Privacy Policy

GM BARBER SHOP, hairdressing sole proprietorship, owned by Goran Mudrinić, Rijeka, Zadarska 3B

27 January 2026.

1. Personal data controller

The personal data controller is:

GM BARBER SHOP, hairdressing sole proprietorship, owned by Goran Mudrinić, Rijeka, Zadarska 3B

E-mail for privacy enquiries: gmudrinic.skare@gmail.com

Telephone: 0997770635
Entered in the Crafts Register, registration number (MBO): 99138409

This Privacy Policy explains which personal data we process, for what purposes, on what legal bases, how long we retain it and what rights you have.

This Policy applies to Clients who book appointments through our website or contact us through other available channels.

2. What personal data do we process?

Depending on your interaction with us, we may process the following categories of data:

Booking data

  • first and last name;
  • telephone number;
  • e-mail address;
  • selected service, appointment date and time;
  • booking, cancellation or no-show status.

Data about services provided

  • records of completed services and information needed to organise future appointments;

Accounting data

  • data required to issue receipts, record payments and fulfil legal obligations.

Photographs

  • photographs of your hairstyle or beard before and/or after a service, if you have consented to being photographed;
  • photographs we wish to publish, if you have consented to their publication.

Technical data

  • limited website usage data, such as your IP address, browser information or cookies.

We do not collect more data than is necessary for a particular purpose. We do not routinely request or record health data.

3. Processing purposes and legal bases

We process your data for the following purposes:

3.1. Booking, confirming and managing appointments

We use data to receive bookings, confirm appointments, enable changes or cancellations and organise the provision of services.

Legal basis: taking steps at the Client’s request before entering into a contract and, where applicable, in accordance with Article 6(1)(b) GDPR.

3.2. SMS reminders about booked appointments

We use your telephone number to send messages relating to your appointment, such as confirmations, changes or reminders.

SMS reminders help us organise booked services and do not include promotional offers. If we wish to send you marketing messages, we will first check the applicable rules on electronic communications and direct marketing and obtain consent where required.

3.3. Providing services and technical notes

We use information about the selected service and limited technical notes to organise appointments and provide the agreed service.

Legal basis: performance of a contract or a legitimate interest in organising our business effectively, depending on the particular data and purpose.

Notes must be appropriate and necessary. We do not enter unnecessary private or health information.

3.4. Receipts and legal obligations

We process data needed to issue and retain receipts to fulfil tax, accounting and other legal obligations.

Legal basis: Article 6(1)(c) GDPR, namely compliance with a legal obligation.

3.5. Taking and publishing photographs

With your separate and voluntary consent, we may photograph the result of a haircut or beard grooming service. If we wish to publish a photograph on the website or the Salon’s social media profiles, we will request separate consent for publication.

Legal basis: consent under Article 6(1)(a) GDPR.

Refusing photography or publication does not affect your ability to book or use the Salon’s services.

You may withdraw consent at any time by e-mail to gmudrinic.skare@gmail.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

After withdrawal, we will stop relying on that consent for future processing and remove photographs from channels we manage, to the extent applicable and feasible. Withdrawal does not mean that removal of all copies independently stored by third parties can be guaranteed.

3.6. Handling complaints and legal claims

We may process data to receive and resolve complaints, establish relevant facts, and establish, exercise or defend legal claims.

Legal basis: a legal obligation or legitimate interest, depending on the purpose and specific circumstances.

4. Is providing data mandatory?

Data marked as necessary for booking is required to identify the booking, contact you about the appointment and provide the service.

If you do not provide necessary data, we may be unable to confirm or fulfil the booking.

Consent to photography and publication of photographs is not a condition for booking or receiving standard services.

5. Who do we share data with?

We do not sell or rent personal data.

We may make data available only where necessary and in accordance with applicable regulations, for example to:

  • the website hosting and technical maintenance provider;
  • the online booking system provider (Enter Internet d.o.o.);
  • the SMS service provider, to send appointment-related messages;
  • an accounting service, if we use one;
  • competent authorities where required by law.

