1. Data Controller
The controller of your personal data is Adria Media j.d.o.o. ("Krovke", "we", "us"), with registered office at Snežnička ulica 2, 51000 Rijeka, Croatia, OIB: 98131137868, MB: 40346137. For any data protection inquiries or to exercise your rights, write to info@krovke.com. Under Article 37 GDPR we are not required to appoint a Data Protection Officer; all communication goes to the email above.
2. Data We Collect
We only collect data we need to provide the service:
- When you submit a lead: full name, email, phone, country and region, housing preferences (type, size, number of bedrooms, roof style, energy standard, budget, timeline), search stage, plot status.
- When you create an account: name, email, phone, password stored as an irreversible hash, role; for manufacturers additionally company OIB, address, description and assets (images, documents).
- Automatically: IP address, browser data, session identifier, cookies required for security and site functionality.
- Consent for marketing communications if you explicitly grant it through a separate checkbox.
- When you express interest in a future financing service: full name, email, phone, and the calculator inputs and estimates you submit.
3. Purposes and Legal Bases
We process different categories of data on different legal bases:
- Sharing your lead with relevant manufacturers — your explicit consent (GDPR Article 6(1)(a)).
- Automatic matching against the manufacturer catalog — consent (Article 6(1)(a)); details in Section 4.
- User account, login, dashboard — contract performance (Article 6(1)(b)).
- Abuse prevention, platform security, duplicate prevention — legitimate interest (Article 6(1)(f)).
- Newsletter and marketing communications — separate consent (Article 6(1)(a)).
- Accounting records for paying manufacturers — legal obligation (Article 6(1)(c), Croatian Accounting Act).
- Recording and responding to interest in a future financing service — your explicit consent (Article 6(1)(a)).
4. Automated Matching
When you submit a general inquiry, an automated system compares the location, budget, house type and size, number of bedrooms, roof style, energy class, and completion stage with Manufacturers' service areas, catalogues, and settings. The system determines no more than three Manufacturers that you see. Order is also affected by whether a Manufacturer paid for or automatically unlocked the contact: paid results have priority, followed by unpaid full and then close matches. Payment is not an endorsement or quality guarantee. This process does not conclude a contract or make a credit decision. Details are available on the "How we rank results" page. You may request an explanation or human review by emailing info@krovke.com.
5. With Whom We Share Your Data
We share your data with three categories of recipients, strictly to the extent necessary to provide the service:
- Prefab house manufacturers — those you select through an individual inquiry or that lawfully unlock the contact under the matching rules, and only with your explicit consent. Once received, the Manufacturer becomes an independent controller and processes the data under its own privacy policy.
- Technical providers (sub-processors): Supabase Inc. (USA) for the database, Vercel Inc. (USA) for hosting, Resend (EU) for email delivery, Mollie B.V. (Netherlands) for manufacturer payment processing.
- Competent authorities when legally required (courts, supervisory authority, tax administration).
- We do not sell your data to third parties.
- We do not currently send financing-interest data to external financial institutions or credit intermediaries. Before any future sharing, we will identify the partner and request separate explicit consent.
6. International Transfers
Supabase Inc. and Vercel Inc. are based in the United States. The transfer of data to the USA is covered by the European Commission adequacy decision (EU–US Data Privacy Framework of July 2023) and standard contractual clauses. We monitor the status of this coverage regularly.
7. How Long We Keep Your Data
Retention varies by purpose:
- Lead data: at most 24 months from submission, or until you request deletion.
- User account: until you request deletion or 24 months of inactivity.
- Manufacturer accounting records: 11 years (Article 10 of the Croatian Accounting Act).
- Security backups: up to 90 days after which they are automatically deleted.
- Data about interest in a future financing service: no more than 24 months after submission or until consent is withdrawn earlier, unless longer retention is needed to evidence how the request was handled.
8. Your Rights
Under GDPR you have the following rights, exercisable by sending a request to info@krovke.com (reply within 30 days):
- Right of access — a copy of all data we hold about you (Article 15).
- Right to rectification of inaccurate data (Article 16).
- Right to erasure, the "right to be forgotten" (Article 17).
- Right to restriction of processing (Article 18).
- Right to data portability in a structured format (Article 20).
- Right to object to processing based on legitimate interest (Article 21).
- Right to withdraw consent at any time (Article 7(3)) — withdrawal does not affect the lawfulness of processing before withdrawal.
9. Complaint to the Supervisory Authority
If you believe your rights have not been respected, you may file a complaint with the Croatian Personal Data Protection Agency (AZOP): Selska cesta 136, 10000 Zagreb, email azop@azop.hr, web www.azop.hr. You may also contact the supervisory authority in your country of residence.
10. Cookies and Tracking Technologies
We use three categories of cookies and similar technologies:
- Necessary — login security, language memory, abuse prevention. Always on, cannot be disabled.
- Analytics — Vercel Analytics (anonymized cookieless statistics, always on) and Google Analytics (used with your consent).
- Marketing — enabled only after your consent.
- You may change your settings at any time by clicking "Cookie settings" in the page footer.
11. Data Security
We protect data with encryption in transit (HTTPS) and at rest, access is restricted by role, we run regular backups and monitor systems. In case of a breach posing risk to your rights, we will report it to the supervisory authority within 72 hours and notify you without undue delay.
12. Changes to This Policy
We may amend this policy due to changes in legislation, our service, or sub-processors. The date of the last update is shown at the top of the page, and material changes will be announced by email 30 days in advance to registered users.
13. Contact
For all data protection inquiries and exercising your rights, write to: info@krovke.com