Back to home

Privacy policy

Last updated: 9 October 2026.

This policy explains what personal data we process when you visit zauzeto.eu, get in touch or we contact you, why, where it goes and how long we keep it. In short: we don't sell your data and we don't give it to anyone except the service providers without whom the website and email wouldn't work. We switch on Google Ads ad measurement only with your consent.

Controller

2GREAT d.o.o., Ilica 138, 10000 Zagreb, Croatia, OIB 18520556531 (legal notice). For any question about personal data, write to info@zauzeto.eu or by post to the address above. We are not required to appoint a data protection officer, so please contact us directly.

What we process, why and on what basis

When you send us an enquiry

Data
Your name, email or phone number, a link to your listing or website, your message, your confirmation that you are at least 18, and the time you sent it. The same applies when you email, call or message us on WhatsApp.
Purpose
Replying to your enquiry and preparing a quote.
Basis
Steps taken at your request before entering into a contract, and your consent (Article 6(1)(b) and (a) of the General Data Protection Regulation, the GDPR).
Kept for
Up to 12 months after our last contact, unless the enquiry turns into a contract.

When we contact you

Data
The name of your property, its location, the business phone number and the link from your public listing on Google Maps, the date of our call and your answer (for example that we may send you an example, or that you don't want us to call).
Source
Your public property listing on Google Maps. Before calling we check the number in the Croatian regulator HAKOM's "Ne zovi" (do not call) register, and we don't call numbers listed there.
Purpose
One call in which we briefly introduce our service and ask whether we may send you an example. We only send a message (WhatsApp or email) if you agree to it during the call.
Legal basis
Our legitimate interest in offering our service to hosts (point (f)), and your consent for the message (point (a)). You can object at any time: tell us during the call, reply "no", or write to info@zauzeto.eu, and we won't contact you again.
Retention
Up to 12 months after the call. If you don't want us to call, we keep only the phone number, so that we don't call you again.

When you sign a contract with us

Data
Your name or company name, address, tax number (OIB), contact details, order and payment details, project correspondence and the materials you send us (texts, photos). If you give us access to a listing for a makeover, that access too.
Purpose
Performing the contract, invoicing, bookkeeping, and handling complaints and disputes.
Basis
The contract (point (b)) and legal obligations (point (c)): accounting, VAT and fiscalisation rules.
Kept for
Invoices and accounting records for 11 years, as the Croatian Accounting Act requires. The contract and correspondence until claims become time-barred, usually 5 years after the work ends. We stop using access to your listing as soon as the work is done, and recommend that you then remove it or change your password.

When you cancel a subscription or withdraw from a contract

Data
What you enter in the cancellation form (name, email, the site or order it concerns, a note) and the time you sent it.
Purpose
Carrying out the cancellation or withdrawal and sending you an acknowledgement.
Basis
Legal obligation and contract (points (c) and (b)).
Kept for
5 years, as proof that the cancellation or withdrawal was received and carried out.

When you visit the website

Data
On every visit the server automatically logs technical data: IP address, time, the page you opened, the page you came from, and your browser and device type.
Purpose
Running the website and keeping it secure (for example spotting attacks), and aggregate visitor statistics in the hosting provider's dashboard, which don't show who you are.
Basis
Legitimate interest (point (f)): the website has to run securely, and we need to know how many people visit it.
Kept for
The hosting provider keeps these logs and deletes them itself after a short period, usually a few weeks. To protect the forms from abuse (at most five enquiries per 15 minutes and ten a day from one address) we turn the IP address into an irreversible hash and delete it within 24 hours.

Visitor statistics (Google Analytics), only with your consent

On your first visit we ask whether we may switch on statistics and ad measurement. One answer covers both. If you decline, nothing is sent to Google.

