Privacy Policy

This Privacy Policy serves the purpose of informing you how Infinum collects, uses, and discloses personal data and how you can exercise your data protection rights pursuant to General Data Protection Regulation (REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, hereinafter: “GDPR”).

This Privacy Policy is supported by Infinum’s internal Bylaw on the Processing of Personal Data (dated 2 May 2024), which sets out the general framework, principles and procedures applied across the organization to ensure the protection of personal data.

Data controller for this website is Infinum d.o.o., Mala Švarča 23, 47000 Karlovac, Croatia, registered before the Commercial Court in Zagreb, Croatia under the number (MBS): 020036150 (referred to as: „Infinum“, „we“, „our“ or „us“).

Infinum subsidiaries and affiliates are based in the EU, USA, UK, Montenegro and North Macedonia (in further text: Infinum affiliate) and contact details of each Infinum entity are available at our Legal page.

Each Infinum entity on various occasions and for the purposes stated within this Privacy Policy, can be considered a data controller or data processor. Infinum determined, in a transparent manner, the responsibilities of roles of each Infinum entity vis-à-vis your personal data.

However, irrespective of the terms of our internal arrangements, you may exercise your rights by contacting Infinum’s single point data protection officer at antispam dpoantispam@antispaminfinum.comantispam who will, in a properly and in a timely manner, address all issues which relate to the protection of personal data.

We are dedicated to keeping your personal information confidential. We do not sell, rent, or lease your data to third parties, we will not provide your personal information to any third party, individual, government agency, or company without legal ground.

We do not collect more personal data than necessary for achieving the specific purpose that personal data is collected for, and we process it in a lawful, fair, and transparent manner. We collect personal data about you both online and offline as follows:

A. Data you provide to us

a. Data you provide to us through any of our contact forms, when you send us an e-mail, when you download content from our website or when you sign up for our newsletter

Which data is processed

When you contact us for business, sponsorships, media inquiries, events, or anything else through our contact forms or our e-mails, when you download content like books, whitepapers and other downloadable content from our website, or when you sign up for our newsletter, data collected may include your first name, last name, your e-mail, phone, and any other personal data contained in any files you attach to the contact form or your e-mail.

Purposes, Legal basis & Retention periods

Legitimate interest

When you contact us for various general inquiries regarding a new business, sponsorships, media inquiries, events, or anything else through our contact form or our e-mail or when you download content from our website, your data is processed on the basis of our legitimate interest for the purpose of answering to your inquiry, sending you the requested material, for the purpose of direct marketing when we are sending you similar content to that previously downloaded from our website, for the purpose of gathering follow-up feedback about your experience with our webpage and our products/services in order to improve the quality of our services, for informing you about follow-up projects, and offers.

We will keep your personal data only for the period:

– when you send us an inquiry, for a period of 12 months after the inquiry in case of any follow-up communication including to inform you about follow-up projects and offers or until you object to such processing by sending us an e-mail to antispam dpoantispam@antispaminfinum.comantispam
– after you download our content, for a period of 12 months so we can send you similar content to that downloaded or until you object to such processing by sending us an e-mail to antispam dpoantispam@antispaminfinum.comantispam
– after you interact with our webpage, for a period of 12 months in order to gather feedback about your experience with the webpage or until you object to such processing by sending us an e-mail to antispam dpoantispam@antispaminfinum.comantispam

If you have contacted us or attended one of our events in your professional capacity, or are otherwise in business contact with us, we may send you occasional news, invitations and similar content on the basis of our legitimate interest in direct marketing. We keep your contact data for 12 months after our last contact. You can object at any time by clicking the unsubscribe link or writing to antispam dpoantispam@antispaminfinum.comantispam .

If a specific dispute or legal claim arises, we keep the data relevant to it until it is finally resolved.

