AQUALING GROUP

Privacy Policy

This Privacy Policy describes the collection, use and protection of personal data in accordance with the General Data Protection Regulation (GDPR) and the Republic of Croatia's Act on the Implementation of the General Data Protection Regulation (NN 42/2018). The controller is AQUALING GROUP d.o.o., OIB: 49880145653, Put Vrela 41B, 23000 Zadar. By accepting this Policy, the user undertakes to provide personal and other information that is truthful and complete, as far as possible, and to notify us in good time of any change that must legally be reported. For questions about this Policy, contact info@aqualinggroup.hr.

1. What data do we collect?

We collect personal and other data voluntarily provided by the user, including full name, company name, contact telephone number, email address, enquiry subject, descriptions of properties, pools or requirements, photographs and videos, drawings and technical documentation:

• Through the website contact form: full name, email address, telephone number, subject and message;
• Through the newsletter subscription form: email address, chosen language, subscription status and a record of consent and confirmation;
• Directly from the user by telephone, email, WhatsApp messages or a visit to our store;
• Through cookies and similar browser storage: strictly necessary session, form security and privacy-choice data. Optional analytics, preference or marketing functions remain disabled unless configured and separately consented to;
• Technical request data, including IP addresses, is processed to keep the website and forms secure. The form protection system stores pseudonymous identifiers, time limits and consent records. Analytics data is collected only if analytics is configured and the user has consented;
• Limited information about the user may be collected from other sources, such as public databases, business partners and other external sources.

2. How do we use data?

We process users' data to:

• Answer enquiries, prepare quotations and contracts, communicate and report on projects;
• Supply, install, service and maintain equipment and handle warranty requests and complaints;
• Publish completed projects as references in the website's Projects section, with the user's prior consent;
• Request feedback and publish reviews on our website, with the user's prior consent;
• Send information about products and news to newsletter subscribers until they unsubscribe;
• Protect the website through security measures and fraud monitoring;
• Enforce our terms and policies;
• Respond to legal requests and prevent harm;
• Improve the website and user experience and pursue other business purposes, including analysis of data, usage trends and content effectiveness where the required conditions are met;
• Fulfil other legal obligations, including accounting and tax obligations.

The legal bases for processing are the user's consent (contact form, newsletter, non-essential cookies, publication of references and reviews); performance of a contract or steps before entering into a contract (quotations, supply, installation, servicing and maintenance); our legitimate interest (website security and improvement and protection against abuse); and legal obligations (accounting and tax documentation).

Users' data is not shared with third parties except where necessary to provide services or fulfil legal or other obligations. The technical processing in this version uses:

• The existing hosting provider through the cPanel hosting environment, for operating the website and storing protected application data;
• Authenticated SMTP provided by the hosting environment, for contact messages and newsletter confirmation and unsubscription emails. The controller must confirm the exact hosting and email provider before publication;
• Google Analytics only if explicitly configured and only with the user's consent; it is disabled by default;
• Subcontractors and equipment suppliers where necessary for supply, installation, servicing or resolution of warranty requests.

The forms do not use a third-party form-processing or antispam service. Newsletter subscriptions require confirmation through an emailed link. Unsubscription is available through the relevant link or by contacting us.

3. How long do we keep data?

We keep data for as long as appropriate to its business purpose or for no longer than two years after the last communication, unless a justified legitimate interest warrants longer retention. Data relating to concluded contracts, supplies and warranties is retained for the contractual relationship and warranty period. Accounting documentation is kept for the periods required by the Accounting Act. A newsletter subscriber's email address is retained until unsubscription. Cookies are retained according to their settings and type. Expired security tokens, rate-limit records and other temporary technical records are periodically removed under the application's retention rules.

4. How do we protect data?

In accordance with GDPR principles and obligations, appropriate technical and organisational data protection measures are applied, including HTTPS/SSL, access control and access records. Persistent form records are stored outside the publicly served directory. Application logs must not contain passwords, security tokens or full message content.

5. Minors

We do not target minors or knowingly collect their data. If we discover that we have collected a minor's data, we will delete it.

6. Privacy rights

Every user has the right to:

• Access and obtain a copy of data;
• Rectification or erasure;
• Restriction of processing;
• Object to processing;
• Data portability;
• Withdraw consent without affecting the lawfulness of processing before withdrawal.

To exercise these rights, contact info@aqualinggroup.hr or write to Put Vrela 41B, 23000 Zadar. The controller must respond without undue delay and no later than 30 days after receiving the request.

7. Cookies

Strictly necessary cookies provide basic website functionality and cannot be disabled through the website's preference settings. Non-essential analytics, preference and marketing choices can be accepted, refused or changed later through the cookie settings. Saving a choice does not by itself activate an unconfigured third-party service. Further information is available in the Cookie Policy.

8. Changes to the Privacy Policy

We reserve the right to amend this Policy at any time and state the date of the latest update at the end. Significant changes will be announced in a visible place on the website.

9. Supervisory authority and complaints

The user may submit a complaint about personal data protection and related rights to the Croatian Personal Data Protection Agency (AZOP): azop@azop.hr.

Original policy last updated: 02 September 2026. Technical updates to the domain, forms, hosting and cookies: 06 November 2026. The controller must confirm the provider details and retention policy before publication.