1 Controller and contact
The controller of personal data is:
- Adventure Spirit d.o.o. za usluge (trading as Adventure Spirit Consulting)
Antuna Šoljana 22, 10000 Zagreb, Croatia · VAT ID: HR72169598754 · Company number: 4845552 · Commercial Court in Zagreb - Registered office: Zagreb, Republic of Croatia
- Email: info@adventurespirit.hr
For any question about data protection, or to exercise your rights as a data subject, write to the address above.
2 What we collect and why
We collect only what is necessary to provide our services and to communicate with users:
- Contact details (name, email) - when you send an enquiry through a form on the site; legal basis: performance of a contract and legitimate interest (Art. 6(1)(b) and (f) GDPR)
- Platform usage data (for users of app.adventurespirit.hr) - email, name, role, activity within the platform; legal basis: performance of a contract (Art. 6(1)(b) GDPR)
- Technical data - browser type and the pages you visited; legal basis: legitimate interest in security and statistics (Art. 6(1)(f) GDPR)
We do not collect special categories of personal data (Art. 9 GDPR) and we do not knowingly collect data from anyone under 16.
3 Cookies
This website and the GRC platform use cookies to function correctly and to improve the user experience. Below is the complete list of what we set:
| Name | Type | Duration | Purpose |
|---|---|---|---|
as_cookie_consent |
Necessary | Persistent (localStorage) | Records your cookie decision so the banner does not reappear on every visit. |
as_cookie_consent_date |
Necessary | Persistent (localStorage) | The date you gave or refused consent, kept as a record of consent (Art. 7 GDPR). |
grc_cookie_consent |
Necessary | Persistent (localStorage) | The same mechanism for the GRC platform (app.adventurespirit.hr). |
grc_cookie_consent_date |
Necessary | Persistent (localStorage) | The date consent was given on the platform. |
grc_token / grc_refresh |
Necessary | Session / 30 days | JWT authentication token for the GRC platform. Sign-in is not possible without it. |
| Analytics cookies (future) | Analytics | Up to 13 months | We currently use no third-party analytics tools. If we introduce any, it will be only with your explicit consent, and this page will be updated. |
Note: for consent data we use localStorage (browser storage) rather than classic HTTP cookies, which means the data stays locally on your device and is never sent to the server.
Managing your consent
You can change or withdraw your consent at any time:
4 Notifications about new articles
The site offers a form for subscribing to notifications about new articles in the knowledge base. Subscribing is voluntary and the site can be used in full without it.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email address | Sending notices about new articles, roughly every two weeks | Consent (Art. 6(1)(a) GDPR) | Until consent is withdrawn |
| Record of consent | Demonstrating that consent was given, as required by Art. 7(1) GDPR | Legitimate interest in demonstrating compliance | Until withdrawal plus one year |
You may withdraw consent at any time, either by writing to info@adventurespirit.hr or through the unsubscribe link in every notice. Withdrawal does not affect the lawfulness of processing carried out before it.
We use the address for that purpose only. We do not pass it to third parties, do not use it for profiling, and do not combine it with the visit statistics described in the next section.
Forms on the site - contact, the report request from the self-assessment tool, and the notification sign-up - are delivered through a form-processing service, which acts as a processor for that purpose.
5 Cookieless visit statistics
We keep visit statistics using our own solution on our own server. We do not use Google Analytics or any other external measurement tool, so your data never leaves our infrastructure.
For this processing we set no cookies and store nothing on your device. The consent requirement under the electronic communications rules therefore does not apply, and the legal basis is our legitimate interest in understanding how the site is used (Art. 6(1)(f) GDPR).
What we record
| Data | Content |
|---|---|
| Time | Date and time of the visit in UTC |
| Path | The address of the page visited, without query parameters |
| Source | Only the domain you came from (for example google.com), never the full address |
| Device | A desktop, tablet or mobile label derived from window width |
| Language | The language version of the page and the browser language |
| Event | Use of the free tools, for example a completed self-assessment and its overall percentage |
| Visit fingerprint | A 16-character string described below |
Why an individual cannot be tracked
We do not store your IP address. It is used only at the moment of the visit, as input to a cryptographic hash function together with a secret value and browser data. The result is a 16-character string from which the IP address cannot be reconstructed.
The secret value changes every day at midnight UTC and the old one is deleted. The same visitor therefore receives a completely different fingerprint the next day, so visits cannot be linked across days or attributed to a particular person. The result is aggregate statistics, not a profile.
We respect the Do Not Track and Global Privacy Control settings in your browser. If either is enabled, we record nothing. No statistics are collected if you disable JavaScript either.
Records are kept in monthly files on our server, are not publicly accessible and are not shared with third parties.
6 Recipients and transfers outside the EU
We do not sell your personal data and do not pass it to third parties for marketing purposes.
For technical infrastructure we use the following processors:
- Cloudflare, Inc. (USA) - platform hosting, CDN, DDoS protection; safeguards: EU standard contractual clauses and the Cloudflare Data Processing Addendum
- Google Fonts - font loading; no personal data stored
Every processor we work with handles data solely on our instructions and in accordance with the GDPR.
7 Retention periods
- Contact enquiries are kept for 3 years from the last communication
- Platform accounts are kept while the account is active; on a deletion request we erase all personal data within 30 days
- Technical logs are kept for up to 90 days for system security
- Consent records are kept for 3 years to demonstrate compliance (Art. 7(1) GDPR)
8 Your rights as a data subject
Under the GDPR (Regulation (EU) 2016/679) you have the following rights:
- Access (Art. 15) - you may request a copy of the personal data we process about you
- Rectification (Art. 16) - you may request correction of inaccurate data
- Erasure (Art. 17) - you may request deletion of your data, the so-called right to be forgotten
- Portability (Art. 20) - you may request your data in a machine-readable format (JSON or CSV)
- Objection (Art. 21) - you may object to processing based on legitimate interest
- Restriction (Art. 18) - in certain cases you may request that processing be suspended
- Withdrawal of consent - at any time, without affecting the lawfulness of processing carried out beforehand
Send requests to info@adventurespirit.hr marked "GDPR request". We reply within 30 days of receipt (Art. 12(3) GDPR).
If you believe we process your data unlawfully, you have the right to lodge a complaint with the supervisory authority:
- AZOP - Croatian Personal Data Protection Agency, azop.hr
9 Data security
We apply technical and organisational measures appropriate to the state of the art:
- HTTPS encryption of all communication (TLS 1.2 and above)
- Password hashing (bcrypt or PBKDF2)
- Role-based access control
- Regular backups and monitoring
- Tenant data isolation in the multi-tenant architecture
In the event of a breach presenting a high risk to data subjects, we will notify you without undue delay in accordance with Art. 34 GDPR.
10 Changes to this policy
We may update this privacy policy from time to time. Any material change will be published on this page with a new "Last updated" date. Users of the GRC platform will also be notified by email of material changes.
We recommend reviewing this page periodically.
11 Privacy contact
- Adventure Spirit d.o.o. za usluge (trading as Adventure Spirit Consulting)
Antuna Šoljana 22, 10000 Zagreb, Croatia · VAT ID: HR72169598754 · Company number: 4845552 · Commercial Court in Zagreb - Email: info@adventurespirit.hr
- Web: adventurespirit.hr