Privacy policy

Introductory provisions

We collect and process your data solely for the purpose of providing our services to a high standard, in a lawful, fair and transparent manner. We process only the data necessary to provide a particular service, taking care to protect it appropriately.

Such personal data primarily relates to natural persons with whom Interaktify solutions d.o.o. has a business relationship or a legitimate interest in contacting (clients, suppliers, business contacts, employees, etc.)

When the need to process your personal data ceases, we erase all personal data or, by applying appropriate technical solutions, anonymise it for use exclusively for statistical purposes.

We collect and process personal data in accordance with our values and principles, this privacy policy and the applicable European and Croatian regulations on personal data protection.

This privacy policy applies equally to personal data in digital or electronic form and to personal data in printed (paper) form, regardless of whether it is a printout of a digital or electronic record.

Terms used in this privacy policy that have a gendered meaning apply equally to the male and female gender.

Principles

When processing personal data, we are guided by the principles and rules established by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

When processing personal data, we observe the obligation of professional secrecy as governed by the law of the European Union and of the Republic of Croatia.

We process personal data:

lawfully, fairly and transparently;
for specified, explicit and legitimate purposes;
using only accurate, up-to-date, adequate and relevant data limited to the purpose for which it is processed;
only for as long as necessary to achieve the purpose of the processing and
protecting it against any unauthorised or unlawful processing and against accidental loss, destruction or damage.

We process the personal data of persons under the age of 16 only on the basis of the consent of a parent or guardian, and only to the extent and scope for which consent has been given.

Confidentiality and security

We treat all personal data as confidential, ensuring an appropriate level of security and protection. We do not in any way collect, process or otherwise use personal data without authorisation.

Employees of Interaktify solutions d.o.o. also protect personal data as a business secret, even after their employment ends.

Employees of Interaktify solutions d.o.o. process only the data they are authorised to process, in the manner and within the limits of their authorisation, that is, solely for the purpose for which the data was collected or is being processed.

In working with personal data, we follow the “need-to-know” principle to ensure that only authorised employees have access to specific personal data for a precisely defined period of time.

Before introducing new technologies that may be used to process personal data, we carry out a thorough analysis and adapt our technical and organisational measures to ensure that the highest standards of personal data protection are applied.

Guidelines for employee conduct

In their daily work, employees of Interaktify solutions d.o.o. are guided by this privacy policy and the applicable regulations on personal data protection.

Access to personal data is granted exclusively to employees of Interaktify solutions d.o.o. who need such access to do their job or carry out their tasks. Personal data will not be shared informally among employees; any access must be requested from the person responsible for the specific job or the person who issued the assignment.

At least once a year, Interaktify solutions d.o.o. organises training or otherwise appropriately informs its employees of their obligations and of the regulations on personal data protection, and ensures that good data protection practices are applied in line with the recommendations of the Croatian Personal Data Protection Agency and other data protection authorities in the European Union and Croatia.

Employees take appropriate organisational and technical protection measures to minimise the risk to personal data, and in particular:

use strong passwords, which are known only to them and are not shared with third parties;
regularly check that personal data is up to date and still serves its purpose. If personal data is no longer needed, or is out of date and cannot be updated, it is erased or anonymised;
lock the computers on which they work with personal data when leaving them unattended;
take particular care not to pass on or disclose the personal data they have access to to unauthorised persons, whether or not they are employees of Interaktify solutions d.o.o. and
seek advice or assistance from the responsible person when in doubt about any aspect of personal data protection.

Data storage

We take care in how data is stored, regardless of whether it is on paper, in digital or electronic form, or in some other form.

Personal data on paper, regardless of whether it is a printout of data otherwise kept in digital or electronic form:

when not in use, is kept in a closed drawer or filing cabinet accessible only to authorised persons;
all employees are responsible for not leaving such papers in plain sight or anywhere unauthorised persons could access the personal data and
when no longer needed, is destroyed in a paper shredder or in another technically acceptable manner and properly disposed of.

