1. Controller
HAUSPOST j.d.o.o.
Kninska 15
22000 Šibenik
Croatia
Contact: privacy@hauspost.org
2. Personal data we process
Depending on your consent and technical configuration, we may process device and browser information, approximate location, referring pages, pages viewed, interactions, timestamps and similar usage information.
When you request access, we process your email address, authentication events, access status, account preferences and saved favourites. If onboarding is required, we also process the information you submit during onboarding.
When you submit a data request or contact us, we process your name, work email, company or organisation, the content of your request and subsequent correspondence.
The website may use local storage or strictly necessary technologies to keep you signed in, store interface preferences, remember favourites, protect forms and maintain the security of the service.
3. Why we process personal data
- Provide sign-in, account features and access to the STR Index.
- Respond to data requests, commercial enquiries and other communications.
- Measure website use with Google Analytics after consent.
- Meet legal obligations and handle legal claims.
4. Google Analytics
When enabled, we use Google Analytics 4, a web analytics service provided in Europe by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics helps us understand how visitors use the website and how the website performs.
Subject to your consent, Google Analytics may use cookies or similar identifiers and process information such as pages viewed, interactions, browser and device characteristics, approximate location, referrer information, date and time, and technical identifiers. Google states that IP addresses collected from users in the EU, Switzerland and the United Kingdom are discarded before the data is logged through regional domains and servers.
Google may process data through affiliated companies and service providers, including outside the European Economic Area. Where applicable, transfers may rely on the EU–US Data Privacy Framework and/or contractual safeguards.
You may refuse or withdraw analytics consent at any time through the website’s cookie settings. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
Further information is available in Google’s privacy policy and Google Analytics privacy documentation.
5. Service providers and recipients
We may use service providers for hosting, authentication, email delivery, analytics, form processing, security, customer support and infrastructure. These providers process data only as necessary to provide their services and under appropriate contractual safeguards.
We may also disclose data where required by law, to competent public authorities, or where necessary to establish, exercise or defend legal claims.
6. Retention periods
- Account and profile data: For as long as the account remains active, then deleted or anonymised within 30 days after account closure. Residual copies may remain in protected backups for up to 90 additional days.
- Authentication and security logs: Up to 12 months, unless a longer period is needed to investigate abuse, fraud or a security incident.
- Data requests and general enquiries: Up to 24 months after the last substantive interaction. If the enquiry leads to a contract or transaction, relevant records may be retained for the contractual relationship and applicable statutory periods.
- Customer, invoice and accounting records: At least 11 years where the records form part of accounting documentation, calculated in accordance with applicable Croatian accounting rules.
- Consent records: Up to 5 years after consent is withdrawn or replaced, where needed to demonstrate compliance.
- Privacy-rights requests: Up to 3 years after the request is closed, unless a longer period is needed for a legal claim.
- Cookie preferences: 12 months, or until you change your choice or the cookie policy version changes.
- Google Analytics event data: 14 months once Google Analytics is enabled, subject to the configuration in the Google Analytics property. Aggregated reports may be retained longer where they no longer identify an individual.
7. Your rights
Subject to the conditions of the GDPR, you may have the right to:
- access your personal data;
- correct inaccurate or incomplete data;
- request deletion or restriction of processing;
- object to processing based on legitimate interests;
- receive certain data in a portable format;
- withdraw consent at any time; and
- lodge a complaint with a supervisory authority.
8. Security
We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration or disclosure. No internet-based service can guarantee absolute security.
9. Changes to this policy
We may update this privacy policy when our services, providers or legal obligations change. The latest version will be published on this page with an updated effective date.
Effective date: 3 August 2026