This privacy policy explains how ACCREDO d.o.o. processes personal data when you visit our websites accredo.hr and hrpaintball.hr, send us an enquiry, subscribe to the newsletter or fill in the participant registration before a programme. We collect only the data we need for these purposes and process it in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Croatian Act on the Implementation of the GDPR.
Last updated: 30 September 2026.
Data controller
ACCREDO d.o.o., Zasadbreg 243, 40311 Lopatinec, Croatia
OIB (tax number): 23377137880 · MBS (registration number): 070060458, Commercial Court in Varaždin
Email: info@accredo.hr · Telephone: +385 40 364 720
For any question about the protection of personal data, and to exercise your rights, contact us by email at info@accredo.hr or by post at the address above.
Visiting the websites
On every visit the server automatically records the IP address, the date and time of access, the page requested, the type of browser and operating system, and the page you came from. We use these logs only to keep the websites secure and stable and to detect misuse and errors. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR). The logs are deleted automatically after 60 days at the latest.
The websites are hosted on a server of netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany, in a data centre in the European Union. netcup processes data solely on our instructions, as a processor.
Cookies
Cookies are small text files that the browser stores on your device. We use only cookies without which the websites cannot work; under the Croatian Electronic Communications Act these do not require consent. We do not use cookies for statistics, advertising or tracking.
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
| accredo_consent | Remembers your answer in the cookie notice (both websites). | 6 months | essential |
| pll_language | Remembers the language you chose (accredo.hr). | 1 year | essential |
| wp_woocommerce_session_… | Links the list of products for your enquiry to your browser (hrpaintball.hr). | 2 days | essential |
| woocommerce_items_in_cart, woocommerce_cart_hash | Show whether there are products on the enquiry list (hrpaintball.hr). | until the browser is closed | essential |
You can also delete or block cookies in your browser settings. If you block the essential cookies, the list of products for an enquiry in the shop will not work.
Enquiries through accredo.hr, by email and by telephone
When you send us an enquiry, we process the data you enter: your name, email address, telephone number, the programme or package you want, the number of people, the date you prefer and your message. We use it only to answer the enquiry, prepare an offer and agree a date. The legal basis is steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
The enquiry is stored in the website’s system and delivered to our mailbox. If no contract follows, we delete the data 12 months after the last contact. If a contract follows, we keep it for as long as the obligations under the contract last, and invoices and accounting documents for the periods laid down by the Accounting Act and tax regulations (as a rule 11 years).
Enquiries in the hrpaintball.hr shop
The hrpaintball.hr shop does not sell online: by sending the list of products you send a non-binding enquiry, which we answer with an offer. In doing so we process your name, email address, telephone number, address (if you want delivery), the products chosen and your note. The purpose is to check availability, prepare an offer and arrange collection or delivery; the legal basis is steps taken before entering into a contract (Art. 6(1)(b) GDPR). The retention periods are the same as for enquiries through accredo.hr.
Withdrawal from a contract and complaints
If you declare, through the “Raskid ugovora” (withdrawal) form or in any other way, that you are withdrawing from a contract, we process the data in your statement: your name, address, email address, the number of the offer or invoice, the products, and the dates on which the contract was concluded and the goods were received. The same applies to written complaints. We need this data to handle your request, refund the amount paid and meet our obligations under the Consumer Protection Act (Art. 6(1)(c) GDPR). We keep withdrawal statements and complaints for 5 years.
Newsletter
You subscribe to the newsletter with your email address and by confirming through the link we then send you (double opt-in). Without that confirmation we send nothing, and a subscription you do not confirm is deleted after 30 days. We store the email address, the time of the subscription and of the confirmation, and the page you subscribed from, so that we can prove your consent. The legal basis is your consent (Art. 6(1)(a) GDPR). We send the newsletter from our own server, without an external mailing service.
You can unsubscribe at any time through the link in every newsletter or by email to info@accredo.hr. After you unsubscribe we no longer use the address for sending; we keep the record of the subscription and the unsubscription for a further 3 years as evidence and then delete it. The subscription is intended for people aged 16 or over.
Participant registration before a programme
Before a programme every participant fills in a short registration and signs a statement on liability and the safety rules, in advance through a link or on a tablet on site. We process:
- name, date of birth and mobile number;
- optional: email address (for the confirmation), address and an emergency contact;
- optional: health notes, for example allergies, injuries or conditions the staff should be aware of;
- for participants under 18, the name of the parent or guardian, who signs the statement;
- the signature, the statements accepted with the version of their text, the time of signing, and the IP address and type of device the registration was sent from.
We use the data to run the programme safely, to check age and as proof that the participant knows the safety rules and accepts them. The legal basis is the performance of the participation contract and our legitimate interest in the safety of participants and in being able to prove the statements (Art. 6(1)(b) and (f) GDPR). We record the IP address, the type of device and the time only so that the signature can be reliably attributed to the registration.
Health notes are a special category of personal data. You enter them only if you wish, and we use them solely so that the staff know what to watch out for. The legal basis is your explicit consent (Art. 9(2)(a) GDPR), which you give by ticking the box next to that field and can withdraw at any time. We use the emergency contact only in an emergency; please let that person know that you have given us their details.
Consent to being photographed and to the publication of photographs is optional: you can refuse it and still take part, and you can withdraw a consent you have given at any time by email to info@accredo.hr (Art. 6(1)(a) GDPR).
Registrations are seen only by authorised Accredo staff. We keep them for 5 years after the date of the programme, within the limitation periods for possible claims for damages, after which they are automatically and permanently deleted.
Videos (YouTube) and maps
Videos on our websites do not load automatically: until you click play you see only an image from our own server, and YouTube receives no data. Only after the click does the YouTube player load from the domain youtube-nocookie.com (Google Ireland Limited). Google then receives your IP address and browser data, and the player may store data on your device. The legal basis is your consent, which you give by clicking play (Art. 6(1)(a) GDPR). Google LLC in the USA may access this data; Google is certified under the EU-U.S. Data Privacy Framework.
The “Open in maps” link is an ordinary link to Google Maps; data is passed to Google only when you open it.
Recipients and processors
We do not sell your data or pass it on to others for marketing purposes. It is accessible only to the Accredo staff who need it for their work, and to the processors that provide technical services for us and with which we have a data processing agreement:
- netcup GmbH, Germany — hosting of the websites and the database (EU);
- Google Ireland Limited, Ireland — business email (Google Workspace) for the @accredo.hr addresses. Google LLC in the USA may access the data, on the basis of the EU-U.S. Data Privacy Framework.
We disclose data to public authorities only where the law obliges us to.
Your rights
With regard to your personal data you have the right:
- of access to the data and to a copy of it (Art. 15 GDPR);
- to have inaccurate data rectified (Art. 16);
- to erasure (Art. 17) and to restriction of processing (Art. 18);
- to portability of the data you gave us on the basis of consent or a contract (Art. 20);
- to object to processing based on our legitimate interest (Art. 21);
- to withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal (Art. 7(3)).
Send your request to info@accredo.hr. We reply without undue delay and within one month at the latest. If you believe that our processing breaches the rules, you can lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr.
Do you have to provide the data?
Providing the data is voluntary. Without the data marked as required we cannot answer an enquiry or accept a participant registration. We do not carry out automated decision-making or profiling.
Data security
The websites are transmitted exclusively in encrypted form (HTTPS). Only authorised persons have access to the data, and we keep backups for no more than 14 days.
Changes to this policy
We change the privacy policy when the way we process data changes. The version published on this page applies.