Privacy Policy

Data Controller: Renata Horvat, trading as CreativeStar

For privacy questions or requests, please use the email address above. The contact form requires a name, email address and message so that we can respond. You can also contact us by email. Please do not include sensitive personal information that is unnecessary for your enquiry.

We may collect the following categories of personal data:

We process personal data for the following purposes:

• Responding to enquiries and communication requests.
• Providing requested information or services (quotes, project consultations).
• Improving website performance and user experience.
• Website security and technical maintenance.
• Statistical analysis (where consent has been given).

Personal data is processed on one or more of the following legal bases:

• Consent (Article 6(1)(a) GDPR) – for optional analytics cookies. Consent can be withdrawn in Cookie Settings.
• Contractual necessity (Article 6(1)(b) GDPR) – to prepare a quote or take other steps you request before entering into a contract, and to provide agreed services.
• Legitimate interests (Article 6(1)(f) GDPR) – to respond to general enquiries and maintain a secure, reliable website. You may object to processing based on these interests.
• Legal obligations (Article 6(1)(c) GDPR) – to keep required tax records and handle consumer complaints. Confirming that you have read this policy is not consent to analytics or marketing.

We retain personal data only for as long as necessary:

• Enquiries via contact form/email: up to 12 months after the last communication, unless a business relationship is established.
• Invoices and tax records: for the retention period required by applicable Croatian tax legislation, including the General Tax Act. The period depends on the document and the statutory starting date; records are kept longer where a specific law requires it.
• Consumer complaints: one year from receipt, as required by Croatian consumer protection law.
• Analytics data: according to the Google Analytics property's configured retention period. Standard GA4 user and event data retention settings are 2 or 14 months; aggregated reports may be retained longer.

We use the following providers to operate the website and handle enquiries. Depending on the service and data involved, a provider may act as a processor or an independent controller:

• Vercel: website hosting, request processing and anonymous performance monitoring through Speed Insights.
• Resend: delivery of contact form messages, including your name, email address and message.
• Google: email handling through Gmail and optional Google Analytics 4 after analytics consent.
• Legal authorities, if required by applicable law.

We do not sell, rent or trade your personal data. If you choose to contact us through WhatsApp, that service processes data under its own privacy terms. External project links take you to websites operated by others.

This website stores your cookie choices in your browser and uses optional cookies to analyse website usage.

• Essential storage: your preferences are saved in your browser’s local storage. This records your choice and its date; it does not require analytics consent and remains until changed or cleared.
• Analytics cookies: Google Analytics 4 is loaded only after you opt in. It uses cookies such as _ga and _ga_* to distinguish visits and analyse usage. GA4 does not log or store individual IP addresses; this does not mean that hosting or other providers never process an IP address.

You can change or withdraw analytics consent at any time by opening Cookie Settings using the settings button or the footer link. Rejecting analytics does not prevent you from using the website or contacting us. You can also clear stored cookies and preferences in your browser.

Our providers may process data outside the European Economic Area, including in the United States. Where required, transfers are governed by applicable safeguards, such as an adequacy decision covering the recipient or European Commission Standard Contractual Clauses and any necessary supplementary measures. Contact us for information about the safeguards relevant to your data.

Under the GDPR, you have the following rights, subject to the conditions and exceptions applicable to each right:

• Right of access — obtain confirmation of whether your data is being processed and receive a copy.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — request deletion of your data where no legal obligation requires retention.
• Right to restriction of processing — request that processing be limited in certain circumstances.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interest (Art. 21 GDPR).
• Right to withdraw consent at any time, without affecting the lawfulness of prior processing.

We apply appropriate technical and organisational measures to protect your data. While we strive for maximum security, no method of transmission over the internet is 100% secure.

We reserve the right to update this policy. Any changes will be published on this page with an updated revision date.