How we handle your data.

1. Who we are (Controller)

We are the data controller for any personal data you provide through rosemarkotic.com, the free Starter Guide and email series, or coaching services. A formal DPO is not required at our processing scale; Rose Markotic acts as the privacy contact and is reachable at the email above.

2. What we collect and why

We process the following categories of personal data:

• Contact info (email, name, country) — when you sign up for the newsletter, submit the contact form, or book a Discovery Call. Legal basis: consent (Art. 6(1)(a)) for marketing; legitimate interest (Art. 6(1)(f)) for transactional communication.
• Attribution data (referrer, landing page, UTM parameters) — automatically captured on first visit if UTM tracking parameters are present. Stored in cookies (rm_attribution) and the attribution table. Legal basis: legitimate interest in understanding our marketing channels.
• Quiz responses + intake responses (mental-health context) — Article 9 special-category data under GDPR. Processed only with your explicit consent indicated by a checkbox before submission. Consent text version is stored alongside your responses so we can re-prompt if wording changes. You can withdraw Article 9 consent at any time by emailing the privacy contact above.
• Purchase records (Stripe customer ID, amounts, dates, fiscalized Croatian invoice details with JIR code) — required for tax + accounting. Retained for 11 years under Croatian Tax Code. Legal basis: legal obligation (Art. 6(1)(c)).
• Booking + session data (Discovery Call screening, scheduled times, session attendance) — required to deliver the service. Legal basis: contract performance (Art. 6(1)(b)).
• Coaching agreement acceptance (IP address, user agent, timestamp, agreement version) — required to evidence informed consent to the coaching agreement. Retained for the limitation period under Croatian Civil Code (5–10 years). Legal basis: legitimate interest in defending legal claims (Art. 6(1)(f) + Art. 17(3)(e)).
• Email engagement (deliveries, opens, clicks, bounces, complaints) — only for marketing emails; transactional emails have tracking disabled. Legal basis: consent for marketing.
• Abuse-prevention counters (IP address, submitted email address) — when you submit a public form (contact, newsletter, quiz result, cancellation) we count recent submissions per address and per IP, so this site cannot be used to send unwanted email to other people. Stored only as a one-way hash with a counter — never the address or the IP itself — and deleted within 7 days. Legal basis: legitimate interest in the security of our systems (Art. 6(1)(f), Recital 49).

3. Who else processes your data

We use the following data processors, each under a signed Data Processing Agreement:

• Supabase (EU region, Frankfurt) — database + auth + storage
• Resend (EU region) — transactional + marketing email delivery
• Cal.com (EU-hosted) — Discovery Call scheduling
• Stripe (US-based, EU subsidiary for EU customers; SCC-based transfer mechanism) — payments + Customer Portal
• Vercel Web Analytics (part of our hosting, EU edge configured) — cookieless, aggregate web analytics
• Cookiebot (Denmark) — consent management
• Cloudflare (Turnstile only) — bot-check on the contact, newsletter, and quiz-result forms. We do not route site traffic or email through Cloudflare.
• Google Workspace (Google Ireland Ltd., EU terms) — business email: messages you send to our hello@/support@/privacy@ addresses are received and stored in Google Workspace mailboxes
• Vercel (EU edge configured) — hosting
• Sentry / BetterStack (EU residency or PII-scrubbing) — error tracking + uptime monitoring
• FINA + Croatian Tax Administration (Croatia, government) — fiscalization of Croatian invoices (Fiscalization 2.0 since 2026-01-01)
• Meta / Google (US, SCC-based) — retargeting pixels, ONLY active after explicit cookie consent. Default off.
• Mux / Cloudflare Stream (v1.1 only) — course video hosting

4. Cookies

We use three categories of cookies, managed via Cookiebot:

• Necessary — for the site to function (e.g., rm_anon anonymous session, rm_attribution for first-touch attribution, Cookiebot itself). Cannot be disabled.
• Analytics — Vercel Web Analytics is cookieless, stores no persistent identifiers, and runs without consent as aggregate statistics. We do not use Google Analytics.
• Marketing — Meta Pixel and Google retargeting cookies run only after explicit consent.

5. How long we keep your data

• Invoices + purchase records: 11 years (Croatian Tax Code retention requirement)
• Coaching agreement acceptance: 5–10 years (Croatian Civil Code limitation period for legal claims)
• Marketing contacts: until you unsubscribe; then retained as a suppression record only (email hash) to honor the unsubscribe
• Anonymized event analytics: 12 months in the live database, then archived to cold storage
• Quiz + intake responses: retained until you withdraw Article 9 consent OR request erasure (see your rights below)
• Email tracking events: 24 months, then anonymized
• Abuse-prevention counters: 7 days (one-way hash + a count; no address or IP is stored)

6. Your rights under GDPR

• Access (Art. 15) — get a copy of your data within 30 days, free
• Rectification (Art. 16) — correct inaccurate data
• Erasure (Art. 17) — delete your data, subject to retention exceptions for invoices, agreements, and legal-claims defense
• Restriction (Art. 18) — pause processing while disputes are resolved
• Portability (Art. 20) — receive your data in a machine-readable format (JSON)
• Object (Art. 21) — refuse legitimate-interest processing
• Withdraw consent — for any consent-based processing, at any time
• Special — withdraw Article 9 consent — separately from marketing unsubscribe, you can withdraw consent for processing of your sensitive (mental-health) data. Once withdrawn, we stop future processing of quiz / intake / session-notes data.

To exercise any of these, email privacy@rosemarkotic.com with the specific request. We respond within 30 days.

7. Complaints to the supervisory authority

You have the right to lodge a complaint with the Croatian data-protection authority:

8. Automated decision-making

We do not use automated decision-making (including profiling) that produces legal or similarly significant effects on you. The quiz pattern-matching uses a rule-based rubric, not machine learning, and its output is informational — not a service decision.

9. Changes to this policy

When this policy changes materially we’ll email anyone with an active marketing consent and post the new version with an updated date. Prior versions are kept in version control and available on request.