This policy explains how AI MAX d.o.o. processes personal data when you visit this website, send us an enquiry, talk to the AI assistant or e-mail us. It follows the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Croatian Act on the Implementation of the GDPR (OG 42/18).
In short: we collect only what we need to reply to you and to run the site securely. We never sell data. Analytics and marketing tools load only with your consent, and the site works exactly the same without it.
1. Controller
The controller is AI MAX d.o.o., Zdravka Kučića 39, 51000 Rijeka, Croatia, OIB (tax ID) 32316086825, company reg. no. (MBS) 040500532. Contact for any data-protection question: info@aimax.hr (subject “Data protection”) or in writing to our registered address.
We have not appointed a Data Protection Officer because it is not required for our activity and scale of processing (GDPR Art. 37). Requests are handled personally by the founders.
2. What we process, why and for how long
| Situation | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Visiting the site | IP address, date and time, requested URL, HTTP status, browser and device (user agent), referring page | security, abuse prevention, troubleshooting | legitimate interest, Art. 6(1)(f) | 14 days, then deleted automatically |
| Contact form | name, company, e-mail, phone (optional), area of interest, message, site language | replying to your enquiry and preparing an offer | steps prior to a contract at your request, Art. 6(1)(b); for representatives of legal entities, legitimate interest, (f) | up to 24 months after the last contact; if we sign a contract, for the periods set by the contract and law |
| Form spam protection | sender's IP address | rate limiting, detecting automated messages | legitimate interest, (f) | in server memory for at most 1 hour; the IP is also included in the delivered enquiry and kept with it |
| AI assistant (when enabled) | your question and the answer, language, page, a random conversation ID, technical data about the answer; IP address only in memory for rate limiting | answering, quality control and abuse prevention | legitimate interest, (f) | 30 days; the IP is not logged and e-mail addresses and phone numbers are masked automatically before logging |
| E-mail and business correspondence | data you send us | communication and performance of contracts | (b) and (f) | up to 24 months after the last contact, longer where a contract or law requires |
| Analytics (consent only) | pseudonymous browser ID, pages viewed, traffic source, approximate location (country/city), device type | measuring traffic and improving the site | consent, Art. 6(1)(a) and Art. 43(4) of the Croatian Electronic Communications Act | 14 months (Google Analytics setting) |
| Marketing (consent only) | pseudonymous ID, pages visited, ad-click data | measuring ad performance on Meta platforms (Facebook, Instagram) | consent, (a) and Art. 43(4) ECA | up to 90 days in the cookie; Meta retains data under its own policy |
Accounting records (e.g. invoices) are kept for as long as the Croatian Accounting Act requires. When a period ends, data is deleted or irreversibly anonymised.
3. Who else sees the data
- RiNET (Damir Radulić, Amsterdam, the Netherlands, KVK 42067247) — our technology partner, which operates the site, servers, e-mail and AI assistant. It processes data only on our instructions as a processor (GDPR Art. 28).
- A data-centre provider in Germany; backups are stored in Finland. Both are inside the EU.
- Google Ireland Limited (Dublin, Ireland) — some form enquiries are delivered to a board member's Google mailbox; with your consent also Google Analytics / Google Tag Manager.
- Meta Platforms Ireland Limited (Dublin, Ireland) — only with your marketing consent (Meta Pixel). AI MAX and Meta are joint controllers for collecting and transmitting data via the Pixel (GDPR Art. 26); Meta carries out further processing as an independent controller — see Meta's Privacy Policy.
- Public authorities, only where required by law.
We do not sell or rent data and do not profile you beyond what you have consented to.
4. Transfers outside the EU
The site, e-mail and AI assistant run on servers in the EU, and the AI assistant does not send your questions to external AI providers.
Google and Meta may also process data in the USA. Such transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework (10 July 2023), under which both companies are certified, and on standard contractual clauses. For Google and Meta this concerns only form enquiries delivered to Google mail and the tools you have consented to.
5. Automated decision-making
We make no decisions based solely on automated processing that produce legal or similarly significant effects for you (GDPR Art. 22). The AI assistant only informs you about the site's content — people decide on enquiries and offers.
6. Your rights
- right of access and to a copy (Art. 15)
- right to rectification (Art. 16) and erasure (Art. 17)
- right to restriction (Art. 18) and data portability (Art. 20)
- right to object to processing based on legitimate interest (Art. 21)
- right to withdraw consent at any time, as easily as you gave it — via the Cookie settings link in the footer; withdrawal does not affect the lawfulness of prior processing
Send requests to info@aimax.hr. We reply without undue delay and within one month at the latest; in complex cases this may be extended by two further months, and we will tell you (Art. 12(3)). If we cannot reliably identify you, we may ask for additional confirmation. Exercising your rights is free of charge.
7. Complaints
If you believe we breach data-protection law, you may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr — or with the supervisory authority of the member state where you live or work. We would appreciate the chance to resolve the issue directly first.
8. Do you have to give us data?
No. You can browse the site without giving any data about yourself. Form fields marked as required are needed to reply — without them we cannot process the enquiry. Refusing cookies does not affect any function of the site.
9. Security
All communication with the site is encrypted (HTTPS with HSTS), connections between servers are encrypted, access is limited to authorised people and backups stay within the EU. The site loads no third-party fonts or scripts other than the tools you have consented to. Report vulnerabilities as described in security.txt.
10. Changes
We update this policy when our processing or the law changes. The date of the last change is shown at the top. If a material change requires new consent, we will ask you again through the cookie notice.