Privacy Policy
Last updated:
This policy explains which personal data we process when you use amondi-media.com, why, on what legal basis, for how long, and what rights you have. It follows Articles 12 to 14 of the General Data Protection Regulation (GDPR).
1. Controller
amondi Media d.o.o. za usluge (amondi Media d.o.o.), Radnička cesta 47, 10000 Zagreb, Croatia, OIB 20380401877, MBS 081288513 (Commercial Court in Zagreb).
Write to [email protected] about anything to do with your data.
2. Cookies
Cookies are small text files a website stores in your browser. Under Article 5(3) of the ePrivacy Directive and Article 43(4) of the Croatian Electronic Communications Act (NN 76/22), cookies that are not strictly necessary may only be set with your consent. The table lists every cookie this site can set.
| Cookie | Set by | Purpose | Category | Lifetime |
|---|---|---|---|---|
amondi_cmp_consent | amondi-media.com | Remembers the choice you made in the cookie banner so it is not shown again | Necessary | 12 months |
__cf_bm | Cloudflare, on amondi-media.com | Set on some requests by the bot protection of our security provider to tell people and automated traffic apart. Used only to keep the site secure | Necessary | 30 minutes |
| Turnstile check (no cookie) | Cloudflare, on the pages with a form | Reads technical data of your browser when you send a form, to tell a person from a bot. Stores no cookie; listed here because it accesses your device | Necessary | Only while the check runs |
wordpress_logged_in_*wordpress_sec_*wordpress_test_cookiewp-settings-* | amondi-media.com | Keep an editor logged in to the site administration and remember their screen settings. Only set when someone logs in — never for visitors | Necessary | Session, or 14 days when “Remember me” is ticked; wp-settings-* 1 year |
_ga | Google Analytics, on amondi-media.com | Tells visits by the same browser apart with a random identifier, for statistics | Analytics, only with your consent | 2 years |
_ga_<ID> | Google Analytics, on amondi-media.com | Keeps the state of the current visit; <ID> is our Analytics measurement ID | Analytics, only with your consent | 2 years |
The Analytics cookies are only set after you accept the Analytics category in the cookie banner. Until then the site loads nothing from Google. After that, Google Analytics is loaded through Google Tag Manager, a Google tool that only delivers the analytics code and sets no cookie of its own. The site sets no advertising and no social-media cookies.
Changing Your Choice
You can change or withdraw your choice at any time: open the cookie settings with the link below, or with the round cookie button at the bottom right of every page. Withdrawing consent applies from then on: Google Analytics stops on the page you are on, its cookies are removed and it is not loaded again. You can also delete cookies in your browser settings; the banner then appears again on your next visit.
Consent Log
Your choice is recorded so we can demonstrate it, as the GDPR requires: a random consent id, the categories you accepted or rejected, an anonymised IP address, your browser type and the time. Section 3 says how long the record is kept.
3. What We Process, Why, and on What Basis
The site is a company website with three forms. Nothing is profiled and nothing is sold. The table lists every processing the site itself performs.
| Processing | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Call request form (Book a call) | Name, company, work email, country, the area you want to modernise, your optional message, anonymised IP address, the page you sent it from, date and time | To prepare and hold the call you asked for and to answer your enquiry | Art. 6(1)(b) GDPR — steps taken at your request before a contract | 24 months after our last contact, then deleted |
| Checklist request | Name, work email, anonymised IP address, date and time | To send you the checklist you asked for — one email, nothing further. If you also tick the newsletter box, the newsletter row below applies to that | Art. 6(1)(b) GDPR — a service you requested | 12 months, then deleted |
| Newsletter | Email address, the consent sentence you ticked and on which form, anonymised IP address, the date and time of your request, of your confirmation and of an unsubscribe | To send you our newsletter. Double opt-in: after you tick the box we send you an email, and you are on the list only once you confirm with the link in it. The list is kept only in the site database, and we send each issue ourselves from [email protected] | Art. 6(1)(a) GDPR — your consent, which you can withdraw at any time | Until you unsubscribe; the record of consent for 12 months after that (Art. 7(1) GDPR) |
| Google Analytics, only with your consent | Pages viewed, the page you came from, device, browser and screen data, an approximate location derived from your IP address, the random identifier in the _ga cookies, date and time | Statistics about how the site is used, so we can see which content is read and improve it | Art. 6(1)(a) GDPR — your consent in the cookie banner, which you can withdraw at any time | Cookies up to 2 years (section 2); statistics in Google Analytics for at most 14 months |
| Cookie consent log | Consent id (random), accepted and rejected categories, policy revision, anonymised IP address, browser user agent, date and time | To prove which cookie choice you made (accountability, Art. 5(2) GDPR) | Art. 6(1)(c) and (f) GDPR | 12 months |
| Server logs | IP address, requested URL, referrer, browser, date and time | Delivery, security and troubleshooting of the web server | Art. 6(1)(f) GDPR — our legitimate interest in a secure site | Deleted automatically by the log rotation on our server after 90 days at the latest |
“Anonymised IP address” means the last octet of an IPv4 address (or the last 80 bits of an IPv6 address) is removed before storing, so the value corroborates that a submission happened but no longer identifies a connection.
