Privacy policy

1. Data controller

The controller of personal data within the meaning of the GDPR is the sole proprietorship:

For any questions about the processing of your personal data you can contact us by email at info@mayntech.hr.

2. Data we collect

2.1. Data you provide to us

Data you actively submit through forms or in communication with us:

• Contact form: full name, email, company name (optional), the content of your message.
• Newsletter sign-up: email and date of sign-up.
• Job applications (Careers): full name, email, CV and cover message.
• Business communication: the content of emails, phone calls and other documentation exchanged during our collaboration.

2.2. Data we collect automatically

The following technical data is collected automatically during your visit:

• IP address (anonymised where technically possible).
• Browser type and version, operating system, browser language.
• Date and time of the visit, pages visited, referrer URL.
• Device data (mobile / desktop, screen resolution).

Read more about the cookies we use in our Cookie Policy.

3. Purpose and legal basis of processing

• Responding to your inquiry (Art. 6(1)(b) GDPR — pre-contractual relationship / Art. 6(1)(f) — legitimate interest).
• Sending the newsletter (Art. 6(1)(a) GDPR — your explicit consent).
• Processing job applications (Art. 6(1)(b) GDPR — steps prior to entering into a contract).
• Statistical traffic analysis (Art. 6(1)(a) GDPR — consent given by accepting statistical cookies).
• Compliance with legal obligations (accounting, tax and other statutory obligations — Art. 6(1)(c) GDPR).

4. Retention period

• Contact form inquiries: up to 24 months from the last communication, after which they are deleted.
• Newsletter sign-up: until you unsubscribe (an unsubscribe link is in every message).
• Job applications: until the recruitment process ends, at most 12 months with your consent.
• Accounting records: 11 years, in accordance with the Accounting Act.
• Technical logs: at most 30 days, except in the event of a security incident.

5. Recipients and processors

We do not sell or hand over your personal data to third parties for marketing purposes. We entrust data only to carefully selected processors with whom we have data processing agreements in place:

• Vercel Inc. (USA) — hosting infrastructure. Data transfers are based on the EU Standard Contractual Clauses.
• Supabase Inc. (USA / EU region) — database and authentication. Our data is primarily stored in the EU region.
• Resend Inc. (USA) — sending transactional emails.
• Google LLC (USA) — Google Analytics 4, visitor statistics with IP anonymisation.
• PostHog Inc. (USA / EU) — product usage analytics.

Every third party that receives data is obliged to keep it in accordance with the GDPR and to use it exclusively for the stated purpose.

6. Your rights

Under the GDPR you have the following rights:

• Right of access (Art. 15) — to learn which data we hold about you.
• Right to rectification (Art. 16) — to correct inaccurate or incomplete data.
• Right to erasure (Art. 17) — to request deletion of data ("right to be forgotten").
• Right to restriction of processing (Art. 18).
• Right to data portability (Art. 20) — to receive your data in a machine-readable format.
• Right to object (Art. 21) — to object to processing based on legitimate interest.
• Right to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

You can submit a request to exercise your rights at info@mayntech.hr. We will respond within 30 days of receiving the request at the latest.

7. Right to lodge a complaint with a supervisory authority

If you believe that our processing of your personal data violates the GDPR or other data protection regulations, you have the right to lodge a complaint with the supervisory authority:

8. Data security

We apply appropriate technical and organisational measures to protect personal data: encryption in transit (HTTPS/TLS) and at rest, the principle of least privilege for data access, regular updates of systems and dependencies, and continuous monitoring of access logs.

9. Minors

Our website is not intended for persons under 16 years of age. We do not knowingly collect personal data of minors without the consent of a parent or legal guardian.

10. Changes to this policy

We may update this policy from time to time. We will notify you of significant changes via this page (and by email if the change is material). The date of the last update is shown at the top of the document.