Legal
Privacy notice
This notice explains how Architech d.o.o. handles personal data when you visit architech.hr or contact us through the website or by email.
Last updated: 20 October 2026
Who is responsible for your data
Architech d.o.o. is the controller of the personal data covered by this notice.
Registered office: Ulica Lea Müllera II. odvojak 10, 10000 Zagreb, Croatia.
OIB: 48820585966.
For privacy questions or to exercise your rights, email [email protected] or write to our registered office, marked “Data protection”.
What this notice covers
This notice covers our company website and related enquiries and correspondence. It does not describe the processing of customer content within the Archy AI Platform or its products. See the separate privacy information at archy-ai.com/privacy when using those services.
If you become a client, additional information may apply to the services we provide and to personal data processed on your organisation’s behalf.
When you contact us through the form
We collect your name, work email address, company or organisation, area of interest and message. You may also provide your role and preferred timing. We record the time of submission and the form acknowledgement and wording version associated with your submission.
The form may also include information about how you reached the website, including the initial page, referring website and campaign parameters in the URL. Where present in the URL, advertising click identifiers such as gclid or fbclid may be included in the enquiry record. These identifiers are not needed to answer your enquiry. We use referral information to understand the context and source of incoming enquiries; we do not use it to deliver personalised advertising or build cross-site browsing profiles.
We use your enquiry to respond, arrange a discussion, prepare a proposal where requested and manage the resulting business correspondence. Enquiries are passed to our CRM and made available to the Architech people responsible for responding. An internal notification alerts the relevant person to a new enquiry. Submitting the form does not subscribe you to automated marketing emails.
For enquiries made on behalf of an organisation, our legal basis is our legitimate interest in responding to business requests and managing business relationships under Article 6(1)(f) GDPR. Where you personally request steps towards entering a contract with us, Article 6(1)(b) GDPR applies to processing necessary for those steps. We consider the limited information involved and your reasonable expectation that we will respond when assessing our legitimate interests.
The form acknowledgement confirms that you have seen this notice. It is not consent to marketing and is not the legal basis for responding to an enquiry.
Providing data is voluntary. The form requires your name, email address, company, area of interest and message to submit an enquiry through that channel. Your role and preferred timing are optional. You can instead email [email protected]. Please do not include sensitive personal data, passwords or confidential customer information in a general enquiry.
Website delivery and security
Cloudflare helps deliver the website, run the form endpoint and protect the site. Technical information can include IP address, browser and device information, requested pages, timestamps and security events. We process this information for reliable delivery, diagnosing faults and preventing spam, fraud and attacks, based on our legitimate interest in operating a secure website under Article 6(1)(f) GDPR.
The form uses a hidden spam-detection field, submission rate limits and Cloudflare Turnstile. Turnstile evaluates browser and device signals to distinguish legitimate visitors from automated traffic. Cloudflare processes data on our behalf to provide this protection. It also acts as a separate controller for signals used to improve Turnstile’s bot detection capabilities, as explained in its Turnstile Privacy Notice.
We do not use website analytics tags, advertising pixels or social-media tracking tools. Referral information included with an enquiry is described above. Fonts and images are served from this website.
When you email us
We receive your email address, any name or signature included in your email, message content, attachments and associated email metadata. We use this information to respond and manage correspondence, using the legal bases described for enquiries above. Our email service provider processes messages and internal enquiry notifications on our behalf.
Where correspondence must be retained to comply with a legal obligation, we rely on Article 6(1)(c) GDPR. Where it is necessary to establish, exercise or defend legal claims, we rely on our legitimate interests under Article 6(1)(f) GDPR.
Who receives your data
Access is limited to people and providers who need it for the purposes described here. We do not sell personal data.
| Provider or recipient category | Purpose and data involved | International processing |
|---|---|---|
| Cloudflare, Inc. | Website delivery, security, form processing and Turnstile; hosting the CRM application that receives enquiries and writes them to the CRM database; technical information, enquiry details and operational metadata | US-based provider operating a global network; processing can take place outside the EEA |
| Notion Labs, Inc. | CRM database storing enquiry details and associated correspondence records | US-based provider; storage region depends on the workspace arrangement and international access may occur |
| Neon, Inc. | Database of the CRM application; enquiry details and operational metadata | Stored on Amazon Web Services in Frankfurt, Germany; US-based provider, so support access from outside the EEA may occur |
| Microsoft (Microsoft 365 business email) | Email correspondence and internal enquiry notifications | Location depends on the contracted service and tenant configuration |
| Transactional notification delivery provider, where a separate provider is used | Delivery of internal new-enquiry alerts; enquiry details included in those alerts | Location depends on the contracted service and configuration |
| Professional advisers, competent authorities and courts | Advice, compliance with legal duties and establishing, exercising or defending legal claims | Only the information necessary for the relevant purpose is disclosed |
Providers acting as processors are subject to contractual data-protection obligations. Providers may use authorised subprocessors to deliver their services. Where a provider acts as a separate controller, its own privacy information applies to that processing, including Cloudflare’s Turnstile improvement activity described above.
