Last updated: 17.10.2026
Your privacy matters to us. This policy explains what personal data we process when you use the website domiva.hr and our services, for what purpose, how long we keep it and what your rights are under the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Croatian Act on the Implementation of the GDPR.
1. Data controller
The controller of personal data is Domiva, obrt za savjetovanje (sole trader), owner Ivan Mikić, Murska ulica 9, 10370 Dugo Selo, OIB: 04630104434. Contact for all data protection questions: info@domiva.hr.
2. What data we process, why and on what legal basis
- Booking a service or rental: name, email, phone, address, preferred date, chosen service, machine or items, delivery method, note and website language. Purpose: processing the order, arranging the appointment and providing the service. Legal basis: performance of a contract and pre-contractual steps (Art. 6(1)(b) GDPR).
- Date of birth (optional): only if you enter it yourself, so that we can send you a birthday greeting with a discount. Legal basis: your consent (point a), which you can withdraw at any time.
- Order notifications: we email you a confirmation of receipt, the appointment confirmation and updates on your order. Legal basis: performance of a contract (point b).
- Client register: we keep order data in a client list so that we recognise returning clients and have an order history (e.g. for complaints). Legal basis: legitimate interest (point f).
- Promotional messages: about 6 months after a service we send a reminder with a discount and, if you entered your date of birth, a birthday greeting with a discount. We send these only to our clients and only for our own services. Legal basis: legitimate interest (point f) and Art. 50 of the Croatian Electronic Communications Act. You can opt out with the tick box in the booking form, with the link "I no longer want to receive such messages" in every message, or by email to info@domiva.hr.
- Enquiries by email, phone or WhatsApp: the data you send us, in order to answer your enquiry. Legal basis: legitimate interest or pre-contractual steps (points f and b). If you write to us on WhatsApp, the messages are also processed by WhatsApp (Meta) under its own privacy policy.
- Withdrawal, complaints and claims: the data in your statement or complaint. Legal basis: legal obligation (point c).
- Invoices: the data needed to issue an invoice. Legal basis: legal obligation (point c).
- Blog comments: name, email (not published) and the content of the comment. Legal basis: consent (point a). For "like / dislike" votes we record the IP address to prevent multiple voting. Legal basis: legitimate interest (point f).
- Cookie-free visitor statistics: we count page views, traffic source, device type and language. Visitors are recognised only by a one-way hash of the IP address and browser with a secret key; the IP address itself is not stored. Legal basis: legitimate interest in measuring traffic (point f).
- Analytics and ads (only with consent): if you choose "Accept all" in the cookie notice, Google Analytics, Google Ads and Meta Pixel collect data about visits and interactions for statistics and to measure ad performance. Legal basis: consent (point a). For the collection of data via Meta Pixel we are jointly responsible with Meta Platforms Ireland Ltd.; Meta is responsible for further processing.
- Server logs: IP address, time and requested page, for security and operation of the website. Legal basis: legitimate interest (point f).
3. How long we keep data
- Enquiries and bookings that did not become a contract: 12 months.
- Completed orders and client register data: 3 years from the last order, for complaints and possible claims.
- Invoices and other business records: for the periods required by tax and accounting regulations.
- IP address with a blog vote: 12 months. Approved comments: until you ask us to delete them.
- Visitor statistics: 25 months. Log of sent emails: 12 months.
- Server logs: briefly, according to the hosting provider's settings.
When these periods expire, the data is deleted automatically.
4. Who has access to the data
We do not sell or pass it to third parties for marketing purposes. We use the following external service providers (processors), only to the extent needed for their service:
- Kuhada: web hosting and email; the servers are located in the EU.
- CallMeBot and WhatsApp (Meta): when a new order arrives, its details are sent to the business owner as a WhatsApp notification.
- DeepL SE (Germany): automatic translation of public website texts into English and German, including published comments. Data from forms and orders is not sent for translation.
