Sonitus
Sonitus

Privacy Policy

Last updated: 9 November 2026

This policy explains which personal data we collect through the website www.sonitus.eu, why we process it and what your rights are. We process data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Croatian Act on the Implementation of the GDPR.

1. Controller

Sonitus d.o.o., Krešimirova 71, Starigrad, 48000 Koprivnica, Croatia

E-mail: info@sonitus.eu

For any question about data protection and to exercise your rights, contact us at this e-mail address or by post at our registered address.

2. What we process and why

Inquiries sent through the contact form and by e-mail

  • Data: name, e-mail address and, if you provide them, company name, phone number and the content of your message. The product or division the inquiry refers to is stored with it.
  • Purpose: answering your inquiry, preparing an offer and communicating with you about it.
  • Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering the inquiries we receive (Art. 6(1)(f) GDPR).
  • Retention: until the communication is finished, and no longer than two years from receipt of the inquiry. If a business relationship follows, the data is kept for the periods required by tax and accounting law.

We do not use inquiry data for marketing. We do not send a newsletter and we do not build visitor profiles.

Technical data about your visit

On every visit the server automatically records the IP address, date and time of access, the page requested, the browser and operating system and the referring page. These records serve system security and troubleshooting (legitimate interest, Art. 6(1)(f) GDPR). They are kept only as long as that purpose requires and are then deleted. We do not combine them with other data about you.

3. Cookies

The website uses only cookies that are strictly necessary for it to work:

  • sonitus-session – keeps your session (for example, sending a form securely). Deleted two hours after your last activity.
  • XSRF-TOKEN – protects forms against forged requests. Deleted two hours after your last activity.

Strictly necessary cookies do not require consent (Art. 5(3) of Directive 2002/58/EC as implemented in the Croatian Electronic Communications Act), so the website shows no cookie banner. We use no analytics or marketing cookies and no visitor tracking tools. Should that ever change, we will ask for your consent first.

4. Third-party content

  • Fonts and images are served from our own server. Loading a page sends no request to third parties.
  • Video. Some product pages contain a YouTube video (Google Ireland Limited). The video is loaded only when you press play. YouTube then receives your IP address and may set its own cookies, in accordance with Google's privacy policy.
  • Links to social networks are plain links. Data reaches those networks only when you open the link.

5. Who has access to the data

Only our employees who need the data to handle inquiries have access to it. For the website and e-mail we use a web hosting provider established in Croatia, which processes data solely on our instructions. Data is stored on servers in the European Union. We do not sell data or pass it on to third parties for their own purposes. We disclose it to public authorities only where the law obliges us to.

6. Your rights

At any time you have the right to:

  • request access to your data and a copy of it,
  • request rectification of inaccurate or incomplete data,
  • request erasure of your data,
  • request restriction of processing,
  • object to processing based on our legitimate interest,
  • request data portability, where applicable.

Send your request to info@sonitus.eu. We will reply without undue delay and within one month at the latest.

You also have the right to lodge a complaint with the supervisory authority: Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, Croatia, azop@azop.hr, www.azop.hr. If you live in another EU member state, you may also complain to the supervisory authority of that state.

7. Is providing data mandatory

Providing data is voluntary. Without a name and an e-mail address we cannot answer your inquiry. We make no decisions based solely on automated processing and we carry out no profiling.

8. Security

The website uses an encrypted connection (HTTPS). Only authorised persons have access to the data, and access to the administration is protected by a password.

9. Changes to this policy

We update this policy when the way we process data or the law changes. The current version is always published on this page, with the date of the last update.