Privacy Policy

Institut za umjetnu inteligenciju, obrt za razvoj i primjenu umjetne inteligencije, owned by Patricija Topić (hereinafter: “we“, “the Institute“), is committed to protecting your personal data. This Privacy Policy explains what data we collect, why we collect it, how we use it, and what your rights are.

1. Data controller

Institute for Artificial Intelligence
Ulica grada Vukovara 269D, 10000 Zagreb, Croatia
OIB: 79932246060
Email: info@institutzaui.hr
Telephone: +385 99 4824 007

Data Protection Officer (DPO): not appointed. Appointing a DPO is not mandatory within the meaning of Article 37 GDPR, because the processing of personal data is not our core activity, we do not process special categories of data on a large scale, and we do not carry out systematic monitoring of individuals.

2. What data we collect

a) Contact form
When you send us an enquiry through the contact form, we collect: your name and surname, your email address, and the content of your message. We use this data solely to respond to your enquiry.

Two technical data points are also processed when you submit the form. Your IP address is passed to Cloudflare Turnstile to verify that the enquiry is not sent by an automated bot; we do not store it separately. Your browser identification (User-Agent) is written into the notification message that arrives at info@institutzaui.hr, so that unwanted messages can be recognised. Enquiries are not written to the website database; they exist only as an email message.

b) Cookies and analytics (Google Analytics)
We use Google Analytics 4 (Google LLC, USA) to analyse site traffic. Google Analytics collects: your IP address (anonymised), browser and device type, the pages you visited, the time spent on the site, and the referral source. The Google Analytics script loads only after you click Accepton our cookie banner. The legal basis is your consent (Article 6(1)(a) GDPR), as well as the requirement of Article 5(3) of the ePrivacy Directive 2002/58/EC (transposed into Article 100 of the Electronic Communications Act), which requires the user’s prior consent before analytical cookies may be placed. You may withdraw your consent at any time by clicking Cookie Settings in the site footer. More about how Google processes data: Google Privacy Policy.

c) Cloudflare Turnstile
To protect the contact form from automated (bot) enquiries, we use Cloudflare Turnstile (Cloudflare Inc., USA). Turnstile may collect technical data about your browser in order to verify that you are a real person. More information: Cloudflare Privacy Policy.

d) Technical server data
Each time our site is accessed, the server automatically records: the IP address, the date and time of access, the requested page, and the HTTP status code. This data is used solely to ensure the stability and security of the site.

e) Meta Pixel and social media advertising
On this site we use the Meta Pixel (ID 1091165709304543), Meta’s measurement code. It is loaded only after you give consent for the marketing category on the cookie banner. Without that consent the code is not executed and no data is sent to Meta.

Once consent has been given, the Pixel records: which pages on institutzaui.hr you opened, whether you submitted an enquiry through the contact form, technical data about your browser and device, and your IP address. This data is sent to Meta and may be linked to your Facebook or Instagram account if you have one.

We use the data to measure how many visits and enquiries came from our advertising, and to build advertising audiences, including lookalike audiences. The Pixel does not transmit the content of your messages from the contact form.

Legal basis: consent (Article 6(1)(a) GDPR, in conjunction with Article 5(3) of the ePrivacy Directive). You may withdraw your consent at any time by clicking Cookie Settings in the site footer. The list and duration of the _fbp and _fbc cookies are set out in the Cookie Policy.

Advertising audiences built from contact lists. In addition to the data collected by the Pixel, we may provide Meta with a list of email addresses of clients and people who have contacted us, in order to build an advertising audience or a lookalike audience from it. Addresses are hashed with SHA-256 before being sent, and Meta uses them solely to compare against existing accounts, deleting non-matching records. The content of your communication with us is never sent.

The legal basis for that processing is legitimate interest (Article 6(1)(f) GDPR, together with Recital 47, which expressly names direct marketing as a possible legitimate interest). Under Article 21(2) GDPR you have an unconditional right to object: it is enough to write to info@institutzaui.hr and we will remove your address from all advertising audiences without delay and without asking for a reason.

We do not currently send a newsletter and we do not maintain a subscriber list. Should we introduce one, we will update this policy before the change is introduced.

