Privacy Policy

1. Who is responsible for your data

RoRay Advisory d.o.o. is the controller responsible for the personal data described in this policy.

2. Personal data we collect

When you use the enquiry form or contact us directly, we may receive your name, company, email address, telephone number, message, and any other information you choose to provide.

The website or its hosting provider may also process limited technical information needed to deliver and secure the site, such as an IP address, browser type, requested page, and the date and time of a request.

If you accept analytics, Google Analytics may process technical and usage information such as online identifiers, IP address, approximate location, device and browser information, referral source, pages viewed, and interactions with the website.

Please do not send health information or other sensitive personal data through the enquiry form.

3. Why we use personal data

We process personal data only where there is a lawful reason to do so. Depending on the circumstances, we use it to:

• respond to enquiries and communicate about requested services, including taking steps before entering into a contract;
• manage professional relationships and pursue our legitimate interest in operating and developing the business;
• operate, maintain, and protect the website and communications systems;
• measure and improve website use through Google Analytics when you have consented; and
• comply with legal obligations or establish, exercise, or defend legal claims.

The corresponding legal bases are Article 6(1)(b), Article 6(1)(f), and, where applicable, Article 6(1)(c) of the General Data Protection Regulation (GDPR). Analytics processing is based on your consent under Article 6(1)(a). We do not use enquiry details for unrelated direct marketing without an appropriate legal basis.

4. Contact form and service providers

The contact form is transmitted using FormSubmit and delivered to a designated RoRay Advisory email inbox using Google services. These providers process information as necessary to transmit, filter, secure, and store the message. Their own privacy information is available through the FormSubmit policy and the Google Privacy Policy.

If you accept analytics, Google LLC provides Google Analytics 4 for measurement ID G-YL23HW35X9 and processes analytics data on our behalf and under its own applicable terms. Further information is available in the Google Privacy Policy.

We may also disclose personal data to website hosting and IT providers, professional advisers, or public authorities where this is necessary, legally required, or connected with the protection of legal rights. We do not sell personal data.

5. International transfers

Some service providers may process personal data outside Croatia or the European Economic Area. Where GDPR requires it, such transfers must be covered by an adequacy decision, standard contractual clauses, or another lawful transfer safeguard. You may contact us for further information about safeguards relevant to your data.

6. How long we keep personal data

We retain enquiry and correspondence data only for as long as reasonably necessary to respond, manage any resulting professional relationship, meet accounting or other legal obligations, and protect legal rights. Retention is determined by the nature of the enquiry, whether a business relationship follows, applicable statutory periods, and whether a dispute or legal obligation requires longer storage. Data that is no longer required is deleted or anonymised.

7. Cookies and analytics

This website uses Google Analytics 4 only after you select “Accept analytics” in the consent panel. Until consent is granted, the Google Analytics tag is not loaded. When enabled, Google Analytics may set analytics cookies, including _ga and related _ga_* cookies, to distinguish visits and measure how the website is used. The site does not use Google Analytics for advertising or personalised advertising.

Your analytics choice is stored in your browser’s local storage so the website can remember it. You can decline analytics or withdraw consent at any time through “Cookie Settings” in the footer. Withdrawing consent does not affect processing that occurred lawfully before withdrawal. The contact-form and infrastructure providers may still use strictly necessary technical measures to prevent abuse and deliver their services.

8. Your data-protection rights

Subject to the conditions and exceptions in applicable law, you may request:

• access to your personal data;
• correction of inaccurate or incomplete data;
• erasure of personal data;
• restriction of processing;
• data portability where applicable; and
• objection to processing based on legitimate interests.

Where processing is based on consent, you may withdraw that consent at any time without affecting earlier lawful processing. Analytics consent can be changed through “Cookie Settings” in the footer. This website does not use automated decision-making or profiling that produces legal or similarly significant effects.

To exercise a right, email info@rorayadvisory.com. We may need to verify your identity before responding.

9. Complaints

If you believe your personal data has been processed unlawfully, you may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP). Information about data-subject rights and complaints is available on the AZOP website.

10. Security

We use reasonable technical and organisational measures intended to protect personal data against accidental loss, misuse, alteration, unauthorised access, or disclosure. No internet transmission or storage system can be guaranteed to be completely secure.

11. Changes to this policy

We may update this policy when the website, service providers, or legal requirements change. The latest version will be published on this page with a revised “Last updated” date.