- Google (Google Ireland Ltd.): Google Analytics and Google Ads, only with your consent. We fetch the ratings and reviews from our Google profile onto our own server; your browser does not contact Google for this.
- Meta (Meta Platforms Ireland Ltd.): Meta Pixel, only with your consent.
- Competent authorities, where required by law.
Some of these providers or their subcontractors are located outside the EU (e.g. in the USA). Such transfers are based on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses.
5. Your rights
Under the GDPR you have the right of access to your data, rectification, erasure ("right to be forgotten"), restriction of processing, data portability and the right to object, including objecting to processing for direct marketing. You can withdraw consent at any time without affecting the lawfulness of processing before the withdrawal. We do not make decisions based solely on automated processing that would have legal or similarly significant effects on you.
Send your request to info@domiva.hr; we reply within one month at the latest. You also have the right to lodge a complaint with the supervisory authority, the Croatian Personal Data Protection Agency (AZOP), azop.hr.
6. Cookies
The website uses essential cookies to work properly and, only with your consent, analytics and marketing cookies (Google Analytics, Google Ads, Meta Pixel). Fonts and icons are served from our own server. You give consent in the cookie notice on your first visit and can change it at any time via the "Cookie settings" link in the page footer. Read more in the Cookie Policy.
7. Security
The website works exclusively over an encrypted connection (HTTPS). Only the business owner has access to the data, via a protected admin interface. We never store user passwords in their original form.
8. Home Helper: user account
If you open an account in Domiva's Home Helper (domiva.hr/pomocnica), we additionally process:
- Account data: first name, last name, email, mobile number and password. We store the password only as a one-way cryptographic hash (Argon2id), so not even we can see it.
- Content you publish yourself: recipes (with photos and video), comments, ratings, favourites, public meal plans and content reports.
- Household data: number of household members, rooms and floor area, approximate location (a town or a point you choose yourself, to find the nearest shops), selected shops, meal plan, shopping list, tasks and loyalty cards.
- Household invitations: if you invite someone to your household, we use their email only to send the invitation. An unaccepted invitation is deleted 30 days after it expires.
- Support messages: the content of the message and your email, in order to reply. Resolved requests are deleted after 24 months.
- Home assistant emails: confirmations and notices about your account and, if you switch it on, the morning email with tasks, which you can switch off in "My account" or via the link in the message itself.
- Security records: the number of login attempts per IP address and email address (in hashed form), to protect against password guessing; they are deleted after 24 hours.
Purpose and legal basis: performance of the contract for using the home assistant (Art. 6(1)(b) GDPR) and legitimate interest in service security and preventing abuse (point f). An account may be opened by anyone aged at least 16.
Password check: when you choose a password, we check whether it appears in publicly known data breaches (Have I Been Pwned service). Only the first five characters of the password's SHA-1 hash are sent; neither the password nor its full hash ever leaves our server.
External processors (only for services that are enabled and only to the extent necessary for them):
- Google or Apple (if you log in with their account): we receive only your name, email and account identifier from them.
- Twilio (confirming your mobile number by SMS): mobile number and a one-time code.
- Anthropic (automatic checking of published content): the text of recipes, comments or meal plans and still frames from videos. Under its terms of service, Anthropic does not use the data sent to train its models.
Some of these processors are located outside the EU (USA); the transfer is based on standard contractual clauses or the EU-US Data Privacy Framework.
Your control: in "My account" you can change your data, download all your data in one file and delete your account at any time. The account is closed immediately and your recipes, meal plans and comments are removed from public view; after 30 days your name, email, number, password, recipes, comments and household data are permanently deleted. Within those 30 days you can restore the account by logging in. Older shopping-list items and tasks are deleted automatically after 6 months, and meal plans after 12 months.
Shop prices that we display are taken from retailers' official price lists published under the Decision (Official Gazette NN 75/2025) and contain no personal data.
9. Changes to this policy
We may update this policy from time to time. The date of the last change is shown at the top of the page. We notify home assistant users of material changes by email.
