Privacy notice
Version: 11 November 2026.
Who is responsible?
The controller is BROJKA KREATIVNIH PRODUKCIJA d.o.o., Čazmanska ulica 2, 10000 Zagreb, Croatia, OIB 06015921966. For privacy questions and rights requests, email hello@brojka.hr.
When you contact us
We use the name, email address, message and other information you send us to answer your enquiry, discuss possible collaboration and prepare a proposal you request. The form requires a name, email address and message so we know what to respond to and how to reach you. You have no legal obligation to provide these details; without them we cannot process an enquiry through the form. You can also email us directly. Please avoid sending sensitive information that is not needed for your enquiry.
When we take steps at your request before entering into a contract with you, the basis is Article 6(1)(b) GDPR. For other business correspondence, the basis is our legitimate interest in answering enquiries and running our business, under Article 6(1)(f). Sending an enquiry does not subscribe you to promotional messages.
Website operation and security
When you visit, the server processes your IP address, request time, requested address and technical browser information to deliver content and protect the website. The form uses protection on our own server: a hidden field, a signed time token and a limit on submission attempts. The limit stores a keyed digest of the IP address for up to one hour, without the original IP in that record. We do not use Google reCAPTCHA. The basis is our legitimate interest in operating a secure and reliable website.
Who has access?
Information is accessible to people at BROJKA who need it to respond and collaborate, and to hosting, email and technical maintenance providers to the extent needed for their services. CyberFolks provides website hosting and sends messages from the form. Form enquiries are sent to produkcija@brojka.hr and delivered to Gmail, which we use to handle email. Google therefore receives the information in the message. We do not enter enquiries into a CRM system. We may disclose information to competent authorities where required by law. If you allow external videos, their providers also receive information as described below.
How long we keep information
We keep enquiries that do not lead to a business relationship for two years from the last communication. We delete the messages manually when that period ends. If a particular message is needed for a legal obligation or a specific legal claim, we retain it while that reason applies. If collaboration follows, contractual and accounting records are subject to the relevant legal obligations. Security logs are kept for the time needed to identify and resolve an incident or misuse. Backups support recovery and are replaced progressively according to the service provider’s cycle.
Browser storage and external videos
With separate consent, we use Google Analytics to measure visits and successful contact form submissions. Google receives technical information about visits and may use cookies. For predefined campaign links, with the same analytics consent, we send the known source, medium and campaign label to measure response. We do not forward arbitrary URL values or advertising click identifiers. The basis is your consent under Article 6(1)(a) GDPR. We do not send the name, email or message from the form to this tool. Google Ads tags and Meta Pixel are inactive. Our Analytics account is linked to our Google Ads account for reporting and future campaigns; Google may use analytics data in linked reports, according to account settings and your consent. The current Analytics retention settings are two months for event data and 14 months for user data. Videos and photographs delivered from our own website do not require external-media consent.
YouTube (Google Ireland Limited and affiliated companies) and Vimeo (Vimeo.com, Inc.) load only after you allow external media. They then receive your IP address and information about your device, browser and playback, may use their own cookies and may associate the visit with your account with them. The basis for enabling this optional content is your consent under Article 6(1)(a) GDPR. Rejecting it does not prevent you from browsing other content or sending an enquiry.
You can change or withdraw your choices here and through the always available Privacy settings button. After withdrawal, we stop the relevant services, attempt to remove their cookies on this domain and reload the page. Withdrawal does not affect the lawfulness of earlier processing. You can delete cookies already stored by a provider using your browser or the provider’s settings; we cannot delete information held on its servers.
| Purpose | Information and duration |
|---|---|
| Remembering your choice | brojka_consent_2026_11_v4 in local storage: your external-media and analytics choices, notice version and choice time. Valid for 180 days, after which we ask again. It is not sent to measurement tools. If storage is unavailable, your choice lasts only on the open page. |
| Catalogue return and focus | brojka.catalog.return, brojka.catalog.restore and brojka_media_restore_focus in session storage: returning to a selected project and restoring focus after a settings change. Lasts for the tab’s session. |
| Editor sign-in | WordPress and language settings may use necessary cookies for signed-in users. Public browsing does not require an account. |
| Analytics | With consent Google may set _ga and _ga_* cookies for measurement. Their configured lifetime is 180 days from the last activity; on withdrawal we attempt to remove the relevant cookies on this domain. |
Transfers outside the EEA
Google, whose Gmail and YouTube services we use, and Analytics with consent, and Vimeo may process information in the United States and other countries outside the European Economic Area. According to their policies, they use adequacy decisions, including the EU–US Data Privacy Framework for covered transfers, and standard contractual clauses where needed. Details, rights and how to obtain information about safeguards are provided in Google’s privacy policy, its transfer frameworks and Vimeo’s privacy policy. We process enquiries in Gmail to respond to your message on the grounds described above; this does not depend on your external-media setting. We request separate consent to load YouTube and Vimeo on the website.
Your rights
Subject to the GDPR, you may request access, correction, erasure or restriction of processing, and data portability where applicable. You may object to processing based on legitimate interests and withdraw consent where it is the basis for processing. Email requests to hello@brojka.hr. We respond without undue delay, normally within one month; we will explain any permitted extension and its reasons within that period. Where necessary, we may request information for proportionate identity verification.
You may complain to the Croatian Personal Data Protection Agency (AZOP) without contacting us first. We do not make automated decisions about enquiries that produce legal or similarly significant effects for you.