1. Who we are — the data controller

The controller responsible for the processing described here is Common Sustainability d.o.o. (CoSustain), Viška ulica 22, 21000 Split, Croatia. Email info@cosustain.eu. CoSustain has not appointed a Data Protection Officer, as it is not required to do so under Article 37 of the GDPR at its current scale.

2. The personal data we process

• Contact and inquiry data — name, employer, role, email, telephone, and the content of any message sent through the contact form or by email.

• Engagement data — for clients, the information needed to scope, perform, and administer an engagement.

• Technical and usage data — IP address, browser and device information, pages visited, collected automatically.

• Consent records — a timestamped record of the cookie and marketing preferences you set.

• Newsletter data — if you subscribe to Insights, your email address and subscription status. We do not knowingly collect special categories of personal data through this website.

3. Why we process it, and on what legal basis

• Responding to an enquiry; pre-contractual steps - Art. 6(1)(b) / Art. 6(1)(f)

• Providing and administering an engagement - Art. 6(1)(b) - performance of a contract

• Sending the Insights newsletter - Art. 6(1)(a) — consent, withdrawable any time

• Analytics cookies and website measurement - Art. 6(1)(a) - consent via the cookie banner

• Records required by law (accounting, tax)- Art. 6(1)(c) — legal obligation

• Establishing or defending legal claims; site security - Art. 6(1)(f) — legitimate interest

4. Who we share data with — processors and recipients

We do not sell personal data. We share it only with service providers acting on our behalf under a written data processing agreement: Squarespace (website hosting and the contact form), Iubenda (cookie-consent management and consent logging, EU-hosted), our web analytics provider, Matomo Cloud or Google Analytics 4, and our email provider, Microsoft. We may also disclose data to professional advisers, to public authorities where required by law, and to Valuad AG (Zug, Switzerland) where you have engaged the combined CoSustain × Valuad offering.

5. International transfers

Where a processor transfers data outside the EEA, that transfer is protected by an appropriate Chapter V GDPR safeguard — typically the Commission’s Standard Contractual Clauses and, for the United States, the EU–U.S. Data Privacy Framework. A copy is available on request.

6. How long we keep data

• Contact-form inquiries that do not become engagements - Up to 12 months from last contact

• Client engagement records - Duration of the engagement + the period required by Croatian accounting, tax and limitation law (generally up to 11 years)

• Newsletter subscription data - Until you unsubscribe

• Cookie-consent records - Typically up to 24 months

• Server logs and technical data - A short rolling period, typically up to 12 months

7. Your rights

Under the GDPR, you may request access, rectification, erasure, restriction, or portability of your data; object to processing based on legitimate interest; and, where processing is based on consent, withdraw that consent at any time. Contact us using the details in Section 1 — we respond within one month.

8. Your right to complain

You have the right to lodge a complaint with the Croatian supervisory authority, AZOP (see the Data Protection Authority page). We would, however, appreciate the chance to address your concerns first.

9. Automated decision-making

We do not carry out automated decision-making, including profiling, that produces legal or similarly significant effects.

10. Children

This website is directed at businesses and professionals. We do not knowingly process the personal data of persons under 16.

11. Cookies

This website uses cookies. Strictly necessary cookies are required for the site to operate; all others are used only with your consent, which you can change through the cookie banner and the “Cookie settings” link in the footer.

12. Changes to this policy

We may update this policy from time to time; the current version and the date of the last update are shown below.