Privacy Policy
This Privacy Policy explains how DENONA d.o.o. processes personal data in connection with the use of the website www.denona.hr, contact and project inquiries, job applications, cookies and other business communications.
1. Data controller
DENONA, production, trade and services, limited liability company
Short name: DENONA d.o.o.
Registered office: Radnička cesta 206, Zagreb, Republic of Croatia
Personal identification number (OIB): 97373082565
Email: denona@denona.hr
Telephone: +385 (0)1 2361 777
2. Principles of processing
We process personal data lawfully, fairly and transparently, only for specified and legitimate purposes and to the extent necessary for those purposes. We endeavour to keep data accurate, retain it only for as long as necessary and protect it using appropriate technical and organisational measures.
3. What data we process and why
| Activity | Data | Purpose and legal basis | Retention period |
|---|---|---|---|
| Website visit | IP address, access time, pages visited, technical data about the device and browser, and error logs. | Secure and stable operation of the Website, prevention of misuse and troubleshooting. Legitimate interests in protecting information systems and data (Article 6(1)(f) of the GDPR). | Generally up to 30 days, unless longer retention is necessary due to a security incident or legal claim. |
| Quick contact and detailed project inquiry | Full name, company name, contact details, contents of the inquiry, project information, and files and other data voluntarily submitted by the individual. | For an inquiry from an individual concerning a potential contract: taking steps at their request before entering into a contract (Article 6(1)(b) of the GDPR). For general inquiries and contact persons of legal entities: legitimate interests in responding and conducting business communications (point (f)). | Until the communication is concluded and generally for a further two years, unless a business relationship is established or longer retention is necessary for legal claims. |
| Business cooperation | Identification and contact details of the business partner or their contact person, quotations, orders and business correspondence. | For a contract with an individual: performance of the contract and pre-contractual steps (Article 6(1)(b) of the GDPR). For contact persons of legal entities: legitimate interests in carrying out business cooperation (point (f)). For mandatory records: legal obligation (point (c)); for the protection of legal claims: legitimate interests (point (f)). | For the duration of the business relationship and thereafter for the periods prescribed by tax, accounting and other regulations, and applicable limitation periods. |
| Job application | Full name, contact details, CV, education and work experience, communications, attached documents and a photograph if the candidate chooses to provide one. | Reviewing the application and taking steps at the candidate's request before entering into an employment contract (Article 6(1)(b) of the GDPR). Limited retention after the recruitment process for the protection of legal claims: legitimate interests (point (f)). Future vacancies: separate, freely given consent (point (a)), which can be withdrawn without affecting the current application. | Until the end of the recruitment process. Thereafter, only data necessary for the protection of legal claims, for a maximum of six months, unless a specific dispute or claim requires longer retention. For future opportunities, up to 12 months from the date separate consent is given or until it is withdrawn earlier. |
| Cookies, analytics and embedded map | Online identifiers and data about the device and Website use, depending on the user's settings. | Storing necessary cookies or accessing them without consent only to the extent permitted by the statutory exception. Related processing of personal data: legitimate interests in Website security and operation (Article 6(1)(f) of the GDPR). Analytics and Google Maps: consent (point (a)). | Cookie lifetimes are specified in the Cookie Policy. Data retention periods on providers' servers differ from cookie lifetimes. |
4. Forms and data storage
Forms are handled using Gravity Forms, integrated into WordPress. Data submitted through forms is stored in the WordPress database, while attached files are stored on the Website server. Authorised users can view, search, export and delete this data through the administration interface.
A notification of each form submission is also sent to an email address designated by Denona. Retention periods apply to form entries, attached files, emails and exported copies. Backups are deleted or overwritten according to an established cycle; the data they contain is not used for other purposes, and previously specified deletions are carried out again when the system is restored.
5. Requirement to provide data
Providing personal data through the Website is generally voluntary. If certain data is required to respond to an inquiry, prepare a quotation or consider a job application, Denona may be unable to process the request without it. Mandatory form fields are clearly marked. A photograph is not required for a job application, and candidates may apply without one. Submitting an inquiry or a job application does not require consent to analytics or general consent to acceptance of this Policy. Please do not submit health data, other special categories of personal data or data relating to criminal convictions unless specifically requested on a lawful basis.