We do not ask for consent on the call-request and checklist forms on purpose: both are processed to deliver what you asked for, not on the basis of consent, and asking for a consent the processing does not rest on would misstate the legal basis.
Google Analytics 4 uses your IP address only to derive an approximate location and does not store it. We have switched off Google signals and advertising features, so the data is used for statistics only.
We also use Google Search Console to see how the site appears in Google search results. It works with data Google collects through its own search engine. On this site it adds only a verification tag, which loads nothing and sends no data about you.
4. Who Receives Your Data
- Hetzner Online GmbH, Gunzenhausen, Germany, provides the server in its data centre in Falkenstein, Germany, on which the site, its database and the server logs are stored.
- Cloudflare, Inc., USA, sits in front of our server as content delivery network and security service. Every request to the site passes through Cloudflare, which sees your IP address and the technical data of the request, filters attacks and may set the necessary
__cf_bmcookie. On the pages with a form, its Turnstile check also looks at technical data of your browser, so that a form is only accepted from a person, not from a bot; it sets no cookie for this. - Mailgun Technologies, Inc., USA, delivers the notification emails the forms send to us and the checklist email to you, through its EU region. These emails contain what you entered in the form.
- Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland, provides our mailbox [email protected] (Google Workspace). Form notifications, your emails to us and the newsletter issues we send pass through it.
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, processes the Google Analytics data described in section 3, loaded through Google Tag Manager, only with your consent.
These providers process the data on our behalf and on our instructions, as processors under Article 28 GDPR. No advertising networks and no chat vendors receive data from this site.
5. Transfers Outside the European Economic Area
The site and its database are stored in Germany. Cloudflare, Mailgun and Google LLC, the parent company of both Google companies named in section 4, are based in the United States, so personal data may be processed there: Cloudflare runs a worldwide network, Mailgun handles the emails in its EU region, although as a US company it may access them from the United States, and Google may transfer data to Google LLC.
Where personal data reaches the United States, the transfer rests on the EU-U.S. Data Privacy Framework (an adequacy decision of the European Commission, Art. 45 GDPR) for recipients certified under it, and otherwise on the Standard Contractual Clauses adopted by the European Commission (Art. 46(2)(c) GDPR). Transfers to the United Kingdom rest on the adequacy decision for the United Kingdom.
6. Your Rights
Under Articles 15 to 22 GDPR you can ask us at any time for:
- access to the data we hold about you and a copy of it;
- rectification of inaccurate data;
- erasure (“right to be forgotten”);
- restriction of processing;
- data portability in a machine-readable format;
- objection to processing based on our legitimate interests;
- withdrawal of consent at any time, with effect for the future — for the newsletter, use the unsubscribe link in any of our emails, reply “unsubscribe” or write to us; for Google Analytics, use the cookie settings.
Write to [email protected]. We answer within one month. You also have the right to lodge a complaint with a supervisory authority. Ours is the Croatian Personal Data Protection Agency (AZOP), Ulica Metela Ožegovića 16, 10000 Zagreb, azop.hr; you can also turn to the authority of the EU member state where you live.
7. Security
The site is served over HTTPS. Form submissions are stored in private sections of the site database that only our administrators can open, before any email is sent. A copy reaches us by email as described in section 4; no other service receives them. Spam is filtered without any external service (a hidden field and a timing check), so nothing you type is sent to a spam-scoring provider.
8. Changes
When the site starts collecting something new, we update this policy first and change the date at the top.