CRO GOLF CAR
Privacy
Updated 12 October 2026
Controller and contact
The controller for crogolfcar.com is CROGOLFCAR d.o.o., Šetalište 150. brigade Hrvatske vojske 8, 10000 Zagreb, Croatia, OIB 44077673271. Contact info@crogolfcar.com or this postal address for privacy requests; telephone +385 98 7697 63.
Information and purposes
Enquiries contain your first and last name, email, phone, country, vehicle, configuration, quantity and message. Business enquiries also require company, tax number and address; an address is optional for individuals. Required fields support preparing and following up your request; without them the form cannot be submitted. You may also email us. Please do not send sensitive information or unnecessary information about others.
Legal bases
Responding to your request and preparing a quotation are steps at your request before entering a contract (GDPR Article 6(1)(b)). Business representative communications and website protection rely on legitimate interests in business communication and security (f). Complaints and statutory duties rely on legal obligations (c). Optional statistics rely on consent (a). An enquiry is not marketing consent.
Technical data and statistics
Our host receives IP address, time, requested URL and browser information to deliver and secure the website. Application rate limits temporarily use a hash of the IP, not its readable value. With statistics enabled, we save aggregate counts by day, page, action, country and referring domain without visitor identifiers. Statistics respect DNT and Global Privacy Control. There is no advertising profiling or automated decision-making with legal effects.
Recipients and transfers
Authorised CROGOLFCAR staff access enquiries. Cloudflare provides hosting, security, the database and image storage; Spaceship/Spacemail processes business email. Vimeo videos load automatically, independently of CGC statistics choices. The player uses dnt=1; Vimeo receives playback data and may set security cookies. Providers and subprocessors may process data outside the EEA, including the USA. International transfers require applicable GDPR Chapter V safeguards, such as an applicable adequacy decision or standard contractual clauses. Ask us for information on specific recipients and a copy of applicable safeguards. Provider documents are linked below.
Retention
Drafts use this tab’s sessionStorage for up to 24 hours, removed on the next draft access after expiry or when the tab closes. Submitted enquiries and related emails are retained for the response and ongoing negotiations, and afterwards only for a statutory obligation or specific legal claim until its applicable period expires. Criteria are enquiry status, any resulting contract and statutory periods. Written complaint records are kept for at least one year from receipt. Aggregate statistics older than 90 days are removed at the next accepted statistics event. Security counters expire after one hour and are removed at the next rate-limit check; administrator sessions last eight hours. Browser storage periods appear in the cookie policy. Provider backups and logs follow their separate retention cycles.
Your rights
You may request access, correction, erasure, restriction and, where applicable, data portability. You may object to legitimate-interest processing for reasons relating to your particular situation. Withdraw consent in cookie settings without affecting earlier lawful processing. We normally respond within one month and notify you within that period of any permitted extension and reasons. Proportionate identity verification may be required. You may complain to the Croatian supervisory authority AZOP, azop.hr, or the authority where you habitually live, work or consider an infringement occurred.