Privacy policy
This policy explains which personal data we collect via arboring.hr, why, on which legal basis, how long we keep it and what your rights are. It is drafted in line with Art. 13 of the General Data Protection Regulation (GDPR) and the Croatian GDPR Implementation Act.
1. Controller
ARBORING j.d.o.o., Matije Gupca 6, 10450 Jastrebarsko, Croatia, VAT ID HR19760746105.
Data protection contact: fran@arboring.hr, +385 98 411 431. The company is not required to appoint a data protection officer (Art. 37 GDPR).
2. What we process, why and on which basis
| Processing | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Server logs | IP address, time, requested URL, user agent | Security, abuse detection, troubleshooting, aggregate visit statistics (no cookies, no tracking of individuals) | Art. 6(1)(f) (legitimate interest) | Up to 30 days (Cloudflare) |
arb_consent cookie | Your cookie category choice and its time | Remembering your cookie decision | Art. 6(1)(f) / Croatian Electronic Communications Act (necessary cookie) | 6 months |
| E-mail correspondence | Address, message content | Replying to enquiries, scheduling, quotes | Art. 6(1)(b) | End of correspondence + 12 months; contractual records for statutory periods |
We do not profile you or make automated decisions. We do not process special categories of data (Art. 9) and do not request them. If you include any in the description, we delete them.
3. Photos and location sent by e-mail
If you e-mail us tree photos, please photograph only the tree and its immediate surroundings, without people or licence plates. We use photos solely for assessment and never publish them; we do not use GPS metadata. You may give the location approximately.
4. Recipients and processors
- Cloudflare, Inc. (USA): hosting (Workers), DNS, security logs and aggregate visit statistics. Third-country transfer under the EU-U.S. Data Privacy Framework and standard contractual clauses (Art. 45/46).
- The e-mail provider for fran@arboring.hr.
We do not sell, rent or share your data with third parties for marketing. We disclose data to authorities only where the law requires.
5. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection to processing based on legitimate interest (Art. 21), and to withdraw consent at any time without affecting prior processing (Art. 7(3)).
Send requests to fran@arboring.hr; we respond without undue delay and within one month. We may ask you to confirm your identity.
If you believe processing infringes the law, you may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr, azop@azop.hr, or with your local supervisory authority.
6. Security
The site is served over HTTPS only with security headers (HSTS, CSP). Only the controller has access to enquiries. We use no external fonts or third-party scripts.
7. Children
The site is not intended for persons under 16 and we do not knowingly collect their data.
8. Changes
We update this policy whenever processing changes (e.g. introducing analytics). The version published on this page applies.
Version 2.1 · 3 November 2026
ARBORING j.d.o.o. · Matije Gupca 6, 10450 Jastrebarsko · VAT ID HR19760746105 · fran@arboring.hr · Imprint