Controller
Estelluxe d.o.o., Vilima Muhe 1, 44250 Petrinja, Croatia, OIB 54086891147. Contact: info@brutaldigital.agency.
Data we process
Contact and project information you submit, technical security logs, consent choices and, for approved clients, account, project, message and file metadata.
Purposes and legal bases
We process inquiries to take steps before a contract, deliver services under a contract, protect systems based on legitimate interests, meet legal obligations and load optional analytics or advertising only with consent.
Recipients and processors
Data may be processed by hosting, email, analytics, payment or infrastructure providers only as needed. International transfers are protected through applicable safeguards where required.
Retention
Unsuccessful inquiries are normally deleted or anonymised after 24 months. Contract and accounting records are kept for legally required periods. Client project data is retained for service delivery and a reasonable support/archive period. Security logs are kept only as long as needed.
Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, portability or objection, and withdraw consent at any time. You may also contact the Croatian Personal Data Protection Agency.
Security
We use access controls, secure sessions, password hashing, validation, protected file storage and operational logging. No internet service can promise absolute security.
Automated decisions
We do not make solely automated decisions that produce legal or similarly significant effects from website inquiries.
Updates
We may update this policy when services or legal requirements change. The current version is dated 15 July 2026.