V&H Vision / Privacy policy
Privacy policy
How V&H VISION d.o.o. processes the personal data of visitors and users of this site, under the General Data Protection Regulation (GDPR).
Controller
V&H VISION d.o.o. za projektiranje
Ozaljska ulica 108, 10000 Zagreb, Croatia
OIB 42180565619 · info@vhvision.hr · +385 98 477 766
We are not required to appoint a data protection officer. For any privacy question, write to info@vhvision.hr.
What data we process and why
We collect data only when you send it to us or when you visit the site (server logs and our own visit statistics). We do not use advertising tools or third-party analytics (such as Google Analytics): we count visits ourselves, on our own server, without cookies and without following you across sites or days. You download documents such as the grandstand drawing freely, without entering any details; we count downloads only as a daily total. We track nothing else.
If your browser sends a Do Not Track or Global Privacy Control signal, we do not count your visit at all. Search engine robots and the site administrator are not counted either.
| Processing | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Inquiries by form, email, phone or WhatsApp | name, email, phone, organisation or company, location, message; with the form also the IP address and time of sending (protection against abuse) | replying to the inquiry and preparing an offer | Art. 6(1)(b) GDPR (steps before a contract) and (f) (legitimate interest in replying and preventing abuse) | up to 2 years after the last contact, for possible follow-up questions on the same project; if we do business, see the Accounting row |
| Inquiries from the 3D configurators, for a standards analysis and for a check of your drawing | contact data as above, the configuration or hall details (dimensions, version, check results), the scope of the requested analysis and the drawings and other files you send us for a check | preparing an offer and calculation for your hall; the request confirmation (PDF) we send you by e-mail | Art. 6(1)(b) and (f) GDPR | as above; the inquiry, the files and the confirmation are stored on our server outside the public part of the site, and the confirmation download link works once and for at most 24 hours |
| Ordering and paying for services (standards check, design of the built-in equipment, bill of quantities) | company and e-mail, optionally name, phone, tax number or VAT ID and address for the invoice; the configuration from the 3D configurator or the scope from the offer; from Stripe the amount, status and identifier of the payment. We never see or store the card number or other card data: you enter them directly on Stripe’s page. | carrying out the order, preparing and sending the report or design, issuing the invoice | Art. 6(1)(b) GDPR (contract) and (c) (legal obligation to keep invoices) | 11 years from the end of the business year the document relates to (Croatian Accounting Act, Art. 10) |
| Accounting and tax (after we do business) | data on offers, contracts and invoices | keeping business books and invoices | Art. 6(1)(c) GDPR (legal obligation) | 11 years from the end of the business year the document relates to (Croatian Accounting Act, Art. 10) |
| VISION portal (app activation) | name, email, company, password (stored in protected form), licence, token and activated-computer data | user account and licence activation | Art. 6(1)(b) GDPR (contract) | while the account and licence exist, then as required by law |
| Server logs | IP address, time, requested page, browser | security and operation of the site | Art. 6(1)(f) GDPR (legitimate interest) | no longer than 2 months (server setting), then deleted automatically |
| Visit statistics (our own, without cookies) | which page was opened, its language, the domain of the site you came from, the campaign tag in the link (utm_source), the device type (phone, tablet or computer), the country only if the server recognises it itself; clicks on phone, e-mail, WhatsApp and external sites and inquiries sent, only as a number; so that the same visit is not counted twice, a short digest (hash) of the IP address and browser with a random value that changes every day | daily totals of which pages are read and where visitors come from, to improve the site | Art. 6(1)(f) GDPR (legitimate interest in improving the site); nothing is stored in your browser | the IP address and browser data are not written down; the digest and the daily random value are deleted the next day; only daily totals remain, which do not relate to any individual |
| YouTube videos | IP address and device data your browser sends to Google | showing a video you started yourself | Art. 6(1)(a) GDPR (consent you give by clicking the video) | Google is responsible for any further processing |
Who receives the data
The following process data on our behalf as processors (Art. 28 GDPR):
- MyDataKnox (Croatia): hosting of the website and the server. The site and the forms run on this server, and the inquiries, the files you send us, orders and server logs are stored on it.
