1. Controller
| Company | ShiftOneZero d.o.o. |
|---|---|
| Registered office | Kobiljačka cesta 120, 10361 Sesvetski Kraljevec, Croatia |
| OIB (tax ID) | 19062953031 |
| Privacy contact | info@shiftonezero.com (subject: "Privacy") |
2. What data we process
Visiting this website
This website uses no cookies for tracking, analytics or advertising and loads no content from third-party services (fonts and images are served from our own server). On every visit, the server and network protection (CDN) technically log standard data: IP address, request time, requested page, browser and operating system. This data is used only for security and to keep the site working.
When you contact us
If you email or call us, we process the data you give us: name, email address, phone number, company name and the content of your enquiry.
Business partners and clients
For contracts we process the contact details of the responsible people at clients and suppliers, and the data needed for invoicing.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Website security and operation (technical logs) | Legitimate interest — Art. 6(1)(f) |
| Answering enquiries, preparing offers | Pre-contractual steps / legitimate interest — Art. 6(1)(b) and (f) |
| Performing contracts with clients and suppliers | Contract — Art. 6(1)(b) |
| Accounting and tax obligations | Legal obligation — Art. 6(1)(c) |
We do not make automated decisions or build profiles that would have legal or similarly significant effects on you.
4. Data in systems we build for clients
When you use an app or website we built for a client (e.g. a fan app, webshop, ticketing, access control, PickAndPos, Clubin at a venue or CrewOps for event staff), that client is the controller and ShiftOneZero acts as a processor on its instructions and under a data processing agreement. That client's privacy policy applies, and you exercise your rights primarily with them. We are happy to forward your request and help resolve it. Read more about how we protect that data on our Data security page.
5. Recipients
We never sell data or share it for marketing. It may only be received by:
- hosting, network protection (CDN) and email providers acting as our processors, under contractual data protection obligations;
- our accounting service, to the extent required for legal obligations;
- competent authorities, where required by law.
6. Transfers outside the EU/EEA
We process data primarily within the EU. If a provider (e.g. for network protection) processes data outside the EU/EEA, the transfer relies on an adequacy decision (e.g. the EU–US Data Privacy Framework) or the European Commission's standard contractual clauses.
7. Retention periods
| Data | Period |
|---|---|
| Server technical logs | up to 30 days, unless needed to investigate a security incident |
| Enquiries that did not lead to a contract | up to 12 months from the last communication |
| Contract documentation | for the term of the contract and until limitation periods expire |
| Invoices and accounting records | 11 years, under the Croatian Accounting Act |
8. Your rights
At any time you may request:
- access to your data and a copy (Art. 15);
- rectification of inaccurate data (Art. 16);
- erasure ("right to be forgotten", Art. 17);
- restriction of processing (Art. 18);
- data portability (Art. 20);
- to object to processing based on legitimate interest (Art. 21);
- to withdraw consent, where processing is based on consent, without affecting the lawfulness of earlier processing.
Send your request to info@shiftonezero.com. We respond without undue delay and within one month at the latest. We may ask you to confirm your identity so we don't disclose data to the wrong person.
9. Cookies
This website sets no cookies. We only use temporary browser storage (sessionStorage) so the intro animation doesn't replay on every page — it holds no personal data, is never sent to us and is deleted when you close the tab. That is why we don't ask for cookie consent.
Our network protection (CDN) may set a strictly necessary security cookie to block malicious traffic; it is not used for tracking.
10. Data protection
We apply the technical and organisational measures of our information security management system, certified to ISO/IEC 27001:2022: encrypted communication, least-privilege access control, an audit trail, backups and regular reviews. Details are on our Data security page.
11. Changes to this policy
We update this policy from time to time. The date of the last change is shown at the top, and we will announce material changes on this page.