How we handle your data.

1. Who we are (Controller)

We are the data controller for any personal data you provide through rosemarkotic.com, the free Starter Guide and email series, or coaching services. A formal DPO is not required at our processing scale; Rose Markotic acts as the privacy contact and is reachable at the email above.

2. What we collect and why

We process the following categories of personal data:

• Contact info (email, name, country) — when you sign up for the newsletter, submit the contact form, or book a Discovery Call. Legal basis: consent (Art. 6(1)(a)) for marketing; legitimate interest (Art. 6(1)(f)) for transactional communication.
• Campaign data (referrer, landing page, campaign parameters) — recorded only if you submit a form, and only from the parameters present in the web address you arrived on. We record which campaign or referral brought you here, never an identifier for you personally. No advertising or tracking cookie is set, and nothing is sent to an advertising platform. Legal basis: legitimate interest in understanding which of our channels work.
• Quiz responses + intake responses (mental-health context) — Article 9 special-category data under GDPR. Processed only with your explicit consent indicated by a checkbox before submission. Consent text version is stored alongside your responses so we can re-prompt if wording changes. You can withdraw Article 9 consent at any time by emailing the privacy contact above.
• Purchase records (Stripe customer ID, amounts, dates, fiscalized Croatian invoice details with JIR code) — required for tax + accounting. Retained for 11 years under Croatian Tax Code. Legal basis: legal obligation (Art. 6(1)(c)).
• Booking + session data (Discovery Call screening, scheduled times, session attendance) — required to deliver the service. Legal basis: contract performance (Art. 6(1)(b)).
• Coaching agreement acceptance (IP address, user agent, timestamp, agreement version) — required to evidence informed consent to the coaching agreement. Retained for the limitation period under Croatian Civil Code (5–10 years). Legal basis: legitimate interest in defending legal claims (Art. 6(1)(f) + Art. 17(3)(e)).
• Email engagement (deliveries, opens, clicks, bounces, complaints) — only for marketing emails; transactional emails have tracking disabled. Legal basis: consent for marketing.
• Abuse-prevention counters (IP address, submitted email address) — when you submit a public form (contact, newsletter, quiz result, cancellation) we count recent submissions per address and per IP, so this site cannot be used to send unwanted email to other people. Stored only as a one-way hash with a counter — never the address or the IP itself — and deleted within 7 days. Legal basis: legitimate interest in the security of our systems (Art. 6(1)(f), Recital 49).

3. Who else processes your data

We use the following data processors, each under a signed Data Processing Agreement:

• Supabase (EU region, Frankfurt) — database + auth + storage
• Resend (EU region) — transactional + marketing email delivery
• Cal.com (EU-hosted) — Discovery Call scheduling
• Stripe (US-based, EU subsidiary for EU customers; SCC-based transfer mechanism) — payments + Customer Portal
• Vercel Web Analytics (part of our hosting, EU edge configured) — cookieless, aggregate web analytics
• Cloudflare (Turnstile only) — bot-check on the contact, newsletter, and quiz-result forms. We do not route site traffic or email through Cloudflare.
• Google Workspace (Google Ireland Ltd., EU terms) — business email: messages you send to our hello@/support@/privacy@ addresses are received and stored in Google Workspace mailboxes
• Vercel (EU edge configured) — hosting
• BetterStack — uptime monitoring. It requests a status endpoint that returns no personal data.
• FINA + Croatian Tax Administration (Croatia, government) — fiscalization of Croatian invoices (Fiscalization 2.0 since 2026-01-01)

4. Cookies

We set no advertising cookies and no tracking cookies, so there is no cookie banner to click through. In full, what the site stores on your device is:

• Sign-in cookies — only if you have a client portal or admin account, and only once you sign in. They keep you signed in and nothing else.
• Campaign parameters, for one visit — if you arrive from a campaign or a referral link, the campaign name is held in your browser for the length of that visit so it can be passed to our booking page. It is deleted when you close the tab, it identifies a campaign rather than a person, and it is never shared.

We do not use Google Analytics, and there is no Meta Pixel, Google Ads tag, or any other advertising tag anywhere on this site. Our visitor statistics come from Vercel Web Analytics, which is cookieless and stores no persistent identifier.

Until 31 July 2026 this site also set two one-year cookies — rm_anon and rm_attribution — for internal analytics. We switched them off because they were not necessary for anything you asked us to do. If you still hold either from an earlier visit, it is no longer read or renewed, and clearing your cookies removes it.

5. How long we keep your data

• Coaching session records: 3 years after the end of the coaching relationship, then securely deleted (coaching agreement §12)
• Invoices + purchase records: 11 years (Croatian Tax Code retention requirement)
• Coaching agreement acceptance: 5–10 years (Croatian Civil Code limitation period for legal claims)
• Marketing contacts: until you unsubscribe; then retained as a suppression record only (email hash) to honor the unsubscribe
• Anonymized event analytics: 12 months in the live database, then archived to cold storage
• Quiz + intake responses: retained until you withdraw Article 9 consent OR request erasure (see your rights below)
• Email tracking events: 24 months, then anonymized
• Abuse-prevention counters: 7 days (one-way hash + a count; no address or IP is stored)

6. Your rights under GDPR

• Access (Art. 15) — get a copy of your data within 30 days, free
• Rectification (Art. 16) — correct inaccurate data
• Erasure (Art. 17) — delete your data, subject to retention exceptions for invoices, agreements, and legal-claims defense
• Restriction (Art. 18) — pause processing while disputes are resolved
• Portability (Art. 20) — receive your data in a machine-readable format (JSON)
• Object (Art. 21) — refuse legitimate-interest processing
• Withdraw consent — for any consent-based processing, at any time
• Special — withdraw Article 9 consent — separately from marketing unsubscribe, you can withdraw consent for processing of your sensitive (mental-health) data. Once withdrawn, we stop future processing of quiz / intake / session-notes data.

To exercise any of these, email privacy@rosemarkotic.com with the specific request. We respond within 30 days.

7. Complaints to the supervisory authority

You have the right to lodge a complaint with the Croatian data-protection authority:

If you live in another EU/EEA country, you may lodge your complaint with the supervisory authority of your own country of residence instead — you are not required to come to AZOP.

8. Automated decision-making

We do not use automated decision-making (including profiling) that produces legal or similarly significant effects on you. The quiz pattern-matching uses a rule-based rubric, not machine learning, and its output is informational — not a service decision.

9. Changes to this policy

When this policy changes materially we’ll email anyone with an active marketing consent and post the new version with an updated date. Prior versions are kept in version control and available on request.