Skip to content
HREN

Privacy policy

Last updated: 27 August 2026

This policy describes what personal data is collected by the Association of medical students and healthcare professionals Probudi heroja (the Association), for what purposes, on which legal bases, and what rights you have. We process personal data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) and the Croatian GDPR Implementation Act (Official Gazette 42/2018).

1. Data controller

Association of medical students and healthcare professionals Probudi heroja
Registered seat: 21000 Split, Croatia (full address to be added)
Personal identification number (OIB): 86186264366
Registry of Non-Profit Organisations (RNO): 0524174
Data protection contact: info@probudi-heroja.hr

The Association has not appointed a data protection officer, as it is not legally required to do so. For any questions about the processing of your personal data, please contact the e-mail address above.

2. What data we collect and why

Contact form. We collect your name, e-mail address, topic and message. Purpose: responding to your enquiry. Legal basis: your consent (Art. 6(1)(a) GDPR), given by ticking the consent box before submitting.

Membership application. We collect your name, date of birth, e-mail address, mobile number, status (student or healthcare professional), faculty or institution, and motivation. Purpose: deciding on admission and keeping the register of members. Legal basis: steps prior to and performance of the membership relationship (Art. 6(1)(b) GDPR) and the legal obligation to keep a register of members under Article 12 of the Croatian Associations Act (Art. 6(1)(c) GDPR).

Trauma Rescue Challenge registration. We collect the team name, institution, category, team leader name, contact details (e-mail, mobile) and the names of team members. Purpose: organising and running the competition. Legal basis: Art. 6(1)(b) GDPR. Separate consent is requested for photographing participants and publishing photos (Art. 6(1)(a)); details are set out in the Rules and Regulations.

Automatically collected data. The server hosting this website keeps standard technical logs (IP address, time of access, requested page) for security and troubleshooting purposes; the legal basis is the legitimate interest of the Association (Art. 6(1)(f) GDPR). Visit data is also processed through analytics, but only with your consent (see section 7).

3. Recipients and processors

We do not sell your data or share it with third parties for marketing purposes. Only authorised persons of the Association who need the data for the stated purposes have access to it. The following processors assist us:

  • Hostinger International Ltd. - website hosting and e-mail services (servers in the European Union);
  • Google Ireland Ltd. - visitor analytics tools (Google Tag Manager and Google Analytics), only with your consent.

4. Transfers to third countries

Google may process part of the visit data on servers in the United States. Such transfers are based on the EU-US Data Privacy Framework and the European Commission standard contractual clauses.

5. Retention periods

  • contact form enquiries: 12 months from the last communication;
  • membership applications of persons not admitted: 6 months from the decision;
  • member data: for the duration of membership and 2 years after it ends (member register archive);
  • competition registrations: until the end of the competition edition and 2 years after it;
  • event photographs: for as long as the promotional purpose lasts, or until consent is withdrawn;
  • analytics data (Google Analytics): 14 months.

6. Your rights

You may at any time request access to your data, its rectification or erasure, restriction of processing, data portability, and you may object to processing. You may withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal. Send your request to info@probudi-heroja.hr; we will respond without undue delay and no later than within 30 days.

If you believe we are processing your data unlawfully, you have the right to lodge a complaint with the supervisory authority: the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr.

7. Cookies and analytics

The website uses essential cookies required for its basic operation (for example, remembering your language choice and security settings) - these are set without consent, as the website cannot function properly without them.

To measure traffic we use Google Tag Manager and Google Analytics 4. Analytics cookies are set exclusively on the basis of your consent, which you give or refuse through the cookie notice on your first visit. You can change your choice at any time through the cookie settings on the website. A detailed list of cookies is available on the cookie page.

8. Event photographs and recordings

Photographs and recordings may be taken at public events of the Association (trainings, campaigns, competitions) and used to report on the work of the Association, based on legitimate interest, and where prescribed - on explicit consent (e.g. competition participants). If you appear in a published photograph and wish it removed, contact info@probudi-heroja.hr and we will remove it.

9. Minors

The website and membership in the Association are intended for adults. In relation to information society services, consent may be given independently by a person aged 16 or over. If a team registered for the competition includes underage members, the required consents (including consent to photographing) are obtained by the team leader from a parent or guardian.

10. Security of processing

The website is served exclusively over an encrypted connection (HTTPS), access to data is restricted to authorised persons, and form data is stored on servers in the EU. The Association does not carry out automated decision-making or profiling.

11. Changes to this policy

We may update this privacy policy from time to time; every change is published on this page with the date of the last update.