Privacy policy

Three groups, and nothing outside them.

• What you send us yourself, through the quotation form on this site, by email or by telephone. That is your name, company, email and telephone, and the substance of the enquiry: which stone and finish you are after, quantity, thickness, timescale, where it is going, and your message. The form accepts no files; if you give a link to drawings, only the link is kept.
• Server logs, which the server records automatically on every request: shortened IP address, date and time, the address requested, browser and operating system, and the page you came from.
• Data held in cookies and in the browser's local storage, described in the cookie policy.

We do not collect special categories of personal data and we do not process children's data. This site is not directed at anyone under 16.

Cookie policy

What you put into the form reaches us as an email and is stored nowhere else: there is no database, no account and no profile. The message stays in our mailbox for as long as the exchange lasts and at most two years after the last contact, unless the enquiry becomes an order, in which case it is kept as long as the rest of the business record.

The basis is your own request: you send the details so that we can prepare a quotation. The form uses no captcha and no outside service; it is protected from abuse by a hidden field and a limit on how often one address may send, and neither of those checks is stored. If sending the email should fail, the enquiry is written to the server log so that it is not lost, and it is deleted from there with the rest of the logs.

• Answering enquiries, preparing quotations and performing contracts. Legal basis: steps taken at the request of the data subject before entering into a contract, and performance of that contract, article 6(1)(b) GDPR.
• Keeping the site secure and working, detecting misuse and reading load statistics from the server logs. Legal basis: the controller's legitimate interest, article 6(1)(f).
• Legal obligations, above all the retention of invoices and business records. Legal basis: article 6(1)(c).
• Audience measurement and marketing, if and when we switch them on. Legal basis: consent, article 6(1)(a), given in the cookie bar and withdrawable at any time.

• Enquiries that did not lead to work: up to two years from the last message, because in stone a project can come back after a long pause.
• Business records and invoices: eleven years, which is what Croatian tax law requires.
• Server logs: up to twelve months, then deleted.
• Cookie consent: twelve months, after which the bar is shown again.

We do not sell personal data and we do not pass it to third parties for their own purposes. Access is limited to our own staff who need it for their work, and to the following processors, each under contract and only to the extent they need:

• The hosting provider, whose server is in Germany.
• The email provider through which business correspondence runs.
• Our accountants and, where needed, our lawyer, within our legal obligations.
• Google Ireland Limited, for audience measurement, and only if you have explicitly switched it on in the cookie bar. Nothing from the enquiry form ever reaches it.

Everything you send us, the whole enquiry form included, is processed inside the European Economic Area. The single exception is audience measurement, which happens only with your consent: it can involve a transfer to the United States, covered by the EU-US Data Privacy Framework and by the European Commission's standard contractual clauses. If you do not switch measurement on, nothing leaves the European Economic Area.

At any time you have the right to:

• ask for access to your data and a copy of what we hold,
• ask us to correct anything inaccurate and complete anything missing,
• ask for erasure, where there is no longer a basis for the processing,
• ask us to restrict processing while a disputed record is checked,
• ask for the data you gave us in a machine-readable form,
• object to processing based on legitimate interest,
• withdraw consent, without affecting the lawfulness of processing before you withdrew it.

Send your request to the email address in the first section. We answer without delay and within one month at the latest. If you believe your rights have been infringed you can complain to the supervisory authority.

Supervisory authority

Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop@azop.hr

The site is served only over an encrypted connection. Access to the server and to the mailboxes is protected and limited to the people who need it. Data is not moved into any system not named in this policy.

We change this policy when what the site does changes, for instance when audience measurement is switched on. The date of the last change is given at the top. Material changes are announced on the home page.