Consent

When you subscribe to our newsletter by entering your email address and ticking the consent checkbox in the subscription form, we process your email address on the basis of your consent (Article 6(1)(a) GDPR) in order to send you our newsletter with news, insights and event announcements. You can withdraw your consent at any time by clicking the unsubscribe link in any of our emails, by changing your preferences on the page linked in each email, or by writing to antispam dpoantispam@antispaminfinum.comantispam . We keep your data until you withdraw your consent. After that, we keep only your email address on a suppression list, on the basis of our legitimate interest (Article 6(1)(f) GDPR), so that we do not send you the newsletter again. If you do not open or click any of our emails for 12 months, we stop sending the newsletter to you and delete your email address from our newsletter list.

Fulfillment of contractual obligations

If your inquiry relates to entering into or fulfilling a contract with us (e.g., requesting service details or negotiating terms), we will process your data to take the necessary steps prior to entering into a contract.

In case our business relationship does not evolve further from this initial pre-contractual phase, we will keep your data for the period of 12 months after our last contact.

b. Data you provide to us when you apply for a job position, during the recruitment process or recruitment-related events

Which data is processed

When you apply for a position at Infinum (through our careers page, our applicant tracking system, or at a recruitment-related event), we collect personal data necessary to assess your application and to manage the selection process. The data we collect falls into two categories: data we require in order to consider your application, and data that you may choose to provide voluntarily.

Mandatory data — required in order to consider your application:

– first name and last name;
– e-mail address;
– mobile phone number;
– CV (résumé);
– preferred work location;
– preferred work model (e.g., remote, hybrid, on-site);
– preferred type of contract (e.g., employment contract, service contract, student contract);
– the channel through which you heard about the vacancy (used for marketing-channel analytics only, not for the hiring decision).

If you do not provide the mandatory data, we will not be able to process your application. You will be informed of this at the point of submission so that you may complete the missing information.

Optional data — provided voluntarily:

– cover letter, motivation letter, or summary;
– links to your professional profiles or portfolio (e.g., GitHub, X/Twitter, Dribbble, Behance, personal website);
– your photograph;
– financial expectations (salary range);
– notice period at your current employer;
– results of psychometric or skills tests, where applicable to the role;
– outputs of technical assignments (online or live, e.g., code samples, design tasks);
– references and employment certificates from previous employers (where you provide them or where we obtain them with your consent — see below);
– information disclosed during interviews (e.g., level of English or other languages, additional skills, availability).

Providing optional data is entirely voluntary. If you choose not to provide any of the optional data, your application will still be considered and there will be no adverse effect on the selection process. You may also withdraw any optional data at any time by contacting antispam dpoantispam@antispaminfinum.comantispam .

Psychometric and skills testing: Where psychometric or skills tests are used, the results are interpreted and reviewed by a human (a member of our People team or hiring manager) before any decision is made. Infinum does not use solely automated decision-making in its recruitment process, within the meaning of Article 22 of the GDPR.

Use of AI tools in recruitment. To handle application volume consistently, we use AI-assisted tools within our applicant tracking system and related systems to help screen and summarise applications, suggest how a candidate matches the role’s criteria, and support candidate sourcing. These tools assist our team and do not make hiring decisions: every shortlisting and selection decision is made by a member of our People team or the hiring manager, who reviews each candidate and can override any AI-generated suggestion, and no decision producing legal or similarly significant effects about you is taken solely by automated means (Article 22 GDPR). You may request human review of any AI-assisted step, contest it or object to this processing, and obtain further information, by contacting antispam dpoantispam@antispaminfinum.comantispam .

AI-assisted interview transcription. Some interviews are recorded (audio only) and transcribed by an AI note-taking tool to produce a written record — Transkriptor for Croatian-language interviews and the note-taking feature in our Google Workspace for English-language interviews, both acting as our processors. The transcript is a record only: it is not used to assess or score you or to make any automated decision, and the hiring decision is always made by a person. We tell you at the start of the interview, and you may ask us not to record it with no effect on your application. Transcripts are kept for the same period as your other application data.

