Last updated: 2 November 2026
Extreme IT d.o.o., Zagrebačka avenija 106, 10000 Zagreb, Croatia ("Extreme IT", "we") is the controller of personal data processed through this website and in the course of providing our services. We process personal data in line with Regulation (EU) 2016/679 (GDPR) and the Croatian Act on the Implementation of the GDPR.
1. What we collect
- Enquiries: name, company, e-mail address and the content of your message when you use the contact form or e-mail us.
- Contracts: contact and billing details of client representatives, and the data needed to deliver and invoice the service.
- Technical data: IP address, browser and request logs kept by our servers for security and troubleshooting.
- Cookies: only the cookies this site needs to work (session and your cookie choice). Analytics or marketing cookies are set only if you allow them in the cookie banner.
2. Why we process it and on what basis
| Purpose | Legal basis |
|---|---|
| Answering enquiries and preparing offers | Pre-contractual steps, Art. 6(1)(b), and legitimate interest, Art. 6(1)(f) |
| Delivering and invoicing services | Performance of a contract, Art. 6(1)(b), and legal obligations, Art. 6(1)(c) |
| Security of our systems and websites | Legitimate interest, Art. 6(1)(f) |
| Optional analytics or marketing cookies | Consent, Art. 6(1)(a) |
3. How long we keep it
- Enquiries that do not lead to a contract: up to two years after the last contact.
- Contract and invoicing records: eleven years, as required by Croatian accounting and tax law.
- Server logs: up to twelve months.
4. Who else sees it
We do not sell personal data. We share it only with processors we need to run the service, under data processing agreements: hosting providers in the EU (Hetzner, DigitalOcean) or our own infrastructure in Zagreb, our accountants, and payment providers for card payments. Fonts and scripts on this site are served from our own servers, not from third parties. Data is processed in the European Economic Area unless a client contract says otherwise.
5. Your rights
You can ask for access to your data, correction, deletion, restriction of processing, data portability, and you can object to processing based on legitimate interest or withdraw consent at any time. Write to info@extremeit.hr. We answer within thirty days. You can also complain to the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr, or to the supervisory authority in your country.
6. Security
We protect personal data with TLS encryption in transit, encrypted backups, access limited to the people who need it, two-factor authentication on our systems and regular security testing. Security is part of what we sell, and we apply the same standards to ourselves.
7. Changes
We update this policy when our processing changes and publish the new version here with the date above.