1. Data Controller
The controller of your personal data is Adria medija j.d.o.o. ("Krovke", "we", "us"), with registered office at Snežnička ulica 2, 51000 Rijeka, Croatia, OIB: 98131137868, MB: 40346137. For any data protection inquiries or to exercise your rights, write to info@krovke.com. Under Article 37 GDPR we are not required to appoint a Data Protection Officer; all communication goes to the email above.
2. Data We Collect
We only collect data we need to provide the service:
- When you submit a lead: full name, email, phone, country and region, housing preferences (type, size, number of bedrooms, roof style, energy standard, budget, timeline), search stage, plot status.
- When you create an account: name, email, phone, password stored as an irreversible hash, role; for manufacturers additionally company OIB, address, description and assets (images, documents).
- Automatically: IP address, browser data, session identifier, cookies required for security and site functionality.
- Consent for marketing communications if you explicitly grant it through a separate checkbox.
3. Purposes and Legal Bases
We process different categories of data on different legal bases:
- Sharing your lead with relevant manufacturers — your explicit consent (GDPR Article 6(1)(a)).
- Automatic matching against the manufacturer catalog — consent (Article 6(1)(a)); details in Section 4.
- User account, login, dashboard — contract performance (Article 6(1)(b)).
- Abuse prevention, platform security, duplicate prevention — legitimate interest (Article 6(1)(f)).
- Newsletter and marketing communications — separate consent (Article 6(1)(a)).
- Accounting records for paying manufacturers — legal obligation (Article 6(1)(c), Croatian Accounting Act).
4. Automated Matching
When you submit a lead, an automated algorithm compares your preferences (region, budget, house type, energy standard, number of bedrooms) against the manufacturer model catalog to recommend the most relevant providers. The algorithm therefore determines which manufacturers you see as a "match". If no match exists, we suggest relaxing criteria. You have the right to request human review of the decision, to express your point of view, and to contest the result — write to info@krovke.com and we will review your lead manually.
5. With Whom We Share Your Data
We share your data with three categories of recipients, strictly to the extent necessary to provide the service:
- Prefab house manufacturers — only those matching your lead and only with your explicit consent. Once received, the manufacturer becomes an independent controller and processes the data under its own privacy policy.
- Technical providers (sub-processors): Supabase Inc. (USA) for the database, Vercel Inc. (USA) for hosting, Resend (EU) for email delivery, Mollie B.V. (Netherlands) for manufacturer payment processing.
- Competent authorities when legally required (courts, supervisory authority, tax administration).
- We do not sell your data to third parties.
6. International Transfers
Supabase Inc. and Vercel Inc. are based in the United States. The transfer of data to the USA is covered by the European Commission adequacy decision (EU–US Data Privacy Framework of July 2023) and standard contractual clauses. We monitor the status of this coverage regularly.
7. How Long We Keep Your Data
Retention varies by purpose:
- Lead data: at most 24 months from submission, or until you request deletion.
- User account: until you request deletion or 24 months of inactivity.
- Manufacturer accounting records: 11 years (Article 10 of the Croatian Accounting Act).
- Security backups: up to 90 days after which they are automatically deleted.
8. Your Rights
Under GDPR you have the following rights, exercisable by sending a request to info@krovke.com (reply within 30 days):
- Right of access — a copy of all data we hold about you (Article 15).
- Right to rectification of inaccurate data (Article 16).
- Right to erasure, the "right to be forgotten" (Article 17).
- Right to restriction of processing (Article 18).
- Right to data portability in a structured format (Article 20).
- Right to object to processing based on legitimate interest (Article 21).
- Right to withdraw consent at any time (Article 7(3)) — withdrawal does not affect the lawfulness of processing before withdrawal.
9. Complaint to the Supervisory Authority
If you believe your rights have not been respected, you may file a complaint with the Croatian Personal Data Protection Agency (AZOP): Selska cesta 136, 10000 Zagreb, email azop@azop.hr, web www.azop.hr. You may also contact the supervisory authority in your country of residence.
10. Cookies and Tracking Technologies
We use three categories of cookies and similar technologies:
- Necessary — login security, language memory, abuse prevention. Always on, cannot be disabled.
- Analytics — Vercel Analytics (anonymized cookieless statistics, always on) and Google Analytics (used with your consent).
- Marketing — enabled only after your consent.
- You may change your settings at any time by clicking "Cookie settings" in the page footer.
11. Data Security
We protect data with encryption in transit (HTTPS) and at rest, access is restricted by role, we run regular backups and monitor systems. In case of a breach posing risk to your rights, we will report it to the supervisory authority within 72 hours and notify you without undue delay.
12. Changes to This Policy
We may amend this policy due to changes in legislation, our service, or sub-processors. The date of the last update is shown at the top of the page, and material changes will be announced by email 30 days in advance to registered users.
13. Contact
For all data protection inquiries and exercising your rights, write to: info@krovke.com