Privacy Policy — Oglasna Ploča

01 Controller and contact

The controller of personal data processed through Oglasna Ploča is Borna Hilc. For privacy questions and requests, contact us via [email protected].

This policy covers visitors, account users, applicants, employer representatives, review authors and people whose information may appear in public sources. Oglasna Ploča provides job listings, company profiles, reviews and direct applications for jobs posted by employers on the platform.

02 Data, purposes and legal bases

For each activity we list the data we use, the purpose and the legal basis.

Accounts and sign-in — email, profile details you provide, password hash, email confirmation, roles, security information and identifiers for a selected external login, to provide your account and its features. Basis: performance of the requested service; legitimate interests in security.
Direct applications — name, email, phone, CV, links, answers and status history you provide, to deliver and track your application. Basis: performance of the requested service and steps taken at your request before a contract.
Saved jobs — the association between your account and a selected job. Basis: performance of the requested service.
Reviews and moderation — rating, text, employment information you provide, your confirmation that the review describes your own experience, account association and moderation history, to publish experiences and prevent abuse. Basis: legitimate interests in employer information and safe moderation.
Employer profiles, claims and direct listings — representative details, authority verification, listing content and application contacts. Basis: performance of the requested service; legitimate interests in authority verification and abuse prevention.
Public sources — job content from enabled sources and selected Court Register information, for job discovery and company matching. Basis: legitimate interests in job discovery and accurate employer matching, subject to data minimisation.
Support, content reports and rights requests — messages, content links, reasons, optional contact information and decisions. Basis: legitimate interests in support and moderation; legal obligations for rights requests.
Security and diagnostics — IP address, User-Agent, timing, technical request information, errors and an audit trail of actions. Basis: legitimate interests in protecting the service, detecting abuse and fixing errors; applicable legal obligations.

Our legitimate interests do not automatically override your rights, and you may object to this processing. Public availability alone is not a legal basis. We make no automated decisions with legal or similarly significant effects; employers make recruitment decisions.

Do not include health information, criminal-conviction information or unnecessary private-life details in CVs, reviews or reports. Browsing public jobs requires no account; account features and direct applications require the indicated mandatory information.

03 Sources, including information not collected from you

Information comes from you, authorised employer representatives, technical systems and, if you choose Google sign-in, the information needed for that login. Imported jobs come from the enabled sources identified alongside listings, and company information from the Croatian Court Register (Sudski registar).

We strip email addresses, phone numbers and identifiable labelled contact-person or owner names from imported text. Automatic removal may miss something; if you find your information, report the listing or send us the link so we can remove it. We do not store an imported employer name that is not matched to the Court Register, so such a listing is shown without an employer name. We do not import individual traders or information about individuals, members, founders or representatives.

Matching uses company name, MBS, OIB, legal form and city. Register email and street address are kept only for linked companies to verify profile claims; the email is never published and is shown masked during a claim. Unclaimed profiles show city and county without the street. Published reviews and jobs are visible to the public and search engines.

If you did not give us information directly, this section explains its categories, sources and purposes. You can request access, correction or removal, or object, via [email protected]. Appearance in a public source does not remove your rights.

04 Applications and employers

We deliver a direct application to the employer you select. The employer is a separate controller for its recruitment and the information it receives; its retention and procedures may differ from ours, so address requests about its copies to the employer as well. Application documents have restricted access, and administrators access them only when needed for support, security or troubleshooting.

For imported jobs, the apply button opens the original website. Applications sent there are governed by that site's and the employer's policies; Oglasna Ploča does not receive them.

05 Reviews

A review author's name and email are never shown publicly. A company's reviews are shown only once its number of approved reviews reaches 3, so authors at small companies are not easy to identify.

We do not disclose an author's identity to the company or to a reporter without a court order or legal obligation. If a company disputes that an author worked there, we may ask the author for proof; that proof is not passed to the company and is deleted after the decision.

06 Providers and international transfers

Resend delivers transactional email. Cloudflare provides DNS, incoming Email Routing, private R2 document storage and Turnstile protection against automated abuse where those features are enabled; incoming email is forwarded to a support mailbox. Sentry provides error diagnostics when enabled. Google processes information for its own sign-in service if you choose it. Turnstile processes technical signals such as IP address and browser information, including for its own bot-detection improvement. Hosting, database services and backups support operation of the service.

Some providers may process information in the United States or other countries outside the European Economic Area. Sending email from an EU region does not mean all email-related data is stored in the EU. Such transfers rely on appropriate safeguards, such as standard contractual clauses or an adequacy decision covering the recipient. You can request information about the safeguards and a copy via [email protected].

07 Retention

Account and saved jobs: until account deletion; accounts are not deleted solely for inactivity.
Direct applications, data and CVs: 365 days from submission, with scheduled deletion; an active legal hold may postpone deletion.
Failed-email records: 30 days from the failure.
Inactive imported jobs: 90 days from recorded inactivity.
Removed-job records: after deletion only an identifier and the deletion time remain, plus, for administrative removals, the source, original identifier and removal time so the job is not republished. Listing content is not retained.
Reviews: while needed to display experiences and for moderation; deleted with the author's account, subject to legal-obligation and legal-claim exceptions.
Register information: while needed for matching and maintaining profiles; unnecessary contact fields of unlinked entries are removed.
Content reports: 90 days from resolution, at most 365 days from submission, including unresolved reports.
Technical logs: limited by storage size with rotation; external systems may have their own periods.
Audit trail, correspondence and legal requests: as long as needed for security, responding and establishing or defending rights.

Document destruction uses a deletion queue with retries, and backups follow their own expiry cycle. Copies already downloaded by employers are outside our control.

08 Your rights

Subject to applicable conditions, you may request access, correction, erasure, restriction and portability. You may object to legitimate-interest processing because of your particular situation, and where processing relies on consent you may withdraw it without affecting earlier processing.

Send requests via [email protected]. Account settings provide data export and account deletion. We verify identity proportionately and respond without undue delay, normally within one month; if up to two further months are needed, we will tell you and explain why within the first month.

You may complain to the Croatian Personal Data Protection Agency (AZOP, azop.hr) or another competent supervisory authority. Removal from Oglasna Ploča does not remove information held by the original publisher.

09 Security, cookies and updates

We use access controls, password hashing, document checks and limits on information in logs. No measure guarantees complete security.

We use only necessary cookies for sign-in, form protection and your selected language; advertising and analytics tools are not enabled. Accounts are intended for people aged at least 16.

The update date appears at the top of this policy. We will give appropriate notice of material changes affecting your information.

Open the cookie policy