Privacy policy
This page explains which personal data I collect through this website, why I collect it, how long I keep it and which rights you have. The policy follows the General Data Protection Regulation (GDPR) and the Croatian Act on the Implementation of the GDPR.
Last updated:
Who is responsible for your data
The data controller is Vrh, obrt za digitalne usluge, owner Matija Terzić, Vozišće 5, 51216 Viškovo, Croatia, OIB (tax number) 70680025658.
For any question about personal data, write to info@vrhagencija.com or call 097 664 7428. I reply within 30 days at the latest.
Which data I collect and why
| When | Data | Purpose | Legal basis |
|---|---|---|---|
| Call booking form and forms on landing pages | Name, company, email, phone, city, answers to the form questions | Replying to your enquiry, preparing the call and the offer | Steps taken at your request before entering into a contract |
| Booking a time slot | Name, email, chosen slot, note | Arranging and holding the call | Steps taken at your request before entering into a contract |
| Downloading the free guide | Name, email | Sending the guide and occasional tips by email | Your consent, which you can withdraw at any time |
| Email or phone call | The data you choose to share | Replying to your enquiry | Legitimate interest in answering a message |
| AI assistant (website chat) | The messages you type in the chat and the page you are on. If you ask for a video review or to be contacted in the chat: name, email, website or phone and the chat transcript | Answering your questions and, at your request, the video review or getting in touch | Legitimate interest in answering a question, and for the video review and contact, steps taken at your request before entering into a contract |
| Analytics and ad measurement | Device and browser data, truncated IP address, pages visited, cookie identifiers | Visit statistics and measuring ad performance | Your consent given in the cookie banner |
| Form protection | A hashed fingerprint of the IP address, deleted after 10 minutes | Preventing spam and automated submissions | Legitimate interest in website security |
With each enquiry I also record the page it was sent from, the referring page and campaign tags from the address (UTM, gclid, fbclid), so I know which channel brings enquiries.
I don't store conversations with the AI assistant on the server. While the tab is open, the chat is kept only in your browser (sessionStorage, no cookies), and under its API terms Anthropic does not use the messages to train its models. I only receive the chat transcript if you ask for a video review or to be contacted in the chat.
I do not collect special categories of personal data and I do not make decisions by automated processing or profiling.
Who else processes the data
I do not sell your data or pass it to third parties for their own purposes. To run the website I use service providers who process data on my instructions:
| Provider | What it is for | Based in |
|---|---|---|
| Hostinger International Ltd. | The server that hosts the website and forms | Cyprus, server in Germany |
| Brevo (Sendinblue SAS) | Sending email: enquiry notification, the guide, occasional tips | France |
| Contabo GmbH | Server for my own call booking calendar | Germany, server in the EU |
| Anthropic, PBC | The AI model (Claude) that answers in the website chat | USA |
| Google Ireland Limited | Google Tag Manager, Google Analytics, Google Ads | Ireland |
| Meta Platforms Ireland Limited | Meta Pixel and ad measurement on Facebook and Instagram | Ireland |
For enquiries sent from landing pages you reached through an ad on Facebook or Instagram, I also send Meta a server-side confirmation that the enquiry was submitted (Conversions API). Email, phone and name are sent only in hashed form (SHA-256) and are used to measure ad performance.
If you send an enquiry from a landing page, your name, email and the form details are also stored in my own email tool on my own server. From there you receive a personal reply to your enquiry within a few minutes, followed by a few short messages on the same topic. If you do not want them, reply to any of them and they will stop.
Transfers outside the European Union
Anthropic, Google and Meta may also process data in the United States. The transfer relies on the European Commission adequacy decision (EU-U.S. Data Privacy Framework) and on standard contractual clauses.
How long I keep the data
- Enquiries and call bookings: up to 24 months from the last contact, if we do not start working together.
- Client data: for the duration of our work, and contracts and invoices for 11 years, as required by accounting and tax law.
- Email address for the guide and tips: until you unsubscribe.
- Analytics and marketing cookies: as listed in the cookie policy, 24 months at most.
Your rights
At any time you can ask for:
- access to the data I hold about you and a copy of it,
- correction of inaccurate or incomplete data,
- erasure of your data,
- restriction of processing,
- transfer of the data to you or to another controller,
- an objection to processing based on legitimate interest,
- withdrawal of consent, which does not affect processing before the withdrawal.
Send your request to info@vrhagencija.com. You can unsubscribe from tip emails with the link at the bottom of each message or by replying to it.
If you believe the processing breaks the law, you have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr.
Data security
The website uses an encrypted connection (HTTPS). Access to enquiries is limited to the people who need it to reply, and the tools I use are password protected.
Changes to this policy
I update the policy when the way I process data or the law changes. The date of the last update is at the top of the page.