Privacy Policy

Last updated: 22 August 2026

This policy explains what personal data we collect through this website, why we collect it, who has access to it and what your rights are. We process personal data in accordance with the General Data Protection Regulation (GDPR) and Croatian data protection legislation.

1. Data controller

The controller of personal data collected through this website is:

• CESA - GRADNJA j.d.o.o.
• Krapanjska ulica 4, 10000 Zagreb
• OIB (Tax No.): 23402773810
• cesa.gradnja@gmail.com
• +385 95 397 8955

Given the scale and nature of our processing, we are not required to appoint a data protection officer. For any question about how your data is handled, please write to the email address above.

2. What data we collect

We only collect personal data that you send us yourself through the enquiry form on the Contact page. This consists of:

• your name (required)
• your email address (optional)
• your phone number (optional)
• the service you are interested in (optional)
• the content of your message

Sending us an enquiry is neither a statutory nor a contractual requirement — it is entirely your choice to contact us. Name and message are the only mandatory fields, because without them we cannot reply; if you leave them empty, the form will not be submitted. The remaining fields are optional and only help us answer you more easily.

We do not ask for, and do not wish to receive, special categories of data (such as health, religious or political information). Please do not include such details in your message.

3. Purpose and legal basis

If you ask us for a quote, we process your data in order to take steps at your request prior to entering into a contract (Article 6(1)(b) GDPR).

If you contact us with a general enquiry that does not lead towards a contract, the legal basis is our legitimate interest (Article 6(1)(f) GDPR) in replying to a message we have received and keeping an orderly record of business correspondence. We have assessed that this processing does not interfere disproportionately with your rights, because we process only the data you sent us yourself and use it solely to answer your enquiry.

Where processing is based on legitimate interest, you have the right to object to it at any time. Send your objection to our email address and we will stop processing your data, unless we can demonstrate compelling legitimate grounds for continuing that override your interests and rights.

We do not use your data for marketing messages, we do not sell it and we do not pass it to third parties for marketing purposes. We do not make automated decisions producing legal effects concerning you or similarly significantly affecting you, and we do not carry out profiling.

4. How long we keep your data

Enquiries that do not lead to work are kept for a maximum of two years from our last contact, that being the period within which enquirers in practice come back to us about the same project; after that they are deleted. If an enquiry does lead to work, invoices and the related accounting records are kept for eleven years, as required by the Croatian Accounting Act. You can ask us to delete your data sooner, except where we are legally obliged to retain it.

5. Server logs

As with any website, the server hosting this site automatically records technical details of each visit: IP address, browser and operating system type, date and time of access, and the address requested. We do not link these logs to your identity and do not use them to track visitors or for analytics. We process them on the basis of legitimate interest (Article 6(1)(f) GDPR) for the security and correct operation of the site, and our hosting provider generally deletes them within a few weeks.

6. Cookies

This website uses no analytics, tracking or advertising cookies. We use only two strictly necessary cookies:

• lang – remembers whether you chose the Croatian or English version of the site. It is set only if you click the language switch yourself and lasts one year.
• PHPSESSID – a login security cookie used only in the administration area of the site. Visitors never receive it.

7. Google Maps

The Contact page shows a map of our location. The map does not load automatically — content from Google servers is loaded only once you click the “Show map” button yourself. When you do, your IP address and browser information are passed to Google, which is outside our control.

Loading the map is based on your consent, which you give by that click (Article 6(1)(a) GDPR). You can withdraw consent simply by reloading the page — the map will then no longer be shown until you request it again. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before it was withdrawn.

Google Privacy Policy →

8. WhatsApp

The WhatsApp link opens an external service operated by Meta. If you contact us via WhatsApp, Meta’s terms and privacy policy apply to that conversation. Clicking the link alone does not pass any of your data to Meta — a transfer only occurs if you choose to send a message.

Meta Privacy Policy →

9. Who has access to your data

Only people within the company working on your enquiry have access to your data. Beyond them, your data sits with the following service providers:

• our web hosting provider, on whose servers the site, the enquiry database and the technical access logs are stored. A data processing agreement under Article 28 GDPR is in place with the hosting provider;
• Google, because the notification of each new enquiry is delivered to our email inbox, which is hosted on Gmail. Google’s terms of service and privacy policy apply to that service.

We do not pass your data to anyone else, unless we are legally required to do so or it is necessary for the establishment, exercise or defence of legal claims.

10. Transfers outside the European Economic Area

Some of the service providers named above are companies established in the United States, so in those cases your data is transferred outside the European Economic Area:

• Google (Gmail) — the content of your enquiry sits in our email inbox;
• Google (Google Maps) — your IP address and browser information, but only if you click the button to display the map;
• Meta (WhatsApp) — only if you choose to contact us that way.

Both companies are certified under the EU–US Data Privacy Framework, for which the European Commission has issued an adequacy decision. This means the transfer takes place under a recognised level of protection. You can request further information about the safeguards applied at our email address.

11. Your rights

In relation to your personal data you have the following rights:

• the right of access — you may ask whether we process your data and for a copy of it;
• the right to have inaccurate data corrected or incomplete data completed;
• the right to erasure (the “right to be forgotten”);
• the right to restriction of processing;
• the right to data portability in a machine-readable format;
• the right to object to processing based on our legitimate interest;
• the right to withdraw consent at any time, where processing is based on it.

Send your request to the email address given in this policy. We will respond without undue delay and at the latest within one month. Dealing with your request is free of charge. If we have reasonable doubts about the identity of the person making the request, we may ask for further information to confirm who you are — solely so that we do not disclose your data to someone else.

If you believe we are not processing your data lawfully, you may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb. Lodging a complaint does not affect your right to seek a remedy before the competent court.

azop.hr →

12. Security

The site is served over an encrypted HTTPS connection, and access to received enquiries is password protected and limited to as few people as possible. We take reasonable technical and organisational measures to protect your data, although no transmission over the internet is entirely free of risk.

13. Children

Our services are intended for adults and this site is not directed at children. We do not knowingly collect data from children under 16. If you believe a child has sent us their details, contact us and we will delete them without delay.

14. Changes to this policy and governing version

We may update this policy from time to time, for example if we add new features to the site or change service providers. The date of the last change is shown at the top of the page.

This policy is published in Croatian and English. In the event of any discrepancy between the two versions, the Croatian version prevails.