Privacy policy

This Privacy Policy explains how INSPIRACIJA DIGITAL d.o.o. (“we”, “us”, “our”) collects and processes personal data when you visit our website, contact us, use our services, or apply for a job.

1) Data Controller

INSPIRACIJA DIGITAL d.o.o.
Address: Srebrnjak 90A, 10000 Zagreb, Croatia
OIB: HR89556824634
Website: www.inspiration-agency.com
Email: info@inspiration-agency.com

2) Applicable law

We process personal data in accordance with:

• GDPR (Regulation (EU) 2016/679)
• Croatian Law on the Implementation of the GDPR (Zakon o provedbi Opće uredbe o zaštiti podataka)

3) Personal data we may collect

Depending on how you interact with us, we may process:

• Contact & identification data: name, email, phone, company name, job title.
• Communication data: messages sent via contact forms, email, calls, or meetings.
• Client/service data: project details, campaign assets provided by clients, reporting and performance data connected to the services.
• Billing & accounting data: invoicing details, payment status, transaction documentation.
• Website usage data: IP address, device and browser information, pages viewed, timestamps, approximate location, referral source.
• Recruitment data (if you apply): CV, portfolio, employment/education history, and information you submit.
• We do not intentionally request special categories of data (e.g., health, political opinions). Please avoid sharing such data unless necessary.

4) How we collect data

• Directly from you (forms, email, phone, meetings, contracts).
• Automatically via cookies and similar technologies when you use our website.
• From publicly available sources (e.g., company websites, professional networks) when relevant to a business relationship and permitted by law.

5) Purposes and legal bases for processing

We process personal data only where we have a lawful basis under the GDPR.

A. Website operation, security, and fraud prevention

• Purpose: ensure site functionality, maintain security, prevent abuse, troubleshoot.
• Legal basis: legitimate interests.

B. Responding to inquiries and pre-contract steps

• Purpose: reply to requests, schedule meetings, prepare offers.
• Legal basis: steps prior to entering into a contract / legitimate interests.

C. Providing contracted services

• Purpose: deliver digital marketing services (strategy, campaign setup, optimization, analytics, reporting, account management).
• Legal basis: performance of a contract / legitimate interests.

D. Billing, accounting, and legal compliance

• Purpose: invoicing, bookkeeping, tax compliance, and defending legal claims.
• Legal basis: legal obligation / legitimate interests.

E. Our marketing communications

• Purpose: send updates or newsletters about our services.
• Legal basis: consent (where required) or legitimate interests (where permitted).
• Opt-out: you can unsubscribe anytime or contact us.

F. Recruitment

• Purpose: evaluate candidates and manage hiring.
• Legal basis: steps prior to entering into a contract for the selected application; separate optional consent applies only to keeping the application and contacting you about future job opportunities.

6) Cookies and similar technologies

We use our own first-party Consent Manager to display the consent banner, remember technical preferences and let you change or withdraw optional permissions through Cookie settings in the footer.

Necessary is always enabled for essential operation, security, form processing and remembering consent choices where applicable. Analytics, Marketing and External Media / Google Maps are separate optional permissions and are OFF by default. Optional analytics and advertising technologies require both the relevant permission and approved configuration.

We use Cloudflare Turnstile for form security and abuse prevention. During the form security/token flow, it may process technical request, device and network information according to the service's operation. This Website does not use Turnstile as advertising or analytics consent. See Cloudflare's Turnstile Privacy Addendum at https://www.cloudflare.com/turnstile-privacy-policy/ for information about the service.

Analytics and advertising delivery are currently dormant: no Google Tag Manager container, GA4 delivery, Google Ads conversion delivery, Meta Pixel or Meta CAPI is active on this Website.

The Contact Google Maps iframe is blocked until External Media permission is given. Address and contact information remain available without it. Once permitted, Google may process information under its own service and privacy terms.

You can Accept all, Reject non-essential or Manage preferences, and later reopen Cookie settings to change or withdraw optional permissions. Necessary remains enabled. Withdrawal stops future optional delivery for that purpose; it does not delete information already sent to an external third party.

Our first-party local storage record contains only the consent version, Necessary state, Analytics, Marketing and External Media preferences, update and expiry timing, and an opaque receipt reference when recording succeeds, for a maximum of 180 days. It contains no name, email, phone, account identifier, marketing profile or fingerprint. See our Cookie Policy for details.

We also record your explicit consent choices as server-side evidence linked to an immutable configuration and Privacy/Cookie Policy snapshot. The receipt contains an opaque request identifier, receipt identifier, server timestamp, versions, action and category choices. It does not contain your name, email, phone, IP address, User-Agent, fingerprint, form or application identifiers, CV data, raw URLs, query strings or referrers. Browser preference expiry does not delete this separate evidence; its retention period requires a separate decision.

7) Who we share data with (processors and recipients)

We may share personal data with trusted providers (data processors) only as necessary, such as:

• Website hosting and IT support providers
• Email/collaboration tools
• CRM and customer support tools
• Analytics providers
• Advertising platforms (only where applicable to your project and settings)
• Accounting, legal, and audit advisors
• We require processors to protect personal data and process it only under our instructions.

8) International transfers

Some service providers may process data outside the EEA. Where this happens, we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses (SCCs), plus additional measures where required.

9) Data retention (default periods)

We keep personal data only as long as needed for the purposes described:

• General inquiries (non-client): up to 12 months after last contact.
• Prospective clients / offers: up to 24 months after last contact (unless you become a client).
• Client project data: for the duration of the contract and up to 5 years after contract end (for continuity and claims management, unless longer required).
• Invoices, accounting and tax documentation: typically 11 years, in line with Croatian retention rules for business/accounting documentation.
• Recruitment applications for the selected role: up to 6 months after the relevant recruitment process ends. If no explicit recruitment end is recorded, the current application deadline is the operational fallback; an explicitly approved later recruitment end takes precedence. Optional talent-pool retention: up to 12 months from explicit consent, where granted. These are project policy maxima, not universal statutory GDPR periods. Withdrawing talent-pool consent stops future-opportunity processing immediately; any remaining current-recruitment retention still applies. The same application is deleted when its last valid purpose expires.
• Website logs (security/technical): typically up to 12 months (unless needed longer for security incidents).
• Consent preferences: saved in first-party local storage for a maximum of 180 days. Storage used by optional external services has its own duration; see our Cookie Policy.

10) Your rights

Subject to conditions and exceptions, you have the right to:

• access, rectification, erasure, restriction, data portability, objection
• withdraw consent at any time (where consent is the basis)

To exercise rights, contact: info@inspiration-agency.com

11) Complaints (supervisory authority)

You can lodge a complaint with the Croatian supervisory authority:
Agencija za zaštitu osobnih podataka (AZOP), Selska cesta 136, 10 000 Zagreb.

12) Security

We apply appropriate technical and organizational measures to protect personal data (access controls, least-privilege access, backups, and security monitoring as appropriate). No system is completely secure, but we work to reduce risk.

13) Children

Our website and services are not intended for children under 16, and we do not knowingly collect children’s personal data.

14) Changes to this policy

We may update this Privacy Policy from time to time. The newest version will always be posted on our website with an updated “Last updated” date.