Privacy Statement

Insignum d.o.o.
Rudeška cesta 146
10000 Zagreb
Croatia
Phone: +385 1 777 0 111
E-mail: voditeljgdpr@insignum.hr

Purpose / legal basis: Data you provide via the contact form, phone, e-mail or pickup request is used solely to handle your enquiry. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in responding to customers and visitors), or Art. 6(1)(b) where processing is necessary for pre-contractual steps or performance of a pickup service contract.

Recipients: We generally do not share data outside Insignum. Processors (e.g. courier for pickup) act on our instructions under Art. 28 GDPR. Where parts of a request must be forwarded to partners, we anonymise where possible and seek your consent before sharing personal data further.

Retention: All data collected via contact requests and device pickup organisation is deleted or anonymised within 90 days of our last reply, or of the completion of transport and device delivery.

Purpose / legal basis: When you hand in a device for repair, we process data from the work order to conclude and perform the service contract (Art. 6(1)(b) GDPR). After the contract is performed, we keep data to meet legal obligations (accounting and tax, Art. 6(1)(c) GDPR) and to establish, exercise or defend legal claims (Art. 6(1)(f) GDPR). You can check work-order status at https://insignum.hr/radni-nalozi/ or in the mobile app by entering the work-order number and the unique code from the intake receipt, or by scanning the QR code; that is the same processing, not a new purpose.

Data categories: data about you (name, surname, phone, address) and device identifiers (e.g. IMEI, serial number, model). We do not copy or store content from the device (photos, messages, files, etc.).

Recipients: Data is processed by Insignum staff and, where needed, processors (IT/hosting) under Art. 28 GDPR. For warranty repairs we share device identifiers and, where necessary, data required for the warranty process with the manufacturer or its authorised representative. We send your name, surname and phone to the manufacturer for a satisfaction survey only if you consented on the work order (Art. 6(1)(a) GDPR); you may withdraw that consent.

Retention: For out-of-warranty repairs we keep data about you and device identifiers for 11 years from the end of the financial year in which the work order was booked. For warranty repairs we keep data about you for 90 days after you collect the device, or, if the device is not collected, 90 days from the notice that it is ready for collection; we keep device identifiers for 6 years from the end of the financial year in which the work order was booked. After the period expires we delete or anonymise the data unless further retention is legally required. You may withdraw manufacturer-survey consent earlier.

Purpose / legal basis: When you place an order we process data needed to perform the contract (name, address, phone, e-mail, order details, payment and delivery method). Legal basis: Art. 6(1)(b) GDPR, and where applicable Art. 6(1)(c) for statutory obligations (e.g. accounting).

Payment: We do not store card numbers on our server. Card payments are processed via Corvus Pay (Corvus info d.o.o., Buzinski prilaz 10, 10010 Zagreb, Croatia) under their rules. Bank transfer uses data you enter at checkout.

Recipients: Processors may include Corvus Pay (payment), GLS or other carriers (delivery), and IT/hosting providers. Art. 28 GDPR agreements are in place where required.

Retention: Order and customer data are kept as long as needed to fulfil the contract, warranty and complaint periods and statutory business record obligations. Afterwards data is deleted or anonymised unless further retention is legally required.

Account: If you register, we process account data (e.g. name, e-mail, address) to provide access to orders and the shop. Legal basis: Art. 6(1)(b) GDPR. Inactive accounts (no login or order) are automatically deleted after 90 days of inactivity.

Newsletter: Marketing e-mails are sent only with your consent (Art. 6(1)(a) GDPR). You may withdraw consent via the unsubscribe link in e-mails or by writing to webshop@insignum.hr.

Purpose / legal basis: When you visit insignum.hr, our web server automatically records technical visit data (e.g. IP address, date and time, requested URL, referrer, browser type / user agent, response status). We use this for site security, abuse detection and basic visit statistics (page views, popular pages). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, stable operation of the website).

Data categories: IP address, access date/time, page URL, referrer, user agent, HTTP status. This processing does not require consent via the cookie popup because it is not stored as cookies in your browser.

Recipients: Logs are stored and processed by our hosting provider (Cyber Folks) as a processor under Art. 28 GDPR. We generate statistics (Awstats / Webalizer) from these server-side logs; we do not use Google Analytics or similar third-party tools that set browser cookies.

Retention: Logs are kept for the period defined by the hosting provider, typically several months, unless longer retention is required to resolve a security incident or legal claim.

This website uses cookies — small files stored in your browser. They help the site work, remember settings and, with consent, basic order-related traffic attribution.

You can manage consent via the popup or bar shown when you visit the site (e.g. “Settings”). Necessary cookies remain always active. See What are cookies? and the on-site consent settings for details.

7.1 Cookie categories we use

Necessary — always active (Art. 6(1)(f) GDPR): consent cookie (cookieyes-consent) storing your cookie choices, WooCommerce cart/session, WordPress login test cookie, Google reCAPTCHA (_GRECAPTCHA) for form protection.

Functional — e.g. insignum_lang (HR/EN); set with consent or legitimate interest depending on configuration.

Analytics — WooCommerce Order Attribution / Sourcebuster (sbjs_*); with consent (Art. 6(1)(a) GDPR).

Advertisement, Performance and Other — currently no active cookies in these categories.

We do not use Google Analytics or advertising-network cookies (e.g. Meta/Facebook Pixel).

Recipients: Technical providers required to operate the site (e.g. Google reCAPTCHA). Processor agreements under Art. 28 GDPR where applicable.

7.2 Cookie retention

Session cookies are removed when you close the browser. Persistent cookies last until their expiry shown in the on-site consent settings or until you delete them. You may change consent in the cookie popup.

Under Art. 15(1) GDPR you may request free information about your personal data. You also have rights to rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), objection (Art. 21), data portability (Art. 20) and withdrawal of consent (Art. 6(1)(a)) without affecting prior lawful processing.

You may lodge a complaint with a supervisory authority (AZOP). For requests and questions contact us using the details in section 9.

Insignum d.o.o.
Rudeška cesta 146
10000 Zagreb
Croatia
Phone: +385 1 777 0 111
E-mail: voditeljgdpr@insignum.hr