Privacy Policy

PETRAGROBENSKI.COM

Last updated: 21 October 2026

1. Data Controller

This Privacy Policy explains how personal data is collected, used, stored, and protected when you visit www.petragrobenski.com, contact us, subscribe to our newsletter, or purchase products and services available through the website.

The data controller responsible for processing personal data is:

MP ENTERPRISE d.o.o.
Registered office: Ulica Velog Jože 22, 52100 Pula, Croatia
OIB (Croatian Personal Identification Number): 56126323169
MBS (Court Register Number): 070159669
Email: petra.grobenski@gmail.com
Website: https://www.petragrobenski.com

In this Privacy Policy, the terms “we”, “us”, and “our” refer to MP ENTERPRISE d.o.o.

We process personal data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679 – GDPR) and applicable laws of the Republic of Croatia and the European Union.

2. What Personal Data Do We Collect?

Depending on how you interact with our website, we may process the following categories of personal data.

2.1. Information You Provide Directly

When you contact us through contact forms or email, we may process:

Your first and last name, if provided;
Your email address;
The content of your message and any information you choose to share with us;
Information necessary to respond to your enquiry or handle your request.

2.2. Order and Purchase Information

If you purchase products, digital content, or services through our website, we may process:

Your first and last name;
Your billing address and, where necessary, your delivery address;
Your email address and telephone number, where required to fulfil your order;
Information about the products or services ordered, prices, orders, and payment status;
Information necessary to issue invoices, fulfil contractual obligations, and process returns or complaints.

The information required depends on the type of product or service you order.

2.3. Payment Information

We use Stripe as a payment service provider for card payments, in accordance with the way payment processing is technically implemented on our website.

Depending on the transaction, Stripe may process information necessary to authorise, process, and confirm payments, prevent fraud, and fulfil related financial obligations.

We may receive transaction status information, transaction amounts, currency, payment references, and other information necessary to manage orders and maintain business records.

We do not make blanket claims about whether full payment card details are stored by us. The handling of such information depends on the configuration of the payment integration actually used.

2.4. Newsletter Information

If you subscribe to our newsletter, we process your email address and, where provided, your name.

We use this information to send new articles, updates, news, and other content covered by your subscription.

Where newsletter communications are used for marketing or the promotion of products and services, processing is carried out on an appropriate legal basis, including consent where required.

You may unsubscribe at any time by using the unsubscribe link included in our emails or by contacting us at petra.grobenski@gmail.com.

2.5. Technical Data and Website Usage Information

When you visit our website, certain technical information may be processed automatically, depending on the configuration of our web hosting, security tools, and other services in use.

This information may include:

IP address;
Date and time of access;
Browser type and version;
Device type and operating system;
Technical logs necessary for website security, diagnostics, and maintenance.

If analytics, audience measurement, or advertising tools are enabled, additional information about website usage may also be processed, subject to the configuration of those tools and applicable cookie and consent requirements.

2.6. Business Collaboration Information

If you contact us regarding advertising, sponsored content, affiliate partnerships, brand relationships, or other commercial activities, we may process your name, business contact details, company or brand name, correspondence, and information necessary to negotiate, enter into, and fulfil agreements.

Where a business partner is a legal entity, we may process personal data relating to its representatives and contact persons to the extent necessary for the business relationship.

3. Why Do We Process Personal Data?

We process personal data only for purposes for which an appropriate legal basis exists.

These purposes include:

Responding to enquiries – communicating with website visitors, readers, customers, and business partners.
Order fulfilment and contractual performance – processing purchases, delivering products or digital content, providing services, and handling returns and complaints.
Payment processing – confirming and recording transactions through Stripe and other payment service providers actually used.
Compliance with legal obligations – fulfilling accounting, tax, and other legal obligations applicable to our business.
Newsletter communications – delivering content you subscribed to and managing your subscription.
Website security and maintenance – identifying technical problems, unauthorised access, and potential misuse.
Analytics and content improvement – understanding how visitors use the website, where relevant tools are used and an appropriate legal basis exists.
Business collaborations – communicating with advertisers, brands, affiliate partners, and other business partners and fulfilling related agreements.
Protection of legal claims – establishing, exercising, or defending legal claims where necessary.

