Privacy Policy

1. Controller and contact

The controller is WEB STUDIO ŠIME, obrt za informatičke i marketinške usluge, vl. Šime Kalpić, Don Šime Urlića 7, 23000 Zadar, Croatia, OIB 72135092882, operating the OwnerCare brand. Contact [email protected] with the subject “OwnerCare – data protection” for privacy questions or rights requests.

2. Who this Policy covers

This Policy covers website visitors, people contacting us by email or form, clients, their authorised and emergency contacts, and people whose contact details a client lawfully provides to organise access or communication. A client providing another person’s data must inform that person where applicable.

3. Data we process

Depending on our relationship, data may include your name or business name, email, phone, communication language and enquiry; property address or internal reference, agreed checks, schedule and access arrangements; authorised or emergency contacts; photographs and notes on visible property condition; key or access handover records; and information needed for quotations, contracts, invoices and payment records. We do not request special categories of personal data. Please do not send such data unless there is a genuine need explained in advance.

4. Purposes and legal bases

• Enquiries, quotations and pre-contract arrangements: contact details and enquiry content, for steps requested before entering a contract.
• Providing visits, reports and communication: contract, contact, access and reporting data, for performance of the contract.
• Invoices, bookkeeping and taxes: invoice, payment and contract data, to meet legal obligations.
• Access protection, dispute handling, preventing abuse and records: limited communication and event data, based on legitimate interests subject to balancing your rights.
• Optional analytics and associated cookies: browser data and online identifiers, with consent for analytics cookies and cookie-based tracking.

We do not make solely automated decisions with legal or similarly significant effects on you. Cookieless network signals are not automatically exempt from data protection rules.

5. Photographs, reports and access

Photographs and notes document agreed visible checks and observed issues. We do not publish them or use them for promotion without separate consent. Key, code and access information is limited to what is needed. Keys carry an internal reference rather than the full address; access records are kept separately from keys. Security codes, passwords and alarm details are not sent by ordinary email where a more secure method has been agreed.

6. Recipients and processors

We do not sell personal data or provide it to others for their marketing. Hosting, email, backup, electronic-signature, payment, accounting or reporting providers may access data as needed when the relevant tool is actually used. Appropriate contractual and security conditions must be checked for those providers. Contractors receive data only when needed for an agreed step and, where required, with the owner’s approval. Google receives analytics data as described in section 11; OpenAI processing for the separate AI function is described below.

7. Transfers outside the EEA

External providers, including Google Analytics and OpenAI for the separate AI function described below, may process data outside the European Economic Area, for example in the United States. We do not claim all processing is EU-only. See Google’s Privacy Policy and data processing terms. Applicable agreements and transfer safeguards must match the actual processing. Publication of this Policy is not evidence that all agreements have been accepted or a legal certification of compliance. Contact [email protected] for information about recipients and transfers in your case.

8. Retention

• Enquiries not resulting in a contract: up to 24 months after the last communication, unless deletion is requested earlier and no other basis applies.
• Contracts, reports and business communication: during the contract and afterwards as needed to evidence performance, defend claims and meet legal obligations.
• Invoices and bookkeeping records: for periods required by applicable tax and accounting rules.
• Key and access records: during access authorisation, then only as needed to evidence proper handover.
• Written consumer complaints: at least one year after receipt.
• Consent for optional cookies: until withdrawal or according to the relevant cookie’s duration.

9. Your rights

Subject to applicable legal conditions, you have rights of access, correction, erasure, restriction, portability, objection to processing based on legitimate interests, and withdrawal of consent at any time. Send requests to [email protected] with the subject “OwnerCare – data protection”. We may request proportionate identity verification to prevent unauthorised disclosure. You can complain to the Croatian Personal Data Protection Agency at azop.hr.

10. Security

We apply proportionate technical and organisational measures, including access limits, separate access records and keys, individual accounts where available, backups and reporting procedures for suspected unauthorised access. No system guarantees absolute security. Personal data breaches are assessed, recorded and, where required, reported to the authority and affected individuals.

11. Cookies and analytics

We use Complianz to manage consent choices, Google Analytics 4 through Google Site Kit for usage statistics, and Koko Analytics for local statistics without analytics cookies. Google may receive page views and interactions, online identifiers after consent, and technical information about the browser, device and approximate location. Koko statistics remain on our WordPress server. Contact-form data, enquiry content, property access information and documents are not intended for analytics tools.

Google analytics cookies are enabled after you accept statistics. Koko statistics also start after acceptance. Advanced Google Consent Mode may load Google’s tag and send consent and measurement signals without analytics cookies before a choice or after rejection. Rejecting therefore does not mean that no network request is sent to Google. The banner explains this distinction. You can change or withdraw consent through Privacy settings; withdrawal does not affect the lawfulness of earlier processing.

Google Ads and AdSense were not introduced by this configuration. Search Console and PageSpeed Insights help manage visibility and technical performance; connecting them does not itself add a separate visitor analytics cookie. See the Cookie Policy for cookie details and durations. Consent is the basis for analytics cookies and cookie-based tracking; cookieless network signals are not automatically exempt from data protection rules.

12. Updates

We update this Policy when actual tools, processes, providers or applicable rules change. The published version should reflect the actual processing and its update date.