Privacy Policy

1. Controller

The controller of personal data within the meaning of Article 4(7) GDPR is:

Controller

Moberg d.o.o.

Strojarska cesta 20, 10000 Zagreb, Republic of Croatia
Email: info@moberg.hr
Telephone: +385 91 555 8875 (HR), +354 853 5353 (IS)

Full statutory identification of the controller is set out in the Impressum.

For all data-protection enquiries, including requests to exercise the rights set out in Section 8 below, please contact: info@moberg.hr with the subject line "Data Protection Request".

The Company has not currently designated a Data Protection Officer (DPO) under Article 37 GDPR, as the criteria of that Article do not apply to its current scale and activities. This determination is reviewed annually.

2. Categories of personal data we process

Website visitors

Technical & usage data

IP address (truncated where feasible)
Browser and device characteristics, operating system
Referring URL and pages viewed, with timestamps
Cookies and similar technologies (see Section 9)

Contact form

Submitted enquiry data

Name, email address, optional company name
Telephone number (where provided)
Subject matter and free-text message content
Topic selection (e.g. data engineering, BI, AI)

Career applicants

Recruitment data

CV, cover letter and professional background
Contact and identification data
Notes from interviews and assessments
Right-to-work / residence information where required

Clients & counterparties

Commercial & contractual data

Contact details of authorised representatives
Contractual correspondence and signed agreements
Invoicing and payment data
Access credentials to client systems (handled as confidential)

3. Purposes and legal bases (Article 6 GDPR)

We process personal data only where one or more legal bases under Article 6(1) GDPR apply.

Art. 6(1)(b) — Contract

Performance of a contract

To respond to commercial enquiries, prepare proposals, conclude and perform Master Service Agreements and Statements of Work, deliver agreed services, manage invoicing and provide support during and after the engagement.

Art. 6(1)(c) — Legal obligation

Compliance with the law

To comply with statutory obligations under Croatian and EU law, including accounting and tax-record retention (e.g. the General Tax Act), employment law and anti-money-laundering legislation where applicable.

Art. 6(1)(f) — Legitimate interests

Legitimate interests, balanced

To operate and secure our website, prevent fraud and abuse, conduct lawful direct outreach to business contacts, manage internal administration and pursue or defend legal claims. A balancing test is documented in each case, with overriding rights of data subjects respected.

Art. 6(1)(a) — Consent

Where consent applies

For non-essential cookies, optional analytics, marketing communications by email or LinkedIn and any processing not otherwise covered by the bases above. Consent may be withdrawn at any time with effect for the future (Article 7(3) GDPR).

Where personal data falls within the special categories of Article 9(1) GDPR, it is processed only where a specific exception in Article 9(2) GDPR applies.

4. Recipients and sub-processors

Personal data is accessed only by personnel of Moberg d.o.o. on a need-to-know basis and by carefully selected sub-processors acting on our documented instructions under written data-processing agreements that meet the requirements of Article 28 GDPR. Categories of recipients include:

Hosting and infrastructure providers — Microsoft Azure (Microsoft Ireland Operations Limited).
Communication and productivity providers — Microsoft 365.
Customer-relationship and pipeline tooling.
Accounting and payroll providers engaged in Croatia for statutory bookkeeping.
Recruitment platforms — used solely where an applicant has chosen to apply through them.
Professional advisors — legal counsel, auditors and tax advisors, bound by professional confidentiality.
Competent authorities — where disclosure is required by law, court order or in defence of legal claims.

An up-to-date list of sub-processors is available on request at info@moberg.hr.

5. International transfers (Articles 44–49 GDPR)

Personal data is primarily processed within the European Economic Area (EEA). Where personal data is transferred to a country outside the EEA, we rely on one of the mechanisms in Chapter V GDPR:

Adequacy decisions — including the United Kingdom (Commission Implementing Decision (EU) 2021/1772) and, where applicable, the United States under the EU–US Data Privacy Framework (Implementing Decision (EU) 2023/1795).
Standard Contractual Clauses (SCCs) as adopted by the European Commission (Implementing Decision (EU) 2021/914), supplemented where necessary by additional safeguards following a transfer-impact assessment.
Transfers to Iceland (an EEA member state) remain subject to GDPR directly.