6. Recipients and processors
Personal data may be accessed by authorised Denona employees and contractors who need it to perform their duties. Processing may involve hosting and backup providers, obART GRAF d.o.o. as the Website developer and maintenance provider, the business email provider, Cloudflare as the network security and content delivery provider, and, following the relevant consent, Google in connection with Google Analytics 4 and Google Maps. The GDPR Cookie Compliance plugin by Moove Agency is used to manage consent. Providers that process data on our behalf act in accordance with our instructions and data processing agreements. The mere use of a plugin does not mean that its developer receives form data or visitor data. We may disclose data to competent authorities where required by law, and to legal and accounting advisers where necessary for business operations or the protection of legal claims.
7. Transfers outside the European Economic Area
If certain providers process data outside the European Economic Area, we apply a transfer mechanism appropriate to the particular recipient and country. For a recipient in the United States, the EU–US Data Privacy Framework applies only if the recipient is covered by a valid adequacy decision and has valid certification for the relevant processing. In other cases, we use appropriate safeguards, such as the European Commission's standard contractual clauses, together with a transfer assessment and additional measures where necessary. Information about the safeguards applied and how to obtain a copy of them can be requested at denona@denona.hr.
8. Cookies and consent management
The Website uses necessary cookies for operation, security and remembering the user's choices. Google Analytics 4, Google Maps and other non-essential services are activated only after the relevant consent has been given. Users can accept all cookies, reject all cookies, select individual categories and subsequently change or withdraw consent via the Cookie Settings link. Further information is available in the Cookie Policy.
9. Automated decision-making
Denona does not make decisions through the Website that produce legal effects concerning an individual or similarly significantly affect them solely on the basis of automated processing.
10. Data security
Denona implements reasonable technical and organisational measures to protect personal data. The Website uses encrypted communication, access controls, backups, technical monitoring, system updates, Cloudflare network protection and Gravity Forms honeypot protection against automated form spam.
11. Rights of data subjects
Depending on the circumstances and the legal basis for processing, individuals may request:
- access to their personal data and a copy of the data;
- rectification of inaccurate data or completion of incomplete data;
- erasure of data where the legal conditions are met;
- restriction of processing;
- data portability where the applicable conditions are met;
- objection to processing based on legitimate interests;
- withdrawal of consent at any time, without affecting the lawfulness of prior processing;
- objection to direct marketing.
A request may be sent to denona@denona.hr or by post to Denona's address. Where there are reasonable doubts about the identity of the person making the request, we may request only the additional information necessary to confirm their identity. We provide information on the action taken without undue delay and no later than one month after receiving the request. Where necessary due to the complexity or number of requests, this period may be extended by a further two months; we will inform you of the extension and the reasons for it within the first month. If we do not act on a request, we will explain the reasons within the same period and inform you of your right to lodge a complaint and seek a judicial remedy. Exercising these rights is generally free of charge; the exceptions in Article 12(5) of the GDPR apply to manifestly unfounded or excessive requests. You may object to processing based on legitimate interests on grounds relating to your particular situation; we will then cease processing unless we demonstrate compelling legitimate grounds that override your rights or the processing is necessary for legal claims. An objection to direct marketing will always result in the cessation of processing for that purpose.
12. Complaint to the supervisory authority
If an individual believes that their data is being processed in breach of the law, they may contact Denona or lodge a complaint with the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka), Ulica Metela Ožegovića 16, Zagreb, email azop@azop.hr, www.azop.hr.
13. Children's data
The Website is not specifically intended for children, and Denona does not knowingly collect their data through the Website. If Denona becomes aware that a child has provided personal data without an appropriate legal basis, it will take reasonable steps to delete that data.
14. Amendments to this Privacy Policy
This Policy may be amended to reflect actual processing practices, technical changes or legal requirements. The current version is published on the Website together with the date of its last update.
Last updated: 13 October 2026