Draft document — details in square brackets [ ] await confirmation by the association. In case of discrepancy, the Croatian version prevails. Last updated: 14 October 2026.
1. Data Controller
SM-ART Hrvatska, association, Kancelak 3B, 10000 Zagreb, Croatia, OIB (personal identification number): 25160763272, entered in the Register of Associations of the Republic of Croatia under number 21012891. Data protection contact: info@sm-art.hr.
The association is not obliged to appoint a Data Protection Officer.
2. What data we process and why
User account: email, name or nickname, date of birth, optionally phone number and FetLife handle — in order to provide access to the members area (Art. 6(1)(b) GDPR) and to verify that you are of legal age.
Application and association membership: email, first and last name, date of birth, FetLife handle or chosen member nickname, optional phone and partner email for linking separate 1+1 applications, OIB (for members holding a Croatian OIB) or identification document number (for others) — in order to maintain the register of members pursuant to the Croatian Associations Act (Art. 6(1)(c) GDPR) and to perform the membership relationship.
Digital membership card: member number, validity and an opaque QR verification token; verification is restricted to authorised association staff.
Membership fees: payment data — in order to fulfil accounting obligations (Art. 6(1)(c)).
General and confidential contact: data you provide yourself — in order to respond to your inquiry (Art. 6(1)(f) and (a)).
Newsletter: email — only with your explicit consent (Art. 6(1)(a)), which you may withdraw at any time.
Visitor statistics: only with consent to cookies.
3. Special categories of data
Membership in the association may indicate data concerning sex life or sexual orientation. We process such data exclusively within the scope of the association's legitimate activities in relation to its members (Art. 9(2)(d) GDPR), we do not disclose it to third parties without your consent, and we protect it with enhanced safeguards.
4. Retention periods
User account: until the account is deleted.
Unconfirmed accounts: 30 days.
Rejected membership applications: 6 months.
Register of members: for the duration of membership and up to 5 years after it ends, unless the law prescribes otherwise.
Accounting records relating to payments: 11 years (Accounting Act).
Confidential messages: content is not stored; minimal logs are retained for 12 months. [Retention periods to be confirmed by the association.]
5. Recipients and processors
We do not sell your data. Access is limited to authorised persons within the association. Processors: hosting and database provider, email delivery provider, [payment provider], [newsletter tool], an AI service provider that internally helps authorised staff search the membership records (no permanent storage of queries and no automated decisions). Data processing agreements have been concluded with all processors (Art. 28 GDPR). Where data is transferred outside the EEA, this is done subject to the European Commission's Standard Contractual Clauses.
6. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability, objection, and to withdraw consent without affecting the lawfulness of processing based on consent before its withdrawal. You may download your data and delete your account directly in your member profile, or contact us at info@sm-art.hr. We respond within one month.
7. Right to lodge a complaint
You may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, www.azop.hr, azop@azop.hr.
8. Security
We use an encrypted connection (HTTPS), record-level access controls, separated administrator privileges, and minimal data collection. We do not store the IP addresses of senders of confidential messages.
9. Age of majority and minors
The website, its content, and all services are intended exclusively for persons who have reached the age of 18. On first visiting the website, the visitor confirms that they are of legal age; this confirmation is stored in the browser for 30 days and serves solely to prevent the age-warning notice from being displayed on every visit. The date of birth is requested when applying for membership in order to verify legal age. We do not knowingly collect data from minors. If we learn that a user has not reached the age of 18, the account is deleted and their data is no longer processed.