Privacy policy
What personal data we handle, why, for how long, who else sees it, and what you can ask of us. It covers visitors of tiaro.eu, people who contact us, and our clients' contact persons. Last updated 3 October 2026.
The short version
- We count visits with our own tool on our own server: no cookies, no stored IP addresses, nothing passed to anyone.
- This website has no advertising trackers, no social media plugins and no fonts or scripts loaded from other companies.
- It sets one cookie on its own, to remember your cookie choice.
- What you send us through the contact form or by email is used to answer you and, if we work together, to do that work. Nothing else.
- We never sell personal data, never share it for advertising, and never pass client information to anyone who does not need it to deliver our work.
Who is responsible
The controller for the processing described here is Tiaro Digital d.o.o. za usluge, Ulica Ivana Meštrovića 35, 10360 Sesvete, Croatia, OIB 50559636036 (details in our legal notice).
For anything about your personal data, write to info@tiaro.eu or to the postal address above. The person in charge of data protection, also as the contact person (encarregado) under Brazil's LGPD, is Rafael Budimir, Director. We have not appointed a data protection officer under Article 37 GDPR, because the law does not require one for a company of our kind.
This policy covers this website and our own business. When we build, host or look after a website or application for a client, the client decides about its visitors' data and we act on the client's behalf under our data processing agreement. For those sites, the client's own privacy policy applies.
Visiting this website
What is processed
Every time a page is requested, the web server receives and records technical data that any browser sends: IP address, date and time, the address requested, the referring page, the HTTP status, the amount of data sent, and the browser and operating system ("user agent").
Why, and on what basis
To deliver the pages, to keep the site and server secure (for example to detect and block attacks and abusive crawlers), and to find faults. The legal basis is our legitimate interest in a secure, working website (Article 6(1)(f) GDPR).
How long
The server logs are kept by our hosting provider only as long as needed for security and troubleshooting and are then deleted in its regular log rotation. We do not combine them with other data and do not use them to identify visitors, unless an attack forces us to report it to the authorities.
Cookies
The site uses only cookies that are needed for it to work, and content from other services only after you allow it. Details are in our cookie policy.
Fonts and other content
Fonts, images, styles and scripts are served from our own server. Your browser does not contact Google or any other third party when you open our pages. If we ever embed a video or a map from another service, it stays blocked until you allow that service in the cookie settings.
Visitor statistics
What is processed
We count the visits to this website with Tiaro Analytics, a tool we built ourselves that runs on our own server. For each page view it records the page, the time, the website you came from (without search terms), the country derived from the time zone set on your device, the browser language, and the type of device and browser. It also records that a form was sent, a file was downloaded or a link to another website was clicked, never what you typed into a form.
To tell visits apart, the server forms an anonymous code from your IP address and browser details. The code changes every day and cannot be turned back into your IP address; the IP address itself is not stored. No cookie is set and nothing is read from your device.
Why, and on what basis
To understand which pages are useful and how people find us, so that we can improve the site. The legal basis is our legitimate interest in that (Article 6(1)(f) GDPR). Because the records cannot be linked to you, we cannot identify your visits among them.
How long
The records are deleted automatically after 25 months. Nothing is passed to third parties.
Opting out
If your browser sends a "Do Not Track" or "Global Privacy Control" signal, your visit is not counted at all.
Contacting us
What is processed
When you use the contact form: first and last name, company (optional), email address, phone number (optional), country, address (optional), subject, your message, and your confirmation that we may use these details to answer you. The form does not record your IP address or browser details. When you write to us by email or call us, we receive what you choose to send, including your email address or phone number.
Why, and on what basis
To answer your question and, if you ask for it, to prepare an offer. Where your message concerns a possible project, the basis is taking steps at your request before entering into a contract (Article 6(1)(b) GDPR). For all other messages it is our legitimate interest in answering the people who write to us (Article 6(1)(f) GDPR).
How long
Form entries are stored in our website's database and automatically anonymised 48 months after they were sent. Emails stay in our mailbox for as long as the conversation or a business relationship that follows from it continues, and are then deleted, except where a law requires us to keep them (see below). You can ask us to delete your message at any time.
Clients and business partners
What is processed
Names, job titles, email addresses and phone numbers of contact persons; company and billing details; contracts, offers, invoices and payment records; project correspondence; and login details for accounts we set up for you.
Why, and on what basis
To deliver the services agreed with you, to invoice and to keep in touch (Article 6(1)(b) GDPR, or Article 6(1)(f) for contact persons of a company client), and to meet accounting and tax obligations (Article 6(1)(c) GDPR).
How long
For the duration of the contract and afterwards for as long as claims can be raised under it. Accounting documents such as invoices are kept for 11 years, as the Croatian Accounting Act requires. Everything else is deleted once it is no longer needed.
We do not
- build profiles of visitors or make automated decisions about you;
- use analytics services of other companies, or pass our own visit statistics to anyone;
- send newsletters or marketing emails;
- sell personal data, rent it out, or share it for advertising, in the EU, Brazil, California or anywhere else;
- name our clients or show their work without their written permission.
