Privacy policy

The controller is AI MAX d.o.o., Zdravka Kučića 39, 51000 Rijeka, Croatia, OIB (tax ID) 32316086825, company reg. no. (MBS) 040500532. Contact for any data-protection question: info@aimax.hr (subject “Data protection”) or in writing to our registered address.

We have not appointed a Data Protection Officer because it is not required for our activity and scale of processing (GDPR Art. 37). Requests are handled personally by the founders.

Accounting records (e.g. invoices) are kept for as long as the Croatian Accounting Act requires. When a period ends, data is deleted or irreversibly anonymised.

This site has an AI assistant that automatically answers questions about our services, solely from this site's public content. It is clearly labelled as AI before your first question and throughout the conversation (Regulation (EU) 2024/1689, Art. 50(1)). Answers may contain mistakes — please check important information with us. Do not enter personal data in the chat.

• Controller: AI MAX d.o.o. (section 1).
• Purpose: answering your enquiry about our services; quality control of answers and security of the service.
• Legal basis: steps taken at your request prior to entering into a contract (GDPR Art. 6(1)(b)) and our legitimate interest in the security and quality of the service (Art. 6(1)(f)).
• Data: the text of your question and the answer, language, the page you asked on and a random session ID (created by your browser and held in the tab's temporary storage — it is not a cookie and disappears when you close the tab). Your IP address is not written to the conversation log — it is used only in memory for rate limiting. E-mail addresses and phone numbers are masked automatically before logging.
• Retention: 30 days, then automatic deletion. Exception: a question the assistant could not answer (with e-mail addresses and phone numbers already masked) may be kept as a test case for quality control, without data that would allow us to identify you, until we review it.
• Processor: RiNET (Damir Radulić, Amsterdam, the Netherlands, KVK 42067247) operates the assistant solely on our instructions under a data processing agreement (GDPR Art. 28).
• Where it runs: the language model runs on servers of our data-centre provider in the EU (Germany; backups in Finland). Questions are not sent to external AI providers, there are no transfers to third countries, and conversations are not used to train general-purpose AI models.
• Cookies and analytics: the assistant sets no cookies and sends no analytics events.
• Your rights: access, erasure, objection and the other rights in section 8. As we do not identify you, please state the approximate time of the conversation and the question in your request. You may lodge a complaint with AZOP (section 9).

Replies to enquiries sent through the form are prepared by the AI MAX AI assistant and sent from a board member's address; every such reply says so. When a reply is not entirely certain (e.g. an unclear enquiry or a topic outside our offer), it is not sent automatically — a person reviews it first.

• Company check: if you write on behalf of a company or from a business e-mail address, we check publicly available data about that company — its public website, the Croatian court register, the beneficial ownership register, published financial statements (RGFI), the register of bankruptcy and pre-bankruptcy proceedings, the courts' e-notice board and the Tax Administration's list of tax debtors. The purpose is preparing a suitable offer and assessing the risk of a business relationship (legitimate interest, GDPR Art. 6(1)(f)). Only our sales team sees the result; we do not send it to you or to third parties and do not use it for automated decisions about you. We run no register checks for people writing to us privately, without a company.
• Draft reply: the text of your enquiry (name, company name as you entered it, message) and the public content of your website are sent to the language-model provider Anthropic PBC (USA) to prepare a draft reply. Register data and our internal assessment are not sent there. The transfer relies on standard contractual clauses (GDPR Art. 46) in the data processing agreement with the provider; under its contractual terms the content is not used to train models.
• Personal conversation: our reply may include a personal link to a conversation with the AI assistant (valid for 30 days). The assistant only knows what you wrote to us, our reply and the AI MAX public offer; it runs on servers in the EU and does not send your questions to external AI providers. Answers you give in the conversation (e.g. which systems you use, approximate volume, a time for a call) are stored with your enquiry in structured form to prepare an offer.
• Where and for how long: the enquiry, our reply and the collected data are kept in our customer relationship management system (CRM), operated by RiNET as processor. The conversation transcript is kept for 180 days and the enquiry data for up to 24 months after our last communication.
• Legal basis: steps prior to entering into a contract at your request (GDPR Art. 6(1)(b)); for representatives of legal persons and for the company check, legitimate interest (point (f)). You may object to the check and further processing (section 8).