3. Legal basis for processing

• Consent (Article 6(1)(a) GDPR) – for sending enquiries through the contact form, for placing analytical cookies (Google Analytics), and for placing marketing cookies and measuring advertising (Meta Pixel)
• Legitimate interest (Article 6(1)(f) GDPR) – for protecting the contact form from bots (Cloudflare Turnstile) and for ensuring the stability and security of the server
• Legal obligation (Article 6(1)(c) GDPR) – for retaining data under tax and accounting regulations, where applicable

4. How long we retain data

• Contact form enquiries: until the communication is concluded, and for no longer than 12 months from the last message
• Meta Pixel data: the _fbp and _fbc cookies last 90 days in your browser. The advertising audiences we build from them refresh automatically, and a visit drops out of them no later than 180 days after it occurred. Data received by Meta is retained by Meta according to its own periods, described in Meta’s privacy policy
• Analytics data: according to the Google Analytics settings (14 months by default)
• Technical server logs: up to 30 days

5. Transfer of data to third parties

We do not sell or rent out your data to anyone. With your consent for the marketing cookie category, we share a limited set of data with Meta in order to measure advertising performance; this is described in point 2.e and stops as soon as you withdraw your consent. The following service providers may process data:

• Nano Informatika d.o.o. (Subhosting, Ključka 3, 10000 Zagreb, Croatia) – Croatian intermediary for the hosting service. The technical infrastructure (web server, MySQL database, backup, mail server) is located with Cyber Wurx LLC (Portland/San Diego, USA) via the hostingsrv.net infrastructure.
• Google LLC (USA) – site traffic analytics (Google Analytics)
• Cloudflare Inc. (USA) – bot protection (Turnstile)
• Meta Platforms Ireland Limited (Ireland), with onward transfer to Meta Platforms, Inc. (USA) – measuring advertising performance and building advertising audiences (Meta Pixel). For that processing, the Institute and Meta act as joint controllers within the meaning of Article 26 GDPR, in line with the judgment of the Court of Justice of the European Union in Wirtschaftsakademie (C-210/16), and not in a controller – processor relationship

The transfer of data to the USA (Google Analytics, Cloudflare Turnstile, Meta Pixel, and the hosting infrastructure through Cyber Wurx LLC) is based on the European Commission’s Standard Contractual Clauses (SCC) and/or the EU-U.S. Data Privacy Framework (DPF), where the respective service provider is certified. Google LLC and Meta Platforms, Inc. are certified under the DPF.

With the processors Google LLC and Cloudflare Inc., data processing agreements (Data Processing Agreement) have been concluded in accordance with Article 28 GDPR, through acceptance of their standard terms of use, which include the obligations of the processor.

6. Cookies

Our site uses the following types of cookies:

• Necessary cookies – required for the basic functioning of the site (WordPress session). They do not require consent.
• Analytical cookies – Google Analytics cookies (_ga, _ga_GF7X9YQ4EW) for tracking site traffic. They are placed only after your explicit consent on the cookie banner.
• Marketing cookies – Meta Pixel (_fbp, _fbc) for measuring advertising performance. They are placed only after your explicit consent for the marketing category. You may withdraw your consent at any time by clicking Cookie Settings in the site footer.
• Security cookies – Cloudflare cookies for bot protection.

You can manage cookies through your browser settings. Disabling cookies may affect the functionality of the site.

7. Your rights

In accordance with the General Data Protection Regulation (GDPR), you have the right to:

• Access – request to see the personal data we process
• Rectification – request the correction of inaccurate data
• Erasure – request the deletion of your data (the “right to be forgotten“)
• Restriction of processing – request a restriction on how we use your data
• Portability – request a copy of your data in a machine-readable format
• Objection – object to processing based on legitimate interest
• Withdrawal of consent – at any time, without affecting the lawfulness of processing carried out before the withdrawal

To exercise any of the above rights, please contact us at info@institutzaui.hr. We will respond within 30 days.

8. Right to lodge a complaint

If you believe that your rights have not been respected, you have the right to lodge a complaint with the supervisory authority:

Croatian Personal Data Protection Agency (AZOP)
Selska cesta 136, 10000 Zagreb
azop.hr

9. Automated decision-making and profiling

We do not make automated decisions that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 of the General Data Protection Regulation (GDPR). All decisions about your enquiries, applications and contracts are made by a natural person.

If you have given consent for marketing cookies, profiling for advertising purposes within the meaning of Article 4(4) GDPR does take place: based on the data collected by the Pixel, Meta places users into advertising audiences and lookalike audiences. This has no legal effect on you and does not affect the price, terms or availability of our services. You may withdraw your consent at any time by clicking Cookie Settings in the site footer, which ends the profiling. You also have the right to object under Article 21 GDPR.

10. Changes to the privacy policy

We reserve the right to amend this Privacy Policy. Any amendment will be published on this page with an updated date. We recommend that you check this page from time to time.