Privacy Policy

Last updated: 3 November 2026.

This policy explains how Be-lux oprema d.o.o. processes the personal data of visitors to be-lux.hr and be-lux.com and people who send us enquiries. The websites present professional equipment and allow you to make enquiries. Sending an enquiry does not complete an online purchase or involve entering payment card details.

1. Who is responsible for your data?

The controller is Be-lux oprema d.o.o., Kamenarka 28, 10010 Zagreb, Croatia. For privacy questions and to exercise your rights, contact info@be-lux.hr or write to the address above, marked “Personal data protection”. Contact telephone: +385 98 97 00 932.

2. What data do we collect, and where does it come from?

• Enquiries and business communications: first name, last name, email address, telephone number, subject and message, and any additional details you provide, such as your company, role or equipment requirements. We receive these from you through the form, email, telephone or other direct communication.
• Technical and security data: IP address, access time, requested page, browser and device information, referring page when supplied by your browser, request status and error records. These arise when you use the website and support its operation and security.
• Information stored in your browser: cookie choices, time zone, technical session identifiers, products selected for comparison, locally saved form entries and, where a link includes an advertising click identifier, that identifier. Details, including storage periods, appear in our Cookie and Local Storage Policy.
• Usage data with the relevant consent: browser identifiers, pages visited, catalogue interactions, referral source and general device and location information through Google Analytics. When external videos load, their provider receives information needed to deliver the content, including your IP address.

Please do not send health information, identity document copies or other sensitive information that is unnecessary for your enquiry. If someone in your organisation supplies your business contact details for a particular enquiry, the source is that organisation or its representative. We will inform you about the processing at our first communication, and within one month at the latest, unless a statutory exception applies.

3. Why do we process data, and on what legal basis?

Sending an enquiry does not give consent to advertising. Accepting optional cookies is not a condition for receiving an answer. The link to this policy on the form provides information about data processing.

4. Do you have to provide the data?

The contact form currently requests your first name, last name, email address, telephone number, subject and message. Mandatory fields are marked with an asterisk. Providing these details is not a general statutory requirement, but the form cannot be submitted without completing its mandatory fields. You can also contact us directly by email or telephone. Without suitable contact information or the details needed to understand your request, we may be unable to reply or prepare a quotation. You decide what additional information is relevant to your enquiry.

5. Who may receive your data?

Data may be processed by authorised people within our company and service providers who need access for a specific task:

• Webtasy, d.o.o., Slovenia – our website hosting and related technical infrastructure provider.
• Business email, maintenance and IT support providers, to the extent needed to deliver messages, store correspondence and maintain systems.
• Google Ireland Limited, Ireland, and affiliated companies, including Google LLC in the United States – for Google Analytics and loaded YouTube content, depending on your choices and use. External providers may act as separate controllers for certain purposes of their own under their privacy notices.
• A manufacturer, supplier or service partner, only where needed for the quotation or technical support you request. Before sharing in this way, we will tell you about the relevant recipient and purpose and share only the necessary information.
• Competent authorities and professional advisers where required by law or necessary for a specific proceeding or legal claim.

Providers processing data on our behalf must observe confidentiality, appropriate security and our instructions. We do not sell personal data received in enquiries.

6. Is data transferred outside the European Economic Area?

Hosting with a provider in Slovenia is not, by itself, a transfer outside the EEA. External services, particularly Google's, may involve processing in the United States and other countries. Their processing is not necessarily limited to the EU.

Transfers must have an appropriate basis under GDPR Chapter V: a valid adequacy decision, including the EU–US Data Privacy Framework for covered certified recipients, or appropriate safeguards such as the European Commission's standard contractual clauses and supplementary measures where needed. Google explains its mechanisms in its legal frameworks for data transfers. You may contact info@be-lux.hr for information about the safeguards applicable to processing on our behalf and how to obtain a copy, subject to protecting other people's confidential information.

7. How long do we keep data?

Retention depends on the purpose. The internal periods below are not universal retention periods imposed on every organisation by the GDPR.

• Enquiries that do not lead to a business relationship: up to 24 months after the last substantive communication. We delete data earlier when it is no longer needed. We retain an active enquiry while handling it. Necessary records from a subsequent contract are kept for the periods applicable to those records; we provide additional information about that processing where relevant.
• Access and security logs: retained while needed to check system operation, detect misuse and resolve security events. Duration is determined by the type of record, the risk, any specific incident and evidential needs in proceedings. Records must not be retained after those needs end.
• Google Analytics: records associated with identifiers are retained according to the retention setting in the Analytics property, for comparing visits and improving content. For standard GA4 properties, Google offers periods of 2 or 14 months and removes records in its regular deletion cycle; if user identifier retention is reset on new activity, new activity starts that period again. Standard aggregated reports are not limited by that setting. You can ask info@be-lux.hr about the setting applicable to our property; cookie lifetimes are listed separately in the Cookie Policy.
• Cookies and browser storage: the individual periods in the Cookie Policy apply. A cookie's lifetime is different from the retention period for data held by Google Analytics.
• Legal obligations and claims: we retain only the necessary data for the relevant legal obligation, limitation period or proceeding. This does not justify retaining all information indefinitely.

Data in backups may remain until the backup is overwritten according to the provider's backup cycle. Backups serve system recovery, rather than routine use of deleted data. Previously completed deletions must be reapplied when data is restored.

8. Your rights and how to exercise them

Subject to the conditions in the GDPR, you may request access to your data and a copy, correction, erasure or restriction of processing. Where automated processing is based on consent or a contract, you may also exercise portability of the data you supplied.

You may object to processing based on legitimate interests on grounds relating to your particular situation. We will stop that processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing is needed for legal claims. You may object to direct marketing at any time without giving reasons; processing for that purpose must then stop.

You may withdraw consent at any time. For cookies, use “Cookie settings” in the footer of every page. For other matters, contact info@be-lux.hr or write to us. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

We respond without undue delay, normally within one month of receiving a request. Where complexity or the number of requests requires an extension of up to two further months, we explain the reasons within the first month. Requests are normally free, subject to the statutory exceptions for manifestly unfounded or excessive requests. If we have reasonable doubts about the applicant's identity, we may request only the additional information needed for a proportionate identity check.

9. Complaints to a supervisory authority

If you believe processing infringes data protection law, you may complain directly to the Croatian Personal Data Protection Agency (AZOP), Ulica Metela Ožegovića 16, 10000 Zagreb, Croatia, azop@azop.hr, azop.hr. You may also contact the supervisory authority in the EU Member State of your habitual residence, workplace or the alleged infringement. You do not have to contact us first. This does not restrict your right to a judicial remedy.

10. External content, security and automated decisions

Google Analytics and external videos are explained further in the Cookie Policy. The Google Maps link on the contact page opens an external service; the map is not embedded on our website. External websites have their own privacy rules.

We use HTTPS for transmission to and from the website. Processing also requires appropriate organisational and technical measures, including access restrictions, system maintenance and contractual protection with providers. No system can guarantee absolute security.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you within GDPR Article 22. Visitor statistics, technical spam protection and permitted advertising functions are not used to make such decisions about your enquiry. The websites are intended for business users, rather than children.

11. Changes and applicable rules

We update this policy when processing practices or legislation change. The current version is available on the website with its version date. Where required, material changes receive additional notice and, where necessary, a new consent request.

The legal framework comprises the General Data Protection Regulation – Regulation (EU) 2016/679, the Croatian Act on the Implementation of the General Data Protection Regulation (NN 42/18) and the Croatian Electronic Communications Act (NN 76/22, 14/24 and 45/26), particularly Article 43(4).