Privacy Policy
Last updated: 6 August 2026
This policy explains what personal data Octopod Productions d.o.o., Ljudevita Gaja 43, Mala Gorica, 10431 Sveta Nedelja, Croatia ("Octopod", "we") collects through octopod.productions, why, on what legal basis, and what you can do about it. It is written under the EU General Data Protection Regulation (GDPR) and the Croatian Act implementing it (Zakon o provedbi Opće uredbe o zaštiti podataka, NN 42/2018).
This is a marketing website. There are no user accounts, no payments and no profiling. We do not sell personal data, and we do not use it for automated decision-making.
1. Who is responsible
The data controller is Octopod Productions d.o.o., Ljudevita Gaja 43, Mala Gorica, 10431 Sveta Nedelja, Croatia, OIB 92257091536. For any question about this policy or your data, write to us.
We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR.
2. What we collect, why, and for how long
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Name, email address and message you type into the contact form | To read your enquiry and reply to it | Art. 6(1)(b) — steps at your request before a contract; or Art. 6(1)(f) legitimate interest in answering enquiries | In our mailbox for as long as the correspondence is live, and up to 2 years afterwards so we can pick a conversation back up |
| Your IP address when you submit the form | Rate-limiting, to stop the form being used for spam | Art. 6(1)(f) — legitimate interest in keeping the service working | Held in server memory for 1 hour, then discarded. It is never written to disk or stored with your message |
| Analytics data: pages viewed, approximate location, device and browser, referring site | To see which pages are read and improve them | Art. 6(1)(a) — your consent, given through the cookie banner | 14 months in Google Analytics, then deleted automatically |
| Your cookie choice | So we do not ask again on every visit | Art. 6(1)(f) — legitimate interest in honouring your choice; storing it is also strictly necessary under Art. 43 of the Croatian Electronic Communications Act | In your browser until you clear it |
We collect nothing else. There is no account to create, no newsletter, no advertising or tracking pixel, and no profile built about you.
3. Who else sees it
We use three service providers, each acting as our processor under Art. 28 GDPR:
- **Vercel Inc.** (USA) — hosting. Processes requests to this site, including IP addresses, in order to serve pages.
- **Resend (Plus Five Five, Inc.)** (USA) — delivers the contact form as an email to us. It sees your name, email and message in transit.
- **Google Ireland Ltd.** — Google Analytics. Only runs if you accept analytics cookies.
Beyond these, we disclose personal data only where the law requires it. We do not share or sell your data to anyone for their own purposes.
4. Transfers outside the EEA
Vercel and Resend are established in the United States, so your data may be processed there. Those transfers rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework. You may ask us for a copy of the safeguards in place.
5. Your rights
Under the GDPR you have the right to:
- **Access** — get a copy of the personal data we hold about you (Art. 15).
- **Rectification** — have inaccurate data corrected (Art. 16).
- **Erasure** — have your data deleted (Art. 17).
- **Restriction** — have processing limited while a dispute is resolved (Art. 18).
- **Portability** — receive data you gave us in a machine-readable form (Art. 20).
- **Object** — object to processing based on legitimate interest, including rate-limiting logs (Art. 21).
- **Withdraw consent** — turn analytics off at any time via *Cookie Settings* in the footer. This does not affect processing that happened before you withdrew (Art. 7(3)).
Write to us and we will respond within one month. In practice, the fastest way to have your contact-form data erased is to ask us — it lives in a mailbox, not a database.
6. Complaints
If you think we have handled your data badly, tell us first — we would rather fix it. You also have the right to complain to the Croatian supervisory authority: **Agencija za zaštitu osobnih podataka (AZOP)**, Selska cesta 136, 10000 Zagreb, azop.hr. Complaints about cookies and similar storage may also go to **HAKOM**, which supervises the Electronic Communications Act.
7. Children
This site is not aimed at children. Under Art. 19 of the Croatian implementing act, a child must be at least **16** for consent to information society services to be valid on their own; below that age, consent must come from a parent or guardian. If you believe a child has sent us personal data, write to us and we will delete it.
8. Security
The site is served over HTTPS and the contact form is rate-limited and filtered for spam. No transmission over the internet is ever completely secure, so please do not send us anything confidential through the contact form — say that you would like to talk, and we will arrange a better channel.
9. Links to other sites
Where we link out — to a festival, a broadcaster, a film catalogue — that site's own privacy policy applies. We have no control over what they do.
10. Changes
If we change this policy we will update the date at the top. Where a change materially affects you, we will make it obvious on the site rather than expecting you to notice.