6. Retention

Contact form enquiries — up to 24 months from last contact.
Career applications — 6 months from the conclusion of the recruitment process, or longer with the applicant's explicit consent.
Commercial and contractual records — for the duration of the engagement and the period required by Croatian accounting and tax legislation (currently 11 years from the end of the fiscal year, under the General Tax Act).
Website analytics — for no longer than necessary; thresholds documented in our internal records.
Backups — overwritten on a defined rotation.

7. Security

We implement appropriate technical and organisational measures within the meaning of Article 32 GDPR to protect personal data — including encryption in transit (TLS) and at rest, access controls aligned to the principle of least privilege, multi-factor authentication, logging and monitoring, regular review of supplier security, staff training and documented incident-response procedures.

In the event of a personal-data breach likely to result in a risk to the rights and freedoms of data subjects, we will notify the Croatian Personal Data Protection Agency (AZOP) within 72 hours of becoming aware of the breach (Article 33 GDPR) and the affected data subjects without undue delay where the risk is high (Article 34 GDPR).

8. Your rights (Articles 12–22 GDPR)

Art. 15

Right of access

To obtain confirmation as to whether personal data concerning you is processed and a copy with the prescribed information.

Art. 16

Right to rectification

To have inaccurate personal data corrected and incomplete data completed.

Art. 17

Right to erasure

"Right to be forgotten" — where the grounds in Article 17(1) apply.

Art. 18

Right to restriction

To restrict processing in the situations listed in Article 18(1).

Art. 20

Right to portability

To receive your data in a structured, commonly used, machine-readable format.

Art. 21

Right to object

To object to processing based on legitimate interests, and to direct marketing at any time.

Art. 7(3)

Withdraw consent

To withdraw any consent previously given, with effect for the future.

Art. 77

Lodge a complaint

To lodge a complaint with a supervisory authority — see Section 10.

Requests are handled within one month of receipt (Article 12(3) GDPR), with a possible extension of up to two further months where necessary. We may ask for additional information to verify your identity.

9. Cookies and similar technologies

Strictly necessary cookies — required for the website to function. Set on the basis of Article 5(3) of the ePrivacy Directive without consent.
Functional cookies — improve the user experience by remembering preferences. Set only with consent.
Analytics cookies — aggregated usage information. Set only with consent.
Marketing cookies — used by third-party platforms (e.g. LinkedIn). Set only with consent.

You can withdraw or change your consent at any time via the cookie-preferences link in the footer. Cookie names, purpose and retention are listed in the cookie banner and detailed notice. We follow the European Data Protection Board's Guidelines 03/2022 on deceptive design patterns.

10. Supervisory authority

You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement (Article 77 GDPR).

For Croatia: Croatian Personal Data Protection Agency (AZOP — Agencija za zaštitu osobnih podataka), Selska cesta 136, 10000 Zagreb, azop.hr.

For Iceland: Persónuvernd, Rauðarárstígur 10, 105 Reykjavík, personuvernd.is.

11. Automated decision-making and profiling

We do not subject visitors to this website to decisions based solely on automated processing that produce legal effects or similarly significantly affect them within the meaning of Article 22 GDPR.

Where, in the course of client engagements, we design or operate systems that involve such automated decision-making — for example, credit-risk scorecards or AI-assisted decision support — we do so as a processor on the documented instructions of the controller (the client), under separate written agreements that include the safeguards required by Article 22(2) and (3) GDPR and, where applicable, Regulation (EU) 2024/1689 (the AI Act). Decisions of this kind always remain accountable to a human reviewer.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our processing activities, applicable law or supervisory guidance. The current version, with its effective date, is always available on this page. Material changes will be communicated by clearly visible notice on the website for a reasonable period before they take effect.