Privacy Policy

Welcome to the win-win.hr website. Your privacy is our priority. Data collection and processing are conducted in compliance with the GDPR and applicable regulations, ensuring the security and confidentiality of information.

Win-win Communications, a service business owned by Kristina Marečić, located at Bocakova ulica 46, 10380 Sveti Ivan Zelina, Croatia, collects personal data to answer your enquiries, take registrations for events, sell tickets and issue invoices. Your data is not used for other purposes and is never sold.

Privacy Policy

Data collection is conducted lawfully, transparently, and with the possibility of user choice. The business uses data solely for the stated purposes, ensuring the security and privacy of users.

Data Controller

The data controller for your information is Win-win Communications. For questions about this Privacy Policy, contact us at: [email protected].

---

Personal Data and Processing

Definition and Purpose

Personal data is information that can be used to identify a person. The business collects it through forms on the website, e-mail, social networks and direct contact, in order to provide its services.

Data Processing

• Enquiries and messages (name, e-mail, company, message): to answer you. The legal basis is your consent, or your enquiry.
• Event registrations (full name, e-mail, message): to keep your place and send you the details. The legal basis is your registration for the event (Article 6(1)(b) GDPR).
• Invoices (full name or company name, company VAT number, address): issued in accordance with the law.
• Social networks: to share content and client experiences, with your consent.

Registrations, Purchases and Payment

You can pay for event tickets by card or by bank transfer.

• Card payments (as well as Apple Pay and Google Pay) take place on the secure page of Stripe. You enter your card details directly with Stripe; we never see or store them. Stripe only tells us whether the payment succeeded, the amount and the payment reference. To prevent fraud, Stripe also processes payment data as an independent controller, under its own privacy policy.
• Bank transfer: after you register, we e-mail you the payment details (or an offer, if your company pays).

For each order we keep your first name, last name, e-mail, the event, the amount, the time of payment and the payment reference, so that we can issue the invoice and, if you change your mind, refund you.

Who Else Processes Data

To run the website and the business we use trusted service providers, who process your data only on our instructions:

• DigitalOcean: the server running the website and the database (London).
• Cloudflare: protection and faster delivery of the website.
• Microsoft 365: e-mail, including the confirmations and invoices we send after a registration or purchase (data stored in the EU).
• Stripe: card payments (see above).
• Solo: issuing and fiscalising invoices.

Some events also take registrations through a Google Forms form; what you enter there is processed by Google under its own policies. Podcast episodes are shown through YouTube, which loads only when you click play.

When data is transferred outside the European Union (e.g. to the US or the United Kingdom), this is done with the safeguards the GDPR requires, such as European Commission adequacy decisions or standard contractual clauses.

How Long We Keep Data

• Enquiries, messages and registrations: 2 years after the event or the last contact, unless agreed otherwise.
• Orders and invoices: 11 years, as required by the Croatian Accounting Act.
• Visitor analytics: aggregate figures only, without names or e-mail addresses.

Data is retained as long as there is a legal obligation or purpose for its retention.

---

Visitor Analytics (Without Cookies)

To understand how the website is used and to improve it, we use the analytics tool Umami, which runs on a server we manage ourselves. The tool does not use cookies and does not store anything on your device. The data is not sold, is not shared with third parties for their own purposes and is not used for advertising.

The legal basis is the business's legitimate interest in understanding and improving the website (Article 6(1)(f) GDPR).

---

User Rights

Users have the right to:

1. Access their data.
2. Correct inaccurate data.
3. Have data deleted under the GDPR (except data we must keep by law, such as invoices).
4. Restrict data processing.
5. Transfer data in a structured format.
6. Object to data processing.
7. Withdraw consent at any time, where processing is based on consent.
8. Lodge a complaint with the Croatian data protection authority (AZOP).

To exercise your rights, write to us at [email protected].

---

Changes to the Privacy Policy

The business reserves the right to change this Privacy Policy. All changes will be published on the website. Key changes will also be communicated by e-mail or on the website.