Privacy Policy

Last updated: 8 July 2026.

1. DATA CONTROLLER

The controller for personal data collected through this website is:

Name: LANIVA d.o.o.

Registered address: Ksaver 168, Zagreb, Croatia

Company registration number (OIB): 17284418184

Email for privacy inquiries: tastethemediterranean@gmail.com

No Data Protection Officer (DPO) has been appointed, as LANIVA d.o.o.'s processing activities in connection with this website do not meet the mandatory appointment threshold under Art. 37 GDPR (no large-scale, systematic monitoring or large-scale processing of special categories of data).

2. WHAT DATA WE COLLECT

2.1 Contact form (/contact)

When you contact us via the contact form, we collect: your name, email address, phone number (optional, if provided), and the content of your message. The form is protected by Cloudflare Turnstile (anti-spam), and email delivery is handled via Resend.

2.2 "Med Woman Chefs" membership application

When you apply for membership, we collect: first name, last name, email, phone number, address, city, postcode, country, profession and employer/workplace (both optional), and any notes you enter in the free-text field. Submission requires explicit consent (checkbox) before the form can be sent.

2.3 Site analytics

The site uses Umami — self-hosted, open-source analytics that does not use cookies and does not collect personally identifiable data (no fingerprinting; IP addresses are not stored in an identifiable form). Data is displayed only in aggregate form (visit counts, traffic sources, popular pages).

2.4 Cookies

A cookie is a small text file that your browser stores on your device. Our cookies fall into the following categories:

- NEXT_LOCALE — remembers your chosen site language (HR/EN) — essential — duration 1 year.

- cc_cookie — remembers your cookie-consent decision (which categories you accepted) — essential — duration 6 months.

- Umami — site analytics — analytics — Umami is cookieless, no analytics cookie is ever set.

- Google/YouTube cookies (e.g. VISITOR_INFO1_LIVE, YSC, etc.) — displaying an embedded YouTube video within certain News articles — marketing (third-party) — duration per Google/YouTube's own privacy policy.

Essential cookies do not require consent and cannot be disabled — they are needed for the site's basic operation. Analytics cookies are not currently used, since Umami analytics does not set any cookies. Marketing cookies are only set if a given News article includes an embedded YouTube video, and only once the user loads/plays the video after granting consent for the marketing cookie category. Aside from the YouTube embed, the site does not include any other social media embeds.

You can change your cookie choices at any time via the "Cookie settings" link in the site footer.

2.5 Technical data (server logs)

Our hosting provider automatically logs standard technical data (IP address, browser type, access time) for security and abuse-prevention purposes, on the basis of legitimate interest. Logs are retained only as long as necessary for that purpose (see section 6).

3. LEGAL BASIS FOR PROCESSING

- Responding to contact form inquiries — Art. 6(1)(b) GDPR (steps taken prior to/during performance of a request), or Art. 6(1)(f) legitimate interest in responding to inquiries

- Processing membership applications (Med Woman Chefs) — Art. 6(1)(a) GDPR, consent (explicit checkbox)

- Site analytics (Umami) — Art. 6(1)(f) GDPR, legitimate interest (aggregate, non-personal data)

- Security server log data — Art. 6(1)(f) GDPR, legitimate interest (system security)

4. RECIPIENTS OF DATA / PROCESSORS

We do not sell your data to third parties. Data is shared only with service providers acting as data processors:

- Resend (contact form email delivery) — based in the USA.

- Cloudflare Turnstile (spam protection) — Cloudflare Inc., USA.

- Hetzner Online GmbH (VPS hosting) — Germany, EU. Data from this site is physically stored on a server within the EU, so this part of our infrastructure does not involve a transfer of data outside the EU/EEA.

No data is subject to automated profiling or used for automated decision-making.

5. INTERNATIONAL DATA TRANSFERS

Resend and Cloudflare are based in the USA, so their processing of data (contact form email delivery and anti-spam verification, respectively) constitutes a transfer of data outside the EU/EEA. Data Processing Agreements (DPAs) are in place with both providers, and the transfer is covered by appropriate safeguards (Standard Contractual Clauses and/or participation in the EU-U.S. Data Privacy Framework, depending on the provider). A copy of the relevant safeguards can be requested at the contact email in section 1.

6. DATA RETENTION

We retain personal data only for as long as necessary for the purpose it was collected, in line with the storage-limitation principle (Art. 5(1)(e) GDPR):

- Contact form inquiries: deleted once the inquiry has been resolved and is no longer needed for further correspondence.

- Membership applications (Med Woman Chefs): retained for the duration of membership; deleted upon termination of membership or withdrawal of consent, unless a longer retention period is legally required.

- Server logs: retained only as long as necessary for security purposes, per Hetzner's default infrastructure settings.

- Analytics data (Umami): aggregate data without personal identifiers is retained for as long as it remains relevant to tracking visitor statistics.

7. YOUR RIGHTS

Under the GDPR (Art. 15–22), you have the right to:

- access your personal data,

- rectify inaccurate data,

- erasure of your data ("right to be forgotten"),

- restrict processing,

- data portability,

- object to processing based on legitimate interest,

- withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal,

- lodge a complaint with a supervisory authority — in Croatia, this is the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, www.azop.hr.

Requests can be sent to tastethemediterranean@gmail.com. We respond within the statutory period of one month.

8. DATA SECURITY

The site uses HTTPS/TLS encryption and security HTTP headers (CSP, HSTS, etc.).

9. CHANGES TO THIS POLICY

This privacy policy may be updated from time to time. The date of the last update is shown at the top of this page. Material changes will be highlighted on the homepage.

10. CONTACT

For any questions regarding the processing of your personal data, please contact us at: tastethemediterranean@gmail.com.