Privacy Policy
This policy describes which personal data we collect, why, on what legal basis, and for how long. The data controller is Strani Radnici d.o.o. (Croatian tax ID 85486252651); you can exercise your rights under the GDPR by writing to info@straniradnici.hr.
#1. Data controller and contact
The controller of your personal data is:
Strani Radnici d.o.o. (brand: Foreign Workforce)
Radnička cesta 80, 10000 Zagreb, Croatia
Croatian tax ID (OIB): 85486252651
Email: info@straniradnici.hr
Phone: +385 91 600 6009
What this means for you: any question about your data, exercising your rights or a complaint goes to info@straniradnici.hr. We respond within the statutory 30-day deadline.
#2. What data we collect, why, and for how long
| Data category | Purpose | Legal basis (GDPR Art. 6) | Retention |
|---|---|---|---|
| Name, email, phone | Replying to enquiries via the contact form | 1.b — pre-contractual steps | 24 months from last contact |
| Company name, OIB, contact person (employers) | Recruitment and worker assignment | 1.b — performance of a contract | 11 years (Croatian tax rules) |
| CV, work history, certificates (candidates) | Selection and presentation to employers | 1.a — consent; 1.b — performance of a contract | 2 years from last application |
| Technical data (IP, user-agent, timestamps) | Security, abuse prevention (contact-form rate-limit) | 1.f — legitimate interest | 10 minutes (in-memory rate-limit) |
| Analytics (GA4, anonymised IP) | Measuring site usage, optimisation | 1.a — consent | 14 months (Google default) |
#3. Recipients and processors
We do not sell your data to third parties. We share it only with carefully selected processors that help us deliver the service:
- SendGrid Inc. (Twilio, USA) — email delivery from the contact form. Transfer to the US is covered by Standard Contractual Clauses (SCC) and the EU-US Data Privacy Framework.
- Google Ireland Ltd. — Google Analytics 4 (only with your consent). IP anonymisation (
anonymize_ip: true), Consent Mode v2. - Replit, Inc. (USA) — hosting for the website and the API. SCC + DPF.
- Employers to whom we present candidates — only with your explicit consent for each application.
We have a Data Processing Agreement (DPA) in place with every processor, in line with GDPR Art. 28.
#4. International data transfers
Some processors (SendGrid, Replit) operate infrastructure outside the EU/EEA — primarily in the United States. The transfer is legally secured through:
- The EU-US Data Privacy Framework (DPF) — European Commission decision C(2023) 4745;
- Standard Contractual Clauses (SCC) — Commission Implementing Decision (EU) 2021/914.
For more information, see the privacy policies of those processors.
#5. Your rights under the GDPR
You have, at any time, the right of:
- Access to your data (Art. 15) — you may request a copy of everything we hold about you;
- Rectification of inaccurate or incomplete data (Art. 16);
- Erasure ("right to be forgotten", Art. 17) — subject to legal exceptions;
- Restriction of processing (Art. 18) where you contest accuracy or lawfulness;
- Data portability (Art. 20) — a structured export of your data;
- Objection to processing based on legitimate interest (Art. 21);
- Withdrawal of consent at any time (Art. 7) — without affecting the lawfulness of prior processing.
How to exercise a right: send a request to info@straniradnici.hr, or in writing to Radnička cesta 80, 10000 Zagreb, Croatia. We verify identity so we don't disclose data to the wrong person. We reply within 30 days.
#6. Complaint to the supervisory authority (AZOP)
If you believe our processing breaches the GDPR or the Croatian implementing act, you have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP):
AZOP — Personal Data Protection Agency
Selska cesta 136, 10000 Zagreb, Croatia
Email: azop@azop.hr
Web: azop.hr
Before complaining to AZOP, please contact us first — most misunderstandings can be resolved without a formal procedure.
#8. Changes to this Privacy Policy
We update this policy when laws, our practices, or the list of processors change. Material changes are announced in advance via the "Version X.Y" badge at the top of the page and, where possible, by email to registered users.
Current version: 2.0 (effective May 10, 2026).
