Privacy policy

This policy explains what personal data the GFK Studio website (gfk-studio.com) collects, why, how long we keep it and what your rights are. We process data in line with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the laws of the Republic of Croatia.

1. Who is the data controller?

GFK MONT j.d.o.o. (brand GFK Studio)
Ulica Braće Radić 28, 42000 Varaždin, Croatia
OIB (tax no.): 83913595051
Email: info@gfk-studio.com
Phone: +385 92 5035 517

2. What data do we collect?

Contact form. When you send an enquiry, we collect your name, email address, phone number (if you enter it), the selected service, the approximate budget (if you choose one) and your message.

Messages, calls and email. If you contact us via WhatsApp, Viber, phone or email, we process the data you send us yourself (name, phone number or email address and the content of your message).

Analytics, only with your consent. If you accept cookies, Google Analytics records how you use the website: which pages you visit, from which device and browser, your approximate city or country, and where you came from (e.g. Google or Instagram). We do not collect data that would let us identify you personally.

Technical logs. For security and to keep the website running properly, our hosting provider may briefly log technical data such as IP addresses and visit times.

3. Why do we process data and on what legal basis?

• Replying to enquiries and preparing quotes: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
• Providing the agreed service: performance of a contract (Art. 6(1)(b) GDPR).
• Invoicing and bookkeeping: legal obligation (Art. 6(1)(c) GDPR).
• Analytics and ad measurement: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
• Website security: legitimate interest (Art. 6(1)(f) GDPR).

We do not sell your data, do not use it for automated decision-making and do not send you marketing messages without your consent.

4. Who else has access to the data?

We share data only with service providers we need to run the website and our business:

• Netlify, Inc.: website hosting and receiving enquiries from the contact form.
• Google Ireland Limited / Google LLC: Google Analytics, only if you have accepted cookies.
• WhatsApp (Meta) and Viber (Rakuten Viber): only if you contact us through those apps yourself. Their own privacy policies also apply to those conversations.
• Accounting service: invoice data, for legal obligations.
• Public authorities: only when required by law.

Some of these providers are located in, or process data outside, the European Economic Area, mainly in the USA. In that case the transfer relies on appropriate safeguards under the GDPR, such as the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses.

5. Cookies

When you first open the website, we ask for your consent. Without it, we only use what is necessary for the website to work.

• Essential: remembering your cookie choice, stored in your browser. Without it we would ask you on every visit.
• Analytics (only with consent): Google Analytics cookies (e.g. _ga and _ga_*), used to measure visits and website usage.
• Advertising (only with consent): if we run ads, cookies that measure whether the ads led to visits or enquiries.

You can change your choice at any time via the Cookie settings link at the bottom of the page, or by deleting cookies in your browser settings.

6. How long do we keep data?

• Enquiries that do not lead to a project: up to 12 months after the last contact.
• Client data and invoices: as long as tax and accounting laws require.
• Analytics data: up to 14 months, according to our Google Analytics settings.

7. Your rights

At any time you can request:

• access to the data we hold about you and a copy of it,
• correction of inaccurate data,
• erasure of data we are no longer required to keep,
• restriction of processing or data portability,
• objection to processing based on legitimate interest,
• withdrawal of consent, without affecting the lawfulness of processing before withdrawal.

Send your request to info@gfk-studio.com. We will reply within 30 days at the latest. If you believe we process your data unlawfully, you can lodge a complaint with the Croatian Personal Data Protection Agency (AZOP, azop.hr).

8. Security

The website uses an encrypted connection (HTTPS). Only people who need it for their work have access to enquiries and client data.

9. Changes to this policy

If we change how we process data, we will update this page and the date at the top.