Privacy Policy
Last updated: 26 September 2026
Who is responsible for processing your data?
The exhibition organiser and data controller for this website is Outbox d.o.o., Vice Vukova 8, 10000 Zagreb, Croatian personal identification number (OIB) 71493396724. For privacy questions and to exercise your rights, contact info@outbox.hr. For exhibition information, contact info@vangoghalive.hr.
Visiting this website
This website has no user accounts, data entry forms, first-party analytics or advertising pixels. Photographs, fonts and the Zagreb Fair map are loaded from this website. When the website is displayed, our hosting provider Cloudflare processes technical data, such as your IP address, browser information and request details, to deliver content and maintain security. The legal basis is our legitimate interest in operating a secure and reliable website.
Your privacy choices are stored in your browser. More information about storage and the optional video is provided in our Cookie Policy.
Email enquiries and group visits
Clicking an email link opens your email application. No data is sent until you send the message yourself. If you contact us, we process the details you provide, such as your name, contact details, organisation, preferred time slot, number of visitors and message content.
We use this information to reply, prepare a quotation and arrange your visit. For enquiries about entering into a contract, the legal basis is taking pre-contractual steps at your request; for other correspondence, it is our legitimate interest in communication. Where invoices or other business records must be retained, the legal basis is a legal obligation. Providing data is not mandatory, but without contact details and the information needed for your enquiry, we may be unable to respond or prepare a quotation. Do not send lists of children or sensitive data that is not needed to arrange the group visit.
Buying tickets
The “Tickets” buttons take you to Entrio. Payment details are neither entered nor processed on this website. Information about data processing during purchase, recipients and the organiser’s role is available on the ticket sales page and in the documents presented during purchase. This policy does not replace Entrio’s privacy policy.
YouTube video and external links
The YouTube video loads only after you consent to the “YouTube video” category and start playback. Google may then receive your IP address, device information and data about your interaction with the video, and may use its own storage. We use youtube-nocookie.com, but this does not mean that no data is processed after playback starts. Processing may include transfers outside the European Economic Area. More information about recipients, retention periods and safeguards is available in Google’s Privacy Policy.
You can withdraw consent in the privacy settings. This stops the embedded video and prevents it from loading again. It does not delete data Google has already received; that data is subject to Google’s own policies and privacy settings. Google Maps and Entrio open only when you select their external links.
Recipients and data retention
Depending on the purpose, data may be accessible to authorised personnel of the organiser, hosting and email providers, and authorities where required by law. Cloudflare uses international infrastructure; information about processing and international transfers is available in Cloudflare’s Privacy Policy.
The retention period for correspondence depends on the time needed to resolve enquiries and arrangements, the duration of any contractual relationship, legal obligations and the time limits for legal claims. You may request information about the retention period applicable to a specific enquiry. Service providers retain technical logs according to their purpose and policies. Your privacy choice on this website is valid for 180 days; after it expires, we ask you to choose again on your next visit.
Your rights
Subject to the conditions of the GDPR, you may request access, rectification, erasure, restriction of processing and data portability, and object to processing based on legitimate interests. You may withdraw consent at any time without affecting the lawfulness of earlier processing. The organiser does not carry out automated decision-making or profiling on this website.
Send your request to info@outbox.hr. You have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP).