Ekspertos Privacy Policy

Updated 01 February, 2025

1. Introduction

This website (www.ekspertos.eu) is owned and operated by Jezgra Neo j.d.o.o. (trading as CoreNeo). Velimira Škorpika 7a, 22000 Šibenik, Croatia (‘’Jezgra Neo’’, “Ekspertos’’, ’’CoreNeo”, “we”, “our”, or “us”). This Privacy Policy outlines how we collect, what information we gather, and the reasons for collecting it, how we use it, the duration of storage, and the measures we have in place to protect your privacy. As the data controller, we are responsible for your personal data, including the processing activities conducted by our subcontractors under our instructions.

We maintain the confidentiality of your personal data. If you have any questions regarding how we handle personal data, please contact us. The primary contact for privacy matters at our organization is the Data Protection Officer, who can be reached via email at gdpr@ekspertos.eu.

You have the right to file a complaint with the Croatian Personal Data Protection Agency (AZOP), the supervisory authority for data protection issues in Croatia (https://azop.hr/).

This Privacy Policy should be read in conjunction with our Cookies Policy.

We reserve the right to amend this Privacy Policy, along with other related GDPR documents, in compliance with the European Union’s General Data Protection Regulation (Regulation 2016/679) and Croatian GDPR laws (NN 42/2018).

2. How We Collect Your Personal Data

Personal data encompasses any information that can identify you, either directly or indirectly, through various identifiers or unique characteristics specific to you.

We collect only the information that is necessary, relevant, and sufficient for the purposes you provide it for. This Privacy Policy applies to personal data we receive through:

      • Our website: https://www.ekspertos.eu/
      • Our contact channels: When you provide personal information via our “Contact Us” form on our website, or through email and/or phone.
      • Applying for a position: When you send us an application for employment when applying for a position at our company.
      • When you place an order: When you place an order, or open an account with us. In order to process orders, we require your contact details, invoice/delivery address, and payment information (e.g. credit card information). We reserve the right to perform a credit check when we receive an order. We provide detailed information during the checkout process.
      • When you subscribe to a newsletter, we collect and process the following data: when signing up to our newsletter, we collect the following data:
            • Your title;
            • Your First and Last names;
            • Your email address;
            • Please be aware that we conduct anonymous link tracking for statistical purposes.

We may collect your personal data in the following ways:

      • Directly from you: When you interact with us directly, correspond with us, or submit information via email, phone, or social media.
      • Automatically: When you access and browse our website, we collect information about your usage and activity using technologies such as cookies and other tracking technologies.
      • Public sources: Information that is publicly available.

Our website may contain links to third-party websites, plug-ins, and applications. Following these links or enabling these connections may allow third parties to collect or process your data. Please note that we do not control these third-party websites and are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party sites you visit.

3. Registration / customer account

You have the option to create an account on our website by providing certain personal information. A customer account allows you to view your order history and save your information to simplify future orders, so you don’t have to re-enter details each time.

Account registration is required to fulfil a contract (through our online shop) or to initiate pre-contractual actions.

We apply the principles of data minimization, meaning only the essential information is required for account registration. Additional fields are optional and clearly marked as such.

When placing an order, we require an invoice address (title, first name, last name, postal address) and, if applicable, a separate shipping address.

Upon registering an account, we also collect your IP address and the date and time of registration for technical reasons. An account is created when you click the “Register” button in the form.

Your password is encrypted and cannot be viewed by our employees. If you forget it, we cannot retrieve it for you. Instead, you can click “I forgot my password” to receive a new one via email. Please note that our staff will never ask for your password, and you should never share it with anyone.

Once registered, your data is stored securely in your customer account. By logging in with your email address and password, you can access your account, place orders, review your order history, and update your invoice and shipping addresses. Our customer service team is also available to help you update this information. You may delete your account at any time.

At Ekspertos, we ensure that only personnel within our organization who need access to your data for their operational duties can view it. Your personal data will only be used for its intended purpose and will not be shared with third parties unless necessary.

If you use your private address as the shipping address, it will be saved for future orders. You may delete this address from your account settings if you prefer not to store it.

For enhanced security, we provide the option to use multifactor authentication (MFA) in our webshop. This means logging in requires an additional authentication method (e.g., token) along with your login credentials. To streamline future logins, you can opt to save your device’s authentication in local storage after completing MFA once. Specifically, we collect and process the following data:

      • User agent header
      • Random numbers
      • Unique local user ID
      • Timestamp

To enable this, we require your consent (Art. 6 Para. 1(a) GDPR), which you can provide when you first visit our website.

