Privacy Policy

This Privacy Policy explains how Offshore CV Pro ("we", "our", "us") collects, uses and protects personal data submitted through this website, in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and the Croatian Act on the Implementation of the General Data Protection Regulation. This page is maintained by the data controller named below to answer common privacy questions about Offshore CV Pro and should be reviewed and finalised by a qualified legal adviser before launch.

1. Data Controller

The controller responsible for the processing of your personal data is:

• ALTONA d.o.o. trading as Offshore CV Pro
• Randici 25, 51221 Kostrena, Croatia, European Union
• Company Registration Number (MBS): 06176518
• Personal Identification Number (OIB): 32700643833
• General contact: contact@offshorecvpro.com
• Data protection contact: privacy@offshorecvpro.com

We have not appointed a formal Data Protection Officer (DPO) as we are not required to under Article 37 GDPR. For any privacy-related request, use the data protection contact above.

2. What personal data we collect

• Identification and contact details: full name, email address, country of residence, optional LinkedIn URL.
• Professional information: current and target job titles, years of experience, sector, employer, projects, responsibilities, achievements, tools, certifications.
• Documents you upload: existing CV, target job description, certificates, additional project lists.
• Service and preference data: selected service tier, preferred CV language, any additional information you provide.
• Consent records: which consents you gave, the timestamp, and the policy version in force at submission.
• Technical data: limited information needed to operate the website securely (for example session cookies for the administrator area, IP address in server logs).

3. Purposes and legal bases for processing

We process your personal data on the following legal bases (Article 6 GDPR):

• Performance of a contract (Art. 6(1)(b)): to deliver the CV writing or review service you have requested, including reviewing your CV, communicating about your request and delivering the finished document.
• Consent (Art. 6(1)(a)): for non-essential cookies and any optional marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Legal obligation (Art. 6(1)(c)): to meet accounting, tax and other statutory obligations under Croatian and EU law.
• Legitimate interests (Art. 6(1)(f)): to keep our website and services secure, prevent fraud and abuse, and improve service quality. We balance these interests against your rights and freedoms.

We do not process special categories of personal data (Art. 9 GDPR). Please do not include health, religious, political, biometric or similar sensitive information in your CV submission.

4. How uploaded CVs are used

Uploaded documents are used solely to deliver the service you have requested — for example to review, rewrite, format or tailor your CV. Documents are reviewed by a qualified human specialist. They are stored in private, access-controlled storage and are never published or shared on public URLs.

5. Recipients and subprocessors

We use trusted infrastructure providers ("processors") to deliver the service. They process data only on our documented instructions and under written data processing agreements that include the confidentiality and security obligations required by Article 28 GDPR. We do not sell your data and do not share it with third parties for their own marketing purposes.

Current categories of subprocessors:

• Cloud hosting and serverless compute (website and API).
• Managed database and private file storage.
• Transactional email delivery (service notifications, confirmations).
• AI tooling used by specialists as an assistive aid (see Section 7).

A current list of named subprocessors is available on request from privacy@offshorecvpro.com.

6. International data transfers

Where possible, your data is processed within the European Economic Area (EEA). Where a subprocessor processes data outside the EEA, the transfer is protected by an appropriate safeguard under Chapter V GDPR — typically the European Commission's Standard Contractual Clauses (SCCs) of 4 June 2021, supplemented by additional technical and organisational measures where required, or by an adequacy decision under Article 45 GDPR. You may request a copy of the safeguards in place by contacting our data protection address.

7. Use of AI tools and automated decision-making

Our service is human-led. AI tools may be used by our specialists as an assistive aid (for example for spelling, grammar or language-polish suggestions) but documents are not automatically submitted to AI services. We will not use your documents to train public AI models without your explicit, separate written permission.

We do not make any decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on you within the meaning of Article 22 GDPR.

8. Retention periods

• Uploaded CV documents: retained for 90 days after service completion and then deleted, unless you request earlier deletion.
• Contact form messages: retained for up to 12 months after the last related communication.
• Account and order data: retained for the duration of the customer relationship and for as long as necessary to handle warranty, dispute or liability claims.
• Accounting and invoicing records: retained for 11 years as required by the Croatian Accounting Act (Zakon o računovodstvu).
• Consent records: retained for as long as we rely on the consent, plus a reasonable period to demonstrate compliance.
• Server and security logs: retained for a short period (typically up to 90 days) for security and abuse prevention.

9. Cookies and analytics

We use only strictly necessary cookies required to operate the website (for example session cookies for the administrator area). Any non-essential cookies or analytics tools are loaded only after you give consent. See our Cookie Policy for full details and instructions on managing your preferences.

10. Your rights under the GDPR

Subject to the conditions in the GDPR, you have the right to:

• Access your personal data (Art. 15).
• Rectify inaccurate or incomplete data (Art. 16).
• Erase your data ("right to be forgotten") (Art. 17).
• Restrict processing (Art. 18).
• Data portability — receive your data in a structured, commonly used, machine-readable format (Art. 20).
• Object to processing based on legitimate interests (Art. 21).
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3)).
• Lodge a complaint with a supervisory authority. The competent authority in Croatia is the Croatian Personal Data Protection Agency (AZOP — Agencija za zaštitu osobnih podataka), Selska cesta 136, 10000 Zagreb, Croatia — azop.hr. You may also lodge a complaint with the supervisory authority in your EU country of residence or workplace.

To exercise any of these rights, contact us at privacy@offshorecvpro.com or via our Contact page. We respond within one month of receiving your request, as required by Article 12(3) GDPR. We may need to verify your identity before acting on a request.

11. Security

We apply appropriate technical and organisational measures under Article 32 GDPR to protect your data, including private access-controlled storage, role-based administrator access, secure short-lived download links, validated uploads, encrypted transport (HTTPS/TLS), encryption at rest where supported by our providers, and regular review of access rights.

12. Personal data breach notification

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority (AZOP) without undue delay and, where feasible, no later than 72 hours after becoming aware of it, in accordance with Article 33 GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also inform you directly without undue delay, as required by Article 34 GDPR.

13. Children

Our service is intended for adults seeking offshore employment. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us so we can delete it.

14. Changes to this policy

We may update this policy from time to time. The version number and "last updated" date at the top of this page indicate when changes were made. The version in force at the time of your submission is recorded with your consent record. For material changes, we will provide reasonable advance notice where appropriate.