SaaStanak Privacy Policy

Last updated: 3 November 2026

This website (the "Website") is operated by SaaStanak d.o.o., Braće Radić 30B, 10410 Velika Gorica, Croatia, OIB: 40801114584 ("SaaStanak", "we", "us"). SaaStanak and Revenue Day are brands of SaaStanak d.o.o.

SaaStanak d.o.o. is the controller of the personal data described in this Privacy Policy. We have not appointed a data protection officer. For any question about your data, or to exercise your rights, contact us at info@saastanak.com.

Scope

This Privacy Policy explains how we process personal data of visitors to the Website and of people who register for, attend or are interested in SaaStanak and Revenue Day conferences, meetups, workshops and training courses. It applies to all processing carried out by SaaStanak d.o.o.

What data we collect and how

We collect personal data in the following ways:

Data you give us — when you fill in a contact, registration or speaker form, sign up for our newsletter, buy a ticket or write to us. This usually includes your first and last name, email address, phone number, company name and job title.
Data collected automatically — when you visit the Website, our service providers receive technical data such as your IP address and browser information. With your consent, analytics and marketing cookies also collect data about how you use the Website (see the Cookie Policy below).
Data collected at events — attendance records, photos and video recordings of our events, and video surveillance footage at some event venues.

Why we use your data and on what legal basis

We process personal data only for the purposes below, each on its own legal basis under Article 6 of the General Data Protection Regulation (EU) 2016/679 ("GDPR"):

Registration and participation in our events, ticketing and delivery of the service you booked — performance of a contract (Art. 6(1)(b) GDPR).
Answering your enquiries via contact forms or email — our legitimate interest in responding to you, or steps you asked for before entering into a contract (Art. 6(1)(f) and 6(1)(b) GDPR).
Newsletters and marketing emails — your consent (Art. 6(1)(a) GDPR). We use double opt-in, and you can unsubscribe at any time via the link in every email.
Analytics and marketing cookies on the Website — your consent (Art. 6(1)(a) GDPR).
Accounting and tax record-keeping — legal obligation (Art. 6(1)(c) GDPR).
Video surveillance at event venues — our legitimate interest in protecting people and property (Art. 6(1)(f) GDPR).
Protecting the Website and our forms against spam, abuse and technical problems — our legitimate interest (Art. 6(1)(f) GDPR).

Where we rely on legitimate interest, you have the right to object at any time (see Your rights below).

We do not sell your personal data, and we do not use it for automated decision-making or profiling that has legal or similarly significant effects on you.

Event photos and recordings

We take photos and record talks, panels and other sessions at our events. We publish this material on the Website, on our social media channels and in our newsletters, to document our events and promote future ones. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR).

If you do not want to be photographed or recorded, please tell our team at the event. If you would like a photo or recording of you removed, contact us at info@saastanak.com and we will remove it from the channels we control.

Speakers and speaker referrals

If you speak at one of our events, we publish your name, photo, job title, company, short bio and the details of your talk on the Website and in our promotional materials. We process this data to organise your appearance and promote the event, based on our agreement with you (Art. 6(1)(b) GDPR).

The Website also lets visitors refer someone they think should speak. In that case, we receive the referred person's name, contact details and the reason for the referral from the person who made it. We process this data to invite the referred person to speak, based on our legitimate interest (Art. 6(1)(f) GDPR). When we first contact a referred person, we tell them that we received their details through a referral and how to find this Privacy Policy. If they are not interested or object, we delete their data.

How long we keep your data

We keep personal data only as long as needed for the purpose it was collected for:

Event registration and participant data (name, contact details, company): invoices and related accounting records are kept for at least 11 years from the end of the business year they relate to, as required by the Croatian Accounting Act; data not needed for those records is deleted after the event cycle ends.
Newsletter subscriptions: until you unsubscribe or withdraw consent.
Contact form submissions and email enquiries: up to 12 months after our last exchange, unless they lead to a contract.
Analytics and marketing cookies: for the periods listed in the Cookie Policy below, or until you withdraw consent.
Video surveillance footage: for the period set by the venue operator and applicable Croatian law, after which it is deleted.

Cookie Policy

A cookie is a small file stored on your computer or mobile device when you visit a website. Cookies let a website remember your choices and help us understand how the Website is used. We use three types of cookies and similar technologies:

Necessary cookies

These are needed for the Website to work. They are not used for analytics or advertising. They include remembering your cookie choice (stored in your browser's local storage for up to six months) and protecting our forms against spam and abuse with Cloudflare Turnstile. Under the Croatian Electronic Communications Act, they do not require your consent.

Analytics cookies (only with your consent)

We use Google Analytics 4, provided by Google Ireland Limited, to understand how visitors use the Website, for example which pages are visited and how visitors find us. It sets the cookies _ga and _ga_<ID>, which expire after up to 2 years. We do not use this data to identify you personally. More information: Google Privacy Policy.

