Privacy policy

How we process personal data submitted through the forms on this website.

Effective date: in progress

This is a courtesy translation. In case of discrepancy, the Croatian version prevails.

1. Data controller

The data controller is the association:

Full name: Boksački klub Lokomotiva
Address: Ul. Đure Crnatka 18, 10000 Zagreb, Hrvatska
E-mail: boxinglokomotiva@gmail.com
Phone: 098 211 509
OIB (tax ID): 00312808455
Representative: Jozo Katić

For any questions regarding the processing of your personal data or exercising your rights, contact us at boxinglokomotiva@gmail.com.

The club is not required to appoint a Data Protection Officer (DPO) under Article 37 GDPR. in progress

2. Data we process

Through the forms on this website we process:

Training sign-up (/en/training)

participant's full name,
participant's age,
contact person's full name (parent or guardian if the participant is a minor),
contact person's e-mail address,
contact person's phone number,
free-text message (optional),
form submission timestamp.

Contact form (/en/contact)

full name,
e-mail address,
phone number (optional),
free-text message,
form submission timestamp.

The site uses a hidden „honeypot" field as spam protection. Any value entered there is discarded — it exists solely to reject automated submissions.

3. Purpose and legal basis

Training sign-up: Purpose: arranging your first training session and possible enrolment. Legal basis: steps taken at the request of the data subject prior to entering into a membership relationship (Art. 6(1)(b) GDPR) and your consent to process contact data for the purpose of getting back to you (Art. 6(1)(a) GDPR).
Contact form: Purpose: responding to your enquiry. Legal basis: your consent given by ticking the checkbox on submission (Art. 6(1)(a) GDPR).

4. Retention period

Enquiries that do not lead to membership are kept for in progress from the last communication, then deleted from our inbox and any related records.
If you enrol, the data submitted through the form is taken over by a separate membership record whose retention is defined by in progress and applicable law (e.g. Sports Act, Accounting Act for financial obligations).
Messages sent through the forms remain in the club inbox (Gmail) until manually deleted, with an obligation of regular clean-up.

5. Recipients

Form data is processed on our behalf by the following processors:

Web3Forms — form submission service. Receives the form payload and forwards it to the club's e-mail. Data is not stored permanently by the processor.
Google Ireland Limited (Gmail) — e-mail service to which form submissions are delivered.
Cloudflare, Inc. — hosting and CDN provider (Cloudflare Pages) serving this website.

Beyond the above, we do not disclose data to third parties, except where required by a competent authority under applicable law.

6. Transfers to third countries

Some of the above processors (Web3Forms, Cloudflare) may process data outside the European Economic Area. Transfers rely on appropriate safeguards under Chapter V GDPR — an adequacy decision (e.g. the EU–US Data Privacy Framework) or Standard Contractual Clauses (SCCs) concluded between the controller and the processor.

7. Your rights

Regarding the data we have collected about you, you have the following rights:

Right of access — to confirm whether we process your data and receive a copy.
Right to rectification — to correct inaccurate or complete incomplete data.
Right to erasure („right to be forgotten") — under conditions in Art. 17 GDPR.
Right to restriction of processing — under conditions in Art. 18 GDPR.
Right to data portability — to receive your data in a machine-readable format.
Right to object — to processing based on legitimate interests.
Right to withdraw consent — at any time, without affecting processing already carried out.

Submit requests to boxinglokomotiva@gmail.com. We respond within 30 days of receipt.

You also have the right to lodge a complaint with the supervisory authority — in the Republic of Croatia that is the Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr.

8. Cookies and analytics

This website does not use tracking cookies or tools that require consent under the Croatian Electronic Communications Act.

If we add visitor statistics in the future, we will use Cloudflare Web Analytics, which sets no cookies and does not build user profiles. Any change will be reflected in this policy.

9. Security

We take reasonable technical and organisational measures against unauthorised access, loss or destruction of data: HTTPS on all pages, restricted access to the club inbox, and regular deletion of messages no longer needed.

10. Automated decision-making

We do not carry out automated decision-making or profiling. Every enquiry is handled by a human.

11. Changes to this policy

We reserve the right to update this policy. The current version is always available on this page, with the effective date shown at the top.