Privacy Policy
Last Updated: October 2026
Centar izvrsnosti MARBLE d.o.o. (“CoE MARBLE”, “we”, “us”, or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website marble.eu or interact with us.
This policy is provided in accordance with the General Data Protection Regulation (GDPR) – Regulation (EU) 2016/679.
1. Data Controller
The data controller responsible for your personal data is:
Centar izvrsnosti MARBLE d.o.o.
Unska 3
HR-10000 Zagreb
Croatia
Email: info [at] marble.eu
Registration: Commercial Court in Zagreb, MBS 081609956
OIB (PIN): 30490124308
VAT No.: HR30490124308
Management Board Member: Nikola Mišković
2. Personal Data We Collect
We collect personal data that you voluntarily provide to us when you:
2.1 Contact Form
When you submit a message through our contact form, we collect:
Your name
Email address
Message content
2.2 Newsletter Subscription
If you subscribe to our newsletter, we collect:
Email address
Name (if provided)
2.3 Automatically Collected Information
Our hosting and security providers process your IP address and basic request data to deliver and protect the site (legitimate interest).
If you consent to analytics, Google Analytics 4 collects pages visited, time on page, referring site, approximate location (country), browser and device type.
If you consent to marketing, the LinkedIn Insight Tag collects data to measure our LinkedIn advertising.
For more information, please see our Cookie Policy.
3. Purpose and Legal Basis for Processing
We process your personal data for the following purposes:
| Purpose | Legal Basis (GDPR Article 6) |
|---|---|
| Responding to your inquiries via contact form | Legitimate interest (Art. 6(1)(f)) – to respond to your request |
| Sending newsletters and updates | Consent (Art. 6(1)(a)) – your explicit consent to receive communications |
| Ensuring website security and functionality | Legitimate interest (Art. 6(1)(f)) – to maintain website security |
| Complying with legal obligations | Legal obligation (Art. 6(1)(c)) |
| Website analytics (Google Analytics 4) | Consent (Art. 6(1)(a)) |
| Measuring LinkedIn advertising | Consent (Art. 6(1)(a)) |
| Keeping proof of your cookie choices | Legal obligation (Art. 6(1)(c)) in connection with Art. 7(1) GDPR |
| Student Corner accounts | Performance of a contract (Art. 6(1)(b)) |
4. Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:
| Data Type | Retention Period |
|---|---|
| Contact form submissions | 2 years from submission |
| Newsletter subscriber data | Until you unsubscribe + 30 days for processing |
| Cookie consent records | 3 years from the choice, then automatically deleted (a choice itself is valid for 12 months) |
| Google Analytics data | 14 months |
| Student Corner account data | Until the account is deleted |
| Server logs | As determined by hosting provider security requirements |
After the retention period expires, your data will be securely deleted or anonymized.
5. Data Sharing and Third Parties
We do not sell, trade, or rent your personal data to third parties. We may share your data only with the following categories of recipients:
5.1 Service Providers (Data Processors)
| Service Provider | Purpose | Location |
|---|---|---|
| Lovable | Website hosting | Sweden (EU) |
| Cloudflare | Content delivery and security | United States* |
| Supabase | Database for Student Corner and consent records | United States* |
| Sanity | Content management for news, people and careers | United States* |
| Mailchimp (Intuit) | Newsletter and email communications | United States* |
| Google (Google Analytics 4) | Website analytics, only with consent | United States* |
| Advertising measurement, only with consent | United States* |
*These providers are located in the United States. Data transfers to the US are conducted in compliance with GDPR requirements, including appropriate safeguards such as Standard Contractual Clauses (SCCs) and/or the EU-US Data Privacy Framework where applicable.
5.2 Legal Requirements
We may disclose your personal data if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency).
6. International Data Transfers
Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA), particularly the United States, where several of our service providers are located.
When we transfer your data outside the EEA, we ensure appropriate safeguards are in place, including:
Standard Contractual Clauses approved by the European Commission
Certification under the EU-US Data Privacy Framework (where applicable)
Other legally recognized transfer mechanisms
7. Your Rights Under GDPR
Under the GDPR, you have the following rights regarding your personal data:
7.1 Right of Access (Article 15)
You have the right to obtain confirmation as to whether your personal data is being processed and, if so, to access that data and receive information about the processing.
7.2 Right to Rectification (Article 16)
You have the right to have inaccurate personal data corrected and incomplete data completed.
7.3 Right to Erasure (Article 17)
You have the right to request the deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected.
7.4 Right to Restriction of Processing (Article 18)
You have the right to request that we restrict the processing of your personal data in certain circumstances.
7.5 Right to Data Portability (Article 20)
You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.
7.6 Right to Object (Article 21)
You have the right to object to the processing of your personal data based on legitimate interests or for direct marketing purposes.
7.7 Right to Withdraw Consent (Article 7)
Where processing is based on your consent, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing based on consent before its withdrawal.
Exercising Your Rights
To exercise any of these rights, please contact us at info [at] marble.eu. We will respond to your request within one month of receipt. If your request is complex or we receive a large number of requests, we may extend this period by a further two months, in which case we will inform you.
8. Right to Lodge a Complaint
If you believe that our processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority.
For Croatia, the supervisory authority is:
Agencija za zaštitu osobnih podataka (AZOP)
Croatian Personal Data Protection Agency
Selska cesta 136
HR-10000 Zagreb
Croatia
Website: https://azop.hr
Email: azop@azop.hr
9. Data Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:
SSL/TLS encryption for data transmission
Secure hosting infrastructure
Access controls limiting data access to authorized personnel only
Regular security assessments
However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee its absolute security.
10. Children’s Privacy
Our website is not intended for children under the age of 16. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe that your child has provided us with personal data, please contact us at info [at] marble.eu, and we will take steps to delete such information.
11. Links to Third-Party Websites
Our website may contain links to third-party websites, including social media platforms (LinkedIn, Facebook, YouTube). We are not responsible for the privacy practices or content of these external sites. We encourage you to review the privacy policies of any third-party websites you visit.
12. Embedded Content
Our website may include embedded content from third-party services (e.g., YouTube videos). When you view or interact with such embedded content, these third parties may collect data about you. Embedded videos and maps only load after you click to load them or have allowed external media in cookie settings. Please refer to the privacy policies of these services for more information:
Google/YouTube Privacy Policy
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:
Update the “Last Updated” date at the top of this policy
Post the revised policy on our website
Where appropriate, notify you by email or through a notice on our website
We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.
14. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:
Centar izvrsnosti MARBLE d.o.o.
Unska 3
HR-10000 Zagreb
Croatia
Email: info [at] marble.eu
We will make every effort to respond to your inquiry promptly and address any concerns you may have.