Provider
Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.
Data
Which pages you opened and for how long, the page or ad you came from, your device and browser type, language and approximate location (country and city). Google Analytics uses your IP address only for the approximate location and doesn't store it. We don't send it your name, email or the content of an enquiry. Google signals and ad personalisation are switched off.
Purpose
To see, in total, how many people visit the site and which parts of it help them.
Basis
Your consent (Art. 6(1)(a) GDPR; for the cookies, also Art. 100 of the Croatian Electronic Communications Act). You can withdraw it at any time through the “Cookie settings” link.
Retention
Visit data is kept in Google Analytics for 14 months and then deleted.
Cookies
_ga and _ga_… for up to 2 years. More under Cookies and browser storage.
Transfer
Google may also process the data in the USA, under the EU-US Data Privacy Framework (see below).

Ad measurement (Google Ads), only with your consent

We advertise on Google. On your first visit we ask whether we may switch on ad measurement. If you decline, nothing is sent to Google.

Provider
Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.
Data
If you accept, Google's tag learns that you sent an enquiry, together with the identifier of the ad you clicked, the time, and your IP address, browser and device type. We don't send it your name, email or the content of your enquiry. We don't allow ad personalisation based on this data.
Purpose
To measure whether an ad led to an enquiry, so we know whether advertising is worth it.
Basis
Your consent (Art. 6(1)(a) GDPR; for the cookies, also Art. 100 of the Croatian Electronic Communications Act). You can withdraw it at any time through the “Cookie settings” link.
Cookies
_gcl_au and _gcl_aw for up to 90 days; Google's own cookies on google.com and doubleclick.net for up to 13 months. More under Cookies and browser storage.
Transfer
Google may also process the data in the USA, under the EU-US Data Privacy Framework (see below).

Where your data goes

We don't sell it. Only these service providers receive it, and only as far as their service needs:

Transfers outside the EU. Google (including statistics and ad measurement) and Cloudflare may also process data in the USA. Both are certified under the EU-US Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023, and the European Commission's standard contractual clauses also apply.

Cookies and browser storage

The website itself sets no cookies. Until you answer the question about statistics and ad measurement, and if you decline it, the website doesn't contact Google and sets no cookies at all. It then saves just one entry in your browser (local storage, named zauzeto-privola): your choice, so we don't ask on every visit. That entry is needed for the settings to work, so it needs no consent. We keep it for 6 months and then ask again.

If you accept statistics and ad measurement, these cookies are set:

You can change or withdraw your choice at any time through Cookie settings, which is also in the footer of every page. If you withdraw consent, Google is no longer loaded on later pages and we remove the cookies on zauzeto.eu. You can delete Google's cookies on google.com and doubleclick.net in your browser settings.

Apart from Google, and only with your consent, the website loads nothing from other servers: fonts, images and videos come from ours. Links to other websites, such as WhatsApp or apartmansali.com, lead to sites with their own policies, which only open when you click them.

Security

The website runs only over an encrypted connection (HTTPS). The forms don't store messages on the server: an enquiry is emailed straight away and isn't kept in any database. Only the people working on your enquiry or project can access the mailbox and accounts. If a personal data breach that could put you at risk happens anyway, we will notify the Croatian data protection authority within 72 hours, and you without delay, as the GDPR requires.

Minors

Our services are for adults. A form can only be sent with a confirmation that the sender is at least 18. If we learn that someone under 18 has sent us their data, we delete it.

Websites we build for clients

On the websites we build and maintain for clients (for example guest enquiry forms), we are the processor and the site's owner is the controller. That processing is governed by the data processing agreement in our terms of business. Please send questions about such data to the owner of that website.

Your rights

You can ask for access to your data, for it to be corrected or erased, for processing to be restricted and for your data to be ported, and you can object to processing based on legitimate interest. You can withdraw consent at any time, without affecting the lawfulness of processing before that. For any of these, including deleting everything we hold about you, a short message to info@zauzeto.eu is enough, for example with the subject “Delete my data”. We reply within one month at the latest and delete everything except what the law makes us keep (invoices, for example), which we delete as soon as that period ends. We make no automated decisions and do no profiling.

If you believe your rights have been infringed, you can complain to the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb (azop.hr).

Changes to this policy

If we change how we process data, we will update this policy and the date at the top. We will email clients we have a contract with about any significant change.