Personal data in digital or electronic form is protected against unauthorised access, accidental alteration or erasure, and unauthorised intrusion into the system:

by using strong passwords, which are changed regularly, are known only to authorised persons and are not shared with third parties;
if personal data is held on a portable medium (e.g. CD, DVD, USB stick, portable HDD…), such media are stored in a secure place accessible only to authorised persons;
only official media and servers, or a selected cloud service that applies appropriate organisational and technical protection methods, are used for storage;
servers on which personal data is stored are located in a secure location accessible only to authorised persons;
data is backed up regularly to ensure its integrity, authenticity and accuracy, in accordance with this privacy policy and the applicable regulations on personal data protection;
personal data will not be stored directly on mobile devices (e.g. tablet, smartphone…) unless this is necessary to perform a contract or deliver a contracted service, and then only for the duration and to the extent agreed or necessary;
employees do not store personal data on their own personal computers or other personal devices or media that they use or may use for work;
all servers and computers containing personal data are protected by appropriate technical protection measures, such as encryption software, firewalls, etc.

Data processing

We process all personal data lawfully, in accordance with the conditions, principles and standards of the General Data Protection Regulation and national legislation. We base processing primarily on specific consent, the performance of a contractual relationship or compliance with legal obligations.

We do not process special categories of personal data, except for special categories of employees’ personal data, which employees give their explicit consent to have processed or which is processed in order to protect and exercise employees’ rights and interests in the field of employment law and social security and social protection law.

Interaktify solutions d.o.o. does not use automated processing of personal data, including profiling, to make decisions that produce or may produce legal effects concerning the data subject or that similarly significantly affect the data subject and the exercise of their rights.

We take care to collect personal data primarily from the data subject to whom the personal data relates. When personal data is collected, the data subject is always informed of the reason for and purpose of the processing, as well as its legal basis.

For every transfer of personal data, we use appropriate safeguards that correspond to the categories of personal data and the risk arising from that categorisation, taking into account the specifics of each individual transfer.

Personal data may be sent digitally or electronically, taking into account the application of appropriate protection measures, technical capabilities, the categories of personal data and the risk assessment. We take special measures to prevent unauthorised access to personal data.

We will never disclose your data to third parties without your explicit request and clearly given, unambiguous and specific consent.

Exceptionally, we may disclose your personal data to competent international, state and public authorities if this is necessary to comply with legal obligations or to protect your vital interests or the vital interests of other natural persons. Likewise, at the request of a court and for the purposes of court proceedings (regardless of the stage of the proceedings), we may disclose your personal data to the extent and within the limits of the court order.

When Interaktify solutions d.o.o. acts as a processor on behalf of a controller, it guarantees the implementation of appropriate technical and organisational measures in accordance with the General Data Protection Regulation and this privacy policy, ensuring the protection of data subjects’ rights.

Such processing of personal data is governed by a written contract or other legal act under the law of the European Union or the law of the Republic of Croatia, by which the controller determines the subject matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects, and its own obligations and rights.

In that case, Interaktify solutions d.o.o. processes personal data only on the explicit and clearly defined instructions or orders of the controller. As a processor, Interaktify solutions d.o.o. does not process personal data, regardless of whether it can access it, unless the controller expressly requests it, and then only in the manner and to the extent requested by the controller.

We apply the same principle when providing services such as maintaining or updating websites, applications or other systems that may contain or do contain personal data.

By using technical protection methods, such as encryption, and by respecting and implementing this privacy policy, we ensure that our employees do not access or otherwise come into contact with personal data that is not needed to provide the contracted service.

International transfers of personal data

We do not transfer personal data to third countries or international organisations (international transfer), except in exceptional cases prescribed by law or at your explicit request with clearly given, unambiguous and specific consent.

Any transfer of personal data to a third country or international organisation is based solely on:

the list of countries and international organisations that ensure an adequate level of protection, in accordance with a publicly available decision of the European Commission;
appropriate safeguards provided for, such as binding corporate rules, instruments of public authorities, or an approved code of conduct together with binding and enforceable commitments of the controller or processor in the third country to consistently apply the appropriate safeguards and
the existence of appropriate institutional legal protection for data subjects in the third country.

Any judgment of a court or decision of an administrative authority of a third country requiring the transfer or disclosure of personal data is not binding on us, nor will we act on it, unless it is based on an international agreement binding on the Republic of Croatia, such as a mutual legal assistance treaty.

Accuracy and updating of personal data

The accuracy and currency of personal data is of particular importance, both for achieving the purpose of the processing and for exercising your rights and protecting personal data. We take appropriate technical and organisational measures to ensure that personal data is accurate and up to date, in line with the categories of personal data and their significance for achieving the purpose of the processing.

