Privacy
Privacy
Notice on personal-data processing under the GDPR.
This notice describes what personal data the controller of this website processes, for what purpose, on what legal basis and for how long. It matches the actual technical state of the site: the site has no analytics, no advertising and no tracking cookies.
1. Controller
- Controller
- Association of Anti-Fascist Fighters and Anti-Fascists of the Šibenik-Knin County (ZUABA Šibensko-kninske županije), founder of the Victory Museum and Liberation of Dalmatia
- Registered seat
- Fra Nikole Ružića 1, 22000 Šibenik, Croatia
- OIB (personal ID no.)
- 69299062409
- Contact for requests
- [email protected] or in writing to the registered address
2. What we process, why and for how long
| Personal data | Purpose and legal basis | Retention period |
|---|---|---|
| Form data: name, email, phone (optional), subject and message | Answering your enquiry and arranging a visit. Legal basis: Article 6(1)(b) GDPR (steps at the data subject's request before providing the visit service) or point (f) — legitimate interest in replying to a message received. | The message is not stored in any database or file of the site: it is forwarded to the museum mailbox and kept there only as long as needed for the reply and the correspondence history. |
| The email address you enter | Necessary to send a reply (Article 6(1)(b)). Used as Reply-To, never as the delivery recipient. | As with the message. |
| Request data in the server access log: IP address, date and time, requested path, HTTP status, HTTP method, referrer and browser string (User-Agent) | Keeping the site secure and stable, detecting abuse and troubleshooting (Article 6(1)(f) — legitimate interest). | Logs are rotated daily and archived compressed; the final retention period is set by the server operator (we recommend a maximum of 30 days). |
| Form abuse-protection data: a one-way hash of the IP address, the time and the outcome of the request | Preventing automated bulk messaging (Article 6(1)(f)). | A maximum of 30 days. The original IP address, the email address and the message text are never stored. |
| Browser language header (Accept-Language) | Automatically directing first-time visitors on the root address to the Croatian, English, German or Italian version. | Processed once, not logged and not stored. |
3. What we do not do
- we use no visitor analytics, no advertising, no embedded video and no third-party social-media widgets
- we set no first-party cookies and store nothing in your browser (localStorage, sessionStorage, IndexedDB)
- we do not sell or share personal data for marketing
- we take no automated decisions with legal effect and do not profile
- we require no consent to send an ordinary enquiry; the link to this notice is not consent
4. Who receives the data
Traffic for this domain passes through Cloudflare, which provides DNS, attack protection and content delivery, and therefore processes request metadata (IP address, browser data, timestamps) on the controller's behalf. Transfers to third countries rely on Standard Contractual Clauses and/or the EU-US Data Privacy Framework certification. We recommend that the controller confirm it holds a signed Data Processing Agreement with Cloudflare and with the server operator.
The mailbox and the site files are located on a server managed by an operator engaged by the association. Apart from that, data is disclosed only to legally authorised bodies or at your request.
5. Your rights
- access to personal data and a copy of it (Article 15)
- rectification of inaccurate data (Article 16) and erasure (Article 17)
- restriction of processing (Article 18), objection to processing (Article 21) and data portability (Article 20)
- the right not to be subject to automated individual decision-making (Article 22)
- the right to withdraw consent, if given (Article 7(3)) — processing here is not based on consent
- the right to lodge a complaint with the supervisory authority: Agencija za zaštitu osobnih podataka (AZOP), Zagreb, azop.hr
Submit a request by email to [email protected] or in writing to the registered address. We reply without undue delay and at the latest within one month.
6. Security
- traffic is encrypted with HTTPS (TLS) and HSTS is set with a short max-age
- the server-side form checks the request origin, limits the rate and rejects header-injection markers (CRLF)
- server components hold only the necessary privileges, and access logs do not contain message text
- no database, user accounts or admin interfaces are used on this site
7. Not yet confirmed
Last updated: