Last updated: 5 November 2026
This Privacy Policy explains how we process your personal data when you visit https://xaipemorandini.com, contact us or use our services. We process personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”), the Croatian Act on the Implementation of the General Data Protection Regulation (NN 42/18) and the Croatian Electronic Communications Act.
1. Data controller
Morandini Marketing (XAIPE-Morandini), Republic of Croatia
Email: info@xaipemorandini.com
Phone: +385 91 6230 331
For any question about your personal data, contact us at info@xaipemorandini.com.
2. What data we collect and why
Contact and enquiry forms
When you send us a message we process your name, email address, subject and message content. We use this data only to answer your enquiry and, where applicable, to prepare an offer. Legal basis: steps taken at your request prior to entering into a contract and our legitimate interest in responding to enquiries (Art. 6(1)(b) and (f) GDPR).
Newsletter
If you subscribe to our newsletter we process your email address to send you marketing news. Legal basis: your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in each email or by writing to us.
Clients and business partners
When we provide services we process contact details of our clients' representatives, contract and invoicing data. Legal basis: performance of a contract and compliance with legal obligations, including Croatian accounting and tax law (Art. 6(1)(b) and (c) GDPR).
Website usage, analytics and advertising
Our website uses Google Tag Manager to load the following tools only after you give consent through our cookie banner (Art. 6(1)(a) GDPR):
- Google Analytics (Google Ireland Ltd.) — statistics about how visitors use the site (pages viewed, device, approximate location, referral source).
- Google Ads and remarketing (Google Ireland Ltd.) — measuring ad conversions and showing our ads to people who visited the site.
- Meta Pixel (Meta Platforms Ireland Ltd.) — measuring the effectiveness of Facebook and Instagram ads and building advertising audiences.
- LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company) — conversion tracking, retargeting and aggregated audience insights.
These tools may process online identifiers, IP address, browser and device data, pages visited and interactions. Details about each cookie are in our Cookie Policy. Our hosting provider also processes technical server logs (IP address, time of request) to keep the site secure, based on our legitimate interest (Art. 6(1)(f) GDPR).
3. Recipients of data
We do not sell your personal data. We share it only with service providers who act on our behalf under data processing agreements: website hosting and email delivery providers, email and office software providers, accounting services, and the analytics and advertising providers listed above. We may disclose data to public authorities when required by law.
4. Transfers outside the EU/EEA
Some providers (Google, Meta, LinkedIn) may transfer data to the United States. Such transfers are based on the EU–US Data Privacy Framework adequacy decision, where the recipient is certified, or on the European Commission's Standard Contractual Clauses.
5. How long we keep data
- Enquiries: up to 2 years after our last communication, unless a contract follows.
- Contract and invoicing data: 11 years, as required by the Croatian Accounting Act.
- Newsletter: until you unsubscribe.
- Cookies: as stated in the Cookie Policy; your cookie choice is stored for 12 months.
6. Your rights
Under the GDPR you have the right to: access your data; rectification; erasure (“right to be forgotten”); restriction of processing; data portability; object to processing based on legitimate interest or for direct marketing; and withdraw consent at any time, without affecting the lawfulness of processing before withdrawal. To exercise your rights, email info@xaipemorandini.com. We will respond within one month.
You also have the right to lodge a complaint with the Croatian supervisory authority: Agencija za zaštitu osobnih podataka (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr.
7. Automated decision-making
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you.
8. Security
We use appropriate technical and organisational measures, including encrypted (HTTPS) connections and access control, to protect your personal data.
9. Children
Our services are intended for businesses. We do not knowingly collect data from children under 16.
10. Changes
We may update this policy from time to time. The current version is always published on this page with its date.