Processing Principles
Petason d.o.o. places great importance on the protection of privacy and the security of personal data and, accordingly, operates in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter: the Regulation), the Act on the Implementation of the General Data Protection Regulation, and other applicable regulations of the Republic of Croatia and the European Union.
We process your personal data strictly for defined purposes and only if you choose to share such data with us.
We are guided by the principles of transparency, minimisation of the amount of personal data collected, and limitation of retention periods. Access to personal data is granted exclusively to authorised persons, applying the principles of need-to-know and least privilege.
The protection of your privacy is our highest priority. We protect your data through appropriate technical and organisational measures, do not sell or disclose your data to unauthorised third parties, and guarantee all data subject rights provided under the Regulation.
Scope of this Statement
This Privacy Statement applies to the processing of personal data collected through the official website of Petason d.o.o., including:
- contact forms;
- communication via electronic mail;
- job applications;
- the “Become Our Partner” form.
Data Controller
The data controller is:
Petason d.o.o.
Vranjički put 12
21 211 Vranjic, Solin, Croatia
Contact details of the Data Protection Officer:
info@petason.hr
Personal Data
The main purpose of this Statement is to provide information about the processing of your personal data for the purpose of establishing a contractual relationship and responding to your inquiries.
Depending on how you use our website, we may process the following personal data:
- Responding to inquiries: If you contact us by phone, e-mail, or mail, based on your decision to provide us with your information, we process the following data: first name, last name, e-mail address and/or telephone number, company name, and the content of your inquiry.
Legal basis: taking steps at your request prior to entering into a contract or legitimate interest in responding to inquiries (Article 6(1)(b) and (f) of the GDPR). - Job applications: When applying for an open position or submitting an unsolicited application, we process the data contained in your CV, motivation letter, and other submitted documentation.
Legal basis: taking steps prior to entering into an employment contract and consent where applicable (Article 6(1)(b) and (a) of the GDPR). - “Become Our Partner” form: If you complete the “Become Our Partner” form, we process the data necessary for establishing and maintaining a business relationship.
Legal basis: taking steps prior to entering into a contract or performance of a contract (Article 6(1)(b) of the GDPR). - Legal obligations: Certain data is processed in order to comply with legal obligations, for example in the areas of accounting, taxation, or other legal requirements.
Legal basis: compliance with a legal obligation (Article 6(1)(c) of the GDPR).
For all data you have voluntarily provided to us, you may request deletion at any time, and we will process such request without undue delay.
Personal Data of Children
This website is not intended for persons under the age of 16. If you are under 16 years of age, please do not send us your personal data without the involvement of your parents or legal guardians.
We make reasonable efforts to verify whether consent has been given or authorised by the holder of parental responsibility over the child, taking into account available technology.
Data Retention Periods
We retain personal data only for as long as necessary to fulfil the purpose for which it was collected or for as long as required by applicable regulations.
For example:
- Inquiries: until the completion of communication, and no longer than two years after the last communication;
- Job applications submitted for a specific vacancy: for the duration of the selection process and up to 30 days after the completion of the recruitment process, unless the candidate provides consent for longer retention;
- Unsolicited applications: up to one year with the candidate’s consent;
- Contractual documentation: eleven years after termination of the contractual relationship, unless a specific regulation requires longer retention;
- Accounting and tax documentation: eleven years or longer, in accordance with applicable regulations.
After the retention periods expire, personal data is deleted or securely destroyed.
Recipients of Personal Data
Personal data may be accessible to:
- authorised employees of the company;
- data processors providing IT, hosting, or other contracted services on our behalf;
- public authorities where there is a legal obligation to provide data.
Data processing agreements have been concluded with all processors in accordance with Article 28 of the GDPR.
Protection of Personal Data
To protect your personal data, we implement appropriate technical and organisational measures defined according to the risks to data security. Additionally, we have voluntarily appointed a Data Protection Officer to ensure appropriate compliance and maintain the required level of security in personal data processing activities.
When processing personal data, we use services provided by carefully selected domestic processors, which we continuously monitor. All personal data is processed within the European Economic Area (EEA).
We will disclose personal data only in cases of investigations conducted by competent authorities and upon their explicit request.
Data Subject Rights
Data subjects have the right to request from the data controller access to their personal data, rectification or deletion of personal data, restriction of processing of personal data concerning them, the right to object to processing, and the right to data portability.
Additionally, every data subject has the right to lodge a complaint with the competent supervisory authority – the Croatian Personal Data Protection Agency (AZOP), M. Ožegovića 16, Zagreb.
You may exercise your rights by visiting us in person or by sending a request by post to:
Petason d.o.o.
Vranjički put 12
21 211 Vranjic, Solin, Croatia
or by sending a request via e-mail to the Data Protection Officer at:
If you have any questions or concerns, please feel free to contact us.
Revisions to the Privacy Statement
This Privacy Statement may be updated from time to time in order to comply with legal requirements or changes in the way we process personal data.
Date: 1 June 2026