Who else receives data
Only service providers who need it to run our infrastructure, each bound by a contract under Article 28 GDPR:
- hosting.com (A2 Hosting, Inc., USA): web hosting, our email accounts and backups. The server is located in a data centre in the European Union.
- MailChannels Corporation (Canada): relays the emails our server sends, to protect them from being treated as spam. It sees sender, recipient and the email as it passes through.
Beyond that, data goes to our bank for payments, to an accountant or tax adviser where we use one, and to courts or authorities only where the law obliges us. We will name any other recipient here before we start using it.
Transfers outside the EU
Our server is in the European Union. Some of our providers are companies based outside it. Canada has an adequacy decision of the European Commission (Article 45 GDPR). For providers in the United States, transfers rely on the EU-U.S. Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses (Article 46 GDPR) in the provider's data processing terms. You can ask us for a copy of the safeguards that apply.
If you are in Brazil, your data is transferred to the European Union and to the countries above under the same contractual safeguards, which serve as specific contractual clauses and guarantees of compliance under Article 33 of the LGPD.
How we protect data
Encrypted connections (HTTPS) on every page, current software, strong and unique passwords, access limited to the people who need it, regular backups, and the same standards we apply to our clients' sites. No measure is perfect, but if something goes wrong we will tell the authority and, where your rights are at risk, you, as the law requires.
Your rights in the European Union
You can ask us at any time and free of charge:
- for access to your data and a copy of it (Article 15 GDPR);
- to correct it (Article 16);
- to delete it (Article 17);
- to restrict its processing (Article 18);
- to receive data you gave us in a common machine-readable format, or have it sent to someone else (Article 20);
- to object to processing based on our legitimate interest (Article 21), after which we stop unless we have compelling reasons that override yours, or need it for legal claims;
- to withdraw a consent you gave, with effect for the future.
Write to info@tiaro.eu. We answer within one month and may ask you to confirm your identity first.
You also have the right to complain to a data protection authority. Ours is the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Ulica Metela Ožegovića 16, 10000 Zagreb, azop.hr. You may also contact the authority in the EU country where you live or work.
If you are in Brazil (LGPD)
Brazil's General Data Protection Law (Lei Geral de Proteção de Dados, Law 13.709/2018) applies when we process data of people in Brazil. The purposes described above rely on these legal bases of Article 7 LGPD: performance of a contract or preliminary steps at your request (item V), compliance with a legal obligation (item II), and our legitimate interest (item IX). Consent (item I) applies only to third-party content you choose to allow in the cookie settings.
Under Article 18 LGPD you can ask us for:
- confirmation that we process your data, and access to it;
- correction of incomplete, inaccurate or outdated data;
- anonymisation, blocking or deletion of data that is unnecessary, excessive or processed unlawfully;
- portability of your data to another provider;
- deletion of data processed on the basis of your consent;
- information about the public and private entities we share data with;
- information about the possibility of refusing consent and what refusing means;
- review of decisions taken solely by automated means (we take none).
You may also withdraw consent at any time. Send your request to our encarregado, Rafael Budimir, at info@tiaro.eu. You have the right to petition the National Data Protection Authority (Autoridade Nacional de Proteção de Dados, ANPD), gov.br/anpd.
If you are in California
This section serves as our privacy policy under the California Online Privacy Protection Act and as our notice to California residents.
Categories and sources
In the last 12 months we collected, as described above: identifiers (name, email address, phone number, postal address, IP address); professional information (company, job title); commercial information about clients (offers, contracts, invoices); and internet activity on this site (the server log entries). They come from you directly or from your browser. We use them only for the purposes listed in this policy and keep them for the periods stated.
No sale, no sharing
We do not sell personal information and do not share it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act (CCPA), and we have not done so in the past 12 months. We have no actual knowledge of selling or sharing information of anyone under 16. We do not use or disclose sensitive personal information for any purpose other than those the CCPA allows. We disclose personal information for business purposes only to the service providers named above.
Your choices
Whether or not our business falls under the CCPA's thresholds, we honour these requests from California residents: to know what personal information we collected, used and disclosed; to delete it; to correct it; and not to be discriminated against for making such a request. Send your request to info@tiaro.eu. We will confirm receipt within 10 business days and answer within 45 days, after confirming your identity with the details we already hold. You may use an authorised agent, who must show your signed permission. Under California's "Shine the Light" law (Civil Code §1798.83) you may ask whether we disclosed personal information to third parties for their direct marketing: we do not.
Do Not Track
This website does not track visitors across other websites, does not recognise a visitor beyond a single day, and allows no third party to do either. We honour browser "Do Not Track" and Global Privacy Control signals: when your browser sends one, your visit is not counted in our statistics at all.
Children
Our services are for businesses and adults. We do not knowingly collect data from children under 16 (or under 13 in the United States). If you believe a child has sent us personal data, tell us and we will delete it.
Changes to this policy
We update this policy when our processing changes or the law requires it. The date at the top shows the current version. Where a change affects you as a client, we will tell you directly before it takes effect.