Transfers outside the European Economic Area
Some providers and their subprocessors process personal data outside the European Economic Area, including in the United States. An EU storage location does not by itself exclude international access or transfers.
For transfers to countries without an applicable European Commission adequacy decision, we use the European Commission’s Standard Contractual Clauses in the relevant provider data-processing arrangements, with an assessment of the transfer and supplementary measures where necessary. Where an applicable adequacy decision covers a recipient and the relevant processing, that decision may instead provide the transfer basis.
You can request information about the safeguards applicable to your data and a copy of relevant safeguards by emailing [email protected]. Copies may be redacted to protect confidential information and the rights of others.
Cookies and similar technologies
We do not use cookies for advertising, behavioural tracking or website audience analytics. Security checks may involve limited device information and technologies needed to protect the website and contact form.
Cloudflare Turnstile generates a single-use validation token that expires after five minutes. This token validates a form interaction; it is not an advertising identifier or a five-minute limit on every item of security data processed by Cloudflare.
Depending on the security features enabled and whether a challenge is required, Cloudflare may also use security cookies. A cf_clearance cookie can record that a browser has passed a challenge; it is associated with challenge handling or Turnstile pre-clearance rather than every ordinary Turnstile interaction. Its expiry is determined by the challenge configuration. Cloudflare documents its cookies in its cookie reference.
Consent is not required for storage or access that is strictly necessary to transmit a communication or provide a service you have expressly requested. This exemption applies only to qualifying operations, not automatically to every technology supplied by a security provider. If we introduce optional storage, tracking or similar functionality, we will provide the necessary information and obtain consent before activating it where required. You can use your browser settings to manage cookies; blocking necessary security functionality may affect form submission. You can still contact us by email.
How long we keep your data
We retain data according to its purpose and any applicable legal requirements:
- Enquiries that do not lead to work: up to 12 months after the last substantive exchange, then deleted or irreversibly anonymised, unless limited records are required for an identified legal claim or obligation.
- Enquiries that lead to a contract: relevant information is transferred into the client record. We retain it for the engagement and afterwards only to meet legal duties or establish, exercise or defend claims. We determine that further period by the type of record and the applicable statutory or limitation period; the existence of a contract does not justify retaining every original enquiry indefinitely.
- Accounting records: documents supporting entries in the journal, general ledger or subsidiary books are generally retained for at least 11 years under Croatian accounting law, subject to special rules under fiscalisation legislation. The statutory period for accounting documents starts on the last day of the business year to which the books containing the entries relate. This does not impose an 11-year period on every enquiry or email.
- Technical and security information: retained for the period necessary to deliver the service, operate rate limits, diagnose faults and investigate security incidents, taking account of the relevant provider’s service-specific retention settings. Information needed for an incident or legal claim is restricted and retained only while that need continues.
- Deletion and backups: deletion includes enquiry copies in the CRM, notifications and mailboxes where applicable. Backup copies are removed through the applicable backup lifecycle and remain restricted from ordinary use pending removal.
Your rights
Depending on the circumstances, you may request access to your data, correction, erasure, restriction of processing and data portability. Portability applies to data you have provided where processing is automated and based on consent or a contract.
You can object, on grounds relating to your particular situation, to processing based on our legitimate interests. We must stop unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing is necessary for legal claims. If personal data is used for direct marketing, you can object at any time and we will stop processing it for that purpose.
Where processing relies on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.
Email [email protected] to exercise your rights. We respond without undue delay and normally within one month of receiving the request. For complex or numerous requests, GDPR permits an extension of up to two further months; we will explain any extension within the first month. We may request proportionate additional information if necessary to verify your identity. Requests are normally free of charge.
You may complain to the Croatian Personal Data Protection Agency, Agencija za zaštitu osobnih podataka (AZOP), or to a supervisory authority in the EU/EEA country of your habitual residence, workplace or the alleged infringement. You do not have to contact us first.
Automated decisions and updates
We do not use the information covered by this notice to make decisions based solely on automated processing that produce legal effects or similarly significantly affect you. Automated security checks may challenge or reject suspected spam; you can contact us by email if the form is unavailable.
We update this notice when relevant practices change and show the revision date above. If a change requires further information or consent, we will provide it as required. Questions can be sent to [email protected].