Privacy
This policy explains which personal data we process when you use Lovački oglasnik (the Platform), why, for how long and what rights you have. It follows the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Croatian Act on the Implementation of the GDPR. The Croatian version prevails.
1. Data controller
[not entered yet], OIB [not entered yet], [not entered yet]. For any question about personal data and to exercise your rights: [email protected].
We have not appointed a data protection officer, as Article 37 GDPR does not require one for our kind of processing; the controller handles all requests at the address above.
2. In short
- The Platform is for adults only.
- We do not sell personal data or use it for third-party advertising.
- We do not store dates of birth, personal identification numbers or copies of documents.
- We measure visits without cookies.
- Your e-mail is never shown to other users; your phone number only if you choose to show it with a listing.
3. What we process, why and on which legal basis
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Name, e-mail, password (stored only as a secure hash), interface language | opening and running your account, sign-in, account notices | performance of a contract – Art. 6(1)(b) |
| One-time sign-in code (only its hash, for 10 minutes) | password-free sign-in | contract – (b) |
| Data from Google or Facebook (account identifier, e-mail, name, profile picture address) – only if you choose that sign-in | sign-in and account linking | contract – (b) |
| Mobile number and date of confirmation | confirming the number by SMS; required to post firearms and ammunition; shown with a listing if you allow it | contract – (b); legitimate interest in platform security – (f) |
| A shop's business contact (name, publicly listed business e-mail, city) – only shops we invite to the platform | a one-off invitation, unsubscribing and whether the link was opened | legitimate interest in presenting the platform – (f); unsubscribe in every e-mail |
| The content of an e-mail you send to [email protected] (address, name, text, attachments) | answering it, unsubscribing from invitations | legitimate interest – (f); copy in the admin for 24 months, original in the mailbox |
| The fact that you are confirmed as an adult (date and method) | access to 18+ categories and prices, tour inquiries | legitimate interest and protection of minors – (f); compliance with firearms law – (c) |
| Listings: title, description, category and attributes, price, condition, county and town, photos, view count | publishing and showing listings, search | contract – (b) |
| Your place (settlement or postal code) – only if you enter it; never shown publicly | aggregate statistics on where users come from (by county and place, never a list of people; places with fewer than 3 users are not shown on their own) | legitimate interest in developing the Platform – (f) |
| Messages between users, blocked users | arranging deals and tours, protection against unwanted messages | contract – (b); legitimate interest – (f) |
| Favourites and saved searches (with alert frequency) | your list of listings and the e-mail alerts you switched on | contract – (b) |
| Tour inquiries: tour and date, number of hunters and companions, language, preferred dates, message | sending the inquiry to the provider and arranging the hunt | contract and pre-contractual steps – (b) |
| Tour reviews: ratings, text, country, time of the hunt | publishing reviews | legitimate interest in informing other hunters – (f) |
| Provider details (company, sole trader, hunting association): name, OIB, address, e-mail, phone, website, description | public provider profile and tours | contract – (b) |
| Reports of inappropriate content (for reports without an account also the reporter's name and e-mail), moderation decisions with reasons, account blocks | moderation, handling reports, telling the reporter the outcome and the author the decision | obligations of intermediary services (Digital Services Act) – (c); legitimate interest – (f) |
| Complaints about the service: name, e-mail, topic, text of the complaint and the answer | receiving and resolving complaints | legal obligation (Consumer Protection Act) – (c) |
| Security records: your devices (only a hash of the browser identification, no IP address), account activity log (sign-in, password or e-mail change…) without IP addresses | account protection, new-device sign-in notice, investigating abuse | legitimate interest – (f) |
| IP address – only temporarily, in attempt counters | limiting abuse (password guessing, spam) | legitimate interest – (f) |
| Visit statistics: page visited, device and browser type, country (from network data), referral source, loading speed; visitors are counted with a key that changes daily and cannot be linked to you | measuring and improving the Platform | legitimate interest – (f) |
Without the data needed for an account (name and e-mail) you cannot open an account or post listings. Browsing listings needs no account.
4. Where the data comes from
You provide most of it. If you sign in with Google or Facebook, we receive the data listed above from them. The visitor's country for statistics is supplied by our network intermediary Cloudflare.