You can revoke your consent at any time without explanation, though this will mean completing full MFA every time you log in.

4. Personal Data We Collect

Ekspertos processes personal data for the following groups:

Website Visitors

      • Geo-location, IP address, and cookies (For more details, please see our Cookie Policy).

Job Candidates

      • Data collected through job applications or unsolicited applications, including:
          • Personal Information: Name, address, email, phone number.
          • Professional Data: Information from cover letters and CVs/resumes (such as education, training, and previous employment details).

Potential Clients

      • Name, email, and/or phone number.

Newsletter Subscribers

      • Email address and cookies.

5. Newsletter

You can subscribe to our newsletter via our website. The email address, title, and name provided during the registration process are used to send you personalised newsletters.

All data required to subscribe to our newsletter is subject to our policy regarding data retention. Due to technical and legal reasons, we will also process your IP address.

For newsletter registration services, we rely on third-party services provided by Mailchimp, and/or Hubspot, with whom we have concluded all contracts required under applicable data protection legislation.

You may cancel your newsletter subscription at any time via the unsubscribe option provided in each newsletter and thus revoke your consent to your data being processed. You also have the option to unsubscribe directly via our website within your My Account.

6. Online shop

The data you provide when you submit an order is processed exclusively for the purpose of fulfilling our contractual obligations to you, unless you have given your consent for us to process your data for other purposes, as well.

The information you provide when placing an order is processed solely for the purpose of fulfilling our contractual obligations to you, in accordance with Article 6(1)(b) of the EU GDPR. Should you consent to additional uses, your data may be processed for other purposes as well.

We adhere to the principles of data minimization, meaning we only collect the information necessary to fulfil our contractual obligations—such as your name, postal address, email address, and payment details based on your chosen method—or as required by applicable law.

For technical and legal reasons, we also process your IP address. Without this data, we are unable to process your order and may be forced to decline it or terminate any existing contract. You may, of course, provide optional information at your discretion.

7. Customer and Supplier data

If a contractual relationship exists outside of our website and online shop, we may process the following personal data:

      • Contact information: This includes first and last names of current and former contacts (including titles and suffixes), the customer’s company name and address (employer), mobile and landline numbers (including extensions), email addresses, and fax numbers.
      • Work-related details: Such as your position within the company and department.
      • Bank account information: As needed, including the account holder’s first and last names in the case of a SEPA direct debit mandate.
      • Preferred payment system and, if applicable, credit history and behaviour.
      • Other relevant details: Date of birth, period of employment, and additional information you may provide for customer care purposes.

This personal data is typically collected directly from you during the initiation or duration of a contractual relationship.

In certain exceptional cases, we may also obtain personal data from other sources, such as credit agencies, particularly when we need to assess your credit history and behaviour.

7.1 Purposes and Legal Bases for Data Processing

We process your personal data in full compliance with the EU GDPR and all other applicable data protection regulations. This applies not only to data collected through our website but also to any data collected outside of it.

Your personal data is primarily processed to carry out pre-contractual measures (e.g., preparing quotes for products or services) and to fulfil our contractual obligations, such as delivering services, processing orders, and handling payments, in accordance with Article 6(1)(b) of the EU GDPR. Additionally, we may process your data when required by law, for instance, for tax purposes, under Article 6(1)(c) of the EU GDPR. These purposes are consistent with the reasons for which your data was initially collected.

Your consent also serves as a legal basis for processing your data (Article 6(1)(a) of the EU GDPR). Before you provide consent, we will inform you of the specific purpose of the data processing and your right to withdraw consent, as outlined in Article 7(3) of the EU GDPR.

For data processing related to criminal convictions and offences, we comply with the provisions of Article 10 of the EU GDPR.

7.2 Data Recipients / Categories of Recipients

We work with third-party service providers to facilitate essential business operations. All providers have entered into appropriate agreements to ensure compliance with data protection standards.

These third parties include logistics companies and couriers responsible for shipping and deliveries, as well as financial institutions and consultancies that help us verify order-related information. Additionally, our departments may rely on specialized support from manufacturers’ and partners’ IT experts for product-specific needs. Where necessary for project-specific purposes—such as project registration, quote preparation, or order processing—your data may be shared with the manufacturers of the quoted or ordered products, even if they are based outside the EU.

For payment processing, we may share relevant data with credit agencies, trade organizations, or financial institutions to assess creditworthiness and payment history.

