Privacy Policy

Last updated: 20 October 2026

This Privacy Policy explains how Optimail d.o.o. collects and uses personal data when you visit this website, book a call with us or otherwise get in touch. We process personal data in line with the EU General Data Protection Regulation (GDPR) and applicable Croatian law.

1. Who we are

The controller responsible for your personal data is:

Optimail d.o.o.
Ulica Vinka Žganca 6, 42000 Varaždin, Croatia
OIB: 49706812667
Email: filip@optimailmarketing.com

We have not appointed a Data Protection Officer because we are not required to. For any privacy question or request, contact us at the email address above.

2. What data we collect and why

Visiting the website

When you open the site, our hosting provider Netlify automatically processes technical data such as your IP address, browser type, device, date and time of access and the pages you request. We need this to deliver the website and keep it secure.

• Legal basis: our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR).
• Retention: server logs are kept for a short period, normally no longer than 30 days, unless needed to investigate a security incident.

Booking a Retention Audit (Calendly)

When you book a call through Calendly, we receive the information you enter in the booking form, such as your name, email address, company, website and any answers you give, together with the time you selected. We use it to schedule and hold the call and to prepare your audit.

• Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
• Retention: up to 24 months after our last contact, unless we start working together.

Email and business communication

When you email us or we work together, we process your name, contact details, the content of our correspondence and information needed to deliver our services and invoice them.

• Legal basis: performance of a contract or pre-contractual steps (Art. 6(1)(b)), our legitimate interest in business communication (Art. 6(1)(f)) and compliance with legal obligations, for example accounting and tax law (Art. 6(1)(c)).
• Retention: for the duration of our cooperation and afterwards for as long as required by Croatian accounting and tax law (generally up to 11 years for accounting records). Correspondence that does not lead to cooperation is deleted within 24 months.

Email marketing (Klaviyo)

If you subscribe to our emails, we process your email address, your name if you provide it, and information about how you interact with our emails (for example opens and clicks) to send you content about retention and our services.

• Legal basis: your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time using the link in every email.
• Retention: until you unsubscribe, after which we keep your address on a suppression list only to make sure you are not emailed again.

Analytics (Google Analytics)

Only if you allow analytics cookies, we use Google Analytics to understand how visitors use the site, for example which pages are visited and how people arrive. IP addresses are not stored by Google Analytics 4.

• Legal basis: your consent (Art. 6(1)(a) GDPR).
• Retention: analytics data is kept for 14 months.

Advertising and measurement (Google Ads, Meta Pixel, Klaviyo)

Only if you allow marketing cookies, we use the Google Ads tag, the Meta Pixel and Klaviyo's website tracking to measure the results of our advertising (for example whether someone who saw an ad later booked a call), to build audiences for ads on Google, Facebook and Instagram, and to connect website visits with our email marketing.

• Legal basis: your consent (Art. 6(1)(a) GDPR).
• Retention: see the cookie durations in our Cookie Policy.

For the Meta Pixel, Optimail and Meta Platforms Ireland Ltd. are joint controllers for the collection and transmission of the data. Meta's handling of the data afterwards is described in Meta's Privacy Policy.

Data we process for our clients

When we work for a brand, we may access that brand's customer data (for example in Shopify, Klaviyo or a subscription platform). We do this as a processor on the brand's behalf and under a data processing agreement. That processing is governed by the brand's own privacy policy, not this one.

3. Who we share data with

We do not sell personal data. We share it only with service providers that help us run the website and our business, and only as far as necessary:

• Calendly LLC (USA): appointment scheduling.
• Klaviyo, Inc. (USA): email marketing and website tracking.
• Google Ireland Ltd. / Google LLC (Ireland/USA): Google Analytics and Google Ads.
• Meta Platforms Ireland Ltd. (Ireland, with transfers to Meta Platforms, Inc., USA): Meta Pixel.
• Netlify, Inc. (USA): website hosting.
• Accountants, legal advisers and authorities: where required by law or to protect our rights.

4. Transfers outside the EU

Some of these providers are based in the United States. Where a provider is certified under the EU-U.S. Data Privacy Framework, transfers rely on the European Commission's adequacy decision. Otherwise, we rely on the European Commission's Standard Contractual Clauses and additional safeguards where needed.

5. Cookies

We use necessary cookies and, only with your consent, analytics and marketing cookies. Details are in our Cookie Policy. You can change or withdraw your consent at any time via Cookie settings.

6. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted;
• restrict how we process your data;
• receive your data in a portable format;
• object to processing based on our legitimate interest, and to direct marketing at any time;
• withdraw your consent at any time, without affecting processing that took place before.

To use any of these rights, email us at filip@optimailmarketing.com. We will reply within one month.

You also have the right to lodge a complaint with the Croatian supervisory authority: Agencija za zaštitu osobnih podataka (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr.

7. Do you have to give us your data?

No. However, we need your name and email address to book a call with you, and we cannot work with you without the information required for a contract and invoicing.

8. Automated decision-making

We do not make decisions about you that are based solely on automated processing and that have legal or similarly significant effects. Advertising platforms may use the data from marketing cookies to decide which ads to show you, but only if you have consented.

9. Security

We use appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS), access controls and working only with reputable service providers.

10. Changes to this policy

We may update this policy when our services or the law change. The current version is always on this page, with the date of the last update at the top.