Purposes, Legal basis & Retention periods

Legitimate interest

When you submit your personal data into web forms for the purposes of employment, they’re going to be used solely for the job you’re currently applying for, or the first position we think might fit your profile in case you’re applying for an unspecified position. We are processing your data only to assess you as a candidate, to manage recruitment, verify qualifications, and make hiring decisions.

We will keep the application data of unsuccessful candidates (CV and other documents, contact details, interview notes and transcripts) for a period of 6 months from the end of the selection process.

In case of open job application we will keep your application data for the period of 3 months in order to contact candidates if needed.

If you contest our decision or a dispute arises, we keep the data relevant to it, including your application documents, until the dispute is finally resolved or, if no proceedings are started, until the limitation period for related claims expires.

Consent

You can also choose that we keep your data for two years from our last contact with you, for the purpose of notifying you about new opportunities. If a career opportunity that matches your profile opens during that time period, we’ll inform you. You have the right to withdraw your consent to this further processing at any time, in which case we will delete your personal data without undue delay. At the end of the two-year period, we may ask you whether you wish to renew your consent for a further period; if you do not respond or if you withdraw your consent, your data will be deleted. You can exercise these rights at any time by sending us an e-mail to antispam dpoantispam@antispaminfinum.comantispam .

c. Data you provide to us when you visit our offices

Which data is processed

We may collect your personal data such as your name, surname, affiliation and contact details, your photographs and videos.

Purposes, Legal basis & Retention periods

Legitimate interest

We may process such data for the following purposes: promoting our activities and events via internal or external communications (e.g., newsletters, websites, social media), maintaining security and safety within our offices (via CCTV).

Your data will be retained for a period of 12 months from your visit (or, for photographs and videos used for promotional purposes, until you object to such use), or until you object to such processing by sending us an e-mail to antispam dpoantispam@antispaminfinum.comantispam .

Personal data retained via CCTV will be retained for a maximum period of 6 months after collecting it, unless another law prescribes a longer storage period or if they are evidence in court, administrative, arbitration or other equivalent proceedings.

d. Data you provide to us when you register for or attend our events, or when we meet at third-party events

When you register for an event we organise, including recruitment-related events (e.g. through an RSVP form), or exchange contact details with us at a conference, we may process your name, email address, company, role and any information you give us for the event. We use this data to organise the event, to confirm your registration and to send you reminders and follow-up messages (legal basis: performance of a contract (Article 6(1)(b) GDPR) for your registration and participation, and our legitimate interest (Article 6(1)(f) GDPR) for follow-up messages and for contact details exchanged at third-party events). We may send you invitations to similar events on the basis of our legitimate interest and, when legally required, your consent. We keep your data for 12 months after the event, and you can object or, where you have given consent, withdraw it at any time at antispam dpoantispam@antispaminfinum.comantispam .

When you attend events organized by Infinum or where Infinum participates (such as conferences, presentations, industry events, or humanitarian and community events), we may take photographs and video recordings of attendees in a professional context. We process these recordings on the basis of our legitimate interest in employer branding — promoting our organizational culture, business achievements and the values we represent. Photographs and videos may be published on our social media channels (including Instagram, TikTok, Facebook, LinkedIn), our website, in media coverage and in public presentations. Photographs and videos are retained until you object to such use. We do not photograph or record children without the prior explicit consent of their parent or guardian. You have the right to object to this processing at any time by contacting antispam dpoantispam@antispaminfinum.comantispam , in which case we will cease processing and remove published content, unless we can demonstrate compelling legitimate grounds that override your rights.

Your explicit consent will be required if you are bringing your children to events organized by our company, regarding the personal data of your children, including their photographs and videos.

