Privacy Policy - Enterwell

General info

Owner and Data Controller

Enterwell d.o.o.
Koranska ulica 2, 10000 Zagreb
Croatia
OIB: 44617144415

COLLECTING DATA

Data we collect

In general, we are not trying to automatically collect any personal data about our visitors.

But, there are some situations where your data could be transmitted to us.

When you access our website

When you access our website, our servers could get the following data:

IP address – your public IP address
Platform – the platform from which you are accessing our website
User-agent – the type of your internet browser

Your devices send this information automatically and we use this information only to achieve communication.

When you send us an email

When you send an email to Enterwell, it means that you have voluntarily opened communication with us for the purpose of potential cooperation.

By doing so, we will receive your email address and any other information that you may include in the correspondence.

We will store that information up to 6 months after we finish the work related to your email.

Clients, suppliers and other business contacts

We process personal data of clients who are individuals or sole traders, representatives and employees of current or prospective corporate clients, suppliers, subcontractors, external contractors and other business partners.

Depending on the relationship, these may include names, organisation and job title, business email and telephone number, correspondence, project and contract information, billing data where relevant, and proportionate supplier due-diligence information.

We usually obtain this information from you or your organisation. We may also obtain it from public business registers, professional sources or other business parties. Our purposes, legal bases and retention criteria are summarised below.

Purpose	Legal basis	Retention
Enquiries, quotations and negotiations	Art. 6(1)(b) for an individual contracting personally; Art. 6(1)(f) for company representatives.	Up to 6 months after the activity ends, unless a contract, claim or other valid basis requires longer retention.
Contracts, projects, suppliers and subcontractors (including proportionate due diligence)	Art. 6(1)(b) for an individual contracting party; Art. 6(1)(f) for business contacts and risk management; Art. 6(1)(c) where required by law.	During the relationship and for relevant legal, contractual, audit and limitation periods.
Accounting, invoicing, payments and tax	Art. 6(1)(c), compliance with legal obligations.	For the applicable statutory retention periods.
Access management, information security and prevention of misuse	Art. 6(1)(f), legitimate interest in protecting systems and information; Art. 6(1)(c) if a specific legal duty applies.	Only as long as required for the relevant security purpose; longer for documented incidents or claims.
Establishing, exercising or defending legal claims	Art. 6(1)(f), legitimate interests, or Art. 6(1)(c) where specifically required by law.	For the relevant proceedings and limitation periods.
Public testimonials or case studies identifying an individual	Normally Art. 6(1)(a), separate consent.	While the approved purpose continues, subject to review and withdrawal of consent.

Job applicants

When you apply for a job, internship or other engagement, we may process your name and contact details, CV, education, qualifications, professional experience, portfolio or professional links, technical or practical assignment results, and relevant interview notes. We normally obtain these directly from you, but may also receive them from authorised recruitment agencies, references or publicly available professional sources. We do not ask you to provide sensitive personal data or information about criminal convictions unless a particular collection is permitted or required by law.

We use these data to assess applications, conduct interviews and take steps at your request before potentially entering into a contract (Article 6(1)(b) GDPR). After selection, limited records may be retained to demonstrate that the recruitment process was lawful and to defend potential claims (Article 6(1)(f) GDPR, subject to an assessment of legitimate interests).

For unsuccessful applicants, data are retained until the selection process is completed and, ordinarily, for no more than six additional months. Longer retention is possible where specific claims, proceedings or a documented need to preserve evidence justify it. If we would like to consider your application for future opportunities, we will ask for separate, freely given consent and specify the retention period, generally no longer than 12 months. You can withdraw that consent at any time.

ANALYTICS

Matomo analytics

For analytics purposes, we are using an on-premise and open-source solution called Matomo.

We like Matomo and here are some of the reasons why:

Because the application is hosted on our servers, we are not sharing this data with anyone else.
We are not using cookies to track our visitors.
European Commision is also their user, which you can see if you visit their website.

