Privacy policy

This Privacy Policy explains how REDOX d.o.o. processes personal data when you visit www.redox.hr or contact us through the website. It applies to all five language versions of the site. It does not cover data processing within our contractual relationships with clients and suppliers, which is governed by the relevant agreements and, where required, by separate notices.

REDOX d.o.o., Stupničke šipkovine 37, 10255 Donji Stupnik, Croatia, OIB 36138701442, is the controller of the personal data described in this Policy. You can reach us at info@redox.hr or +385 1 6546 500. We have not appointed a data protection officer, as we are not legally required to do so. For any question about your personal data, please contact us directly.

We collect only the data you provide through the contact form (first and last name, email address, subject, message) and limited technical data generated while you browse (IP address, browser type, pages visited, consent records, cookies according to your choices). The site requires no registration and we do not run a newsletter. We do not collect special categories of personal data; please do not include such information in your messages.

Data: first and last name, email address, subject, message content and time of submission. Purpose: responding to your inquiry, preparing an offer or project proposal and any follow-up business communication. Legal basis: Article 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) or Article 6(1)(f) GDPR (our legitimate interest in business communication) where you contact us on behalf of an organisation. Retention: as long as needed for the inquiry and any follow-up business communication; if the inquiry leads to a contract, contractual and statutory retention periods apply. The form includes a hidden anti-spam field that does not process any data from genuine visitors, and messages are sent server-side.

Our server infrastructure records technical data (IP address, time of access, requested pages, response status, browser details) to keep the website secure, detect abuse and fix faults. The legal basis is our legitimate interest in security and stability (Article 6(1)(f) GDPR). Logs are kept for a short period defined by the server configuration and are not used to profile visitors. We also use the error monitoring service Sentry, which records a sample of approximately 10% of technical events to help us detect and fix faults.

We use a small number of cookies. Strictly necessary cookies (your consent record and language choice) are always active; analytics and performance cookies are set only with your consent, given through the cookie banner. When you make a choice, we store proof of consent on our server (consent ID, selected categories, policy version, language, hashed IP address and timestamp) on the basis of Article 6(1)(c) and (f) GDPR. Details are set out in our Cookie Policy, and you can change your choice at any time in the cookie settings.

With your consent, we use Google Analytics 4 (measurement ID G-PD7GDD9ZKH), a service provided for EEA users by Google Ireland Limited, to measure visits, page use, device and browser information and approximate location so we can improve the website. GA4 is blocked until you consent to Analytics and may then set the first-party cookies _ga and _ga_PD7GDD9ZKH. Google uses the IP address during collection to derive approximate location and does not log or store individual IP addresses. User and event data are retained for 14 months. Google signals, ads personalization and user-provided data collection are disabled. The legal basis is your consent under Article 6(1)(a) GDPR, which you may withdraw at any time in Cookie settings.

We share personal data only with service providers that process it for us under appropriate data-processing terms, including providers of hosting, security and error monitoring and, after Analytics consent, Google Ireland Limited and relevant Google group companies for Google Analytics 4. We do not sell personal data and disclose it to public authorities only where required by law.

The website is hosted on servers in the EU. Some providers, including Cloudflare, Sentry and companies in the Google group used for Google Analytics 4, are headquartered in the United States or may process data outside the European Economic Area. Where this occurs, we rely on applicable safeguards under Chapter V GDPR, including the EU-US Data Privacy Framework adequacy decision where the recipient is certified and standard contractual clauses where applicable.

Data that is no longer needed is deleted or anonymised.

We apply technical and organisational measures appropriate to the risk (Article 32 GDPR): encrypted connections (HTTPS/TLS), restricted access to data, server-side handling of form submissions, hashing of the IP address in consent records and regular system updates. No transmission over the internet is completely secure, but we work systematically to reduce the risks.

Under the GDPR you have the right to be informed and the rights of access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interest, and rights related to automated decision-making; we do not carry out automated decision-making that produces legal effects. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing. Send requests to info@redox.hr; we respond within one month. You may also lodge a complaint with the Croatian Personal Data Protection Agency (AZOP, azop.hr) or your local supervisory authority.

Our products are made for children, but this website is intended for adult professional audiences: municipalities, architects, contractors and investors. We do not knowingly collect children's personal data through the site. If you believe a child has sent us personal data, please contact us so we can delete it.

Once you leave redox.hr, the privacy policy of the site you visit applies, and we recommend reading it.

We update this Policy when the website, our services or the applicable rules change. The current version, together with its date, is always published on this page. If a material change affects your consent, we will let you know by showing the cookie banner again.