Privacy policy

This policy explains what personal data we process when you visit zale.hr or send us an enquiry, why we process it, how long we keep it and what your rights are. It applies to both the Croatian and the English version of the site. We process personal data in line with the General Data Protection Regulation (Regulation (EU) 2016/679, ‘GDPR’) and the Croatian Act on the Implementation of the General Data Protection Regulation (Official Gazette NN 42/18).

Last updated: 24 September 2026

In short

  • You only give us personal data when you contact us with an enquiry (through the contact form, by e-mail or by phone). In addition, the server records basic technical data about visits.
  • Without your consent we use only strictly necessary cookies. Google Analytics 4 loads only after you choose ‘Accept’ in the cookie banner.
  • The site is hosted on a server in the European Union (Hetzner), and traffic to it passes through Cloudflare's network.
  • We send no newsletter, we do not profile visitors and we do not sell personal data.

Data controller

  • ZALE - proizvodnja, trgovina i usluge, d.o.o. (Zale Design Studio)
  • Address: Podbrežje X. 4, 10000 Zagreb, Croatia
  • OIB (Croatian personal identification number): 18014250751
  • E-mail: info@zale.hr

For any question about your personal data, or to exercise your rights, write to info@zale.hr.

Contact form and enquiries

What we collect: your name, e-mail address and message (required), your company name (optional), and the language of the page and the time you sent the message.

Purpose: to reply to your enquiry and, if you wish, to prepare a quote and agree on a project.

Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR), and our legitimate interest in answering enquiries that are not about a project (Art. 6(1)(f) GDPR).

How we process the data: your message is saved in our website's database on a server in the EU. At the same time, its content is e-mailed to info@zale.hr via Resend, a service we use only to deliver e-mail. To prevent spam, the server limits how many messages can be sent from one IP address within a short time. For this it holds the IP address only in memory, and it does not save it with your message.

Retention: we keep enquiry data for as long as we need it to reply and to follow up on that enquiry, and then delete it. Enquiries stored on the website are deleted automatically no later than 24 months after they were sent. If your enquiry leads to a project, we keep the data for as long as we work together and for as long as the law requires (for example, accounting rules).

Providing the data is voluntary, but without a name, e-mail address and message we cannot reply. If you e-mail or phone us directly, we use the details you give us in the same way and for the same purposes.

Cookies and local storage

Cookies are small text files that a website stores in your browser. Without your consent we use only the cookies and stored entries the site needs to run securely or to remember your choice. We do not ask for consent for these. The legal basis is our legitimate interest in running the site securely (Art. 6(1)(f) GDPR).

Strictly necessary (always on):

  • zale-cookie-consent (browser local storage) – remembers whether you accepted or declined analytics. It stays until you clear it.
  • Cloudflare security cookies (e.g. __cf_bm, cf_clearance) – tell real visitors apart from malicious bots. They usually last 30 minutes.
  • Admin sign-in cookies – set only for staff and contractors who sign in to edit the site. Visitors never receive them.

Analytics (only with your consent):

  • _ga and _ga_<ID> (Google Analytics 4) – distinguish visitors and their visits for statistics. They last up to two years.

Giving and withdrawing consent: the cookie banner appears at the bottom of the page on your first visit. Until you click ‘Accept’, Google Analytics does not load. If you click ‘Decline’, analytics stays off and your choice is remembered. You can withdraw consent at any time: clear the cookies and site data for zale.hr in your browser settings. The banner will then appear again and you can choose ‘Decline’. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

If you accept analytics, we use Google Analytics 4, a service provided by Google Ireland Limited (Ireland). It shows us how many people visit the site, which pages they read and where they come from, so that we can keep improving it.

  • Data: pages visited, time of visit, traffic source (e.g. a search engine or a link), device and browser type, language and approximate location (country, city). Google Analytics 4 does not store IP addresses.
  • Legal basis: your consent (Art. 6(1)(a) GDPR).
  • Retention: Google keeps visitor-level and event-level data for no longer than 14 months and then deletes it automatically.
  • Transfers: Google may also process the data in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, and the European Commission's standard contractual clauses also apply.

We only look at statistics in aggregate. We do not use them for advertising, we do not combine them with enquiry data and we do not build visitor profiles.

