Privacy Policy

Last updated: 2026-10-26

1. Introduction

ZAGR Virtual Herbarium (“we”, “us” or “our”) operates the website ZAGR Virtual Herbarium. This Privacy Policy explains how we collect, use, disclose and protect your personal data when you visit our website, in accordance with the General Data Protection Regulation (GDPR – Regulation (EU) 2016/679), the Act on the Implementation of the General Data Protection Regulation (Official Gazette NN 42/18) and other applicable regulations of the Republic of Croatia.

By using our website, you confirm that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use our website.

2. Data controller

The controller responsible for your personal data is:

ZAGR Virtual Herbarium, Svetošimunska cesta 25 10000 Zagreb, Croatia (OIB: 76023745044)
Email: sbogdanovic@agr.hr

3. What personal data we collect

We may collect and process the following categories of personal data:

Identity data: name, username or similar identifier
Contact data: email address, phone number, postal address
Technical data: IP address, browser type and version, operating system, time zone, language settings
Usage data: pages visited, time spent on pages, click patterns, referral source
Cookie data: information collected through cookies and similar technologies (see Section 7 below)
Communication data: any data you provide when you contact us through forms, email or other channels

4. How we collect your data

We collect personal data through:

Direct interactions: when you fill in forms, subscribe to newsletters, create an account, make a purchase or contact us
Automated technologies: as you navigate our website, we may automatically collect technical and usage data through cookies, server logs and similar technologies
Third parties: we may receive data from analytics providers, advertising networks and social media platforms

5. Legal basis for processing

We process your personal data on one or more of the following legal bases under Article 6(1) of the GDPR:

Consent (Art. 6(1)(a)): you have given clear consent to the processing of your personal data for a specific purpose (e.g. marketing cookies, newsletters)
Contract (Art. 6(1)(b)): processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract
Legal obligation (Art. 6(1)(c)): processing is necessary to comply with a legal obligation
Legitimate interest (Art. 6(1)(f)): processing is necessary for our legitimate interests or those of a third party, provided that your rights do not override those interests

6. How we use your data

We use the data we collect for the following purposes:

To provide, operate and maintain our website
To improve and personalise your experience
To understand and analyse how you use our website
To communicate with you, including customer support, notifications and marketing (with your consent)
To process transactions and manage orders
To comply with legal obligations
To detect, prevent and address technical issues or fraud

7. Cookies and tracking technologies

Our website uses cookies and similar tracking technologies. A cookie is a small text file that is placed on your device when you visit a website. We use the following categories of cookies:

Strictly Necessary

These cookies are required for the website to work and to be secure — for example, they remember your cookie choice and make forms, logins or a shopping cart work. They cannot be switched off, and the law does not require your consent for them.

Cookie	Category	Provider	Domain	Duration	Description
`r2cc_consent`	Strictly Necessary	This website	herbarium.agr.hr	365 days	Stores the visitor's cookie consent preferences (which categories were accepted or rejected).
`r2cc_consent_uid`	Strictly Necessary	This website	herbarium.agr.hr	365 days	Pseudonymous identifier of this browser's consent record, kept as proof of which choice was made and when.

Functional

These cookies remember choices you make (such as language or region) and enable additional features such as embedded maps, videos or chat. They may be set by us or by third-party providers whose services are embedded on the page. If you do not allow them, some features may not work.

Cookie	Category	Provider	Domain	Duration	Description
`_icl_current_language`	Functional	This website	herbarium.agr.hr	1 day	Stores the language preference for the WPML multilingual plugin.
`wp-wpml_current_language`	Functional	This website	herbarium.agr.hr	Session	Stores the current language selected by the user on the multilingual website.

Analytics & Performance

These cookies help us understand how visitors use the website — which pages are visited, how long a visit lasts and where visitors come from — so that we can improve it. They may give your browser a unique identifier; the providers are listed below. They are used only if you allow them.