Personal data of children, including their photographs and videos, will be retained for a maximum period of 2 years from the event, or until you withdraw your consent, whichever occurs first. You may withdraw your consent at any time by sending us an e-mail to antispam dpoantispam@antispaminfinum.comantispam

e. Data of members of our Referral Program

If you take part in our Referral Program, we process your name, contact details, company and information about your referrals in order to run the program and to send you updates about it, on the basis of performance of a contract, i.e. your participation in the program (Article 6(1)(b) GDPR), and, for program updates, our legitimate interest (Article 6(1)(f) GDPR). We keep this data while you take part in the program and for 12 months afterwards, except for records of rewards paid, which we keep for as long as accounting and tax laws require. You can object to program updates or unsubscribe at any time.

B. Data we receive from third parties

Reference checks: If you provide us with references or employment certificates from previous employers, or if you authorise us to contact previous employers, we may receive personal data about you from those third parties. In accordance with Article 14 of the GDPR, we inform you that such data may include confirmation of your previous employment, role, duration, and (where shared) feedback on your performance. We will only contact references with your prior knowledge.

Public professional profiles. As part of the recruitment process, we may also review publicly available professional information about candidates on professional networks (such as LinkedIn), on the basis of our legitimate interest in assessing your suitability for the role. We review only information that candidates have made publicly accessible for professional purposes; we do not request access to private or restricted content. You have the right to object to this processing at any time by contacting antispam dpoantispam@antispaminfinum.comantispam .

C. Automatically collected data

Based on our legitimate interest and, when legally required, based on your consent, we may use cookies, log files, and other technologies to collect personal information in a manner described within our Cookie Policy.

Our newsletter emails contain a small image (tracking pixel) and trackable links that tell us whether and when you opened an email and which links you clicked. We use this information to understand which content is relevant to you and to improve our communication. You can prevent the loading of images in your email client, and you can unsubscribe at any time. Legal basis: your consent (Article 6(1)(a) GDPR), which you can give separately from your newsletter subscription, in the subscription form or on the preferences page linked in each email, and withdraw at any time on the same page without unsubscribing. We keep this information until you withdraw your consent or unsubscribe. Without this consent, we use only the date on which you last opened one of our emails, and only to stop sending the newsletter to inactive subscribers as described above (legal basis: our legitimate interest in keeping our mailing list up to date, Article 6(1)(f) GDPR). We do not use tracking pixels or trackable links in emails we send you on the basis of our legitimate interest.

Internally, your personal data is disclosed to our employees and associates only on a need-to-know basis.

Respecting the same rule, we will share your personal data with other Infinum entities, based on legitimate interest for wide business-related reasons, such as research and development, HR matters, accounting, network, and information security, internal administrative purposes, prevention of fraud, etc.

In order to provide our services on the highest level, we cooperate with carefully selected companies and use their tools and services for managing client relations, billing, payments, administration, communication, business planning, HR and recruitment, sending emails on our behalf, customized advertising on our website, hosting, operation, optimization, and maintenance of our website, performing marketing activities, market research, organizing events, etc. Companies we cooperate with are seated within the EU, USA, UK and Canada. You may request a full list of the parties to whom we disclose your data by contacting us at antispam dpoantispam@antispaminfinum.comantispam .

We may be legally obliged to disclose your personal data within the legal process, or court order from governmental authorities, for the purposes of law enforcement, national security, anti-terrorism, or other issues that are related to public security.

Certain organizational and corporate issues such as merger, transfer, acquisition, sale, or bankruptcy may occur and your personal data may be shared with third parties such as advisors, competent authorities, companies participating in such events, etc.

Also, for certain disclosures described in this Privacy Policy, we may share information about you with third parties following your explicit consent.

We pay a lot of attention to localizing most of our data processing within EU territory, as in respect of the dominant role of the EU-based Infinum entity regarding data processing operations, but also in respect to the choice of entities we collaborate with.