5. Who sees your data
Other users see your name with your listings and in messages; providers see your name and the details of inquiries you send them. Your phone number is shown only to signed-in users who click "Show number", and only if you enabled it for the listing. Reviews are shown without names ("Verified hunter", with country and time of the hunt).
Tour providers use the details of your inquiry as independent controllers to arrange the hunt.
Processors – providers that process data for us only on our instructions and under a data processing agreement:
| Provider | Role |
|---|---|
| Server and maintenance provider | hosting the application, database and backups |
| Cloudflare, Inc. | network intermediary, attack protection, bot check (Turnstile) |
| E-mail delivery provider | delivering e-mails (sign-in codes, notifications) |
| SMS provider (once enabled) | sending the code to confirm your mobile number |
| Anthropic PBC | automatic listing check: text and photos of a published or edited listing, only for the check |
Google and Meta (Facebook) process data under their own policies, only if you choose to sign in with their account.
Public authorities receive data only where the law requires it (e.g. at the request of the police or a court).
6. Transfers outside the European Economic Area
Some providers (Cloudflare, Google, Meta, Anthropic) may process data outside the EEA, in particular in the USA. Such transfers rely on the European Commission's adequacy decision (EU–US Data Privacy Framework) for certified providers or on the Commission's standard contractual clauses.
7. How long we keep data
| Data | Period |
|---|---|
| Account data | while the account exists |
| Sign-in code / phone confirmation code | 10 minutes or until used |
| Sign-in (session) | 2 hours after the last action; with "Remember me" until you sign out |
| Listings | active until the listing expires; expired and archived ones are visible only to you until you delete them or while the account exists |
| Your place | while the account exists or until you remove it in your account settings |
| Messages | while the account exists; a conversation without a new message for 24 months is deleted with its messages |
| Inquiries, favourites, saved searches | while the account exists or until you delete them where possible |
| Visit statistics | individual records 90 days, afterwards only totals per page without any visitor data; the daily counting key is deleted after 2 days |
| Complaints and answers | at least one year after the answer |
| Content reports and decisions | the description of the report and the name and e-mail of a reporter without an account are erased 12 months after the report is closed; reason, decision and statement of reasons are kept while needed (possible dispute or repetition) |
| Database backups | 14 days |
| Attempt counters with IP address | from a few minutes up to an hour |
After an account is deleted we delete or permanently anonymise its data, except what we must keep by law or to establish, exercise or defend legal claims (e.g. data about reported abuse) – and only for as long as that need lasts.
8. Your rights
You have the right:
- of access to your data and a copy (Art. 15),
- to rectification of inaccurate data (Art. 16) – most of it you can change yourself in your account settings,
- to erasure ("right to be forgotten", Art. 17),
- to restriction of processing (Art. 18),
- to data portability – to receive the data you gave us in a machine-readable format (Art. 20),
- to object to processing based on legitimate interest (Art. 21),
- to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before the withdrawal.
You can also download your data or delete your account yourself in your account settings (Account → Security and sign-in). Send other requests to [email protected] from the address linked to your account. We reply without undue delay and within one month at the latest (for complex requests this can be extended by two further months; we will tell you if so). Exercising your rights is free of charge.
If you believe the processing breaks the rules, you can lodge a complaint with the supervisory authority: Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, Croatia, [email protected], azop.hr.
9. Automated decision-making
We take no decisions with legal or similarly significant effects based solely on automated processing and we do not profile users. Automatic rules exist only to prevent abuse (e.g. limiting sign-in attempts, temporarily blocking links in messages from new accounts); listings in sensitive categories and reports are reviewed by a person.
10. Adults only
The Platform is not intended for persons under 18 and we do not knowingly collect their data. If we learn that a minor opened an account, we close it and delete the data.
11. Security
Traffic is encrypted (HTTPS). Passwords are stored only as a secure hash, one-time codes only as a hash and briefly, and photo metadata (location, device) is removed on upload. Only authorised staff can access administration, with mandatory two-factor authentication. We e-mail you when your account is signed in from a new device.
12. Cookies
We use only cookies necessary for the Platform to work. Details are on the Cookies page.
13. Changes
We may change this policy when our processing or the law changes. The date of the last change is shown on this page; we will tell you about significant changes on the Platform or by e-mail.