The Contact page embeds Google Maps; when the map loads, Google receives technical data and may use its own cookies. See section 8 for more information.

6. How long do we retain data?

We retain personal data only for as long as necessary for the purpose for which it was collected, unless the law requires longer retention or another valid legal basis exists for continued storage.

We apply the following rules:

  • Booking data: retained while needed to manage appointments and related business needs, then deleted or anonymised unless there is a justified reason for longer retention.
  • Data about completed services and technical notes: retained while needed to provide services and organise related business activities. Unnecessary notes are regularly removed.
  • Receipts and accounting documentation: retained for the periods required by applicable tax, accounting and other regulations.
  • Photographs: retained while valid consent exists and the photograph is needed for the approved purpose, unless another valid legal basis exists for continued storage. After consent is withdrawn, we stop processing photographs on that basis and remove them from channels we manage, unless there is a legally permitted reason to retain them.
  • Data relating to complaints and legal claims: retained as long as needed to handle the complaint and for the applicable periods for exercising or defending legal claims.
  • Technical data and cookies: retained for periods depending on the type of data, tool function and individual cookie settings, as described in the cookie notice.

At the end of the applicable period, data is deleted or anonymised unless continued retention is permitted or required by law.

7. Your rights

Depending on the circumstances and conditions set out in the GDPR, you have the right to:

  • request access to your personal data and information about its processing;
  • request correction of inaccurate or completion of incomplete data;
  • request erasure where the legal conditions are met;
  • request restriction of processing where the legal conditions are met;
  • object to processing based on legitimate interests for reasons relating to your particular situation;
  • withdraw consent where processing is based on consent.

These rights are not absolute, and their application depends on the legal basis and circumstances of each processing activity. For example, data we are legally required to retain cannot always be erased immediately on request.

To exercise your rights, contact us at gmudrinic.skare@gmail.com. To protect your data, we may request reasonable proof of identity where necessary.

We respond within the periods specified by the GDPR, generally within one month of receipt, with the possibility of an extension where the legal conditions are met.

If you believe that your personal data is being processed contrary to applicable data protection regulations, you may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), the supervisory authority for personal data protection in the Republic of Croatia. Further information is available on AZOP’s official website.

8. Cookies and website technical tools

Our website uses strictly necessary cookies in the online booking and login system to maintain the user session and recognise a logged-in user. Cookies are small text files that your browser stores on your device.

  • BFSESS_2O37TFBA — a session cookie on the website’s domain, enabling session functionality in the booking and login system. It has no persistent browser expiry date (a session cookie); it is generally removed when the browser closes, depending on its session restore settings.
  • BFADM_2O37TFBA — an authentication cookie on the website’s domain, set after a successful login. According to the application settings, it lasts for 14 days from being set or renewed and maintains the login.

The Contact page loads an embedded Google Maps map. Loading the map connects your browser to Google and transmits your IP address and browser and request information. Google may set or read its own cookies; their selection and duration depend on Google’s settings, your login status and your browser settings. See Google’s Privacy Policy and Google’s cookie information. The link for opening the location in Google Maps leads to an external service.

The website has no embedded Google Analytics, Google Tag Manager or Meta Pixel. The embedded Google Maps map may use third-party cookies.

If we use analytics, advertising or other optional cookies and tracking tools, we will provide separate information about them and, where required, request consent before activating them.

You can manage cookies in your browser settings: view, delete or block them, including third-party cookies. Blocking necessary cookies may prevent login or some booking functions. Deleting cookies does not delete data about bookings already made. For enquiries or to book through another channel, contact gmudrinic.skare@gmail.com or 0997770635.

9. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business, technical systems or applicable regulations.

The current version will be published on the Barber Shop’s website, with the date of the last update.

Last updated: 27 January 2026.