Privacy Policy
Last updated: 12 June 2026.
1. Data controller
The controller of your personal data is MFB Solutions, sole trader, owner Martina Bilić, OIB: 88092973161, Klenovec 6, Jagnjić dol, 10431 Sveta Nedelja, Croatia. Email: [email protected]
We have not appointed a Data Protection Officer as this is not legally required; for any privacy questions please contact us directly at the email above.
2. What data we collect
Data you voluntarily provide via the contact form or email: name, email address, phone number (optional), company name (optional) and message content.
If we enter into a contract, we also process data needed to issue invoices and keep accounting records (e.g. client name and address, OIB tax number).
Through analytics and marketing tools we collect data about how the site is used (pages visited, approximate city/country-level location, device and browser type, traffic source). Details are in sections 4 and 6.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Responding to enquiries via contact form or email | Consent, Art. 6(1) a), or pre-contractual steps at the data subject's request, Art. 6(1) b) |
| Providing contracted services and communicating during the engagement | Performance of a contract, Art. 6(1) b) |
| Issuing invoices and keeping accounting records | Legal obligation, Art. 6(1) c) |
| Measuring visits and improving the site (analytics, marketing cookies) | Consent, Art. 6(1) a) |
| Anonymous aggregated visit statistics (Plausible, no cookies) | Legitimate interest, Art. 6(1) f) |
You give consent for analytics and marketing cookies by clicking “Accept” on the cookie banner, and you may withdraw it at any time (see section 6).
4. Recipients (processors)
We do not sell your data or share it for third-party marketing. Your data is processed only by carefully selected service providers necessary to run the site and the business, acting as processors under data processing agreements:
| Recipient | Role | Processing location |
|---|---|---|
| Cloudflare, Inc. (Cloudflare Pages) | Site hosting and delivery | EU / US |
| Web3Forms | Receiving and forwarding contact form messages | EU / US |
| Plausible Analytics | Anonymous, cookieless analytics | European Union |
| Google Ireland Ltd. (Google Analytics 4) | Visit analytics (with consent) | EU / US |
| Google Ireland Ltd. (Google Ads) | Ad conversion measurement (with consent) | EU / US |
We may also disclose data to competent authorities where legally required.
5. Data retention
| Data type | Retention period |
|---|---|
| Contact form and email enquiries | Up to 12 months from last contact, or until consent is withdrawn |
| Contractual documents and invoices | At least 11 years, under Croatian tax and accounting law |
| Google Analytics data | Up to 14 months |
| Anonymous statistics (Plausible) | No fixed period — data contains no personal identifiers |
6. Cookies
On your first visit a banner lets you accept or decline optional cookies equally easily. There are no mandatory cookies — the site works without any. Plausible Analytics uses no cookies. Your consent choice is stored locally in your browser (localStorage), not as a cookie.
The following cookies are set only after you click “Accept”:
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
| _ga, _ga_QZGB6406RR | Google Analytics | Visit measurement | Up to 2 years |
| _gcl_au | Google Ads | Ad conversion measurement | Up to 90 days |
You can withdraw consent at any time by clearing the stored choice and cookies in your browser, which makes the cookie banner appear again.
7. International transfers
Some of our processors (Google, Cloudflare, Web3Forms) may process data outside the European Economic Area, primarily in the United States. Such transfers rely on appropriate safeguards — the EU-US Data Privacy Framework or Standard Contractual Clauses approved by the European Commission.
8. Your rights
Under GDPR you have the right to access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal). To exercise these rights, contact us at [email protected].
If you believe our processing breaches the law, you have the right to lodge a complaint with the supervisory authority — the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb (azop.hr).
9. Changes to this policy
We may update this privacy policy from time to time. The date of the latest change is shown at the top of the page.