Privacy policy

This Privacy Policy explains how REDOX d.o.o. processes personal data when you visit www.redox.hr or contact us through the website. It applies to all five language versions of the site. It does not cover data processing within our contractual relationships with clients and suppliers, which is governed by the relevant agreements and, where required, by separate notices.

REDOX d.o.o., Stupničke šipkovine 37, 10255 Donji Stupnik, Croatia, OIB 36138701442, is the controller of the personal data described in this Policy. You can reach us at info@redox.hr or +385 1 6546 500. We have not appointed a data protection officer, as we are not legally required to do so. For any question about your personal data, please contact us directly.

We collect only the data you provide through the contact form (first and last name, email address, subject, message) and limited technical data generated while you browse (IP address, browser type, pages visited, consent records, cookies according to your choices). The site requires no registration and we do not run a newsletter. We do not collect special categories of personal data; please do not include such information in your messages.

Data: first and last name, email address, subject, message content and time of submission. Purpose: responding to your inquiry, preparing an offer or project proposal and any follow-up business communication. Legal basis: Article 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) or Article 6(1)(f) GDPR (our legitimate interest in business communication) where you contact us on behalf of an organisation. Retention: as long as needed for the inquiry and any follow-up business communication; if the inquiry leads to a contract, contractual and statutory retention periods apply. The form includes a hidden anti-spam field that does not process any data from genuine visitors, and messages are sent server-side.

Our server infrastructure records technical data (IP address, time of access, requested pages, response status, browser details) to keep the website secure, detect abuse and fix faults. The legal basis is our legitimate interest in security and stability (Article 6(1)(f) GDPR). Logs are kept for a short period defined by the server configuration and are not used to profile visitors. We also use the error monitoring service Sentry, which records a sample of approximately 10% of technical events to help us detect and fix faults.

We use a small number of cookies. Strictly necessary cookies (your consent record and language choice) are always active; analytics and performance cookies are set only with your consent, given through the cookie banner. When you make a choice, we store proof of consent on our server (consent ID, selected categories, policy version, language, hashed IP address and timestamp) on the basis of Article 6(1)(c) and (f) GDPR. Details are set out in our Cookie Policy, and you can change your choice at any time in the cookie settings.

The website does not currently use any third-party analytics tools, and no analytics cookies are set. The cookie banner includes an Analytics category so that such tools can be introduced transparently in the future. If we introduce them, they will run only after your consent (Article 6(1)(a) GDPR), and this Policy and the Cookie Policy will be updated first.

We do not sell personal data, and we disclose it to public authorities only where the law requires us to.

The website is hosted on servers in the EU. Some of our providers (Cloudflare, Sentry) are headquartered in the United States and may transfer part of the data outside the European Economic Area. In such cases we rely on the safeguards of Chapter V GDPR, primarily the adequacy decision for the EU-US Data Privacy Framework where the provider is certified, and standard contractual clauses.

Data that is no longer needed is deleted or anonymised.

We apply technical and organisational measures appropriate to the risk (Article 32 GDPR): encrypted connections (HTTPS/TLS), restricted access to data, server-side handling of form submissions, hashing of the IP address in consent records and regular system updates. No transmission over the internet is completely secure, but we work systematically to reduce the risks.

Under the GDPR you have the right to be informed and the rights of access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interest, and rights related to automated decision-making; we do not carry out automated decision-making that produces legal effects. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing. Send requests to info@redox.hr; we respond within one month. You may also lodge a complaint with the Croatian Personal Data Protection Agency (AZOP, azop.hr) or your local supervisory authority.

Our products are made for children, but this website is intended for adult professional audiences: municipalities, architects, contractors and investors. We do not knowingly collect children's personal data through the site. If you believe a child has sent us personal data, please contact us so we can delete it.

Once you leave redox.hr, the privacy policy of the site you visit applies, and we recommend reading it.

We update this Policy when the website, our services or the applicable rules change. The current version, together with its date, is always published on this page. If a material change affects your consent, we will let you know by showing the cookie banner again.