Privacy policy

Data controller

Meridian Studio d.o.o.

Nikole Pavica 26A, 10090 Zagreb, Croatia

OIB: 98682454376

Contact: ·

No data protection officer has been appointed, as none is required under Article 37 of the GDPR.

Categories and types of personal data we process

The IP address of the device you visit the website from. It is used to deliver the page, and it is recorded in our server access logs, which are kept for 90 days.

If you allow statistics cookies: pages visited and time of visit, the referring website or search engine, approximate location derived from your IP address, device type, browser and operating system, and a randomly generated identifier used to recognise returning visits.

Your answer to the cookie banner: the categories you accepted, when, and a random identifier for that answer, so that the website can honour it on later visits.

All data is collected directly from you. We do not collect your name, email address or any other data by which you can be directly identified; the website has no forms.

Legal bases, purposes of processing and retention periods

To deliver the website and keep it secure, we process your IP address on the basis of legitimate interest (Article 6(1)(f) of the GDPR). Our server access logs record it, together with the page requested and the time it was requested, so that unusual traffic can be told from ordinary traffic after the fact. The logs are deleted after 90 days.

To measure how the website is used, in aggregate, we process analytics data on the basis of your consent (Article 6(1)(a) of the GDPR and the Croatian Electronic Communications Act). It is retained for 14 months.

Your answer to the cookie banner is kept in your browser for 182 days, after which you are asked again.

You are not required to provide any personal data. If you deny statistics cookies, the website works exactly the same.

Technical and organisational measures

The website is served only over an encrypted connection (HTTPS). The server access logs are held in encrypted storage that is closed to the public and readable only by an authorised person, and they are deleted automatically after 90 days. Analytics data is processed by our processor under a data processing agreement.

Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability, the right to object to processing based on legitimate interest, and the right not to be subject to automated decision-making, including profiling. Exceptions provided for in the GDPR may apply.

You may withdraw your consent to analytics at any time using the cookie preferences on the cookie policy page. Withdrawal does not affect the lawfulness of processing before it.

Requests go to the email address given under the data controller. We may ask you to verify your identity before responding. We respond within one month of receiving a request; if a request is complex, we may extend this by up to two further months and will tell you if so.

Recipients, international transfers and automated decision-making

Analytics data is processed by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as our processor. Data may be transferred to the United States on the basis of the European Commission adequacy decision for the EU-US Data Privacy Framework. How Google uses data from sites that use its services is described at policies.google.com/technologies/partner-sites.

The website is hosted on Amazon Web Services, provided by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, which acts as our processor under a data processing agreement. The files are stored in a data centre in Frankfurt, Germany, and are delivered through a content delivery network whose locations are in Europe, the United States and Canada. The connection from your device may therefore be handled by a server outside the European Union, and your IP address processed there, on the basis of the European Commission adequacy decision for the EU-US Data Privacy Framework.

No automated decision-making or profiling takes place.

Use of cookies

Necessary cookies hold your cookie choice and your light or dark theme preference. They are not transmitted anywhere and cannot be switched off, as the website cannot function correctly without them.

Statistics cookies are set by Google Analytics, and only after you allow them. Every cookie this website uses is listed by name, purpose and duration in the cookie policy, which is also where you can change your choice.

Right to lodge a complaint

If you believe our processing of your personal data breaches data protection law, you may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Ulica Metela Ožegovića 16, 10000 Zagreb, azop@azop.hr, +385 1 4609 000, www.azop.hr.

Changes to this privacy policy

We update this policy when the types of data we process or the way we process them change. The current version is always published on this page, with the date of the last update at the top.