Privacy Policy

1. Data controller

The controller of your personal data is Divin, craft business for visual arts, design and services, Ive Šodića 16, Kostrena, Hrvatska. Contact person: Višnja Hrelja. E-mail: divin.creative.studio@gmail.com.

2. Personal data we collect

Through the enquiry form we may collect your name, e-mail address, optional telephone number, type of enquiry, event details, preferred package, optional information about how you heard about us, the content of your message and, if you voluntarily attach one, a photograph for the preparation of an illustration. If you contact us by e-mail, we also process the information contained in that correspondence.

Hosting and security systems may automatically process basic technical information associated with access to the website, such as IP address, access time and technical logs required for security and service operation.

3. Purposes and legal bases

• Responding to enquiries, preparing quotations and arranging services: processing is necessary to take steps at your request before entering into a contract and, where a booking is made, to perform that contract (Article 6(1)(b) GDPR).
• Legal and accounting obligations: where applicable, data are processed to comply with legal obligations (Article 6(1)(c) GDPR).
• Website security and prevention of misuse: certain technical data may be processed on the basis of our legitimate interest in operating a secure and reliable website (Article 6(1)(f) GDPR).

Submitting an enquiry is not treated as consent to marketing. We do not use enquiry data for newsletters or promotional messages without a separate legal basis.

4. Recipients and service providers

We use technical service providers, primarily Netlify for hosting and Netlify Forms and Google / Gmail for receiving and storing e-mail communications. Data may also be disclosed to accounting, legal or IT advisers only where necessary and subject to an appropriate confidentiality obligation or legal basis.

5. International data transfers

Some service providers may process data outside the European Economic Area. Where such transfers apply, we rely on the safeguards used by those providers under the GDPR, such as adequacy decisions, the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses, depending on the specific transfer.

6. Retention

Enquiries that do not lead to a booking are generally retained for no longer than 12 months after the last communication, unless longer retention is necessary to resolve a particular request or protect legal interests. Photographs attached to an enquiry are kept only for as long as necessary to handle the enquiry and, where an order is placed, to create and provide the agreed service, after which they are deleted when no longer needed for those purposes. Where a contract is concluded, data related to the business relationship and accounting records are retained for the periods required by applicable law. Technical logs are retained by service providers according to their own retention policies.

7. Required and optional information

Required fields are necessary for us to understand and handle your enquiry. The telephone number and photograph upload are optional. If required information is not provided, we may be unable to respond or prepare a quotation.

8. Your rights

Subject to the conditions of the GDPR, you may request access, rectification, erasure, restriction of processing and data portability, and you may object where processing is based on legitimate interests. To exercise your rights, contact divin.creative.studio@gmail.com.

You also have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), azop.hr.

9. Automated decision-making

We do not use automated decision-making or profiling based on information submitted through the enquiry form.

10. Cookies and third-party content

This version of the website does not use analytics or marketing cookies and does not include tracking tools such as Google Analytics or Meta Pixel. Fonts are loaded from the visitor's local system rather than from Google Fonts. If we introduce tools that require consent in the future, we will implement an appropriate consent mechanism before activation and update this notice.

11. Security

We apply reasonable organisational and technical measures to protect personal data against unauthorised access, loss, alteration or disclosure. However, no method of internet transmission or storage can guarantee absolute security.

12. Changes to this notice

We may update this Privacy Policy if the website, service providers or legal requirements change. The current version will always be published on this page.