Privacy Policy
Last edit date: 1 November 2026
How Margins collects, uses and shares your personal data.
About this policy
This Privacy Policy explains how Margins d.o.o. handles personal data when you visit margins.agency, contact us, apply for a job or take part in our events. It also explains your rights under the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and how to exercise them.
This policy concerns processing for which Margins determines the purposes and means. Where we process personal data on a client’s instructions to deliver services, that processing is governed by our agreement with the client and the client’s applicable privacy information. Separate privacy notices may apply to our products or particular activities.
Who is responsible for your data?
The data controller is:
Margins d.o.o.
Slavonska Avenija 6
10 000 Zagreb, Croatia
OIB: 30100320285
Email: hello@margins.agency
You can contact us at this email address or postal address about this policy or to exercise your data protection rights.
Personal data we collect and why
Enquiries and business communication
When you contact us by email or through the contact and Discovery Sprint forms on our website, we process the information you provide. This may include your name, email address, company, role, telephone number, message and any attachments. Enquiries sent through our website forms are stored in our content management system, where only authorised members of our team can access them.
We use this information to respond to your enquiry, discuss your requirements, prepare proposals and manage our communication with you.
For general enquiries and communication with representatives of businesses, our legal basis is our legitimate interest in responding to requests and managing business relationships (Article 6(1)(f) GDPR). Where you personally are a party to a proposed or existing contract, we process the information necessary to take steps at your request before entering into that contract or to perform it (Article 6(1)(b) GDPR). We also process records where necessary to meet legal obligations (Article 6(1)(c) GDPR).
We retain enquiry information until the enquiry and any agreed follow-up have been completed. If a business relationship follows, relevant information becomes part of our business records and is retained for the relationship and for applicable statutory retention periods or necessary legal claims. Information that is no longer needed is deleted or anonymised.
You choose what to share. If you do not provide contact details or information necessary to understand your request, we may be unable to respond or prepare a proposal. Please avoid sending sensitive personal information that is not needed for your enquiry.
Job applications
We receive job applications by email and through the application form on our website. We process the information you provide in your application, such as your name, contact details, CV, work history, education, qualifications, portfolio and accompanying correspondence. We may also create interview notes and assessment records during the selection process.
We use this information to assess your suitability, communicate with you and manage recruitment. Processing necessary to take steps towards an employment contract at your request is based on Article 6(1)(b) GDPR. Our legitimate interest in organising a fair selection process and assessing candidates supports related recruitment administration under Article 6(1)(f) GDPR.
Application information is retained for the selection process and until any outstanding questions or review of the recruitment outcome have been resolved. Where a specific complaint or legal claim requires retention, we keep only the relevant records for as long as necessary to resolve it or meet applicable legal requirements. If you join Margins, information needed for your employment becomes part of your employment records and is covered by the relevant employee privacy information.
Future opportunities. With your separate consent, we retain your CV and relevant application information for 24 months from the date you give that consent, so that we can contact you about suitable future openings. This is based on Article 6(1)(a) GDPR. Consent is optional and does not affect consideration for the position you applied for. At the end of 24 months, we delete the information from our candidate pool unless you have actively renewed your consent.
You may withdraw this consent or request removal from the candidate pool at any time by emailing hello@margins.agency. Withdrawal does not affect the lawfulness of processing before withdrawal. Any separate legal requirement to retain particular records does not permit us to continue using them for future recruitment.
Without the information necessary to assess an application and contact you, we may be unable to consider you for a role. Please provide only information relevant to your application.
Events and attendee photographs
When you register for, communicate with us about or attend an event, we may process your name, contact details, company, role and information needed to organise your participation.
We use registration information to manage attendance, communicate practical arrangements and deliver the event. The legal basis is performance of our agreement with you where registration creates a contract (Article 6(1)(b) GDPR), or our legitimate interest in organising the event and communicating with attendees where no such contract applies (Article 6(1)(f) GDPR). We retain this information until the event and related administrative matters are completed, subject to any applicable accounting requirements or necessary legal claims.
We also take and publish photographs of attendees to report on our events and communicate Margins’ activities. Our publication channels are the Margins website and the Margins LinkedIn page. Publicly published images can be viewed by people outside the EU.
For general event coverage, we rely on our legitimate interest in documenting and communicating our activities where this is proportionate and does not override attendees’ rights and reasonable expectations. We provide information about photography before or at the event and explain how to raise an objection. Where consent is needed, including for individual promotional portraits outside reasonable event coverage, we ask for it separately. Attendance alone is not consent. We obtain permission from a parent or guardian before using identifiable photographs of children for promotion.
Photographs are retained for three years after the event. At the end of that period we review them and remove them from the channels we control, unless you have agreed to a longer use.
You can ask not to be photographed, object to our use of a photograph or withdraw consent by contacting our event team or hello@margins.agency. Where we rely on legitimate interests, we stop the processing unless we demonstrate overriding compelling grounds or need the data for legal claims. Where we rely on consent and you withdraw it, we stop that use and remove the photograph from channels we control, unless a separate legal basis requires retention. We cannot directly control copies independently made by other people.
Website operation and security
Operating the website may involve processing technical information such as IP addresses, request times, requested pages, browser and device information and error or security logs.
We use the information necessary to deliver the website, diagnose technical problems and protect it against misuse. This processing is based on our legitimate interest in maintaining a functioning and secure website (Article 6(1)(f) GDPR).