Hosting, Cloudflare and technical logs

  • Hosting: the site, its database and all images and videos are stored on a server we rent from Hetzner Online GmbH (Germany), in a data centre in the European Union. Hetzner is our processor under a data processing agreement (Art. 28 GDPR).
  • Cloudflare: every request to the site passes through the network of Cloudflare, Inc. (USA), which delivers the site faster and protects it from attacks and malicious bots. In doing so, it processes your IP address, technical details of the request and the content being transferred. The legal basis is our legitimate interest in delivering the site securely and quickly (Art. 6(1)(f) GDPR). Transfers outside the EU are covered by standard contractual clauses.
  • Technical logs: for each request, the server records the IP address, date and time, the page requested and browser details. We use these records only for security and troubleshooting, we do not combine them with other data, and we delete them once they are no longer needed for those purposes. The legal basis is our legitimate interest in running the site securely and reliably (Art. 6(1)(f) GDPR).
  • Media: images and videos are served from our own storage on the same server, not from external media services.
  • Fonts: fonts load either from our own server or from Google Fonts (Google Ireland Limited). When a font loads from Google Fonts, your IP address and technical details of your browser are sent to Google. The legal basis is our legitimate interest in displaying the site consistently on all devices (Art. 6(1)(f) GDPR).

YouTube and Vimeo videos

Some articles and projects include videos from YouTube or Vimeo. They do not load automatically: until you click a video, your browser makes no connection to these services. YouTube videos are embedded via youtube-nocookie.com (privacy-enhanced mode), and Vimeo videos with the ‘Do Not Track’ setting turned on.

When you click a video, it loads from YouTube (Google Ireland Limited) or Vimeo. These services then receive your IP address and technical details of your browser, and they may set their own cookies. By clicking, you consent to this (Art. 6(1)(a) GDPR). The services are responsible for any further processing of that data under their own privacy policies: Google and Vimeo.

The site footer contains plain links to our profiles on Instagram, Facebook, LinkedIn, YouTube and Pinterest. We use no social media plugins or tracking pixels, so these networks receive no data until you click a link. After that, the network's own privacy policy applies.

Who receives your data

We do not sell or rent your data, and we do not pass it on to others for marketing. Only the following have access to it:

  • studio staff who need it to reply to your enquiry, and authorised people who maintain the site for us, only as far as their work requires;
  • processors who provide technical services to us: Hetzner (hosting), Cloudflare (site delivery and protection), Resend (delivering e-mails from the form), the provider of our info@zale.hr mailbox, and Google (analytics, only with your consent);
  • Google as the provider of Google Fonts, when a font loads from that service;
  • public authorities, but only where the law requires it.

Transfers outside the EU

Cloudflare and Resend are based in the USA, and Google's parent company is also in the USA, so some data may be transferred there. These transfers rely on the European Commission's standard contractual clauses (Art. 46 GDPR) and, where the recipient is certified, on the adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR). We will give you more information about these safeguards on request.

Data security

Connections to the site are always encrypted (HTTPS). Only authorised people with personal user accounts can access the admin area and form messages. Access requires signing in, and two-factor authentication is available. The number of sign-in attempts is limited to prevent password guessing. We collect only the data we actually need.

Your rights

Under the GDPR you have the following rights:

  • access – to find out whether we process your data and to receive a copy (Art. 15);
  • rectification – to have inaccurate or incomplete data corrected (Art. 16);
  • erasure (‘right to be forgotten’, Art. 17);
  • restriction of processing (Art. 18);
  • notification – to be told about the recipients we have informed of a rectification, erasure or restriction (Art. 19);
  • data portability – to receive the data you gave us in a structured, machine-readable format, where processing is based on consent or a contract (Art. 20);
  • objection – to object to processing based on our legitimate interest (Art. 21);
  • no automated decisions – not to be subject to a decision based solely on automated processing, including profiling (Art. 22). We make no such decisions.

Where processing is based on consent, you can withdraw it at any time (Art. 7(3)).

How to exercise your rights: send a request to info@zale.hr or by post to our address. We reply without undue delay and within one month at the latest. For complex requests this period can be extended by a further two months; if so, we will let you know. Exercising your rights is free of charge. If we cannot be sure who is making a request, we may ask you to confirm your identity.

Complaints to the supervisory authority

If you believe we process your data unlawfully, you can lodge a complaint with the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Selska cesta 136, 10000 Zagreb, azop.hr. We would appreciate it if you contacted us first, so that we can try to resolve the issue directly.

Changes to this policy

We update this policy when we change how the site works or when the law requires it. The version published on this page always applies, and the date of the last update is shown at the top.