Privacy policy
Effective from: 4 November 2026.
This policy provides the information required by Articles 13 and 14 of the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and by Article 43(4) of the Croatian Electronic Communications Act. It also sets out the service provider details required by Article 6 of the Croatian Electronic Commerce Act and Article 21 of the Companies Act. The Croatian version is the authoritative one.
1. Controller and service provider details
2.advice d.o.o., Štrosmajerova ulica 14, 10430 Samobor, Croatia
OIB (VAT ID): 38968052580 · registered with the Commercial Court in Zagreb, MBS 081033125
Share capital: EUR 2,640.00, paid in full · Management board: Matko Cikač, Emanuel Bakić
IBAN: HR7023400091110804072, Privredna banka Zagreb d.d.
Email: info@2advice.hr · Phone: +385 98 548 456, +385 91 602 2004
Real estate brokerage: we are entered in the Register of Real Estate Brokers kept by the Croatian Chamber of Economy (HGK), under no. 25/2018. Our brokerage activity is governed by the Croatian Real Estate Brokerage Act (Official Gazette NN 69/26). Administrative supervision is carried out by the ministry responsible for the economy, and inspection supervision by the State Inspectorate.
2. Data protection officer
We have not appointed a data protection officer, because Article 37 GDPR does not require one: we do not carry out regular and systematic monitoring of individuals on a large scale, nor large-scale processing of special categories of data. For any data protection question, contact info@2advice.hr or write to the address above.
3. What data we process, why, and on what legal basis
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Answering enquiries sent by email or phone | name, company, contact details, content of the enquiry | steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR); for enquiries made on behalf of a company, legitimate interest in business communication (Art. 6(1)(f)) | up to 2 years from the last communication if no business relationship follows |
| Concluding and performing brokerage and other agreements | identification and contact details of the client or its representative, property and transaction details, invoicing data | performance of a contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) under the Real Estate Brokerage Act (contract content and contract records) and accounting and tax law | the term of the contract, then the statutory periods: accounting documents generally 11 years (Accounting Act) |
| Customer due diligence for anti-money-laundering and counter-terrorist-financing purposes | identity document data, beneficial owner data of legal entities, transaction details | legal obligation (Art. 6(1)(c)) and public interest (Art. 6(1)(e)) under the Croatian Anti-Money Laundering and Terrorist Financing Act, which applies to us as a real estate broker | 10 years from the end of the business relationship or the transaction, as that Act requires |
| Business relations with contact persons of retailers, investors, owners and other partners | name, position, business contact details, correspondence | legitimate interest in establishing and maintaining business relationships (Art. 6(1)(f)) | while the relationship lasts or until you object, at most 2 years from the last contact |
| Website visit statistics (Google Analytics 4) | pseudonymous device identifier (cookie), pages visited, referral source, device and browser type, approximate city- or country-level location | your consent (Art. 6(1)(a) GDPR and Art. 43(4) of the Electronic Communications Act), which you can withdraw at any time | cookies up to 2 years; data in Google Analytics at most 14 months |
| Showing project locations on Google Maps | IP address and technical browser data received by Google when the map loads | your consent (Art. 6(1)(a)): a map loads only after you click “Load map” or choose to always load maps in the cookie settings | according to Google’s policies |
| Website security and operation (server logs) | IP address, date and time of access, requested URL, browser data | legitimate interest in the security and proper functioning of the website (Art. 6(1)(f)) | short term, according to the hosting provider’s settings, unless logs are needed to investigate a security incident |
Where we rely on legitimate interest, we have assessed that it is not overridden by your interests and rights. Processing is limited to business contact data and to what the purpose requires.
4. Sources of data
We usually receive data directly from you. Details of contact persons may also come from the company you work for or from business partners. Information about properties and their owners comes from public registers, such as the land registry, the cadastre and the court register, and from publicly available business sources. Where we have not obtained data from you, we will inform you at the latest at our first contact, as required by Article 14 GDPR.
5. Is providing data mandatory?
You can browse this website without providing any personal data. Data needed for a brokerage agreement and for customer due diligence is a statutory or contractual requirement. Without it, we cannot conclude the agreement or act as broker.
