Privacy Policy
Version 1.2 · last updated 3 November 2026
This policy explains which personal data tree.vet processes, why, on what legal basis, for how long, and what your rights are, in line with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Croatian GDPR Implementation Act (OG 42/18). tree.vet is an educational, non-commercial website that collects the least possible amount of data.
1. Data controller
The data controller is Arboring j.d.o.o., Matije Gupca 6, 10450 Jastrebarsko, Croatia, OIB 19760746105. Contact for all data-protection matters: fran@arboring.hr. No data protection officer has been appointed, as the controller does not meet the conditions of Art. 37 GDPR; requests are handled by the controller’s responsible person.
2. What data we process, why and for how long
We require no registration and use no analytics, ads or tracking tools. We process only what is necessary to run the site, the game and to communicate with you:
| Purpose | Data | Legal basis (Art. 6 GDPR) | Retention |
|---|---|---|---|
| Serving the site and server security | IP address, browser type, time and requested page (technical server logs at the hosting provider) | Legitimate interest (Art. 6(1)(f)) — security and troubleshooting | As set by the hosting provider (usually up to 30 days); not used for analytics |
| Remembering language, theme and cookie decision | Cookies treevet_lang and treevet_consent and the local setting treevet_theme (no personal data) | Necessary for the requested service (Art. 6(1)(b/f)); no consent required (Art. 5(3) Directive 2002/58/EC) | Up to 12 months (theme: until you delete it) |
| “Microhabitat hunt” game leaderboard | Nickname you enter yourself, score, time of saving | Consent (Art. 6(1)(a)) — given by clicking “Save score”; withdrawable by requesting removal | 12 months, then automatic deletion |
| Protecting the leaderboard from abuse | One-way hash (SHA-256) of the IP address | Legitimate interest (Art. 6(1)(f)) — preventing spam and bots | 10 minutes |
| Answering your enquiries | Data you send us by e-mail (name, e-mail address, message content) | Legitimate interest (Art. 6(1)(f)) or pre-contractual steps (Art. 6(1)(b)) | Until resolved, at most 12 months |
We carry out no automated decision-making or profiling (Art. 22 GDPR).
3. Cookies and local storage
| Name | Type | Purpose | Duration |
|---|---|---|---|
| treevet_lang (cookie) | Necessary | Remembers your chosen language | 12 months |
| treevet_consent (cookie) | Necessary | Remembers your cookie decision so we do not ask again | 12 months |
| treevet_theme (local storage) | Necessary (user preference) | Remembers light or dark theme — only if you change it yourself | Until you delete it in your browser |
| Functional | With consent | Currently not set. The category is prepared for future features (e.g. photo and location submission forms). It will only be activated after your explicit consent. | — |
You can change your decision at any time via the “Cookie settings” link in the footer or by deleting cookies in your browser. We use no analytics, marketing or third-party cookies.
4. Recipients and transfers outside the EU
- Hosting provider: Cloudflare, Inc. (USA) — serves the site and the game leaderboard (Cloudflare Workers and Workers KV) and keeps technical logs. It acts as a processor under Art. 28 GDPR.
- E-mail: messages you send to an arboring.hr address are processed via Google Workspace (Google Ireland Ltd.).
- Data is not sold, rented or transferred to third parties for marketing purposes. Cloudflare and Google may process data outside the European Economic Area (e.g. in the USA); such transfers rely on the EU-U.S. Data Privacy Framework and standard contractual clauses (Art. 45 and 46 GDPR).
5. Children
tree.vet is an educational site also intended for younger visitors. We do not knowingly collect personal data from children under 16 without parental or guardian consent (Art. 8 GDPR). In the game we ask only for a nickname, never a full name; parents may request removal of a nickname from the leaderboard at any time.
6. Your rights
Under Arts. 15–21 GDPR you have the right to:
- access your data and information about its processing,
- rectification of inaccurate or incomplete data,
- erasure (“right to be forgotten”), e.g. removal of a nickname from the leaderboard,
- restriction of processing and objection to processing based on legitimate interest,
- portability of data you have provided,
- withdrawal of consent at any time, without affecting the lawfulness of processing before withdrawal.
Send requests to fran@arboring.hr. We respond without undue delay and within 30 days at the latest. If you believe processing infringes the law, you may lodge a complaint with the supervisory authority: Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr.
7. Security
The site is served exclusively over HTTPS. We apply data minimisation: no user database, IP addresses are never stored in readable form, and game submissions are validated and rate-limited. Only authorised persons of the controller can access data files.
8. Planned features: submitting tree photos and locations
This section describes processing that is not yet active. We publish it in advance for transparency; it takes effect only when the submission forms are switched on, which we will announce by updating this policy and its version date.
We plan to let visitors report veteran trees by sending photos, a location and a short description. The following would apply:
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Tree photos, description, location (coordinates or address), date | Register and educational map of veteran trees; expert assessment | Consent (Art. 6(1)(a)), withdrawable at any time | For the duration of the project or until consent is withdrawn |
| Sender’s name/nickname and e-mail (optional) | Feedback; crediting the photo author if you wish | Consent | 24 months from last contact |
- Photo metadata (EXIF): before storage we automatically strip all embedded metadata, including GPS coordinates, device information and capture time.
- Location precision: publicly shown locations are rounded (approx. 100 m). Exact locations of trees on private land are not published without the owner’s consent, since a tree’s location may reveal information about the property and its owner.
- People and vehicles: please do not send photos showing identifiable people (especially children) or licence plates. We blur such parts before publication or do not publish the photo.
- Moderation: nothing is published automatically — every submission is reviewed by a person before publication.
- Copyright: by submitting a photo you confirm you are its author or hold the rights, and grant tree.vet a non-exclusive licence to publish it for educational purposes (planned: CC BY 4.0, credited with your name or nickname as you choose, or anonymously).
- Children: persons under 16 may submit only with the consent of a parent or guardian.
- Deletion: you may request removal of your submission, photo or name at any time; we will do so within 30 days.
9. Changes to this policy
We update this policy whenever processing changes (e.g. when the forms in section 8 go live). The current version and date are always shown at the top of this page; significant changes will be highlighted on the homepage.