Privacy policy

In short

We collect only what you send us yourself: an enquiry through the form, an email address for notices about new posts, and the questions you type into the chat. We do not track you around the site, we do not advertise through your data and we do not sell it to anyone. Below, each purpose is set out separately, with its legal basis, retention period and the list of those who also see the data.

Who is the controller

The controller is Riskoria Advising & Professional Services d.o.o., Poljačka ulica 56, 10000 Zagreb, Croatia, company tax number 84611853622. Write to info@riskoria.eu or call +385 97 737 1345. Send any data protection request to the same address.

Enquiry through the contact form

The form on the Contact page asks for your name, email address and message. Organisation, phone number and topic are optional. The enquiry arrives in our mailbox at info@riskoria.eu.

DATAName, email address and message. Optionally organisation, phone number and topic. PURPOSEAnswering your enquiry and preparing possible cooperation. BASISSteps taken at your request prior to a contract, Article 6(1)(b) GDPR. For enquiries unrelated to a contract, our legitimate interest in business communication, point (f). RETENTIONTwo years from the last message. If a contract follows, the documentation is kept for the periods set by accounting and tax rules. RECIPIENTSGoogle Workspace, which runs our email, and the provider that hosts the site.

Media enquiry

Journalists write to info@riskoria.eu directly or use the same form with the topic Media. The data, the legal basis and the retention period are the same as for any other enquiry. Arrangements for an appearance or a statement are made by email, and we keep that correspondence for at most two years from the last message.

Notices about new posts

On the Blog page you can leave your email address so that we can tell you when a new post is out. The form asks only for the address and your consent. After you sign up you receive a message with a confirmation link. Until you confirm, we send nothing.

The list is kept in MailerLite, which acts as our processor. For customers in the European Economic Area the contracting entity is MailerLite Limited, an Irish company at 88 Harcourt Street, Dublin 2, D02 DK18, Ireland. Their privacy policy is at mailerlite.com.

Every message carries an unsubscribe link. One click is enough, you do not have to write to us. We do not use the address for offers or sales messages.

DATAEmail address, language group (Bilten HR or Newsletter EN), and the time, IP address and country of confirmation, which MailerLite records as proof of consent. PURPOSETelling you about a new post on the site. BASISYour consent, Article 6(1)(a) GDPR. You may withdraw it at any time. RETENTIONUntil you unsubscribe. After that we keep only the record needed to make sure we do not write to you again. RECIPIENTSMailerLite Limited, Ireland. Where MailerLite uses sub-processors outside the European Economic Area, the transfer rests on the standard contractual clauses in their data processing addendum.

The chat on the site

There is a chat in the corner of the site. When you send a question it goes to our server and from there to the interface of the Claude model run by Anthropic PBC in the United States, which composes the answer. The conversation so far, the chosen language and the address of the page you are on travel with the question. Under the commercial terms for that interface, Anthropic may not train models on this content.

We log the conversation on our side, so that we know what people ask and so that we can reply if you leave your contact details. The log holds the messages, a session identifier, the language, the page address and the time. It does not hold your name or email address unless you type them in yourself.

So please do not type other people's personal data, business secrets or details of security weaknesses in your organisation into the chat. For a conversation like that, arrange a call or write to us.

If you leave your name and email address in the chat, with consent, that enquiry reaches info@riskoria.eu together with the transcript of the conversation, so that we can answer it properly.

DATAMessage text, session identifier, language, page address and time. Name and email address only if you leave them. PURPOSEAnswering your question, improving the answers and protecting the service from abuse. BASISOur legitimate interest in talking to visitors and in running the service safely, Article 6(1)(f). For the contact details you leave, your consent, point (a). RETENTIONConversation logs are kept for at most twelve months. Contact details you leave are kept like any other enquiry, for two years. RECIPIENTSAnthropic PBC, United States, as the model provider, and the provider that hosts the site.

Server logs

Every visit is recorded by the server of our hosting provider, SiteGround. The log holds the IP address, the time, the address requested and browser details. We do not use these logs to measure traffic and we do not link them to other data. They serve to spot faults and attacks.

DATAIP address, time of the request, address requested, browser and operating system details. PURPOSEKeeping the site running safely and correctly, fixing faults, defending against attacks. BASISOur legitimate interest in network and information security, Article 6(1)(f). RETENTIONThe logs are kept and deleted by the hosting provider under its own schedule. We keep no copy of our own and do not export them. RECIPIENTSThe provider that hosts the site.

Who else sees the data

We do not sell personal data and we do not pass it to third parties for marketing. We share it only with service providers we need in order to work, and only under a processing agreement.

HOSTINGSiteGround, hosting of the site and server logs. EMAILGoogle Workspace, the info@riskoria.eu mailbox. NOTICESMailerLite Limited, the list of people who receive notices about new posts. CHATAnthropic PBC, composing the answers in the chat.

We also hand data to the competent authorities, but only where the law requires it.

Transfers outside the European Economic Area

The only regular transfer to a third country happens in the chat: your question and the course of the conversation are processed by Anthropic in the United States. The transfer rests on the data processing addendum incorporated into the commercial terms for their interface. If you do not want your question to leave the European Union, do not use the chat, write to us or call instead.

The other services are contracted with companies in the European Union. If one of them brings in a sub-processor outside the European Economic Area, the transfer rests on the European Commission's standard contractual clauses or on another safeguard from Chapter V of the GDPR.

Your rights

Articles 15 to 22 GDPR give you the following rights.

ACCESSTo learn whether we process your data, which data and why, and to receive a copy. RECTIFICATIONTo correct inaccurate data and complete incomplete data. ERASURETo ask for deletion when the data is no longer needed for the purpose or when you withdraw consent. RESTRICTIONTo ask us to pause the processing while a dispute about accuracy or basis is resolved. PORTABILITYTo receive the data you gave us in a machine readable form and pass it to someone else. OBJECTIONTo object to processing that rests on legitimate interest.

Any consent you have given, for notices about new posts or for contact from the chat, can be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

Send your request to info@riskoria.eu. We answer within one month of receipt. If the request is complex, or if there are several at once, we may extend that by a further two months and will tell you about the extension within the first month. If we cannot tell from the request who you are, we will ask for one more detail.

Complaint to the supervisory authority

If you believe we process your data unlawfully, you may complain to the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka), Ulica Metela Ožegovića 16, 10000 Zagreb, azop@azop.hr, phone +385 1 4609 000. You are welcome to write to us first, the matter may be settled straight away.

Automated decision making

We take no decisions about you by automated means alone and we do not profile visitors. The chat composes answers, not decisions.

Security

Traffic between your browser and the site is encrypted. Enquiries and logs are accessible only to staff who need them for their work.

Cookies and fonts

The site sets no cookies for traffic measurement or advertising. What exactly is stored in your browser, and what it means that fonts are loaded from Google's servers, is set out in the cookie policy.

Changes to this policy

We change the policy when what we do changes. The date of the last change is on the left, next to the list of documents. This version applies from 5 August 2026.