Privacy Policy

Status. This document is a working draft prepared from a technical audit of what this website actually does. It has not been reviewed by a lawyer and it replaces nothing yet. Items in square brackets are facts we have not confirmed and must not publish as if we had.

1. Who is responsible for your data

Umbrella Co. d.o.o. is the data controller for personal data collected through umbrella-co.eu.

Umbrella Co. d.o.o.
Gornji Bukovac 65, 10000 Zagreb, Croatia
Email: hello@umbrella-co.eu
Company registration number and OIB: [to confirm]
[Confirm whether privacy@umbrella-co.eu exists and is monitored. If it does not, this policy should name hello@umbrella-co.eu only.]

We have not appointed a Data Protection Officer. Based on the scale and nature of this processing we do not currently believe one is required, but that assessment should be confirmed. [to confirm with counsel]

2. What this policy covers

This policy covers the umbrella-co.eu website: the enquiry form, any email you send us, and the technical data your browser provides when you visit. It does not cover client project work, which is governed by the contract for that engagement, and it does not cover third-party websites we link to.

3. What we collect

Information you give us. When you submit the enquiry form or email us: your name, work email address, company name, website address if you provide one, the nature of your situation, and whatever you write in the message. We ask for nothing else and you should not send us anything sensitive through a web form.

Information collected automatically. Standard server access logs, which typically include IP address, browser type, pages requested and timestamps. Cookies and similar storage as described in our Cookie Policy.

What we do not collect. At the time of writing this site runs no analytics platform, no advertising pixels and no cross-site tracking. There is no Google Analytics tag, no Meta pixel and no advertising remarketing tag on this site. If that changes, this policy and the Cookie Policy change with it, before the tag goes live.

4. Why we process it, and on what basis

To answer your enquiry. Legal basis: our legitimate interest in responding to someone who has contacted us about working together, and taking steps at your request before entering a contract.

To keep the site running and secure. Server logs, spam filtering and abuse prevention. Legal basis: legitimate interest in operating a functioning, non-abused website.

Non-essential cookies. Legal basis: your consent. See the Cookie Policy for what is currently set and the open issue flagged there.

We do not sell personal data, we do not share it with data brokers, and we do not use it for automated decision-making or profiling.

5. How long we keep it

Enquiries are kept for as long as the conversation is commercially live, and afterwards for a limited period so we can recall the context if you come back to us. Server logs and spam-filter records are kept for shorter operational periods.

[Specific retention periods to be set and stated here. Do not publish this policy with this section vague. A defensible starting point is: enquiries that do not become clients, 24 months; enquiries that become clients, for the life of the engagement plus the statutory record-keeping period; server logs, [hosting provider default].]

6. Who else touches your data

We use a small number of service providers to run this website. Each processes data on our instructions.

Website hosting. [Hosting provider to confirm, with the location of its servers and whether a data processing agreement is in place.]

Email. Enquiry form submissions are delivered to us by email. [Confirm the mail provider for hello@umbrella-co.eu.]

Elementor. The site is built with Elementor and loads some assets from cdn.elementor.com, which is behind Cloudflare. Your browser therefore contacts that service when you load a page, and Cloudflare sets a bot-management cookie on its own domain.

Akismet. Spam filtering for form and comment submissions, operated by Automattic. Submitted content is sent to Automattic for spam scoring. Automattic is based in the United States.

WooCommerce. Installed on this site. It sets cart and attribution storage in your browser even where no products are on sale. See the Cookie Policy.

[Confirm this list is complete against the installed plugin set, and that a written data processing agreement exists with each provider that needs one.]

7. Transfers outside the European Economic Area

Some providers named above operate outside the EEA, including in the United States. Where that happens, transfers must rely on an approved safeguard such as the European Commission’s standard contractual clauses or an adequacy decision.

[Confirm which safeguard applies to each non-EEA provider before publication. Do not publish a generic assurance here.]

8. Your rights

Under the GDPR you have the right to: access the personal data we hold about you; have inaccurate data corrected; have data erased in certain circumstances; restrict or object to processing, including objecting to processing based on legitimate interest; receive your data in a portable format; and withdraw consent at any time where consent is the basis, without affecting processing already carried out.

To exercise any of these, email hello@umbrella-co.eu. We will respond within one month, and will tell you if we need longer and why.

If you are not satisfied with our response you can complain to the Croatian Personal Data Protection Agency, Agencija za zaštitu osobnih podataka (AZOP), or to the supervisory authority where you live or work.

9. Security

The site is served over HTTPS and access to the systems behind it is restricted to people who need it. No website is perfectly secure, and we will not claim otherwise. If a breach occurs that is likely to result in a risk to your rights, we will notify the supervisory authority and, where required, you.

10. Children

This is a business-to-business website. It is not directed at children and we do not knowingly collect data from them.

11. Changes

If we change how we handle personal data, we will update this page and change the date at the top. Material changes will be summarised here rather than buried.

12. Contact

Questions about this policy or about your data: hello@umbrella-co.eu.