HR

Privacy Policy

Last updated: 25 September 2026.

This Privacy Policy explains what personal data we process when you visit bakart.hr or send us an enquiry through the contact form, why we process it, how long it is retained, and the rights available to you.

Data controller

The data controller is:

Bakart, art education and artistic services craft, owned by Natalia Bakovic
Kneza Borne 14, 10000 Zagreb, Croatia
Croatian tax number (OIB): 47804867660
Email: bakart.art@gmail.com
Phone: +385 99 335 3450

Data we process

When you submit the contact form, we process the information you provide:

  • name
  • email address
  • message
  • form language

Limited technical data may also be processed to operate and protect the website, such as an IP address, browser type, request date and time, and security signals needed to detect automated requests and abuse.

We do not use Google Analytics, advertising tools, or visitor profiling for marketing purposes.

We use contact form data to respond to your enquiry, arrange a class or workshop, and take steps at your request before entering into a possible contract. The legal basis is Article 6(1)(b) GDPR.

Technical and security data is processed to operate the website securely and prevent spam, fraud, and abuse. The legal basis is our legitimate interest under Article 6(1)(f) GDPR.

Where processing is required to comply with a legal obligation, the legal basis is Article 6(1)(c) GDPR.

Service providers and recipients

We use the following providers to operate the website and deliver contact messages:

  • Cloudflare, Inc. – hosting, network and security protection, and Turnstile verification
  • Plus Five Five, Inc. (Resend) – delivery of contact form messages to our email address
  • Google LLC (Gmail) – receipt and processing of business email

Contact details and message content are not stored in the website’s public repository. We do not sell personal data or use it for marketing messages without a separate legal basis.

Provider information is available from Cloudflare, Cloudflare Turnstile, Resend, and Google.

International transfers

Some providers may process data outside the European Economic Area. Where applicable, transfers rely on safeguards such as an adequacy decision, the EU–US Data Privacy Framework, or the European Commission’s Standard Contractual Clauses.

Retention

We retain messages only for as long as needed to respond to and resolve an enquiry. If correspondence results in a business relationship, relevant data may be kept for longer where needed to deliver the service, comply with legal obligations, or establish, exercise, or defend legal claims. Data that is no longer needed is deleted or anonymised.

Resend states that email content and logs on its standard plans are retained for 30 days. Technical security logs are retained according to the applicable provider’s policy and retention periods.

Cloudflare Turnstile

The contact form is protected by Cloudflare Turnstile. Turnstile processes security signals such as IP address, User-Agent, TLS characteristics, and site information to distinguish people from automated programs. Cloudflare states that Turnstile does not access the content of your message or other form entries.

Turnstile only provides a security assessment used to accept or reject a form submission. We do not carry out automated decision-making that produces legal or similarly significant effects, and we do not profile visitors.

Your rights

Depending on the circumstances, you may request:

  • access to your personal data
  • correction of inaccurate or incomplete data
  • deletion of data
  • restriction of processing
  • data portability
  • objection to processing based on legitimate interests

To exercise your rights, contact bakart.art@gmail.com. We may request information needed to verify your identity. We will respond without undue delay and within the time limits required by the GDPR.

You may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Ulica Metela Ožegovića 16, 10000 Zagreb, email: azop@azop.hr, or visit azop.hr.

Changes to this policy

We may update this Policy to reflect changes to our services, technology, or legal requirements. The current version and its last-updated date will always be published on this page.