We do not use personal data for purposes incompatible with those described above without an appropriate legal basis.

4. Legal Bases for Processing

Depending on the activity concerned, we process personal data on one or more of the following legal bases:

Performance of a contract or pre-contractual measures – where the data is necessary to process an order, provide a service, or respond to a request before entering into a contract.

Legal obligation – where we are required to process or retain data under tax, accounting, or other applicable legislation.

Legitimate interests – where processing is necessary for our legitimate business interests, such as website security, fraud prevention, business communications, or the establishment, exercise, or defence of legal claims, provided that your rights and interests are appropriately considered.

Consent – where required, for example for certain marketing activities or non-essential cookies and tracking technologies.

You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

Where certain information is necessary to enter into or perform a contract or comply with a legal obligation, failure to provide that information may prevent us from processing an order, providing a service, or fulfilling the relevant legal obligation.

5. Cookies and Similar Technologies

Our website may use cookies and similar technologies to provide essential functionality, remember preferences, maintain security, and, where relevant tools are enabled, perform analytics and advertising activities.

Cookies may include:

Strictly necessary cookies – required for essential website functionality, security, or the provision of a service you have requested.
Functional cookies – used to remember certain preferences where those features are available.
Analytics cookies – used to understand website usage where analytics tools are implemented.
Marketing cookies – used for advertising or measuring advertising effectiveness where such tools are enabled.

Cookies that are not strictly necessary are activated only after obtaining appropriate consent where required by law.

You can change your cookie preferences through the available consent management tool, if implemented, or through your browser settings. Blocking certain cookies may affect some website functionality.

Further information about the cookies actually used, their providers, purposes, and storage periods is provided in our separate Cookie Policy, which should be read together with this Privacy Policy.

6. Who May Receive Your Personal Data?

We may make personal data available to third parties only where necessary for the purposes described in this Policy and where an appropriate legal basis exists.

Depending on the services used, recipients may include:

Stripe – for payment processing and payment management;
Web hosting and technical infrastructure providers – for website maintenance and security;
Business and communication service providers – for email, contact forms, and newsletter delivery, where used;
Accounting and professional advisers – for tax, accounting, and legal compliance;
Analytics and marketing providers – where such tools are actually implemented and an appropriate legal basis exists;
Delivery services and other service providers – where necessary to fulfil a particular order;
Competent authorities and courts – where required by law or necessary to establish, exercise, or defend legal claims.

Some providers may process personal data as processors acting on our instructions, while others may act as independent controllers. Their role depends on the specific service and processing activity.

We do not sell users’ personal data to third parties.

7. Transfers of Personal Data Outside the European Economic Area

Some service providers we use may process personal data outside the European Economic Area (EEA).

Where such transfers occur, we ensure that they comply with the GDPR and are based on an applicable transfer mechanism, such as an adequacy decision adopted by the European Commission or appropriate safeguards, including Standard Contractual Clauses where required.

You may contact us using the details provided in this Policy to request further information about relevant transfers and the safeguards applied.

8. How Long Do We Retain Personal Data?

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, unless a longer retention period is required by law or the data is necessary to establish, exercise, or defend legal claims.

We apply the following principles:

Enquiries and business correspondence: for the period necessary to respond to and resolve the enquiry, and for any additional period reasonably necessary for record-keeping or the protection of legal claims.
Order and purchase information: throughout the performance of the contract and for the period necessary to handle related claims, subject to applicable statutory retention periods for accounting, tax, and other records.
Newsletter information: until you unsubscribe, withdraw consent, or the applicable legal basis otherwise ceases to exist. Minimal information necessary to record your unsubscribe request may be retained where justified to ensure that your preference is respected.
Technical and security logs: for the period necessary for security, maintenance, and troubleshooting, depending on system settings.
Cookies: according to the periods determined by the type of cookie and the settings of the tools actually used.
Business partner information: for the duration of the business relationship and any additional period required to fulfil contractual or legal obligations.