- Microsoft Ireland Operations Ltd. (Ireland): Microsoft 365 e-mail. All form messages, the files that reach us by e-mail and the notices of orders and payments land in our mailbox info@vhvision.hr.
- Stripe (Stripe Payments Europe, Ltd., Ireland): card payment data; for carrying out the payment and preventing fraud Stripe is also an independent controller (see the next section).
Once we do business, our accounting service and authorities we are legally obliged to inform may receive data. We do not sell data or pass it on for advertising.
Third-party services, only when you click
We load fonts and the 3D library from our own server, so visiting the site sends no data to Google or other content delivery networks.
- YouTube (Google Ireland Ltd.): a video loads only when you click it, from youtube-nocookie.com. The legal basis is the consent you give with that click (Art. 6(1)(a) GDPR). Google then receives your IP address and may store cookies; Google is responsible for any further processing, and data may be transferred to the USA under the EU–US Data Privacy Framework. You withdraw consent by not starting further videos and clearing site data for youtube-nocookie.com in your browser; this does not affect videos already loaded. policies.google.com/privacy
- WhatsApp (WhatsApp Ireland Ltd.): the link opens WhatsApp only when you click it. If you write to us on WhatsApp, WhatsApp Ireland Ltd. also processes the messages under its own terms; data may be transferred to the USA (EU–US Data Privacy Framework and standard contractual clauses). whatsapp.com/legal
- Instagram (Meta Platforms Ireland Ltd.): links to our Instagram profile and posts open Instagram only when you click them. We may publish news from this site on the company’s Instagram profile and take posts from that profile into our news. Our server does this directly through Meta’s interface (Instagram Graph API): visiting this site sends no data about you to Meta, and photos and videos taken from Instagram are shown from our own server. When you use Instagram yourself, Meta Platforms Ireland Ltd. is the controller of that data; data may be transferred to the USA (EU–US Data Privacy Framework). privacycenter.instagram.com/policy
- Stripe (Stripe Payments Europe, Ltd., Ireland): card payment takes place on Stripe’s page checkout.stripe.com, to which we redirect you only when you click to pay; we do not load Stripe scripts on our pages. You enter your card data directly with Stripe; we never see or store it. Stripe processes the payment data on our behalf as a processor, and as an independent controller for carrying out the payment, preventing fraud and its own legal obligations. From Stripe we receive the payment confirmation (amount, status, payment identifier and e-mail). Data may be transferred to the USA (EU–US Data Privacy Framework and standard contractual clauses). stripe.com/privacy
Transfers outside the EEA
Microsoft and Stripe may give their group companies and sub-processors in the USA access to data. Such transfers rely on the EU–US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) and on the European Commission’s standard contractual clauses (Art. 45 and 46 GDPR). You can get a copy of the standard contractual clauses on request at info@vhvision.hr; they are also published by the European Commission.
For YouTube, WhatsApp and Instagram, which you start yourself, the transfer is described in the previous section.
Your rights
Under the General Data Protection Regulation (GDPR) you have the right to:
- access to your data (Art. 15)
- rectification (Art. 16)
- erasure (Art. 17)
- restriction of processing (Art. 18)
- data portability (Art. 20)
- objection to processing based on legitimate interest (Art. 21)
Right to objectYou may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (server logs, visit statistics, replying to inquiries) (Art. 21 GDPR). For the visit statistics it is enough to turn on Do Not Track or Global Privacy Control in your browser.
You may withdraw consent (YouTube videos) at any time; this does not affect the lawfulness of earlier processing.
Send your request to info@vhvision.hr; we reply within one month; in complex cases we may extend this by two further months and will tell you so. You may also lodge a complaint with the supervisory authority: Croatian Personal Data Protection Agency (AZOP), Ulica Metela Ožegovića 16, 10000 Zagreb, Croatia, azop.hr.
Other
Providing data is voluntary, but without contact data we cannot reply. For the VISION portal, name, email and password are required to open an account and activate a licence. We take no automated decisions about you; the configurator checks concern the stand or curtain, not you.
The site uses HTTPS. Inquiries are stored outside the public part of the server and sent to our email; only authorised company staff can access them.
We may change this policy; the current version is always on this page. Cookies are described on the Cookies.
Effective from: 8 November 2026