Privacy policy

Version: 11 November 2026

Privacy policy

This policy explains which personal data we collect through the website and in our dealings with customers, why we collect it, how long we retain it, and your rights under the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Act implementing the General Data Protection Regulation.

1. Data controller

SOLAR MONTER d.o.o. (SOLAR MONTER), Smilčić 188, Smilčić, 23420 Benkovac, Croatia, OIB: 56549662550. Responsible person: Željko Šušak, director. For all personal-data enquiries, write to info@solarmonter.hr. Contact telephone: +385 99 836 1979.

2. Data we process

• Calculator – the data you enter (consumption or capacity, battery, heat pump, subsidy rate) is sent to our server solely to calculate an estimate. With your consent, selected configurator settings are stored in your browser so you can continue your configuration (Article 6(1)(a) GDPR). You can withdraw consent through the storage settings. Contact details are only sent when you submit an enquiry. Technical server logs may be generated when you access the website.
• Enquiry – name, property address and locality, telephone and/or email, preferred inspection appointment, how you heard about us (optional), your message and, if you choose, registration on the waiting list for an FZOEU public call.
• Shop order – name, address, telephone and/or email, delivery method, order contents and, when purchasing for a company, the company name and OIB.
• Project and contract – data you provide during the project that is needed for the quotation, contract, subsidy application and grid connection (e.g. property and metering-point details, FZOEU and HEP ODS documentation), and data on payments, invoices, complaints and servicing.
• Customer account and portal – email, data needed for secure sign-in, session data and associated enquiries and orders. For passkey sign-in, we store the public key and technical data, not your fingerprint or a facial image. The portal link gives access to your case: do not share it.
• Sales records – enquiry status, source, notes on arrangements and response reminders. These are used to handle your request; they do not register you on a marketing list.
• Communication – contents of emails and messages exchanged with you.

Shopping-cart data is stored only in your browser (see Cookies and local storage).

3. Purposes and legal bases

• Responding to enquiries, inspecting the property, preparing quotations, the FZOEU waiting list, processing orders, performing contracts and managing projects (inspection, quotation, contract, FZOEU application, HEP ODS, procurement, installation, commissioning, subsidy payment, servicing) – Article 6(1)(b) GDPR: steps taken at your request before entering into a contract and performance of a contract.
• Issuing invoices, keeping accounting records and meeting tax and other legal obligations, including handling written consumer complaints – Article 6(1)(c): legal obligation.
• System security and operation, establishing and defending legal claims, and tracking how you heard about us – Article 6(1)(f): legitimate interest. Providing the enquiry source is optional, and we only use it in aggregate form.

We do not use the data for direct marketing, sell it or make automated decisions that would have legal effects on you. The calculator provides an indicative estimate only.

Without contact details, we cannot respond to an enquiry or process an order. Other fields marked as optional may be left blank.

4. How long we retain data

• Enquiries that do not result in a contract – 24 months after the last contact, then deleted.
• FZOEU waiting list – until the public call you registered for ends or you unsubscribe, but no longer than 24 months after registration.
• Unpaid orders – 24 months after the order.
• Contracts, invoices and accounting documents – 11 years from the end of the financial year to which they relate, under the Accounting Act, or longer if required by specific legislation or necessary for an ongoing dispute.
• Project and service documentation – for the duration of the contract, warranty periods and limitation periods for claims; 11 years when it forms part of the accounting documents.

5. Recipients of data

We only share data to the extent necessary for the specific purpose:

• contracted installers and authorised designers – for property inspections, design, installation and commissioning;
• HEP ODS – for connecting the power plant to the grid and applications concerning the metering point;
• Environmental Protection and Energy Efficiency Fund (FZOEU) – only when you ask us to help with a subsidy application;
• courier service – name, address and telephone for delivery;
• accounting service – for accounting and tax obligations;
• Apple – iCloud Mail – the business mailbox for info@solarmonter.hr; processes messages and associated technical data for receipt, storage and business communication;
• Resend (Plus Five Five, Inc.) – delivery of automated confirmations, notifications and website sign-in messages. Processes recipient addresses, message contents, and technical data and delivery logs needed to send messages and monitor delivery success;
• DigitalOcean, LLC – web hosting – our web application and database are hosted on a server in the Frankfurt, Germany data centre (region FRA1). The provider processes data required to provide, maintain and protect the infrastructure.
• OpenAI – document analysis through AION – when a document requires additional review, the selected document and the data needed for that review may be processed through the business API to extract text and prepare findings. The findings assist with processing enquiries; final decisions and messages to customers are reviewed by the responsible person. Processing terms are described in the OpenAI Data Processing Addendum.
• competent authorities – where required by law (e.g. the Tax Administration).

The hosting provider's processing terms are described in the DigitalOcean Data Processing Addendum (DPA), which supplements its terms of service and applies to the extent described in that document.

6. Transfers outside the EU

We serve fonts and configurator models from our own server. Processing by hosting and email-delivery providers depends on the contracted service; using an EU server does not in itself rule out international access to data.

We use Apple's iCloud Mail service for the business mailbox. Apple's processing may involve transfers outside the European Economic Area under the rules and safeguards described in Apple's privacy policy. You can request information at our contact address.

We use Resend for automated email delivery. According to its data-processing information, customer data, including message contents and delivery logs, is stored in the USA. Choosing a European sending region determines the delivery route, not the storage location. Resend's Data Processing Addendum (DPA) forms part of its terms of service and includes EU standard contractual clauses for data transfers.

Document analysis through the OpenAI API may involve processing outside the European Economic Area. The safeguards and terms described in the following document apply: Data Processing Addendum. Configuring the website server in Europe does not mean that all processing providers are located in the EU.

7. Your rights

You may request at any time:

• access to your data and a copy of it;
• rectification of inaccurate or incomplete data;
• erasure of data, except where we must retain it by law or for legal claims;
• restriction of processing;
• portability of data you provided under a contract;
• objection to processing based on legitimate interests;
• removal from the FZOEU waiting list.

Send your request to info@solarmonter.hr. We respond without delay and within one month at the latest. To protect your data, we may ask you to verify your identity.

8. Supervisory authority

If you believe we process your data in breach of applicable rules, you may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr.

9. Security

The public website uses an encrypted connection (HTTPS). Access to the enquiry and order database is restricted by administrator authentication.

10. Changes

We may update this policy; the current version and its date are always published on this page.