Privacy policy

This Privacy policy was last updated on 10 November 2026. It is a translation of our Croatian Privacy policy; if the two versions differ, the Croatian version applies.

In this Privacy policy we explain which personal data we collect through the website https://www.torte-i-to.hr, why we collect it, how long we keep it and what your rights are. We process personal data in accordance with the General Data Protection Regulation (GDPR) and the Croatian Act on the Implementation of the General Data Protection Regulation.

1. Controller

COMPETO d.o.o. za usluge
Nova ves 48, 10000 Zagreb, Croatia
OIB (tax number): 18076143551
E-mail: ured@torte-i-to.hr
Phone: +385 1 3090 155

2. What data we collect and why

2.1 Contact form

When you send us a message through the contact form, we process your name, e-mail address, subject and message so that we can reply to you.

Legal basis: taking steps at your request (Art. 6(1)(b) GDPR) or our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

2.2 Order form

When you send an order through the form, we process the data needed to prepare and hand over your order: your full name, e-mail address, phone number, the products and decoration ordered, the date, place and time of pick-up and the payment method. If you ask for an R1 invoice, we also process the company name, address and OIB in order to issue the invoice.

Legal basis: concluding and performing a contract (Art. 6(1)(b) GDPR) and complying with legal obligations, e.g. issuing and keeping invoices (Art. 6(1)(c) GDPR).

Remembering what you enter in the form. So that your details are not lost if the page reloads (e.g. when your phone closes the tab while you are in another app), the form saves what you enter only in your browser (local storage), for no longer than 24 hours. This data does not reach us until you send the order, and it is deleted automatically after the order is sent successfully. You can also delete it yourself with the “Clear form” button or by clearing your browser data.

Technical log of the form. To find and fix errors that could stop an order from going through, we record the steps and the outcome of using the form (e.g. form opened, started, sent, field missing, sending error), the time, the type of device and browser, the page language, whether dark mode is on, and a random visit identifier that is valid only while the browser tab is open. We do not record your name, e-mail, phone number, the content of your order or your IP address in the log. We keep these records for 90 days.

Legal basis for remembering form entries and for the technical log: our legitimate interest in the order form working properly and in you being able to complete your order (Art. 6(1)(f) GDPR).

2.3 E-mail news

If you tick the box in the order form to receive news, we use your name and e-mail address to let you know from time to time when new and seasonal cakes arrive. The box is optional and does not affect your order. You can unsubscribe at any time by replying to any of our messages or by writing to ured@torte-i-to.hr.

Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

2.4 Protecting the forms from abuse

We protect our forms from automated programs (bots) with our own invisible checks: a hidden field that people do not see or fill in, and a check whether the form was sent unusually quickly after the page was opened. We do not use third-party services or cookies for this. If a submission is rejected, only the reason for the rejection is recorded in the technical log of the form.

Legal basis: our legitimate interest in protecting the website from spam and abuse (Art. 6(1)(f) GDPR).

2.5 Google Maps

On our location pages we show Google Maps. They load only if you agree to this in the cookie notice. When a map loads, Google processes your IP address and may set cookies.

Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

2.6 Visiting the website

On every visit, the server hosting the website automatically records technical data (IP address, browser type, time of access and pages visited) so that the website works properly and securely. Fonts are served from our own server, without connecting to Google.

Legal basis: our legitimate interest in the secure and proper operation of the website (Art. 6(1)(f) GDPR).

You can read more about cookies and similar technologies in our Cookie policy (in Croatian).

2.7 Statistics and advertising (only with your consent)

If you agree to statistics in the cookie notice, we use Google Analytics 4 and Metricool to see, in aggregate, how many visitors we have, which pages they read, where they come from and how the order form is used (e.g. attempt to send, error, order sent – without the data you enter in the form). If you agree to marketing, we use Google Ads and Meta Pixel to measure whether our ads led to an order or a call, and to show ads to people who might be interested in them, including people who have already visited our website. These tools are loaded by Google Tag Manager, strictly according to your choice. We use Google Consent Mode v2: until you give consent, Google Analytics and Google Ads do not set cookies, and Google may only receive limited signals without cookies.

Enhanced conversions (Google Ads). If you have consented to marketing and send an order or enquiry through a form on our website, the e-mail address and mobile number you entered in the form are converted in your browser into an unreadable encrypted string (hash, SHA-256) and sent to Google in that form. Google compares this string with the encrypted data of signed-in users of its services to determine whether the order followed a view of or click on our ad, including when the ad was seen on another device or cookies are not available. Under Google's terms, this data is used solely to measure ad performance, and we receive only aggregate figures from Google, with no data about individuals. If you do not consent to marketing, or withdraw your consent, this data is not sent to Google.

Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw or change at any time in the Cookie policy.

3. How long we keep data

  • Enquiries and messages from the contact form are kept for as long as needed to answer the enquiry.
  • Order data (full name, e-mail, phone number, products ordered, pick-up time and place, and R1 invoice details) is kept for 3 years from the day the order is picked up, to deal with any complaints and contractual claims and to make repeat orders easier. After that, we delete it.
  • Data on invoices and other accounting documents is kept for the periods required by law (e.g. the Croatian Accounting Act).
  • Data we process on the basis of consent, such as your e-mail address for news, is kept until you withdraw your consent.
  • Data entered in the order form but not yet sent stays only in your browser, for no longer than 24 hours.
  • Records in the technical log of the form are kept for 90 days and then deleted automatically.

4. Recipients of data

We do not sell your data or pass it on to third parties for their own marketing purposes. Data may be available only to the service providers we work with to run the website and our business, and only to the extent necessary:

  • our web hosting and e-mail provider (messages from the forms are delivered by e-mail),
  • Google Ireland Limited (Google Maps and Google Tag Manager, and with your consent Google Analytics and Google Ads, including the encrypted e-mail address and mobile number from the form for enhanced conversions),
  • Meta Platforms Ireland Limited (Meta Pixel, only with your consent to marketing),
  • Metricool Software, S.L., Spain (visit statistics, only with your consent),
  • our bookkeeping service, in connection with invoices issued,
  • competent authorities, where required by law.

5. Transfers of data outside the EU

Google and Meta may also process data in the United States. Such transfers are based on the EU-US Data Privacy Framework and the European Commission’s standard contractual clauses. More information: Google Privacy Policy · Meta Privacy Policy.

6. Your rights

  • Right of access: you can ask us to confirm whether we process your data and to give you a copy.
  • Right to rectification: you can ask us to correct inaccurate data or complete incomplete data.
  • Right to erasure: you can ask us to delete your data, unless we are required by law to keep it.
  • Right to restriction of processing in the cases set out in the GDPR.
  • Right to data portability: you can ask for your data in a structured, machine-readable format.
  • Right to object to processing based on our legitimate interest.
  • Right to withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.

Send your request to ured@torte-i-to.hr. We will reply within one month at the latest. If you believe that the processing of your data breaches the regulations, you have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), azop.hr.

7. Data security

We apply appropriate technical and organisational measures to protect your data from unauthorised access, loss or misuse. The website uses an encrypted connection (HTTPS).

8. Changes to this policy

We may change this Privacy policy from time to time. The current version is always published on this page, with the date of the last change at the top.