We are only interested in how many people are visiting our website and what pages are the most popular.

Because of that, we are not collecting any of your personal information or do any additional monitoring.

PROCESSING DATA

How we process the collected data

We take appropriate security measures to prevent an unauthorized access to your data.

Data processing is done by using computers or other IT enabled tools while following organizational procedures based on best-practices, as required by Article 28 GDPR.

Your data will be processed strictly for the intended purposes. We will not use your data for any other purpose.

Your data may be accessible to certain types of persons in charge within our Company (administration, system administration, etc.) or to external parties such as third-party technical service providers, hosting providers, internet service providers, etc.

Processing outside the European Economic Area

Some providers or their support arrangements may involve access to personal data from outside the European Economic Area (EEA). If a transfer to a third country takes place, we apply a mechanism permitted by Chapter V GDPR and, where required, appropriate safeguards and additional assessments.

The updates list of these parties may be requested from the Owner at any time.

We respect your privacy and we do not share your data with any other entities.

However, it is possible that your data will be shared with our third-service providers (like our email provider, hosting provider, etc.) but only for the purpose of communicating to you.

All data is transmitted using secure protocols.

Where is your data stored

Your data is securely stored on our servers located in Frankfurt, Germany.

COOKIES

Concerning cookies

Enterwell’s website by default does not use cookies.
If you somehow manage to provoke the website to give you a cookie, that cookie will be of a necessary first-party technical type.

Almost every website on the internet uses cookies to save basic information about the specific visitor of the website.
And that is perfectly fine – as long as you are respecting your visitor’s privacy.

For example, if you visit a website from Europe you will probably see the notification informing you about how they use cookies. You don’t want to read that so you just click the biggest button in hope that this notification will disappear.
As soon as you hit that button, the website gives you a cookie with the information that you already accepted their cookie policy. So the next time when you visit the website, the notification will not appear.

You see, in order to show you the message about cookies, the website needs to use cookies. Funny, but ok. Cookies are also used for logins, saving you light/dark theme preferences, etc.

But, this is where it can get dark.
Any website can within itself, insert the scripts from other pages. And you may not even know about it. This gives the third-parties an option to track your behavior. While they are tracking you, they also give you a cookie with an unique ID. Now, if you visit other sites that also use these scripts from the same place, they can keep following you because of the unique ID cookie they gave you. Do this a lot, and you end up being tracked all over the internet.

Now imagine that third-party is a big company that doesn’t have your best intentions in mind. They can easily track you over vast number of websites and exploit the data against your best interest.

Make note that this is NOT a cookie problem. Cookies are just the easiest way to do it.

If you have actually read everything we have written so far, we salute you. Please, send us an email and tell us how do you feel about cookies and about our site in general. Perhaps we could send you something as a thank you.

Cookies and embeddable content

If you see any kind of embeddable content from third-parties on our website (YouTube video, Vimeo video, etc.), you can rest assured that it will not automatically give you cookies and track you.

You could receive the cookies from third-parties only after you click on that content and give your consent.

FINAL REMARKS

Your rights

If you wish to review, update or delete the data we have collected from you, send us an email and we will process your request within 30 days.

Deleted data may be kept in backup for up to 3 months. Backup is used only for disaster recovery.

You can lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Ulica Metela Ožegovića 16, 10000 Zagreb, Croatia, [email protected], or another competent supervisory authority. This does not affect your right to seek other legal remedies.

We do not currently use solely automated decisions, including profiling, that produce legal effects or similarly significant effects for job applicants or business contact persons within the meaning of Article 22 GDPR.

By using this website, you consent to our privacy policy.

Contact

If you have any questions, you can email us at [email protected].

Changes to this Privacy policy

May 25, 2018: First version published
December 9, 2022: Migrated to a new website and updated the Analytics section
March 17, 2023: Changed the official address
July 7, 2023: Added the part about Magazine subscription
November 3, 2026: Removed the part about Magazine. Added details for job applicants and clients communication