To streamline processes, we may also process your personal data using cloud-based services (e.g., for more efficient communication and contract management). All necessary agreements to comply with applicable data protection laws are in place. If a cloud service provider is located outside the EU/EEA, we ensure compliance with Article 44 and subsequent provisions of the EU GDPR to maintain an appropriate level of data protection. We implement technical and organizational measures to ensure that only authorized personnel have access to your data for fulfilling contractual and legal obligations.

8. Goals of and Legal Basis for Processing

We process your personal data based on one or more legal grounds.

Depending on the data collected, we process personal data for the following purposes:

      • To comply with legal obligations
      • To provide and perform our services
      • To provide you with the necessary information
      • For marketing purposes or to send you information about our services via newsletter
      • To enhance practicality and efficiency using cookies
      • To process job applications

All personal data collection is based on one of the following:

      1. Consent of the individual sharing the data
      2. Performance of a contract to which the individual is a party
      3. Compliance with a legal obligation
      4. Legitimate interests of CoreNeo or a third party
      5. Vital interests of the individual or another person, or the public interest

We will not use your data for any purpose or on any basis other than those listed above. If we need to process personal data for other reasons, we will explicitly seek your permission.

We also collect information you provide when you cooperate with us or use our services, which is necessary for contract execution. This includes data necessary for delivering contracted services, issuing invoices, proving authority to enter into a contract, and data collected during communication with us (e.g., contact information). We process this data for the duration of our contractual relationship.

9. Advertising purposes

At Ekspertos, we aim to maintain strong relationships with our customers and provide you with relevant product and service information, in line with Article 6 Para. 1(f) EU GDPR. This means we may use your data to send you promotional emails with offers and updates, as well as customer satisfaction surveys.

If you prefer not to receive such communications, you can opt out of having your personal data used for direct marketing at any time. This also includes any profiling related to direct marketing activities. Upon receiving your objection, we will stop processing your data for this purpose.

You can object free of charge and without needing to provide a reason or fill out a form. Simply contact us by email at gdpr@ekspertos.eu, or by mail at Jezgra Neo j.d.o.o., Velimira Škorpika 7a, 22000 Šibenik, Croatia.

10. Social Media

All personal data collected through Ekspertos’s social media platforms, as defined by the GDPR, is processed in accordance with this Privacy Policy and in compliance with legal requirements.

Ekspertos is present on the following social media platforms, each with its own privacy policy linked below:

11. Provision to Third Parties

We currently do not share personal data with third parties for their direct marketing purposes. Regarding the quality of our services, we may engage third-party contractors and suppliers. These entities serve as processors or sub processors for data protection purposes, processing personal data strictly as directed by us. If these parties access or handle personal data, we establish a Data Processing Agreement (DPA) with them, ensuring that they only process your personal data for the specified purposes.

For internet analytics, spam protection, and newsletter services, we utilize Google Analytics, reCAPTCHA by Google, Hubspot, and Mailchimp. You can find their privacy policies linked here.

We commit to processing and storing personal data exclusively within the European Union, unless otherwise agreed upon in writing. However, exceptions apply when tracking website interactions. When using Google Analytics, Hubspot, Mailchimp and other services, your data may be stored outside the EU, subject to the respective privacy policies and terms of service. We encourage you to review their privacy policies through the provided links.

In the course of processing activities outlined in this Policy, your data may be transferred to countries outside the EU and the European Economic Area (EEA). These countries, including the US, may have different data protection laws from those of your country. In such cases, we implement appropriate safeguards to protect your personal data in accordance with GDPR Articles 45 and 46. These safeguards may involve adhering to the European Commission’s standard contractual clauses for personal data transfers or relying on other legal frameworks.

12. Security

We implement appropriate technical and organizational measures to protect your personal data from unauthorized access, use, or disclosure. These measures include encryption, access controls, and regular security assessments.

13. Payment systems, credit checks

13.1 Available Payment Methods

When placing an order through our online shop, you can choose from the following payment methods: invoice, credit card, Apple Pay, Google Pay, iDEAL, (available only in the Netherlands), EPS (only available in Austria), Bancontact (available only in Belgium), and Przelewy24 (available only in Poland). We collect the relevant data for your chosen payment method to process your order and payment in accordance with Article 6 Para. 1(a, b) EU GDPR. For technical and legal reasons, we also process your IP address.

In line with the principles of data minimization, we only collect the information necessary to process your payment and fulfil our contractual obligations, or as required by applicable law. Without this data, we cannot proceed with the contract, as it would prevent us from fulfilling our obligations.

Our payment system uses SSL encryption to ensure secure data transmission.

