Introduction

Professio Energia d.d. (the Company) respects your privacy and is committed to protecting your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the General Data Protection Regulation or GDPR), the Act on the Implementation of the General Data Protection Regulation (Official Gazette No. 42/2018) and other applicable laws of the Republic of Croatia.

This Privacy Policy explains which personal data we collect, the purposes for which we process it, the legal bases on which the processing is carried out and your rights as a data subject.

Data controller

As data controller, the Company is responsible for ensuring that personal data is collected, processed, stored and protected lawfully, fairly and transparently, and that all processing activities comply with applicable data protection laws.

The Company implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or other unlawful processing.

What data we collect

We may collect and process the following categories of personal data:

  • contact details (first and last name, email address and telephone number)

  • organisation details (name of the company or institution and job title or position)

  • technical data (IP address, browser information, cookies and other technical data collected when you use this website)

  • data you voluntarily provide through contact forms, by email or in other business communications.

Purpose of processing

We process your personal data solely for the following purposes:

  • responding to your enquiries and providing the requested information

  • communicating with shareholders, business partners, investors and other interested members of the public

  • providing information about business activities, news or other relevant notices, where there is an appropriate legal basis

  • improving the functionality and user experience of our website

  • complying with the Company's legal and regulatory obligations.

Legal basis for processing (GDPR)

We process personal data pursuant to Article 6 of the General Data Protection Regulation (GDPR) where processing is necessary for:

  • the performance of a contract or taking steps at the request of the data subject prior to entering into a contract

  • compliance with the Company's legal obligations

  • the purposes of the Company's legitimate interests, provided that those interests are not overridden by the data subject's rights and freedoms

  • the data subject's consent, where required.

Data sharing

Personal data will not be sold or disclosed to third parties for marketing purposes.

Personal data may be disclosed to authorised processors that provide the Company with IT, administrative or other professional services, and to competent authorities where required by law or necessary for the exercise of rights and compliance with the Company's legal obligations.

In all such cases, the Company ensures that personal data is afforded an appropriate level of protection in accordance with the GDPR.

Retention of personal data

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected or for as long as required by applicable law. At the end of the retention period, personal data is erased, anonymised or otherwise made inaccessible, unless another legal basis applies for its continued processing.

Your rights under the GDPR

As a data subject, you have the following rights:

  • access to your personal data

  • rectification of inaccurate or incomplete personal data

  • erasure of your personal data (the "right to be forgotten")

  • restriction of processing

  • data portability

  • objection to the processing of your personal data

  • withdrawal of consent at any time where processing is based on consent

  • lodging a complaint with the Croatian Personal Data Protection Agency (AZOP).

Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

To exercise your rights or ask any further questions about the processing of personal data, you may contact us using the contact details published on the Company's official website, by email at [email protected] or by post to the Company's registered office at Ivana Lučića 2A, 10000 Zagreb.

Data security

The Company implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, destruction or other unlawful processing, in accordance with the General Data Protection Regulation (GDPR) and the Company's internal policies.

Related internal policies

The Company's personal data protection framework is further governed by internal policies that regulate specific areas of personal data processing in greater detail, including the Rules on Personal Data Protection and Oversight of Its Collection, Processing and Use, as well as specific privacy notices applicable to particular categories of data subjects.

Changes to the Privacy Policy

The Company reserves the right to amend this Privacy Policy to reflect changes in applicable law, business processes or the way in which personal data is processed.

The current version of the Privacy Policy is available on the Company's website.

Last updated: 1 July 2026.