Privacy Policy

Ovdje pročitajte hrvatsku verziju ovih pravila o privatnosti.

The website (hereinafter referred to as the “Website“) is operated by “MALA PLAVA HOBOTNICA j.d.o.o.”, “we”, “us” or “our”) with its registered headquarters in the Republic of Croatia, Put Supavla 1, Split, OIB: 01088969042 (hereinafter referred to as EXPAT)

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter:  General Regulation.

EXPAT is committed to protecting your privacy based on the General Regulation and its principles and adopts this Privacy Policy in accordance with the above.

This Privacy Policy governs the manner in which EXPAT collects, uses and manages your data, including personal data, if you are a user of our services, supplier, partner, if you have signed up for our promotional materials and if you have sent an inquiry through our contact form (hereinafter: “You”).

This Policy applies only to natural persons (“data subjects”) or their personal data. The handling of information from legal entities (such as information considered to be a trade secret, professional secret and classified information) is not subject to this Policy.

EXPAT is the Controller with regard to the personal data we collect from you, i.e. the person who determines the purpose and means of processing personal data.

Please read this Policy carefully to find out why and how we collect your information and how we use it.

By using our website or by contacting us through any of our contact forms, you agree to the use of your personal data as described in this Policy.

This Privacy Policy will be subject to regular revisions, and it may be updated or amended at any time. We will publish any modified version on this website, and any such policy change will take effect immediately after publication, unless otherwise stated in the amendment. By registering or continuing to use this website, you confirm your knowledge and consent to the processing of data in accordance with the amended or updated version of this Policy.

Personal data

For the purposes of this Privacy Policy, the term “Personal Data” refers to all data relating to an identified or identifiable natural person whose identity is or can be identified – data subject. Therefore, it is any data that directly identifies a natural person or through which a natural person can be identified, such as first name, surname, address, personal identification number (OIB), address, e-mail and IP address. Identification may be directly by the information itself or in connection with any other information in our possession or likely to come into such possession.

Except where expressly provided otherwise in this Privacy Policy, the terms used herein have the meaning given to them by REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“General Data Protection Regulation” or “GDPR”).


EXPAT (“we”, “us” or “our”) acts as the Controller in connection with the processing of your Personal Data covered by this Privacy Policy in terms of applicable data protection regulations. This means that EXPAT decides on how these Personal Data are processed and for what purposes they are processed.

Types of Personal Data processed and purposes of processing

Visiting and browsing the Website does not require user registration, so your registration and user account information is not collected, and for more information on collecting data through cookies, please read our cookie notice.

EXPAT, in accordance with the privacy policy, may collect the following personal data:

  • data from voluntarily completed contact forms from our website by users, for the purpose of making inquiries, i.e. communicating with us;
  • other data that the user voluntarily gives us when submitting a request for a particular service or providing certain information.

Normally, this is personal data such as first and last name, postal address, e-mail address, telephone number, date of birth (age), but when you enter into a contractual relationship with us to provide certain services that you have requested, the personal data you provide and that we process are necessary for the fulfillment of contractual obligations.

When you access a website, general, non-personal data (number of visits, average time of visit, pages visited) are automatically recorded. We use this information to measure the attractiveness of our website and to improve content and usefulness.

The purpose of the processing of personal data we carry out is related to the provision of our services and information about our services.

Legal basis for the processing of personal data

EXPAT does not collect or process your personal data, except when you enable it to do so, i.e. you give your consent to this, or where there is a legal basis for the collection of personal data or expat has a legitimate interest in processing.

This privacy policy does not apply to personal data collected without internet access or otherwise, including through websites operated by a third party or to personal data relating to the provision of our services or entering into a contractual relationship with us.

Retention of personal data

All personal data that EXPAT processes on the basis of an individual’s personal consent or legitimate interest, EXPAT keeps permanently until the termination of consent by the individual, i.e. until the request of termination of processing. Expat deletes this data before the termination of consent by an individual, only if the purpose of processing personal data has been achieved or if so determined by law.

EXPAT does not forward your personal data to unauthorized persons.

Safety statement

EXPAT takes all necessary measures to ensure the security of your personal data and strives to protect it from loss, destruction, falsification, manipulation and unauthorized access or unauthorized disclosures.

People who have access to your data

Access to your data is granted exclusively to our authorized representatives who are familiar with the policies and procedures for the protection of your data. Third parties have the right to access and process your personal data only in the situations described below:

– third-party service providers who, in the name and on behalf of EXPAT, provide certain services and products, such as the accounting office, our legal representatives, partners who maintain the technical infrastructure and other partners involved in the provision of services to our customers. In this case, they process your personal data exclusively in accordance with our instructions, and we provide them only with the data necessary for the provision of their services. These service providers have the obligation to maintain confidentiality within the agreed relationship, as well as to implement organizational and technical protection measures;

– when EXPAT is obliged to submit your data to the competent authorities (for example, the Ministry of Finance, tax administration) in order to provide services from its business subject matter in accordance with the applicable regulations;

– competent authorities when conducting supervision over the legality of our business and conduct, in which case your personal data are processed in accordance with their legal authority;

Transfer of personal data outside the European Union

Although EXPAT is headquartered in Croatia, our business partners are located all over the world, but mainly in the United States, and therefore we or our service providers in special cases transfer your personal data to the United States using the prescribed security measures. As an example, we can cite the case when we use an external executor that provides services, such as data storage services in the cloud or business management services. As a concrete example, we can mention that we use the CRM platform Bigin, which has ensured very high standards of security and protection of personal data of clients, and you can read more about it on their pages .