Routine technical logs are retained for up to 30 days. Logs needed to investigate a particular incident may be retained until that investigation and any related legal proceedings are concluded.
Cookies, analytics and embedded content
Our website uses a cookie banner to manage choices about cookies and similar technologies. Strictly necessary technologies support essential functions, including remembering privacy choices. Optional analytics, advertising and embedded-content technologies require consent before activation where applicable.
Google reCAPTCHA
Our contact, Discovery Sprint and job application forms are protected by Google reCAPTCHA, which helps us tell genuine submissions from automated spam. When a form loads, reCAPTCHA processes information such as your IP address, browser and device characteristics and how you interact with the page, and sends it to Google for evaluation.
This processing is based on our legitimate interest in protecting our forms and our team against spam and abuse (Article 6(1)(f) GDPR). See Google’s Privacy Policy and Terms of Service.
Google Analytics
We use Google Analytics to understand how visitors use the website and to improve its content and performance. Depending on the configuration, it processes online identifiers, device and browser information, approximate location, pages visited and interactions with the website.
Our legal basis for optional analytics is your consent (Article 6(1)(a) GDPR). Google Analytics user- and event-level data is retained for 14 months. This is separate from the lifetime of cookies on your device.
More information is available in Google’s privacy information.
LinkedIn Insight Tag
We use the LinkedIn Insight Tag for advertising measurement and audience insights. The tag may process information such as the page visited, referral information, IP address, device and browser characteristics, timestamps and identifiers. LinkedIn may associate these signals with a LinkedIn account.
Our legal basis for activating the tag and the associated optional tracking is your consent (Article 6(1)(a) GDPR). LinkedIn also processes information as a controller under its own terms. See LinkedIn’s Privacy Policy.
YouTube
Our website uses YouTube content. Loading an embedded player may share technical information and your interaction with Google/YouTube. If you are signed into a Google account, the provider may associate activity with that account.
Where loading the player involves optional tracking or other processing requiring consent, we request consent before loading it. Our legal basis for this optional processing is Article 6(1)(a) GDPR. See Google’s Privacy Policy, which covers YouTube.
Managing your choices
You can accept or reject optional categories through the cookie banner. You can change or withdraw your choices using cookie settings. Withdrawing consent does not affect processing that was lawful before withdrawal. Rejecting optional tracking does not prevent access to the main website, although consent-dependent embedded features may remain unavailable.
Browser controls can also help you delete or restrict cookies. These controls do not replace the consent choices available on our website.
Who receives personal data?
Access within Margins is limited to people who need the information for their responsibilities. Depending on the purpose, recipients may include:
- Providers of website hosting, maintenance and technical security services.
- Providers of business email, communication and data storage services.
- Google and LinkedIn in connection with the website services described above, subject to your choices where consent is required.
- Event service providers and photographers where needed to organise an event or create event coverage.
- Professional advisers and public authorities where disclosure is necessary for legal obligations or the establishment, exercise or defence of legal claims.
Where a provider acts as our processor, it processes personal data under our instructions and an appropriate data processing agreement. Some recipients, including platforms processing information for their own purposes, act as controllers under their own privacy information. Published event photographs are available to the audience of the publication channel.
International transfers
Margins is established in Croatia. Some external services used by the website, including Google reCAPTCHA, Google Analytics, LinkedIn and YouTube, may process personal data outside the European Economic Area, including in the United States. The location of our own team does not determine all processing locations used by these services.
Where personal data is transferred outside the EEA, the relevant transfer must be covered by a lawful mechanism. Depending on the provider and destination, this may be an applicable European Commission adequacy decision or the European Commission’s Standard Contractual Clauses, together with additional safeguards where required. Where the EU–US Data Privacy Framework is relied on, it must cover the relevant certified recipient and processing.
Provider information is available in Google’s transfer framework notice, Google’s data processing terms and LinkedIn’s applicable controller terms. Contact hello@margins.agency for information about safeguards relevant to your data or a copy of applicable contractual safeguards, with confidential information redacted where necessary.
Protecting personal data
We apply technical and organisational measures appropriate to the nature of the information and the risks of processing. These measures are intended to protect personal data against unauthorised access, disclosure, alteration and loss. Access to personal data is restricted according to responsibilities and the purpose for which the information is needed.
Your rights
Subject to the conditions in the GDPR, you may request access, correction, erasure or restriction of processing. Where processing is automated and based on consent or a contract, you may request portability of the data you provided.
You may object on grounds relating to your situation to processing based on legitimate interests. You may object to direct marketing at any time. Where processing is based on consent, you can withdraw it at any time without affecting earlier lawful processing. You also have rights concerning decisions based solely on automated processing that produce legal or similarly significant effects.
Send requests to hello@margins.agency. We may request proportionate information to verify your identity. We respond without undue delay and normally within one month. If a permitted extension of up to two further months is needed because of complexity or the number of requests, we explain this within the first month.
You may complain directly to the Croatian Personal Data Protection Agency (AZOP), Ulica Metela Ožegovića 16, 10 000 Zagreb, Croatia, at azop@azop.hr, or another competent supervisory authority. You do not have to contact us first. See AZOP’s contact information.
Changes to this policy
We may update this policy to reflect changes in our activities, services or legal requirements. The current version will be published on this page with its effective date. Where required, we will give additional notice of material changes or obtain fresh consent before introducing a new use of personal data.