01Who we are
Ervalos is an early-stage business initiative based in Zagreb, Croatia. It builds and maintains websites and Google Business Profiles for dental practices. The controller responsible for the personal information described in this notice is:
- Controller
- Luka Franelić, operating under the name Ervalos
- Location
- Zagreb, Croatia
- contact@ervalos.com
In this notice, “we” and “us” refer to the controller.
02Personal information we process
- Business contact information: name, practice name, role, business address, business phone number and business email address.
- Correspondence: the content of messages we exchange and any information you choose to send us.
- Publicly available information about the practice: the content of your website and Google profile, including public reviews, which we look at when preparing a free review.
- Technical website data: when you visit this website, our hosting provider processes data such as your IP address, browser type, the pages requested and the time of the request.
We do not ask for patient information or health data, and ask you not to send it to us.
03Sources of information
- Directly from you, for example when you write to us or we talk.
- From publicly available business sources, such as practice websites, Google Maps, OpenStreetMap, business and professional directories, the court register and the national register of healthcare providers. From these we take only the practice name, the holder’s name, the address, the business phone number and the business email address.
- Automatically, through our hosting provider when you visit this website.
If we contacted you first, your details will normally have come from a publicly available business source. You can ask us which source we used.
04Purposes and legal bases
- Responding to your enquiries and corresponding with you
- Legitimate interests (Article 6(1)(f) GDPR) in responding to business communications. Where you contact us about a possible contract, taking steps at your request before entering into a contract (Article 6(1)(b) GDPR).
- Preparing a free review you requested
- Taking steps at your request before entering into a contract (Article 6(1)(b) GDPR) and legitimate interests (Article 6(1)(f) GDPR).
- Keeping a list of practices and making first contact
- Legitimate interests (Article 6(1)(f) GDPR) in developing our business. See the note on contacting practices below.
- Maintaining website functionality and security
- Legitimate interests (Article 6(1)(f) GDPR) in operating a reliable and secure website.
- Recording objections and meeting legal obligations
- Compliance with a legal obligation (Article 6(1)(c) GDPR) where one applies, and legitimate interests (Article 6(1)(f) GDPR) in respecting your choices.
How we contact practices
We contact practices individually: in person, or by calling the practice’s business phone number. Before calling a mobile number, we check the Croatian “NE ZOVI” (do not call) register.
We send unsolicited emails without prior consent only to legal persons, such as polyclinics and companies. We write to private practices only once they agree. Every message says who sent it and gives a simple way to tell us not to contact you again. We do not send mass campaigns and do not track email opens.
Providing personal information to us is voluntary. If you do not share your contact details, we cannot respond to your enquiry. We do not use automated decision-making, including profiling, that produces legal or similarly significant effects for you.
05Service providers
We use the following service providers, which process personal information on our behalf:
- Cloudflare
- Hosts and delivers this website and protects it against abuse. Cloudflare processes technical website data such as IP addresses.
- Zoho Mail
- Hosts our business email, using Zoho’s EU data centre region. Zoho processes the content of emails and the related contact information.
We do not sell personal information and do not share it with third parties for their own marketing. We may disclose information where we are required to do so by law.
06International data transfers
We cannot guarantee that personal information always remains inside the European Economic Area (EEA).
Cloudflare is based in the United States and operates a global network, so technical website data may be processed outside the EEA. Cloudflare states that it relies on transfer mechanisms recognised under the GDPR for such transfers, including the European Commission’s Standard Contractual Clauses and the EU-U.S. Data Privacy Framework.
Our Zoho Mail account uses Zoho’s EU data centre region. According to Zoho, data may be accessed from India for technical support purposes, and Zoho states that it relies on the European Commission’s Standard Contractual Clauses for that access.
07Data retention
- Practices on our list that did not respond: normally up to 12 months after our last contact.
- Completed business correspondence: normally up to 12 months after our last meaningful interaction.
- Ongoing correspondence: for as long as the conversation continues, and then as described above.
- Client contracts and invoices: for as long as accounting and tax law requires.
- Records of objections: for as long as reasonably required to respect your objection, for example a note not to contact you again.
- Technical website data: processed by Cloudflare under its own retention practices. We do not keep separate website logs.
We may keep information for longer where the law requires it, or where it is needed to establish, exercise or defend legal claims.
08Your rights
Under the GDPR, you have the right to:
- Access the personal information we hold about you.
- Rectification of inaccurate or incomplete information.
- Erasure of your personal information, where the conditions apply.
- Restriction of processing in certain circumstances.
- Object to processing based on legitimate interests, on grounds relating to your particular situation.
- Data portability, where processing is based on a contract or consent and carried out by automated means.
Your right to object to direct marketing
You can object at any time to the use of your personal information for direct marketing. You do not need to give a reason. Once you object, we stop using your information for that purpose and keep only a minimal record so that we can respect your objection. Simply reply to our message, tell us in person or write to contact@ervalos.com.
We will respond to requests within one month. In some cases, the GDPR allows this period to be extended. We may ask you to confirm your identity before acting on a request.
You also have the right to lodge a complaint with a supervisory authority. In Croatia, this is the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Ulica Metela Ožegovića 16, 10000 Zagreb, azop.hr. You can also contact the supervisory authority in the EU country where you live or work.
10Our clients’ websites
When a practice becomes a client, we may process personal information on its behalf, for example technical data about visitors to its website or reviews on its Google profile. In that case the practice is the controller, we act as its processor under a written data processing agreement, and the practice’s own privacy notice applies to that information.
The websites we build do not collect health data through forms and do not use cookies or third-party scripts.
11Changes to this notice
We may update this notice when our activities, service providers or legal requirements change. The date at the top of this page shows when it was last updated.
12Contact
For questions about this notice or to exercise your rights, write to contact@ervalos.com.