In all such cases, we have taken all precautions to ensure that your personal data is maximally protected, such transfers are in accordance with the latest “EU-US Data Privacy” adequacy decision, about which you can read more at the

Measuring attendance – Google Analytics

Our website may use Google Analytics, a web analytics service provided by a third party, Alphabet Inc. and its affiliates (“Google”). The information generated by the cookie about your use of this website (including your IP address) will be transmitted to Google and stored on servers in the Republic of Ireland where it will be stored for a maximum of 26 months and deleted (subject to the terms and conditions applicable on the date of this policy). Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties, if required by law, or if such third parties process the data on behalf of Google. Google will not associate your IP address with other data held by Google. Further information about Google’s privacy policy can be obtained at .

Rights of the individual regarding the processing of personal data

In order to ensure the lawful processing of personal data, as an individual under applicable data protection regulations, you have the following rights:

Right of access to personal data

You have the right to request confirmation as to whether EXPAT processes your data and if this is the case, you also have the right to request access to them. You have the right to access your personal data that we process about you and you can request detailed information in particular about their purpose of processing, the type/categories of personal data being processed including access to your personal data, recipients or categories of recipients and the envisaged period for which the personal data will be stored. Access to personal data may be restricted only in cases prescribed by Union or national law or where such restriction respects the essence of the fundamental rights and freedoms of others.

Right to rectification

If you believe that EXPAT uses inaccurate or incomplete data, or if you wish to have their data changed, as an individual, you have, taking into account the purposes of the processing, the right to supplement incomplete data, to amend and correct it. Please note that the application needs to specify what specifically is not correct, complete or up-to-date and in what sense the above should be corrected and submit the necessary documentation in support of its allegations.

Right to erasure (“right to be forgotten”)

It is your personal right to request from us to erase personal data concerning you without undue delay and EXPAT must erase the data without undue delay. You have the right to request the erasure of personal data concerning you if one of the following conditions is met:

-your personal data is no longer necessary in relation to the purposes for which we collected or processed them;

– you have withdrawn consent on which the processing is based pursuant to Article 6(1)(a) or Article 9(2)(a) and there is no other legal basis for the processing;

– you have objected to the processing of your personal data in accordance with Article 21(1) of the GDPR. the General Data Protection Regulation and if there are no stronger legitimate reasons for the processing;

– the personal data have been unlawfully processed;

– the personal data must be erased in order to comply with a legal obligation under Union or State law to which the controller is subject

– personal data have been collected in connection with the offer of information society services referred to in Article 8(1).

Right to restriction of processing

It is your personal right to ask us to restrict the processing of your data, if you believe that the data held by EXPAT are inaccurate, if the processing is unlawful, but you do not want your data deleted to be used for limited use, if we no longer need your personal data, however you need them to enforce, exercise and defend legal claims, if you have filed a complaint regarding the processing of your personal data;

Right to data portability

It is your personal right to transfer the personal data relating to you that you have provided to us, in a simply usable form. Furthermore, it is your personal right to forward this data to a third party, without interference by EXPAT.

Right to object

Where personal data are processed for marketing purposes, the data subject shall have the right, at any time, to object to processing concerning him or her for marketing purposes; where an individual objects to processing for direct marketing purposes, the data are no longer processed for these purposes.

Right to lodge a complaint with a supervisory authority:

It is your personal right to lodge a complaint with a supervisory authority, in the country where you reside, where you work or where the alleged breach has occurred, if you believe that the processing of personal data relating to you violates the rules on the protection of personal data. For the territory of the Republic of Croatia, the supervisory authority for the protection of personal data, with its registered office at: Selska cesta 136, 10000 Zagreb, Croatia, web:, tel.: +385 1 4609 000.

Notification to the supervisory authority of a breach of personal data security

If there is a violation of the Privacy Policy, EXPAT is obliged to inform the competent authority thereof. When there is a suspicion that a criminal offence has been committed due to a violation, EXPAT is obliged to notify the police and/or the competent prosecutor’s office of the violation.

Right to withdraw consent

It is your personal right to withdraw your consent for data processing based on the same.

In relation to the withdrawal of consent to the processing of your personal data for the setting of “cookies” as stated above, please refer to our Cookie Notice.

Please note that in certain cases provided for by law, we are unable to comply with or fully comply with your requests to exercise your rights, e.g. to comply with our legal obligations, or for the purpose of setting up, exercising or defending legal claims, there is a possibility that we will have to keep certain of your Personal Data even after you have requested deletion.

Changes to this Privacy Policy

If we change the way we treat your Personal Information in connection with your use of our platform, we will update this Privacy Notice. We reserve the right to change our practices and this Privacy Notice at any time, so we encourage you to check the Privacy Notice frequently to be informed of any updates and changes to this Notice.

Contact information of the Controller

To ask questions or comment on this Privacy Policy and our data protection practices or to file a complaint about our compliance with applicable data protection regulations, please contact us by email:

We will take note and investigate any complaint about how we manage Personal Data (including a complaint that we have violated your rights under applicable personal data protection regulations).

January 2024

Subscribe to the Expat in Croatia Newsletter and get our FREE Croatia Starter Kit.
I'm already subscribed.