Privacy Policy
Burzovni list, operator of burzovnilist.com (details in the Impressum). Contact for all personal-data questions: info@burzovnilist.com.
| Data | Purpose | Legal basis |
|---|---|---|
| email address and password (stored exclusively as a hash) | user account: registration, sign-in, password recovery | performance of a contract (Art. 6(1)(b) GDPR) |
| portfolio data you enter yourself (ticker, quantity, average price) | the "My portfolio" feature — a record you keep yourself | performance of a contract (Art. 6(1)(b) GDPR) |
| technical/analytics visit data (cookies — Google Tag Manager / Google analytics) | web analytics — understanding how the site is used | consent (Art. 6(1)(a) GDPR) — strictly opt-in; nothing loads without consent |
| newsletter email address (with language, subscription and confirmation dates) | sending the newsletter — only if you subscribe yourself and confirm by clicking the emailed link (double opt-in) | consent (Art. 6(1)(a) GDPR and Art. 107 of the Croatian Electronic Communications Act) — withdrawn with one click on the unsubscribe link in every email |
| server logs (IP address, user agent, request time) | security, abuse detection and troubleshooting | legitimate interest (Art. 6(1)(f) GDPR) |
| discussion comments (content + hashed IP address; the raw IP is not stored) | publishing your comment and protection against abuse (rate limiting, spam) | performance of a contract for publishing (Art. 6(1)(b)); legitimate interest for the IP hash (Art. 6(1)(f)) |
Your account email is used exclusively for sign-in and password recovery — the newsletter is sent ONLY to addresses that subscribed separately and confirmed the subscription (double opt-in); the account and the newsletter are separate records. Note: the site's fonts load from Google Fonts servers; when fetching a font your browser transmits your IP address to Google (a technical necessity of resource loading).
Supabase — user-account authentication and the portfolio database; the project is hosted in the eu-central-1 region (Frankfurt, EU). Vercel Inc.(USA) — hosting and serving of the site via a global CDN; server logs arise at Vercel. Transfers to the USA rely on the EU–US Data Privacy Framework and standard contractual clauses. Google(Google Ireland Ltd.) — web analytics via Google Tag Manager, strictly with your consent; Google may process data outside the EU/EEA on the basis of the EU–US Data Privacy Framework and standard contractual clauses. Resend (Resend, Inc., USA) — technical delivery of newsletter emails (confirmation email and the newsletter); transfers to the USA rely on standard contractual clauses. Meta (Meta Platforms Ireland Ltd.) and X(X Corp. / Twitter International ULC) — measuring the performance of our own ads via pixels, strictly with your consent to marketing cookies (see the Cookie Policy); transfers outside the EU/EEA rely on those providers' standard contractual clauses and the EU–US Data Privacy Framework. We do not sell data; we pass it to no third parties other than the processors listed, under the stated terms.
Account and portfolio data is kept while the account exists, and for at most 30 days after account deletion (backups). Server logs are kept for at most 12 months. The cookie consent record is valid for at most 12 months, after which consent is requested again. Newsletter: unconfirmed subscriptions are deleted automatically after 30 days; after you unsubscribe we keep the record (address and subscription/unsubscription dates) as proof of consent and an internal suppression list — nothing further is sent to that address.
You have the right to: access your data, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, objection to processing based on legitimate interest, and withdrawal of consent at any time (without affecting the lawfulness of processing before withdrawal). Cookie consent is withdrawn via "Cookie settings" in the footer of every page.
You exercise all rights by email to info@burzovnilist.com — we respond without undue delay, at the latest within 30 days. You also have the right to complain to the supervisory authority: the Croatian Personal Data Protection Agency (AZOP), azop.hr.
Last change: 25.08.2026. Changes to this policy are published on this page; material changes will be highlighted on your next visit. See also the Cookie Policy and Terms of Use.
This is an English translation provided for convenience. In case of dispute, the Croatian version prevails: Croatian version.