Payment by Invoice: If you select invoice as your payment method, we will conduct a credit check. For this purpose, relevant data will be transferred to Creditsafe to assess creditworthiness and potential risks of non-payment, as per Article 6 Para. 1(f) EU GDPR.

Credit Card Payments: If you choose to pay by credit card, your data will be forwarded to our payment service provider, Stripe Payments Europe, Limited, 3 Dublin Landings, North Wall Quay, Dublin 1, Dublin, Ireland, in line with Article 6 Para. 1(b) EU GDPR. Stripe will verify the credit card details and perform a credit and fraud prevention check based on our legitimate interest, under Article 6 Para. 1(f) EU GDPR. You can find more information on Stripe’s data protection policies here:  Stripe Data Processing Agreement

13.2 Information on Data Processing.

Direct Debits: If you choose to pay via direct debit, your account details will be collected to allow the payment amount to be deducted.

Apple Pay Payments: Apple Pay is provided by Apple Distribution International Ltd. (Apple), Hollyhill Industrial Estate, Cork, Ireland. When you use Apple Pay, the payment is processed via the Apple Pay feature on your iOS, watchOS, or macOS device, debiting the payment card linked to your Apple Pay account. Information provided during the order process is encrypted and transmitted securely to Apple and your card’s payment service provider. Further information on Apple Pay and data protection can be found here: Apple Pay Support.

Google Pay Payments: Google Pay and/or Google Wallet is provided by Google Ireland Limited. Gordon House, Barrow Street, Dublin 4, Ireland. When you use Google Pay and/or Google Wallet, the payment is processed via the Google Pay feature on your Android device, or Google Chrome browser, debiting the payment card linked to your Google Pay account. Information provided during the order process is encrypted and transmitted securely to Google and your card’s payment service provider. Further information on Google Pay and data protection can be found here: Google Payments Privacy Notice and Google Privacy.

iDEAL Payments: iDEAL is managed by Currence iDEAL BV, Postbus 83073, 1080 AB Amsterdam, Netherlands. If you use iDEAL, the details of your order, including your name, email address, IBAN, and transaction information, will be forwarded to iDEAL for payment processing under Article 6 Para. 1(b) EU GDPR. For more information on iDEAL’s privacy practices, visit: iDEAL Privacy Statement.

EPS Payments: EPS is managed by Currence iDEAL BV, Postbus 83073, 1080 AB Amsterdam, Netherlands. If you use EPS, the details of your order, including your name, email address, IBAN, and transaction information, will be forwarded to EPS for payment processing under Article 6 Para. 1(b) EU GDPR. For more information on EPS’s privacy practices, visit: EPS Privacy Statement.

Bancontact Payments: Bancontact is managed by Bancontact Payconiq Company NV/SA, Rue d’Arlon 82, 1040-Brussels, Belgium. If you use Bancontact, the details of your order, including your name, email address, IBAN, and transaction information, will be forwarded to Bancontact for payment processing under Article 6 Para. 1(b) EU GDPR. For more information on Bancontact’s privacy practices, visit: Bancontact Privacy Statement.

Przelewy24 Payments: Przelewy24 is managed by PayPro S.A., Pastelowa 8, 60-198 Poznan, Poland. If you use Przelewy24, the details of your order, including your name, email address, IBAN, and transaction information, will be forwarded to Przelewy24 for payment processing under Article 6 Para. 1(b) EU GDPR. For more information on Przelewy24’s GDPR practices, visit:  Przelewy24 GDPR Statement.

14. Automated Decision Making

We do not engage in automated decision-making processes that produce legal effects concerning you or similarly significantly affect you.

15. Data Retention

We will retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. Specific retention periods are determined based on the nature of the data and the purposes for processing it.

Our data retention periods are as follows:

      • Website Visitors: 26 months
      • Job Candidates: 5 years
      • Clients: 5 years
      • Newsletter Subscriptions: 4 years

16. Your Rights

Under GDPR, you have the following rights concerning your personal data:

      • The right to access: You can request copies of your personal data.
      • The right to rectification: You can request correction of inaccurate or incomplete data.
      • The right to erasure: You can request the deletion of your personal data under certain conditions.
      • The right to restrict processing: You can request the restriction of processing under certain conditions.
      • The right to data portability: You can request the transfer of your data to another organization or directly to you under certain conditions.
      • The right to object: You can object to processing your personal data under certain conditions.

To exercise your rights, please contact us at:

Jezgra Neo d.o.o.
Velimira Škorpika 7a
22000 Šibenik, Croatia
Email: gdpr@ekspertos.eu

We will respond to your request within the timeframe required by law.