Privacy Policy

1. Data controller

SMA Agency Ltd. ("we" or the "Controller") is committed to protecting your personal data in accordance with the General Data Protection Regulation (EU 2016/679 — GDPR) and the Croatian Act on the Implementation of the GDPR (OG 42/2018).

2. What data we collect

We collect only the personal data you voluntarily provide or that is necessary to deliver our services:

• Contact data via forms: full name, email, phone, company name and message content.
• Technical data automatically collected on visit: IP address, device and browser type, language, date and time of visit, pages viewed.
• Cookie data (see section 6).

3. Purposes and legal bases

• Responding to inquiries — legal basis: pre-contractual steps at your request (Art. 6(1)(b) GDPR).
• Provision and performance of agreed services — legal basis: contract performance (Art. 6(1)(b) GDPR).
• Compliance with legal obligations (accounting and tax) — legal basis: legal obligation (Art. 6(1)(c) GDPR).
• Analytics and website improvement — legal basis: user consent (Art. 6(1)(a) GDPR).
• Protecting legitimate interests (security, abuse prevention) — legal basis: legitimate interest (Art. 6(1)(f) GDPR).

4. Retention period

We retain personal data only as long as necessary for the stated purposes or as required by law (e.g. accounting records — 11 years). Data from contact forms is deleted no later than 24 months after the last communication if no business relationship is established.

5. Recipients

We do not sell or share your personal data with third parties for marketing purposes. Data may be entrusted to carefully selected processors (hosting, email communications, analytics) who are contractually bound to data protection. Data may also be disclosed to competent authorities when required by law.

6. Cookies

The website uses cookies — small text files stored on your device. We use:

• Necessary cookies — essential for site operation (e.g. storing your consent).
• Analytics cookies — help us understand how the site is used (set only with your consent).

You can change cookie settings at any time in your browser preferences or by clearing site data.

7. Your rights

Under the GDPR you have the following rights:

• right of access to your personal data;
• right to rectification of inaccurate data;
• right to erasure ("right to be forgotten");
• right to restriction of processing;
• right to data portability;
• right to object to processing based on legitimate interest;
• right to withdraw consent at any time;
• right to lodge a complaint with the supervisory authority — Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, www.azop.hr.

You may exercise your rights by contacting info@sma-agency.hr.

8. Data security

We implement appropriate technical and organisational measures to protect personal data from unauthorised access, loss, alteration or disclosure, including transport encryption (HTTPS) and access control.

9. Changes to this policy

We may update this privacy policy from time to time. Any changes will be published on this page along with the date of the last update.