Last updated: 15 October 2026
1. Data controller
The controller of personal data collected through the orehovec.hr website is Poljoprivredno gospodarstvo Orehovec, Franje Sovića 45, 42231 Veliki Bukovec, Croatia, OIB (tax number) 02057987048 (“we”, “us”). More details about us are on the Legal information page.
For any question about data protection or to exercise your rights, contact us at orehovec@orehovec.hr, by phone on +385 42 840 860 or by post at the address above.
2. What data we process, why and on what legal basis
2.1. Visiting the website (server logs)
Each time a page is opened, our web hosting provider’s server automatically records technical data sent by your browser: IP address, date and time of access, the requested address, status code, amount of data transferred, the referring page, and browser and operating system type.
- Purpose: delivering the website, security (detecting and preventing attacks and misuse) and troubleshooting.
- Legal basis: our legitimate interest in running the website securely and correctly (Article 6(1)(f) of the General Data Protection Regulation, GDPR).
- We do not use this data for advertising or visitor profiling and do not combine it with other data.
2.1.a. Visitor statistics (Matomo)
For visitor statistics we use Matomo, analytics software installed on our own server in Croatia; no data is sent to third parties. Matomo is configured not to set cookies or store data in your browser, to shorten your IP address (last two bytes) before storing it, and to respect your browser’s “Do Not Track” setting.
- Data: pages visited and time of visit, referring page, approximate country and region, device, browser and operating system type, language and screen resolution, external links clicked, and the fact that a form was sent (not its content).
- Purpose: understanding which content visitors use and improving the website.
- Legal basis: our legitimate interest in measuring and improving the website (Article 6(1)(f) GDPR).
- Retention: individual visit records are deleted automatically after 6 months; aggregated statistics without personal data are kept longer.
- If you do not want your visits recorded, turn on “Do Not Track” in your browser or contact us to object (section 8).
2.2. Contact form
- Data: full name, email and message (required); phone (optional).
- Purpose: handling your enquiry and communicating with you.
- Legal basis: where your enquiry concerns a possible purchase or other contract with us, steps taken at your request before entering into a contract (Article 6(1)(b) GDPR); otherwise our legitimate interest in answering the enquiries we receive (Article 6(1)(f) GDPR).
2.3. Business enquiry (Private label & export)
- Data: full name, company, email and delivery country (required); phone, type of buyer, products of interest, approximate volume and message (optional).
- Purpose: preparing an offer and business communication.
- Legal basis: our legitimate interest in communicating with representatives of existing and prospective business partners (Article 6(1)(f) GDPR); where you enquire in your own name as a prospective contracting party, steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).
2.4. Contract farming enquiry
- Data: full name, email and message (required); phone, and farm location and capacity (optional).
- Purpose: assessing a possible partnership, arranging a visit and preparing a contract farming agreement.
- Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR); where you contact us on behalf of a legal entity, our legitimate interest in communicating with prospective partners (Article 6(1)(f) GDPR).
2.5. Job applications
- Data: full name, email, position and message (required); phone and CV (optional), and any details you choose to include in your application and CV. Please do not include information that is not needed to assess your application, such as health data, religion, tax or ID card numbers.
- Purpose: running the recruitment process.
- Legal basis: steps taken at your request before entering into an employment contract (Article 6(1)(b) GDPR).
- Additional, optional consent: if you separately tick the box in the form, we keep your application and CV for 12 months so that we can contact you about future openings (Article 6(1)(a) GDPR). Without this consent we consider your application only for positions open at the time you apply.
2.6. Direct email and phone
If you email or call us directly, we process the data from that communication for the same purpose and on the same legal basis as data from the corresponding form.
3. Required and optional data
Providing data through the forms is voluntary and is not a statutory or contractual requirement. Required fields are needed for us to handle your enquiry or application and reply to you: without them the form cannot be sent, but you can still contact us by email or phone. Fields marked as optional are up to you; if you leave them empty, we handle your enquiry on the basis of the other data.
4. How long we keep data
- Enquiries (contact, business, contract farming): for as long as needed to handle the enquiry and the communication that follows. If no business relationship results, we delete the data once it is no longer needed for that purpose. If a business relationship results, we keep the data for its duration and afterwards for as long as the law requires (e.g. accounting and tax rules).
- Job applications: until the recruitment process for the position you applied for is completed; for open applications, until we have finished considering them for the positions open at the time. If you have given separate consent, we keep your application for 12 months or until you withdraw consent, whichever is sooner. If you join us, the data becomes part of your employee records and is kept as employment law requires.
- Visitor statistics (Matomo): individual records for 6 months, then aggregated data without personal data only.
- Server logs: kept within the web hosting provider’s system and deleted automatically after the period set in the hosting configuration; we do not export them or keep them elsewhere.
- Exceptionally, we may keep data longer where needed to establish, exercise or defend legal claims, and only for as long as that need lasts.
5. Who receives the data
- Our web hosting and email provider for the orehovec.hr domain, as our processor: it stores the website and server logs and transmits and stores messages sent through the forms. Its servers are located in Croatia.
- Microsoft (Microsoft 365), as our processor, if you write to an address on the pgorehovec.hr domain (e.g. for export enquiries).
- Within our company, only staff who need the data to handle your enquiry or application (e.g. sales, contract farming, HR).
- Public authorities, where we are legally obliged to disclose data.
We do not sell personal data or share it with third parties for their marketing.
6. Transfers outside the EU/EEA
We process form data and server logs in Croatia. If you write to an address on the pgorehovec.hr domain, the message is processed by Microsoft. Any resulting transfer outside the EU/EEA (e.g. to the United States) relies on the European Commission’s adequacy decision (EU–US Data Privacy Framework) or on the Commission’s standard contractual clauses (Articles 45 and 46 GDPR).
7. Cookies and similar technologies
This website does not set cookies and does not store data in your browser’s local storage (localStorage, sessionStorage). We run visitor statistics with our own cookieless Matomo (section 2.1.a). We do not use third-party analytics, advertising or social media trackers (pixels), embedded third-party content (such as maps or videos) or external fonts: the font, photos and scripts are all served from our own server. That is why we do not ask for cookie consent and there is no cookie banner.
The scripts on the site are used for the mobile menu, loading photos, checking forms before they are sent and the visitor statistics described in section 2.1.a.
The links to Instagram, Facebook and Google Maps are plain links: those services receive no data until you click them. Once you do, their own privacy policies apply (Meta, Google).
If we ever introduce technologies that require consent, we will update this policy and ask for your consent beforehand.
8. Your rights
With regard to your personal data, you have the right:
- of access and to obtain a copy (Article 15 GDPR);
- to rectification of inaccurate or incomplete data (Article 16);
- to erasure (Article 17) and to restriction of processing (Article 18), under the conditions set out in the GDPR;
- to data portability for data you provided, where processing is based on consent or contract (Article 20);
- to object to processing based on our legitimate interest (Article 21);
- to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Article 7(3)).
Send your request to orehovec@orehovec.hr or by post to our registered address. We will reply without undue delay and at the latest within one month of receiving it; in complex cases this may be extended by two further months, and we will tell you if so. Where necessary, we may ask for additional information to confirm your identity.
If you believe our processing breaches data protection law, you have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, Croatia, azop@azop.hr, azop.hr, or with the supervisory authority in your EU country of residence or work.
9. Automated decision-making
We do not make decisions based solely on automated processing, including profiling.
10. Security
The website and forms are transmitted over an encrypted connection (HTTPS). Only authorised staff have access to messages sent through the forms.
11. Changes to this policy
We update this policy when our practices or the law change. The date of the latest change is shown at the top of this page.