• RiNET (Damir Radulić, Amsterdam, the Netherlands, KVK 42067247) — our technology partner, which operates the site, servers, e-mail and AI assistant. It processes data only on our instructions as a processor (GDPR Art. 28).
• A data-centre provider in Germany; backups are stored in Finland. Both are inside the EU.
• Anthropic PBC (San Francisco, USA) — the language-model provider used to prepare draft replies to form enquiries; it receives only the enquiry text and the public content of your website (section 4).
• Google Ireland Limited (Dublin, Ireland) — some form enquiries are delivered to a board member's Google mailbox; with your consent also Google Analytics / Google Tag Manager.
• Meta Platforms Ireland Limited (Dublin, Ireland) — only with your marketing consent (Meta Pixel). AI MAX and Meta are joint controllers for collecting and transmitting data via the Pixel (GDPR Art. 26); Meta carries out further processing as an independent controller — see Meta's Privacy Policy.
• LinkedIn Ireland Unlimited Company (Dublin, Ireland) — only with your marketing consent (LinkedIn Insight Tag): measuring ad performance and aggregate visitor statistics (e.g. industry and job function), with no access to individual profiles. To the extent we jointly determine the purposes and means of collecting and transmitting data via the tag, AI MAX and LinkedIn are joint controllers (GDPR Art. 26); LinkedIn carries out further processing as an independent controller — see LinkedIn's Privacy Policy.
• Public authorities, only where required by law.

We do not sell or rent data and do not profile you beyond what you have consented to.

The site, e-mail and AI assistant run on servers in the EU, and the AI assistant — on the site and in the personal conversation — does not send your questions to external AI providers. The exception is preparing a draft reply to a form enquiry (section 4): the enquiry text and the public content of your website are sent to Anthropic PBC (USA) under standard contractual clauses.

Google and Meta may also process data in the USA. Such transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework (10 July 2023), under which both companies are certified, and on standard contractual clauses. For Google and Meta this concerns only form enquiries delivered to Google mail and the tools you have consented to.

We make no decisions based solely on automated processing that produce legal or similarly significant effects for you (GDPR Art. 22). The AI assistant only informs you about the site's content — people decide on enquiries and offers.

The only automated decision is whether a reply to your enquiry is sent immediately or first reviewed by a person; this has no legal or similar effect for you.

• right of access and to a copy (Art. 15)
• right to rectification (Art. 16) and erasure (Art. 17)
• right to restriction (Art. 18) and data portability (Art. 20)
• right to object to processing based on legitimate interest (Art. 21)
• right to withdraw consent at any time, as easily as you gave it — via the Cookie settings link in the footer; withdrawal does not affect the lawfulness of prior processing

Send requests to info@aimax.hr. We reply without undue delay and within one month at the latest; in complex cases this may be extended by two further months, and we will tell you (Art. 12(3)). If we cannot reliably identify you, we may ask for additional confirmation. Exercising your rights is free of charge.

If you believe we breach data-protection law, you may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr — or with the supervisory authority of the member state where you live or work. We would appreciate the chance to resolve the issue directly first.

No. You can browse the site without giving any data about yourself. Form fields marked as required are needed to reply — without them we cannot process the enquiry. Refusing cookies does not affect any function of the site.

All communication with the site is encrypted (HTTPS with HSTS), connections between servers are encrypted, access is limited to authorised people and backups stay within the EU. The site loads no third-party fonts or scripts other than the tools you have consented to. Report vulnerabilities as described in security.txt.

We update this policy when our processing or the law changes. The date of the last change is shown at the top. If a material change requires new consent, we will ask you again through the cookie notice.