Privacy policy

Updated: October 2026. The Croatian version is the reference text.

1. Who processes your data

The controller is „GESTALTeria“ – Udruga za razvoj kvalitetnijeg življenja, Krešimirova 8, 51000 Rijeka, Croatia, OIB 04172236699, represented by its president Tamara Dukić. For any question about your data, write to gestalteria.udruga@gmail.com. The association is not required to appoint a data protection officer.

2. Cookies, fonts and tracking

We use no tracking cookies and no visitor analytics, and we don’t store IP addresses. Fonts are loaded from our own domain, so your browser does not contact Google. When you send a form, Cloudflare Turnstile checks that a person, not an automated program, is sending it; for this check Cloudflare processes technical browser data and may set a strictly necessary security cookie, and we only receive the result (yes/no). The survey keeps your answers only in your browser (localStorage) until you send them; they are removed from your device once sent.

3. What we collect, why, and for how long

• Membership application: full name, OIB, date of birth, joining date and membership category go into the members’ register that the Associations Act requires us to keep (legal obligation, GDPR Art. 6(1)(c)). Fees are processed to carry out your membership (Art. 6(1)(b)). Email, phone and address are processed with your consent (Art. 6(1)(a)). Contact details are deleted within 8 days after membership ends or consent is withdrawn (Art. 9 of our Statute); register data is kept as long as the law requires. The online application is for people aged 18 or over; younger people join with a parent’s or guardian’s consent, directly through the association.
• Payments (fees and donations): amount, date, payer’s name and, for bank transfers, the details on the bank statement. Kept for the periods set by the accounting rules for non-profit organisations (legal obligation; usually 11 years). We issue a donation receipt on request.
• Anonymous message: the message and, if you leave one, a contact for our reply, so we can help you (legitimate interest and your request). Deleted at the latest 12 months after the case is closed.
• Psychotherapy request: name or nickname, contact, type of conversation and message. Because the message may include health information, we process it only with your explicit consent (GDPR Art. 9(2)(a)). Only the psychotherapist who contacts you sees it. Deleted at the latest 12 months after the last contact; if therapy is arranged, session records are kept under professional rules.
• Workshop sign-up: name and email, to organise the workshop (your request). Deleted after the workshop unless the law or a funder requires an attendance list.
• Survey: anonymous. We don’t ask your name and don’t store your IP address; answers cannot be linked to you and are used only in aggregate for research and project reporting. Please don’t write names or details that could identify you or others in the free-text fields.
• Contact after the survey (optional): an email you leave at the end of the survey is stored separately from your answers, with the date only, so it cannot be linked to them. We use it only to tell you about workshops or offer help, with your consent. Deleted when you withdraw consent, and at the latest when the project ends.

4. Who else processes data for us

• Cloudflare (website hosting, database in the EU and the Turnstile check).
• Resend (sending notifications of new submissions to the association’s email).
• Google (the association’s Gmail inboxes, where notifications and your emails arrive).
• Stripe (card payments; Stripe is an independent controller for payments, and we never see card details).

The association has data protection terms with these processors. Some are based in the USA; transfers rely on the EU–US Data Privacy Framework and standard contractual clauses. We never sell your data or share it for marketing. Only association members who need it for their work have access.

5. How we protect data

All communication with the site is encrypted (HTTPS). Access to the database and inboxes is limited and protected by two-step verification. We don’t store IP addresses or keep visit logs.

6. Your rights

You have the right to access your data and to rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interest. You can withdraw consent at any time, without affecting processing before the withdrawal. Send requests to gestalteria.udruga@gmail.com; we reply within one month. If you believe your rights have been breached, you can complain to the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr.

7. Changes

We update this policy when the way we process data changes. The date of the last update is shown at the top.