Privacy notice and GDPR statement

Version 1.07 September 2026

The short version

This website sets one cookie, which remembers the language you are reading in. There is no analytics, no tag manager, no advertising pixel, no social plugin and no third-party font. Nothing you do here is tracked, profiled or sold. If you write to us, we keep your message so that we can answer it.

Who is responsible

Controller: Storion Energy d.o.o., Radnička cesta 50, 10000 Zagreb, Croatia · OIB 67451522322
Contact for data protection: info@crostorion.com

1 — This website

Server logs

Our web server records each request: the IP address, the time, the page requested, the referring page and the browser's user-agent string. This is ordinary technical logging — it is how a server is operated and defended, not a way of recognising you. The legal basis is our legitimate interest in a working, secure website (GDPR art. 6(1)(f)).

The server is run for us by a hosting provider, which processes those logs on our instructions and for no purpose of its own. We name the current provider on request. Logs are kept only as long as they are needed to operate and secure the site, and are never used to build a profile of a visitor.

Cookies

One cookie, and it is functional rather than analytical:

site_language: Remembers which of the five site languages you are reading in, so that the choice survives to your next visit. Lifetime one year, SameSite=Lax, first-party. It holds a language code and nothing else — no identifier, no personal data.

Because it does nothing but carry your language preference, it does not require consent under the ePrivacy rules. You can delete it in your browser at any time; the site then falls back to the language your browser asks for.

When you write to us

If you send an e-mail, use the contact form or ask for a quote, we process what you give us — typically your name, company, e-mail address, and the details of the site you are asking about. We use it to answer you and, if it goes further, to prepare an offer. The legal basis is the steps taken at your request before entering into a contract (art. 6(1)(b)) or, for a general enquiry, our legitimate interest in responding (art. 6(1)(f)).

We keep enquiries for as long as the commercial conversation is live, and afterwards only as long as tax and commercial law require us to keep the records. We do not use enquiry addresses for marketing unless you ask us to.

What we do not do

No web analytics, no tag manager, no advertising or conversion pixel.
No profiling and no automated decision-making about you.
No sale or sharing of personal data with advertisers or data brokers.
No social-media plugins, embedded video players or third-party fonts, so nothing on this page calls out to another company as it loads.

This section is for customers and prospective customers who need to know how we handle data in the systems we build and operate, rather than how the website behaves. It is the version we are happy to have quoted back to us in a contract.

Which role we are in

We act in two different roles, and it matters which one:

As controller, for the personal data of our own business contacts — the people we correspond with at customers, suppliers, partners and candidates.
As processor, where we run an energy management system on a customer's site and handle data on that customer's behalf and on their instructions.

What is in an operating system, and what is not

Most of what our software handles is not personal data at all: meter readings, state of charge, temperatures, setpoints, market prices, alarms. Personal data enters in a narrow way — the accounts of the people who log in to the portal or the SCADA, and the audit trail of what those accounts did. We treat that audit trail as personal data and protect it as such.

Where the data lives

Operational data from the systems we run stays inside the European Union. We do not transfer it to a country outside the EEA, so no standard contractual clauses or adequacy decision is needed for it. Our software is developed in the EU by our own team, not licensed from a third-country vendor.

Where we use a sub-processor, we give you the current list — who they are and where they process — before any personal data of yours reaches them, and we tell you before the list changes.

What we commit to

A data processing agreement under art. 28, on request, before any personal data is handled on your behalf.
Technical and organisational measures under art. 32: encrypted transport, access limited to named accounts with individual credentials, role-based rights, logged administrative access, and backups held in the EU.
Breach notification without undue delay, and in any case in time for you to meet the 72-hour deadline in art. 33 where you are the controller.
Return or deletion of the data we hold for you at the end of the contract, at your choice.
No secondary use. We do not use a customer's operating data for anything beyond running and improving that customer's own system, unless it has been aggregated so that no site can be identified from it.

Your rights

Under the GDPR you can ask us for access to the personal data we hold about you, for its correction or erasure, for the restriction of its processing, and for a copy in a portable format. You can object to processing we base on legitimate interest. Where processing rests on your consent, you can withdraw it at any time, without affecting what was done before.

Write to info@crostorion.com and we will answer within one month. If you are not satisfied, you can complain to the Croatian supervisory authority:

Supervisory authority: Agencija za zaštitu osobnih podataka (AZOP), Selska cesta 136, 10000 Zagreb, Croatia

You can also complain to the supervisory authority of the EU country where you live or work.

Changes

If we change what we do with data — wire the forms to a CRM, add a service that needs a sub-processor — we change this page first, and the version and date at the top change with it.

Privacy notice