Privacy Policy

1. Data Controller

The data controller responsible for processing your personal data on this website is AK Dubrovnik Racing, the organizer of the Grand Prix of Croatia (hereinafter "we", "us", or "the Organizer").

For any data protection inquiries, please contact us at [email protected].

2. What Data We Collect

Analytics data: With your consent, we collect anonymized usage data including pages visited, time spent on pages, browser type, device type, and approximate geographic location (country/region level only).

Cookie data: Technical and preference cookies as described in our Cookie Policy. Analytics cookies are only set with your explicit consent.

We do not collect any special categories of personal data (such as health data, racial or ethnic origin, political opinions, or biometric data).

3. Legal Basis for Processing

Consent (Art. 6(1)(a) GDPR): Analytics cookies are processed based on your explicit, freely given consent. You may withdraw consent at any time.

Legitimate interest (Art. 6(1)(f) GDPR): We process certain technical data (such as server logs and security-related data) based on our legitimate interest in maintaining the security and functionality of our website.

Contractual necessity (Art. 6(1)(b) GDPR): If you purchase tickets through our external ticketing partner, the processing of your data for that transaction is governed by their privacy policy.

4. How We Use Your Data

To analyze website usage patterns and improve the user experience (only with your consent, via anonymized analytics).

To ensure the technical security and proper functioning of our website.

We will never sell your personal data to third parties. We do not use your data for automated decision-making or profiling.

5. Third-Party Services

Hosting: Our website is hosted on Vercel Inc. (San Francisco, USA). Vercel processes data under Standard Contractual Clauses (SCCs) approved by the European Commission for EU-US data transfers.

Analytics: We use Umami (umami.is), a privacy-focused analytics platform, loaded only after you provide explicit consent. Umami does not use cookies and does not collect personal data. All data is anonymized and aggregated.

Ticket sales: Ticket purchases are processed by Entrio, an external ticketing platform. When you click a "Buy Tickets" link, you leave our website and are subject to Entrio's own privacy policy.

6. International Data Transfers

Some of our third-party service providers are located outside the European Economic Area (EEA), primarily in the United States. We ensure that all international data transfers are protected by appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission and, where applicable, supplementary technical measures such as encryption.

You may request a copy of the relevant safeguards by contacting us at [email protected].

7. Data Retention

Analytics data: Anonymized analytics data is retained for up to 14 months.

Server logs: Technical server logs are automatically deleted after 30 days.

8. Your Rights Under GDPR

As a data subject under the General Data Protection Regulation (GDPR), you have the following rights:

Right of access (Art. 15): You can request a copy of the personal data we hold about you.

Right to rectification (Art. 16): You can request correction of inaccurate or incomplete personal data.

Right to erasure (Art. 17): You can request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations.

Right to restriction (Art. 18): You can request that we restrict the processing of your data in certain circumstances.

Right to data portability (Art. 20): You can request your data in a structured, commonly used, and machine-readable format.

Right to object (Art. 21): You can object to processing based on legitimate interest at any time.

Right to withdraw consent (Art. 7(3)): You can withdraw any previously given consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days.

9. Right to Lodge a Complaint

If you believe that our processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority. In Croatia, the competent authority is the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka — AZOP), Selska cesta 136, 10000 Zagreb, Croatia. Website: azop.hr.

10. Children's Privacy

Our website is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you are a parent or guardian and believe that your child has provided us with personal data, please contact us at [email protected] and we will promptly delete such data.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The "Last updated" date at the top of this page indicates when this policy was last revised. If we make material changes, we will display a prominent notice on our website.

We encourage you to review this policy periodically.

12. Contact

For any questions or concerns regarding this Privacy Policy or our data processing practices, please contact us at:

AK Dubrovnik Racing, organizer of the Grand Prix of Croatia. Email: [email protected].