Cookie	Category	Provider	Domain	Duration	Description
`_ga`	Analytics & Performance	Google Ireland Ltd. / Google LLC	herbarium.agr.hr	2 years	Google Analytics cookie used to distinguish unique users by assigning a randomly generated number as a client identifier. Transfer outside the EEA: United States — EU-US Data Privacy Framework (adequacy decision)
`_ga_*`	Analytics & Performance	Google Ireland Ltd. / Google LLC	herbarium.agr.hr	2 years	Used by Google Analytics 4 to persist session state and track interactions. Transfer outside the EEA: United States — EU-US Data Privacy Framework (adequacy decision)
`_ga_1XBCMM9T4V`	Analytics & Performance	Google Ireland Ltd. / Google LLC	.agr.hr	2 years	Google Analytics 4 cookie to persist session state. Transfer outside the EEA: United States — EU-US Data Privacy Framework (adequacy decision)
`_ga_9YGL0J32VD`	Analytics & Performance	Google Ireland Ltd. / Google LLC	.agr.hr	2 years	Google Analytics 4 cookie to persist session state. Transfer outside the EEA: United States — EU-US Data Privacy Framework (adequacy decision)
`_gat`	Analytics & Performance	Google Ireland Ltd. / Google LLC	herbarium.agr.hr	1 minute	Used by Google Analytics to throttle the request rate and limit data collection on high traffic sites. Transfer outside the EEA: United States — EU-US Data Privacy Framework (adequacy decision)
`_gid`	Analytics & Performance	Google Ireland Ltd. / Google LLC	herbarium.agr.hr	24 hours	Google Analytics cookie used to distinguish users. Stores and updates a unique value for each page visited. Transfer outside the EEA: United States — EU-US Data Privacy Framework (adequacy decision)

Marketing & Advertising

These cookies are used to measure the effectiveness of advertising and to show you advertisements relevant to you, on this and on other websites. They are set by us or by advertising partners and can recognise your browser and device across websites. They are used only if you allow them.

No cookies registered in this category yet.

Providers

Provider	Purpose (category)	Established / processing	Transfer outside the EEA	Cookie
Google Ireland Ltd. / Google LLC	Analytics & Performance	IE, United States	EU-US Data Privacy Framework (adequacy decision)	`_ga, _ga_*, _ga_1XBCMM9T4V, _ga_9YGL0J32VD, _gat, _gid`

Managing your cookie settings

When you first visit our website, you will be shown a cookie notice that lets you accept or reject cookie categories. Optional categories stay off until you switch them on yourself. You can change or withdraw your consent at any time:

Cookie Settings

You can also manage cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of our website.

8. Data sharing and third parties

We may share your personal data with the following categories of recipients:

Service providers: hosting, analytics, email marketing, payment processing
Advertising partners: only with your explicit consent to marketing cookies
Law enforcement and judicial authorities: when required by law or to protect our rights

We do not sell your personal data to third parties.

9. International data transfers

The following providers may process data outside the European Economic Area (EEA). The legal basis for each transfer is listed:

Google Ireland Ltd. / Google LLC — USA — EU-U.S. Data Privacy Framework (adequacy decision)

10. Data retention

We keep your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to meet legal, accounting or reporting requirements. Cookie consent records are kept for as long as they are needed as proof of the consent given.

11. Your rights under the GDPR

Under the GDPR, you have the following rights regarding your personal data:

Right of access (Art. 15): request a copy of your personal data
Right to rectification (Art. 16): request the correction of inaccurate data
Right to erasure (Art. 17): request the deletion of your data (“right to be forgotten”)
Right to restriction of processing (Art. 18): request that the processing of your data be restricted
Right to data portability (Art. 20): receive your data in a structured, machine-readable format
Right to object (Art. 21): object to processing based on legitimate interest or for direct marketing
Right to withdraw consent (Art. 7): withdraw your consent at any time without affecting the lawfulness of processing carried out before the withdrawal

To exercise any of these rights, please contact us at: sbogdanovic@agr.hr

You also have the right to lodge a complaint with the competent data protection authority. In the Republic of Croatia, this is the Personal Data Protection Agency (AZOP), azop.hr.

12. Data security

We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. These measures include encryption, access controls and regular security assessments.

13. Children’s privacy

Our website is not intended for children under the age of 16. We do not knowingly collect personal data from children. If we learn that we have collected data from a child under 16 without parental consent, we will take steps to delete it.

14. Changes to this Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this page periodically.

15. Contact

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

ZAGR Virtual Herbarium
Email: sbogdanovic@agr.hr
Web: ZAGR Virtual Herbarium