Privacy policy
Version 1.0 (draft) · Last updated: 2 October 2026
Note (draft): this text has been prepared in line with applicable regulations and must be confirmed by the SOIS FT Data Protection Officer before publication. Items marked [TO BE COMPLETED] are to be filled in by the client.
1. Controller
The controller of personal data collected through the website www.greenmagcore.hr is:
Dr. Franjo Tuđman Defense and Security University
Ilica 256b, 10000 Zagreb, Croatia
OIB (tax ID): 36752094474 · Reg. no.: 05790255
Phone: +385 75 223 300 · E-mail: info@sois-ft.hr
GreenMagCore project contact: mateja.snajdar@sois-ft.hr · Web: www.sois-ft.hr
Data Protection Officer: Ivica Pavković, e-mail: gdpr@sois-ft.hr, phone: +385 75 223 309, address as above. You may contact the DPO with any question about the processing of your personal data and the exercise of your rights.
The website was created within the GreenMagCore project (PK.1.1.13.0002). It was developed and deployed by Adventure Labs d.o.o., II. Rudeški ogranak 31, 10000 Zagreb, Croatia, OIB 35008205146, MBS 081532878. Hosting is provided by the processor Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA, and technical maintenance by Adventure Labs d.o.o., II. Rudeški ogranak 31, 10000 Zagreb, OIB 35008205146; data processing agreements pursuant to Art. 28 GDPR are in place with the processors.
2. Applicable regulations
- Regulation (EU) 2016/679 – General Data Protection Regulation (GDPR),
- Croatian Act on the Implementation of the GDPR (Official Gazette 42/18),
- Croatian Electronic Communications Act (Official Gazette 76/22) – provisions on storing information on users’ terminal equipment (cookies),
- Regulation (EU) 2021/1060 – visibility and information obligations for operations co-funded by EU funds.
3. What data we process, why and on what basis
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Replying to an enquiry sent via the contact form or e-mail | name, e-mail, institution/company (optional), subject, message, time of sending | Art. 6(1)(e) GDPR – performance of a task in the public interest (dissemination of a publicly funded research project), or Art. 6(1)(f) – legitimate interest in communicating with people who contact us | until the enquiry is resolved, max. 12 months; longer only if further cooperation follows |
| Sending the project newsletter | e-mail address, date, time and method of consent (double opt-in confirmation), unsubscribe record | Art. 6(1)(a) GDPR – consent, which you may withdraw at any time via the link in every message | until consent is withdrawn; the consent record is kept afterwards to demonstrate compliance |
| Web analytics (audience measurement) | truncated (anonymised) IP address, pseudonymous identifier, pages visited, time of visit, device and browser type, referrer | Art. 6(1)(a) GDPR – consent given via the cookie notice | analytics cookies max. 13 months; aggregated reports contain no personal data |
| Website security (server logs) | IP address, time of access, requested URL, response status, browser identification | Art. 6(1)(f) GDPR – legitimate interest in system security and abuse detection | max. 30 days, unless needed to investigate a security incident |
| Form spam protection (captcha) and embedded map | technical data on interaction with the form, IP address, provider cookies | Art. 6(1)(a) GDPR – consent (third-party services load only after your consent) | according to the provider’s policy (see Cookie Policy) |
Providing data via the form is voluntary; without the mandatory fields (marked *) we cannot reply. We do not carry out automated decision-making or profiling.
4. Recipients and transfers to third countries
Your data are processed only by authorised staff of the controller and by the following categories of processors, solely on our instructions and under data processing agreements:
- website hosting provider – Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA; the website is delivered via Vercel’s global content delivery network (CDN), and server logs may be processed in the USA on the basis of the European Commission adequacy decision (EU–US Data Privacy Framework, in which Vercel participates) and the standard contractual clauses (Art. 46 GDPR) in the data processing agreement,
- website technical maintenance provider – Adventure Labs d.o.o., Zagreb,
- e-mail delivery provider for the contact form and the newsletter – Resend, Inc. (USA); personal data (contact form messages, e-mail address, consent record) may be transferred to the USA on the basis of standard contractual clauses (Art. 46 GDPR) or the European Commission adequacy decision (EU–US Data Privacy Framework), and the EU server region is used where available,
- captcha and map service provider – e.g. Google Ireland Ltd.; in that case data may be transferred to the USA on the basis of the European Commission adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses.
We may disclose data to public authorities where required by law (e.g. audits of an EU co-funded project). We do not sell or share data with third parties for marketing purposes.
5. Cookies
The use of cookies and similar technologies, and how to change your settings, are described in the Cookie Policy. Non-essential cookies (analytics, third-party content) are set only with your prior consent, which you can withdraw at any time via the “Cookie settings” link in the footer.
6. Your rights
Under Art. 15–22 GDPR you have the right to:
- access your personal data and information about the processing,
- rectification of inaccurate or incomplete data,
- erasure (“right to be forgotten”) where there is no longer a legal basis for processing,
- restriction of processing in the cases set out in Art. 18 GDPR,
- data portability for data you provided on the basis of consent,
- object to processing based on public or legitimate interest,
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
Requests may be sent to the Data Protection Officer (see section 1). We will respond without undue delay and at the latest within one month of receipt (Art. 12(3) GDPR). We may ask you to verify your identity to protect your data.
If you believe your rights have been infringed, you may lodge a complaint with the supervisory authority: Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop@azop.hr, www.azop.hr.
7. Data security
We apply appropriate technical and organisational measures (Art. 32 GDPR): encrypted connection (HTTPS/TLS), restricted and logged access, regular backups and system updates, and protection of forms against abuse. In the event of a personal data breach we act in accordance with Art. 33 and 34 GDPR.
8. Children
The website is not intended for persons under 16 and we do not knowingly collect their data. Under Art. 19 of the Croatian GDPR Implementation Act, consent for information society services may be given by a child aged 16 or older.
9. Links to external websites
The website contains links to partner and other organisations’ websites. Their owners are responsible for their content and data processing; please consult their privacy policies.
10. Changes to this policy
We may update this policy from time to time due to changes in legislation or in how the website operates. The current version with its date is always published on this page.