In their daily work, employees of Interaktify solutions d.o.o. take reasonable, proportionate and justified steps to ensure that the personal data they process is as accurate and up to date as possible.

To ensure that personal data is accurate and up to date, it will be kept or stored in as few places as possible (that is, only where necessary), and employees will not create or use unnecessary copies, additional databases, sets or other ways of grouping personal data.

Interaktify solutions d.o.o. enables data subjects whose personal data is processed to update their personal data in a simple and accessible way, following good practice.

If, during the processing or use of personal data, certain personal data is found to be inaccurate or out of date, and it cannot be updated or updating it would involve disproportionate effort or cost, that data will be erased.

Retention and erasure of personal data

In accordance with the principles on which our privacy policy is based, we process your personal data only for as long as necessary to achieve the purpose of the processing, or as required by law or subordinate legislation, and once we no longer need the personal data we erase or anonymise it.

If we are unable to determine an exact period, we retain personal data permanently, that is, until erasure, and only an authorised person has access to it.

Twice a year we check and review the personal data we process to ensure that all personal data whose purpose has been achieved, or which we no longer need, has been erased or anonymised. This applies in particular to data we retain permanently, that is, until erasure.

The check is carried out by an authorised employee, who is required to produce a report and any recommendations if they identify personal data for which there is no longer any reason for retention.

Exceptionally, we may retain your personal data for longer than stated if this is necessary to act on a court order or an order of an authorised body, to comply with legal obligations, or to protect your vital interests or the vital interests of other natural persons.

Exercising data subject rights

The rights of the data subjects whose personal data we process are of the utmost importance to Interaktify solutions d.o.o. The exercise of data subject rights is especially important to us, so we treat every request to exercise a right with the utmost seriousness, guided by the requirements of the General Data Protection Regulation and the principles on which this privacy policy rests.

The overview of your rights in this privacy policy has been simplified for clarity and ease of reference. The General Data Protection Regulation and national legislation set out the complex procedure for exercising rights in detail; we therefore suggest that you familiarise yourself with the regulations, which provide a comprehensive description of your rights and how to exercise them.

The data subject has the right to obtain confirmation as to whether or not their personal data is being processed. If their personal data is being processed, the data subject may request access to it, together with information on the purpose of the processing, the categories of personal data concerned and any recipients to whom the personal data has been disclosed (or will be disclosed on a valid legal basis).

The data subject has the right to request the rectification or erasure of their personal data, or the restriction of processing of their personal data.

When an application or other product we have developed uses third-party software or a third-party application:

if registration or login is required to use such third-party software or application, you should contact its provider to exercise your rights
if using such third-party software or application does not require registration or login, you may contact us so that we can help you exercise your rights.

The exercise of data subject rights through Interaktify solutions d.o.o. does not affect the data subject’s right to contact the Croatian Personal Data Protection Agency or another supervisory authority.

Requests to exercise rights are submitted by email to privacy@interaktify.com. Interaktify solutions d.o.o. may also create a dedicated electronic form on its website as a standardised way of submitting requests to exercise data subject rights, but this will not affect the option of sending requests to the above email address.

A request submitted in this way is received by an authorised employee of Interaktify solutions d.o.o. or another authorised person (e.g. a contracted data protection officer). The authorised person will take appropriate steps to establish the identity of the requester beyond doubt before providing any information relating to personal data.

Information relating to the exercise of rights is provided in electronic form, free of charge.

Where a copy of such information is requested, or in the case of repeated requests concerning substantively the same exercise of rights, or manifestly unfounded or excessive requests, Interaktify solutions d.o.o. will charge a fee equal to the actual cost of fulfilling the request, which cannot be less than 20 euros and is based on the actual administrative costs of fulfilling the request.

At any time, you can simply and transparently withdraw your consent and request that we stop processing your personal data for marketing and promotional purposes.

In addition, you may request the erasure of your personal data without undue delay if the personal data is no longer necessary for the purposes for which it was collected, or if it must be erased to comply with the regulations of the European Union or the Republic of Croatia.

If you believe that we are not handling your personal data appropriately, or that the processing of your data is contrary to the General Data Protection Regulation and national legislation, you have the right to contact the Croatian Personal Data Protection Agency.

This privacy policy is updated as needed and at least once a year, taking into account examples of good practice and developments in the field of data protection.

Samobor, 1 January 2026