After the applicable retention period expires, personal data is deleted or anonymised unless another valid legal basis justifies continued retention.

9. How Do We Protect Personal Data?

We implement appropriate technical and organisational measures to protect personal data, taking into account the nature of the data, the purposes of processing, and the risks involved.

These measures may include access controls, limiting access to authorised persons who need the information for their work, using available security settings provided by service providers, and maintaining appropriate procedures for protecting and retaining business records.

Payments are processed through Stripe in accordance with the configuration of the payment integration used. The security measures implemented by service providers do not replace our own obligations to protect the personal data we process.

Although we take reasonable steps to protect personal data, no method of transmission or storage over the internet can be guaranteed to be completely secure.

10. Your Data Protection Rights

Subject to the conditions and limitations set out in the GDPR, you may exercise the following rights:

Right of access – to obtain confirmation as to whether we process your personal data and to access that data.

Right to rectification – to request the correction of inaccurate personal data or the completion of incomplete data.

Right to erasure – to request the deletion of your personal data where the legal conditions are met. This right does not require us to delete information that we are legally obliged to retain.

Right to restriction of processing – to request restriction of processing in the circumstances provided for by the GDPR.

Right to data portability – where the legal conditions are met, to receive personal data you have provided to us in a structured, commonly used, machine-readable format or request its transmission to another controller.

Right to object – to object to processing based on legitimate interests on grounds relating to your particular situation. You may object to the processing of your personal data for direct marketing purposes at any time.

Right to withdraw consent – to withdraw consent where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

To exercise your rights, please contact us at petra.grobenski@gmail.com. To protect personal data, we may request additional information necessary to verify your identity.

We respond to requests without undue delay and generally within one month of receipt. Where permitted by the GDPR, this period may be extended by up to two additional months, taking into account the complexity and number of requests. You will be informed of any extension and the reasons for it.

11. Right to Lodge a Complaint

If you believe that the processing of your personal data does not comply with applicable data protection laws, you have the right to lodge a complaint with the competent supervisory authority.

In Croatia, the competent authority is:

Croatian Personal Data Protection Agency (AZOP)
Official website: https://azop.hr/

You may also contact us at petra.grobenski@gmail.com before lodging a complaint so that we can attempt to clarify and, where possible, resolve the issue.

12. Links to Third-Party Websites

Our website may contain links to third-party websites, including brands, retailers, hotels, service providers, social media platforms, and affiliate partners.

Once you leave our website, the processing of your personal data on other websites is governed by the privacy policies and practices of those providers. We recommend reviewing their privacy policies before providing them with personal information.

13. Affiliate Links, Advertising, and Commercial Collaborations

Our website may contain affiliate links, sponsored content, advertisements, and other commercial collaborations.

If you click an affiliate link and visit a third-party website, that third party may use its own cookies and other technologies in accordance with its privacy policy.

Where tracking tools, conversion measurement, or advertising technologies are used, personal data is processed in accordance with applicable laws and, where required, after obtaining your consent.

The presence of an affiliate link does not necessarily mean that we receive information about your purchase. This depends on the technical integration and the terms of the relevant affiliate programme.

14. Children's Privacy

Our website is not intended to collect children's personal data where there is no appropriate legal basis for doing so.

If we become aware that personal data has been collected in a manner that does not comply with applicable law, we will take appropriate measures.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business activities, technologies, or legal requirements.

The updated version will be published on this page together with the date of the latest revision.

We recommend reviewing this page periodically to remain informed about how we process personal data.

16. Contact Us

For questions, requests, or complaints concerning this Privacy Policy or the processing of personal data, please contact:

MP ENTERPRISE d.o.o.
Ulica Velog Jože 22
52100 Pula, Croatia

Email: petra.grobenski@gmail.com
Website: https://www.petragrobenski.com

This Privacy Policy applies from 21 October 2026, subject to verification and confirmation that it accurately reflects the actual activities, website functionalities, and service providers used on the website.

PRIVACY POLICY