Marketing cookies (only with your consent)

We use the Meta Pixel (Meta Platforms Ireland Limited) and the LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company) to measure the results of our ads on Facebook, Instagram and LinkedIn, and to show our ads to people who have visited the Website. They set cookies such as _fbp (Meta, up to 90 days) and li_fat_id, li_sugr, bcookie and lidc (LinkedIn, from 1 day to 1 year).

Joint controllership with Meta and LinkedIn

For collecting data on the Website through the Meta Pixel and the LinkedIn Insight Tag and sending it to Meta and LinkedIn, we are joint controllers with Meta Platforms Ireland Limited and, separately, with LinkedIn Ireland Unlimited Company (Art. 26 GDPR). The essence of these arrangements is:

Our responsibility: loading these tools only after you consent, informing you about the processing in this Policy, and the configuration of the tools on our Website.
Meta's and LinkedIn's responsibility: the security of the data they receive, and handling your rights requests regarding the data once it is on their platforms.
Your rights: you can exercise your rights with us or directly with Meta or LinkedIn. We will forward any request that concerns their part of the processing.

The arrangements are set out in Meta's Controller Addendum and in LinkedIn's Joint Controller Addendum for the Insight Tag. After Meta and LinkedIn receive the data, they process it as separate controllers under their own policies, and may link it to your account on their platforms: Meta Privacy Policy and LinkedIn Privacy Policy.

Your choices and consent

Analytics and marketing tools are not loaded until you allow them. On your first visit, you can choose "Reject all", "Accept all", or select individual categories under "Customize". The legal basis for analytics and marketing cookies is your consent (Art. 6(1)(a) GDPR).

You can change or withdraw your consent at any time via "Cookie settings" in the footer of every page. When you withdraw consent, we delete the analytics and marketing cookies set on our domain and stop loading those tools. Cookies that Meta or LinkedIn set on their own domains can be removed in your browser settings. We ask for your choice again after six months.

If your browser sends a Global Privacy Control (GPC) signal, we treat it as an objection to marketing cookies: they stay off, even if you click "Accept all".

More information about cookies is available from the Croatian Personal Data Protection Agency (AZOP) and the European Interactive Digital Advertising Alliance.

Service providers

We use the following service providers. They process personal data on our behalf and under our instructions, based on data processing agreements (Art. 28 GDPR). When your browser loads the Website, some of them receive technical data such as your IP address and browser information, which is needed to deliver the content.

Webflow, Inc. (USA) — website hosting and storage of form submissions. Certified under the EU–US Data Privacy Framework.
Cloudflare, Inc. (USA) — Turnstile spam protection on our forms. Certified under the EU–US Data Privacy Framework.
Brevo (France) — sending our newsletter, with double opt-in.
Bunny.net (Slovenia) — video hosting and streaming.
jsDelivr and Slater — delivery of the scripts that run the Website.
Entrio (Croatia) — ticket sales, event registration and payments (see Online payment below).
Google, Meta and LinkedIn — analytics and marketing, only with your consent (see the Cookie Policy above).

We may also share personal data with accountants, legal advisers and competent public authorities where we are legally required to.

Where your data is stored and transfers outside the EEA

We process personal data in the European Economic Area (EEA) wherever possible. Some of our service providers are based in, or use infrastructure in, the United States, so in these cases your data is transferred outside the EEA.

We transfer personal data outside the EEA only with appropriate safeguards under Chapter V GDPR:

United States: we rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework where the recipient is certified under it. Webflow, Inc. and Cloudflare, Inc. are certified. Google, Meta and LinkedIn may transfer data to their US parent companies, which are also certified.
Other countries, or recipients not certified under the Data Privacy Framework: we rely on an adequacy decision for that country or on the Standard Contractual Clauses approved by the European Commission (Art. 46 GDPR).

You can request a copy of the applicable safeguards at info@saastanak.com.

How we protect your data

We apply technical and organisational measures to protect personal data against unauthorised access, alteration, loss, theft and misuse. Access is limited to employees and service providers who need it for the purposes above, and they are bound by confidentiality.

Your rights

Under the GDPR, you have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
have your data erased ("right to be forgotten");
restrict the processing of your data;
receive your data in a portable format;
object to processing based on our legitimate interest;
withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal.

To exercise your rights, contact us at info@saastanak.com. We may ask you to confirm your identity, to protect your data from being disclosed to someone else. We respond within one month.

Right to lodge a complaint

If you believe that we process your personal data in breach of the GDPR, you have the right to lodge a complaint with a supervisory authority. In Croatia, this is:

Croatian Personal Data Protection Agency (AZOP)
Ulica Metela Ožegovića 16, 10000 Zagreb, Croatia
Email: azop@azop.hr
Web: azop.hr

Online payment

When you pay online, you are redirected to the website of a third-party payment processor. Your payment data is then processed under that provider's terms and privacy policy, and we do not receive your card details.

Public spaces

If you share information in public or community spaces we provide, such as event apps or group chats, other participants can see it. If you would like us to remove your personal data from these spaces, contact us at info@saastanak.com. If we cannot remove it, we will tell you why.

Changes to this Privacy Policy

We may update this Privacy Policy when our services or the law change. The date at the top shows when it was last updated. We will inform you of significant changes on the Website or by email.