6. Cookies and local storage
Without your consent, we store on your device only what the site needs to work and to remember your choice. Analytics cookies and Google Maps are activated only after you consent. “Reject” and “Accept analytics” are equally prominent. You can withdraw consent as easily as you gave it, via the “Cookie settings” link in the footer of every page. Withdrawing consent deletes the analytics cookies on our domain. We keep your choice for 12 months and then ask again.
| Name | Type and set by | Purpose | Duration |
|---|---|---|---|
| ta_consent, ta_consent_t | browser local storage, 2.advice (strictly necessary) | remembers your analytics choice and when you made it | 12 months |
| ta_maps | browser local storage, 2.advice (set only if you choose it) | remembers that you want Google Maps to load automatically | until withdrawn |
| _ga | cookie, Google Analytics (consent only) | distinguishes visitors for statistics | 2 years |
| _ga_NB88M1MJL1 | cookie, Google Analytics (consent only) | keeps session state for statistics | 2 years |
| Google cookies on google.com (e.g. NID) | third-party cookies, Google (only if you load a map) | operation and settings of Google Maps | according to Google’s policies, usually up to 6 months |
Until you consent, Google Analytics runs in Consent Mode without setting cookies or accessing information on your device. WordPress cookies (wordpress_*, wp-settings-*) are set only for logged-in administrators, never for visitors.
7. Recipients and processors
- Web hosting: Infonet (infonet.hr), servers in Croatia.
- Email, analytics and maps: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Workspace, Google Analytics, Google Maps).
- External professional advisers (accounting, tax and legal), to the extent their service requires and under a duty of confidentiality.
- The counterparty in a transaction we broker, to the extent that transaction requires.
- Public authorities, where the law requires, e.g. the Tax Administration, the Anti-Money Laundering Office, courts and supervisory bodies.
Our processors act under a contract or data processing terms in line with Article 28 GDPR. We do not sell personal data and do not use it for targeted advertising.
8. Transfers outside the European Economic Area
Google may also process data in the United States. Such transfers rely on the European Commission’s adequacy decision (EU) 2023/1795 (EU–US Data Privacy Framework), under which Google LLC is certified, and in the alternative on the Commission’s standard contractual clauses (Articles 45 and 46 GDPR). We will provide information about these safeguards on request.
9. Automated decision-making
We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects for you (Article 22 GDPR).
10. Your rights
Under Articles 15 to 21 GDPR you have the right to:
- access your data and obtain a copy (Art. 15);
- rectification of inaccurate data (Art. 16);
- erasure, except where we must keep data by law (Art. 17);
- restriction of processing (Art. 18);
- portability of data you gave us on the basis of consent or a contract (Art. 20);
- withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal (Art. 7(3)).
Right to object (Art. 21 GDPR): you may object at any time, on grounds relating to your particular situation, to processing based on legitimate interest or public interest. We will then stop, unless we demonstrate compelling legitimate grounds that override your interests, or the processing is needed for legal claims. If we use data for direct marketing, you may object at any time, without giving reasons, and we will no longer use it for that purpose.
Send requests to info@2advice.hr or by post to our address. We respond free of charge and without undue delay, at the latest within one month. In exceptional cases this period can be extended by two further months, and we will tell you if so (Art. 12 GDPR). We may ask you to confirm your identity first.
11. Right to lodge a complaint
If you believe our processing breaches data protection law, you may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, Croatia, email azop@azop.hr, tel. +385 1 4609 000, azop.hr. You may also complain to the supervisory authority of the EU member state where you live or work. We recommend contacting us first so we can try to resolve the matter directly.
12. Security
The website is served only over an encrypted connection (HTTPS with HSTS). Access to the administration is restricted to authorised persons, and data is kept only in the systems of the processors listed above. We notify AZOP of personal data breaches and, where required, the people affected (Articles 33 and 34 GDPR).
13. Applicable law
- Regulation (EU) 2016/679 (General Data Protection Regulation)
- Act on the Implementation of the General Data Protection Regulation (NN 42/18)
- Electronic Communications Act (NN 76/22 as amended), Art. 43(4)
- Electronic Commerce Act (NN 173/03 as amended, most recently NN 67/25), Art. 6
- Companies Act, Art. 21
- Real Estate Brokerage Act (NN 69/26)
- Anti-Money Laundering and Terrorist Financing Act (NN 108/17 as amended)
14. Changes
We will update this policy when our processing or the law changes. The current version is always published on this page, with its effective date at the top. If a material change affects processing based on consent, we will ask for your consent again.