Privacy Policy

1. Data Controller

The controller of your personal data is:

• ENERGYCOM d.o.o.
• Address: Pod Bregom 2, HR-10255 Donji Stupnik
• OIB: 08368224742
• Website: www.energycom.hr
• E-mail: info@energycom.hr
• Phone: +385 01 4875 952

For all questions regarding the processing of your personal data, you may contact us using the contact details provided above.

2. What personal data we collect and why

We collect personal data only to the extent necessary to provide our services and respond to your enquiries. Below we set out the categories of data, the purpose and the legal basis for processing in accordance with Art. 13 of Regulation (EU) 2016/679 (GDPR).

2.1 Contact form and e-mail enquiries

When you fill in the contact form on our website or contact us by e-mail, we collect the following data:

• First and last name
• E-mail address
• Phone number
• Message content (optional)

Purpose of processing: Responding to your enquiry, providing information about our services and potential continuation of the business relationship.

Legal basis: Legitimate interest of the controller (Art. 6(1)(f) GDPR) for responding to enquiries, and performance of pre-contractual measures (Art. 6(1)(b) GDPR) when the enquiry precedes the conclusion of a contract.

Retention period: Data is retained for up to 2 years from the last communication, unless legal obligations require longer retention.

2.2 Cookie consent records

To fulfil the obligation to demonstrate consent under the GDPR, we record technical data about your cookie decision:

• Hashed (SHA-256) IP address — the original IP address is not stored
• Browser user agent (up to 200 characters)
• Date and time of consent
• Policy version and selected cookie categories

Purpose of processing: Fulfilling the legal obligation to document consent under Art. 7 GDPR.

Legal basis: Legal obligation (Art. 6(1)(c) GDPR).

Retention period: Up to 5 years from the date of consent.

3. Cookies and similar technologies

Our website uses cookies — small text files stored on your device. When you first visit our site, we will show you a cookie notice in which you can select which categories you permit. You can change your decision at any time by clicking the "Cookies" button displayed in the bottom-left corner of the page after you have given your consent.

3.1 Necessary cookies

These cookies are necessary for the correct functioning of the website and cannot be disabled. They do not collect personal data for marketing purposes.

Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) — these cookies are technically necessary for the operation of the site.

3.2 Analytical cookies

These help us understand how visitors use the site by collecting anonymous statistical data. They are only set with your consent.

Legal basis: Consent (Art. 6(1)(a) GDPR).

Note on data transfer: Google LLC is based in the USA. The transfer takes place on the basis of Standard Contractual Clauses (SCC) approved by the European Commission. More information: Google Privacy Policy.

3.3 Marketing cookies

Used to display relevant advertisements and measure the effectiveness of marketing campaigns. They are only set with your consent.

Legal basis: Consent (Art. 6(1)(a) GDPR).

Note on data transfer: Meta and Google are based outside the EU. The transfer takes place on the basis of Standard Contractual Clauses (SCC). Privacy policies: Meta, Google.

3.4 Preference cookies

These allow the website to remember your choices (e.g. language settings). They are only set with your consent.

Legal basis: Consent (Art. 6(1)(a) GDPR).

3.5 Cookie consent management

You can give, refuse or withdraw your consent at any time:

• By clicking "Accept all" you consent to all categories of cookies
• By clicking "Reject all" you refuse all optional cookies
• By clicking "Settings" you can granularly select which categories to permit and save your selection using the "Save settings" button
• To change a previously given consent, click the "Cookies" button in the bottom-left corner of the page
• You can also delete cookies via your browser settings

4. Recipients of personal data

We do not sell your personal data to third parties. We may share data with:

• IT and hosting service providers — solely for the technical operation of the website
• Google LLC — analytics and advertising (with your consent)
• Meta Platforms Ireland Ltd. — advertising (with your consent)
• Competent authorities — where required by law or court order

5. International data transfers

Certain service providers (Google, Meta) are based in the USA, which means your data may be transferred outside the European Economic Area (EEA). Such transfers take place exclusively on the basis of appropriate safeguards — Standard Contractual Clauses (SCC) approved by the European Commission, in accordance with Art. 46 GDPR. Transfers are made only with your consent for the relevant cookie categories.

6. Automated decision-making

We do not use automated decision-making or profiling that would have legal or similarly significant effects on you, in accordance with Art. 22 GDPR.

7. Your rights regarding personal data

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15): You have the right to request confirmation as to whether we are processing your personal data and access to that data.
• Right to rectification (Art. 16): You have the right to request the correction of inaccurate or incomplete personal data.
• Right to erasure (Art. 17): You have the right to request the deletion of your personal data ("right to be forgotten"), subject to the conditions laid down in the GDPR.
• Right to restriction of processing (Art. 18): You have the right to request a temporary restriction on the processing of your data.
• Right to data portability (Art. 20): You have the right to receive your personal data in a structured, machine-readable format and to transmit it to another controller.
• Right to object (Art. 21): You have the right to object to processing of your data based on legitimate interest.
• Right to withdraw consent (Art. 7(3)): Where processing is based on consent, you have the right to withdraw it at any time, without affecting the lawfulness of processing before withdrawal.

To exercise any of the above rights, please contact us using the contact details in section 9. We will respond within 30 days of receiving the request.

8. Right to lodge a complaint with the supervisory authority

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with the competent data protection supervisory authority in the Republic of Croatia:

• Personal Data Protection Agency (AZOP)
• Address: Selska cesta 136, 10000 Zagreb
• E-mail: azop@azop.hr
• Website: www.azop.hr

You may also lodge a complaint with the supervisory authority of the EU member state in which you have your habitual residence or place of work.

9. Data security

We apply appropriate technical and organisational measures to protect personal data from unauthorised access, alteration, disclosure or destruction. IP addresses in consent records are stored exclusively in hashed (SHA-256) form — the original IP address is never stored. Access to personal data is limited to authorised employees who are bound by confidentiality obligations.

10. Updates to this Privacy Policy

We reserve the right to amend this Privacy Policy to align with changes in legislation or our business. The current version is always available on this page. In the event of significant changes affecting your cookie consent, we will request a new consent from you.