Privacy Policy

Who We Are (Data Controller)

The controller of your personal data is:

• MK-Dizajn, craft business for services, production and trade (obrt za usluge, proizvodnju i trgovinu), owner Krešimir Pendić, Nalješkovićeva ulica 5, 10000 Zagreb, Croatia
• OIB / VAT ID: 32343697212 / HR32343697212
• Email: help@mk-dizajn.hr (data protection requests: privacy@mk-dizajn.hr)

Contact Form Information

When you submit our contact form, we collect only the information needed to respond to your inquiry (name, email address and your message). This information is:

• Used exclusively to respond to your project or inquiry
• Never sold, and never passed to third parties other than the service providers listed under “Who Receives Your Data”
• Stored securely and accessed only by authorized team members
• Sent from our own mail server and delivered, via ForwardEmail forwarding, to our business mailbox at Google (Gmail), where the final copy is kept
• Protected against spam by Cloudflare Turnstile, which receives technical data about your browser and IP address to tell humans from bots

Craft / “Za obrtnike” lead form

When you submit the form on /za-obrtnike, we may collect:

• Owner name, business name, contact email, and optional notes
• Business OIB (tax ID) for craft/business verification and follow-up before any manual activation
• Your domain preference (existing domain, free .hr via CARNET, or a new TLD)
• This data is used only to evaluate and respond to your Starter package request (50% off the first year); it is not sold to third parties

Customer Account, Orders and Billing

If you register or buy from us, we process:

• Account data: name, email address, password hash if you use a password (never the password itself) and login activity
• Order and billing data: billing name and address, VAT ID / OIB for business customers, order history, invoices, domain and hosting records
• Payment data: your card details are entered directly on Stripe’s payment page. They are never stored or logged on our servers; we only receive the payment status and a customer/transaction reference
• Technical and support data: messages you send to support and security logs needed to run and protect the service

Cookies, Local Storage and Analytics

We use the following. Items marked “strictly necessary” do not need consent; analytics run only if you accept them in the cookie banner.

• Strictly necessary (browser storage): “cookieConsent” (your cookie choice), “theme” and “language” (your display preferences), and — only while you are logged in — “auth_token” and “auth_user” (your login session)
• Strictly necessary (security): Cloudflare, which protects our website and runs the Turnstile bot check on forms, may set short-lived technical cookies for security and load balancing
• Analytics (only with your consent): PostHog stores a cookie and/or local-storage entry named “ph_…_posthog” in your browser. It contains a random user identifier, a session identifier and campaign/referrer details, and is kept for up to 12 months
• With analytics consent PostHog records page views, clicks and interactions, the pages you visit, browser, device and operating system type, referrer, and your approximate location derived from your IP address. This data is pseudonymous: it is linked to a random identifier, not to your name or email address
• With analytics consent PostHog may also record session replays, a playback of how you move, scroll and click on our pages, to help us find usability problems. Form input fields are masked and not recorded
• Payment pages are hosted by Stripe, which sets its own cookies under its own policy

Analytics start only after you give consent through the cookie banner, and you can withdraw it at any time by clearing your browser storage or changing your choice in the banner. PostHog data is processed and stored on PostHog’s EU Cloud, hosted in Frankfurt, Germany, and is sent through our own subdomain (t.mk-dizajn.hr).

Why We Process Your Data (Legal Bases)

Under Article 6 GDPR we rely on:

• Contract (Art. 6(1)(b)) — to create your account, process orders, provision and run hosting, domains and email
• Consent (Art. 6(1)(a)) — for PostHog analytics cookies. You can withdraw consent at any time
• Legal obligation (Art. 6(1)(c)) — for invoicing, bookkeeping and tax records
• Legitimate interest (Art. 6(1)(f)) — to answer your inquiries and “Za obrtnike” applications, prevent spam and abuse, and keep our systems secure

Who Receives Your Data

We do not sell personal data. We share it only with providers that help us deliver the service, under data processing terms, and only to the extent needed:

• Stripe Payments Europe — card payments. Stripe handles payment data directly with you and also acts as an independent controller for fraud prevention and its legal duties
• Cloudflare — DNS, CDN, web application firewall and Turnstile bot protection
• PostHog (EU Cloud, Frankfurt) — website analytics, only if you consent
• Hetzner — server infrastructure on which our platform and customer websites run (Germany)
• Backblaze B2 (EU region) — off-site backups and media storage for hosting customers
• ForwardEmail — email forwarding for our own mail (@mk-dizajn.hr) and for customer domains
• Google (Gmail) — final mailbox where our @mk-dizajn.hr email, including contact form messages and “Za obrtnike” applications, is delivered
• Namecheap — domain registration; CARNET — registry of .hr domains (registrant data is passed on for .hr registrations)
• Authorities and advisers when required by law

Our role: for your own account and orders we are the controller. For personal data of third parties (for example visitors of your website) that you store with us, you are the controller and we act as your processor, with the providers above as our sub-processors. See Section 11 of our Terms of Service.

Transfers Outside the EU/EEA

Some providers (such as Stripe, Cloudflare, PostHog, Google, Namecheap and Backblaze) are US companies or have US parent companies, so your data may be accessed from outside the EU/EEA. In that case we rely on appropriate safeguards: the EU–US Data Privacy Framework certification of the provider and/or the European Commission’s Standard Contractual Clauses. You can request a copy of these safeguards from us.

How Long We Keep Your Data

We do not keep personal data longer than necessary:

• Account data: while your account exists; deleted or anonymized within 30 days of a deletion request or account closure, except data we must keep by law
• Invoices and accounting records: 11 years, as required by Croatian accounting and tax law
• Contact form messages and “Za obrtnike” applications: up to 24 months after our last communication, unless they lead to a contract
• Backups: kept on a rolling schedule (daily and weekly) and overwritten automatically
• Analytics data (PostHog): up to 7 years

Data Protection

We apply technical and organizational measures to protect your information. Your data is:

• Encrypted during transmission (TLS)
• Stored on protected servers in the EU
• Accessible only to team members who need it
• Shared with third parties only as described under “Who Receives Your Data”

Your Rights

You have the right to:

• Access — get confirmation of whether we process your data and receive a copy
• Rectification — have inaccurate or incomplete data corrected
• Erasure — ask us to delete your data, unless we must keep it by law (for example invoices)
• Restriction — ask us to pause the use of your data (we only store it) while you contest its accuracy, or the processing is unlawful but you do not want deletion, or you need it for a legal claim
• Data portability — receive the data you gave us, and that we process by contract or consent, in a structured, machine-readable format (e.g. CSV/JSON), and have it passed to another provider
• Object — to processing based on our legitimate interest, at any time
• Withdraw consent for analytics at any time, without affecting earlier processing
• Complain to the supervisory authority: Agencija za zaštitu osobnih podataka (AZOP), www.azop.hr, or the authority in your country of residence

Send requests to privacy@mk-dizajn.hr. We answer within one month. We do not use automated decision-making that produces legal or similarly significant effects on you.