However, some of our third-party tools are provided by service providers based outside the EU or EU-based companies that share data with their affiliates seated outside of the EU. According to GDPR, a transfer of personal data to a third country or an international organization may take place where that third country, or the international organization in question, ensures an adequate level of protection. Also, there are countries that are still not covered with adequacy decisions. In such cases, according to GDPR, we transfer your data providing appropriate additional safeguards.

Upon request, you can obtain information about data transfers performed to the USA or any other third country not covered by adequacy decisions. We’ve thoroughly considered all elements of such relationships, when necessary, concluded written contracts based on standard contractual clauses prescribed by the European Commission but also took care that our partners implement appropriate supplementary measures, safeguards, and policies. For providers in the USA certified under the EU-US Data Privacy Framework, we may also rely on that framework.

Also, for the purposes of our business, we may share your data with our affiliates based outside of the EU. All communication takes place through secure channels of communication and respects this Privacy Policy.

For more information, please contact us at antispam dpoantispam@antispaminfinum.comantispam .

1. Right of access (GDPR Article 15) – you have a right to ask us if and which of your personal are being processed, where, why, for how long and who are they shared with;
2. Right to rectification (GDPR Article 16) – you have a right to correct and supplement incomplete personal data;
3. Right to erasure or right to be forgotten with additional stipulations, among others if personal data has been made public (GDPR Article 17) – you can ask us to delete your personal data if they are no longer necessary in relation to the purpose of the processing, in case you have withdrawn your consent to the processing, etc.
4. Right to restriction of processing (GDPR Article 18) – in certain situations you have the right to request that the processing be limited with the exception of storage and some other types of processing;
5. Right to be informed (GDPR Article 19) – within this Privacy Policy and also on your request, you can obtain information on Infinum’s identity, contact data, the purposes of the processing and the legal basis for the processing of data, recipients, presentation to third countries, storage period, ability to withdraw consent, etc.
6. Right to data portability (GDPR Article 20 – means you have the right to receive your personal data previously provided to the us in a structured form and in a commonly used and machine-readable format and transmit it to another controller if the processing is carried out by automated means and is based on the consent or contract;
7. Right to object (GDPR Article 21) – in certain circumstances, depending on the purposes for processing and legal basis for processing, you can object to the processing of your personal data. E.g., if you don’t agree with processing for the purposes of direct marketing based on our legitimate interest, let us know.
8. Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects on you (GDPR Article 22) – (this is just a legal possibility – we won’t be deciding on your rights based on automated processing)

If data was collected based on your consent, you can withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

For more information and for executing your rights, please contact Infinum’s data protection officer at antispam dpoantispam@antispaminfinum.comantispam .

We are holders of the certificate ISO/EC 27001:2022 so you can rely on that all of our processes, protocols, systems, transfers, databases, etc. are tested, secure, and verified. In short, this means that in order to protect data privacy, we implement physical, technical, and administrative measures such as:

– regular updating and testing our systems and security technology;
– implementing technology of highest security standards;
– ensuring that our partners are GDPR compliant;
– providing access to personal data only to authorized employees using multiple level password systems;
– training employees about GDPR and taking appropriate disciplinary measures to enforce employees’ privacy responsibilities.
– encrypting personal data in transit (TLS 1.2 or higher) and at rest (AES-256);
– enforcing multi-factor authentication for access to systems holding personal data;
– regular penetration testing and vulnerability assessments of our systems and applications;
– secure deletion of personal data using methods aligned with NIST SP 800-88 and DIN 66399 (paper).

We are doing all that is within our power to make your experience with Infinum pleasant, and treat your information with the highest integrity. We will endeavor to resolve reasonable complaints and disputes regarding our use and disclosure of personal information in accordance with this Privacy Policy.

In case the dispute cannot be resolved via our internal dispute resolution mechanism, EEA individuals may contact or submit a complaint to the independent dispute resolution body designated to address complaints and provide appropriate recourse free of charge. The supervisory body in the Republic of Croatia is Croatian Personal Data Protection Agency, Zagreb, Selska cesta 136, and you can submit your complaint also via this form.