Personal data protection

Applies to ferokomerc.hr. Updated: 24 October 2026.

Controller and contact

Ferokomerc d.o.o., Trinajstići 97, 51215 Kastav, Hrvatska, is the controller. Contact info@ferokomerc.hr, telephone 098 243 360, for privacy questions and requests. We request additional identification only where necessary to verify a request.

Data and purposes

We use your name, email, optional telephone and message to answer enquiries and prepare offers, based on pre-contractual steps or our legitimate interest in business correspondence. Purchases require contact and delivery information, products and payment method; company purchases also require company name and tax ID. We process these for the contract and legal obligations. We do not collect payment card numbers: current payment methods are bank transfer and cash on delivery.

Accounts contain email, a password hash, optional profile and delivery details, linked orders and authentication records. Security controls and technical logs protect the service based on legitimate interests.

Google Analytics 4 loads only after your consent on public pages. Our integration excludes form contents, email, tax IDs and cart contents and does not run on account or checkout pages. Advertising features are disabled. Google may receive IP and device information. YouTube videos require separate permission and a playback request; Google may receive IP and device information. Rejecting optional services does not prevent shopping.

Recipients and international transfers

Verpex (verpex.com) provides hosting. Engaged email, delivery and accounting providers and public authorities receive data only as required for their role. We do not sell personal data. Google provides Analytics and YouTube: see Google's privacy policy. Transfers outside the EEA must have applicable GDPR safeguards. Contact us for the contracted hosting location, processors, subprocessors and transfer safeguards; the controller maintains these according to its actual service agreements.

Retention

New enquiries submitted through this version of the website are automatically removed 12 months after submission. Earlier business correspondence requires the controller's separate review according to its purpose and retention obligations. Documentation subsequently needed for an order or legal matter is retained in the relevant records. Account data is kept until deletion is requested or no longer needed. Account deletion does not remove order and accounting records subject to legal retention and legal claims. Applicable accounting retention is determined by the controller under relevant law.

The necessary session lasts up to eight hours, language preference up to a year and customer sign-in expires after 60 days of inactivity. A checkout draft stays in the browser tab for up to an hour, is removed when the tab closes and is cleared after ordering. You can empty the cart. Optional-service choices and Analytics cookies last up to six months. Minimal consent receipts are retained up to two years after a choice, and completed rights requests up to two years after closure to document handling. GA4's own event data retention is a separate account setting; ask us for its configured duration.

Rights and choices

You may request access, a copy, correction, erasure, restriction, portability where applicable, or object to processing. Withdraw optional-service consent through Privacy preferences in the footer. Withdrawal does not affect prior lawful processing. Signed-in customers can export their data and submit account erasure requests; for guest orders or other requests, email us.

We respond within one month, explaining any lawful extension. Legal retention can limit erasure. You may complain to the Croatian Personal Data Protection Agency (AZOP). We do not use automated decision-making with legal or similarly significant effects.

Read the cookie notice for storage details. Passwords are hashed, admin access is restricted and production uses HTTPS. Personal data is excluded from public search and sitemaps.