Formalities
Privacy Notice
The House processes only what it needs to issue and deliver a Certificate, keep the Register and meet its legal duties. It does not sell data, show advertising or use third-party analytics on this site. Its own server counts visits only as daily totals, as set out below.
Controller
MP-Dizajn - obrt za izradu personaliziranih poklona i dekorativnih predmeta, VRBANOVEC, Brigade Braće Radića 96, 42232 Donji Martijanec, Croatia. Contact: info@maisonproof.com.
What the House processes and why
| Whose data | Data | Purpose | Legal basis (GDPR) | Kept for |
|---|---|---|---|---|
| You, the requester | Name, email address and other details you enter in the form, your text, occasion, edition, disclosure and delivery choices | Review your request, send the proforma invoice, issue and deliver the Certificate | Contract, Art. 6(1)(b) | As long as the Register entry exists; requests never paid are deleted after 6 months |
| You | Details of your bank transfer: payer name, account, amount, reference | Match your payment, issue the invoice, make refunds | Contract; legal obligation, Art. 6(1)(c) | 11 years, as accounting law requires |
| You | Invoice data | Accounting and tax | Legal obligation, Art. 6(1)(c) | 11 years, as accounting law requires |
| The recipient | Name; email address when the House delivers | Address and deliver the declaration | Legitimate interest, Art. 6(1)(f) | As for your request |
| You and the recipient | Your name and the recipient's initials in a Public entry | Publish the Register entry you chose | Contract for you; legitimate interest for the recipient | Until removed on request |
| You and the recipient | Records of messages sent and of address corrections | Proof of delivery and accountability | Legitimate interest, Art. 6(1)(f) | 2 years |
| Anyone using the form | IP address and email address, stored only as keyed hashes, with the time and outcome of each attempt | Prevent abuse of the form | Legitimate interest, Art. 6(1)(f) | 30 days, deleted automatically |
| Anyone using the serial search | IP address, stored only as a keyed hash, with the time and outcome of each search | Prevent abuse of the search | Legitimate interest, Art. 6(1)(f) | 30 days, deleted automatically |
| Anyone who writes to the House | Your emails | Answer you | Legitimate interest, Art. 6(1)(f) | 2 years |
| Visitors | Technical server logs of the hosting provider | Security and operation | Legitimate interest, Art. 6(1)(f) | Short-term, as set by the hosting provider |
| Everyone above | A nightly backup copy of the House's records | Restore the records after a technical fault | Legitimate interest, Art. 6(1)(f) | 30 days, then deleted |
| Anyone visiting the site | The page requested, the site that linked to it, campaign tags in the link and the type of device, read by the House's own server from each request and added to daily totals, without any cookie; nothing that identifies the visitor is kept | Know how the site is found and used | Legitimate interest, Art. 6(1)(f) | Not kept; only the daily totals remain |
| Visitors to the House's Facebook Page | Aggregate figures about visits to the Page (Page Insights), compiled by Meta | Present the House's work | Legitimate interest, Art. 6(1)(f); joint controllers with Meta | See “The House on Facebook” below |
Who else receives data
- Hostinger, which hosts the site and sends email on the House's behalf.
- MailChannels, the email relay Hostinger uses to deliver messages.
- Zagrebačka banka d.d., Zagreb, which processes your payment as its own controller.
- FIRA, the service used to issue fiscalised invoices.
- The recipient sees your name as the declarant. The public sees only what your disclosure choice allows.
Transfers outside the EU
Where a provider processes data outside the European Union, the transfer is protected by an adequacy decision or by standard contractual clauses in that provider's data processing terms.
Your rights
You may ask for access, correction, erasure or restriction of your data, object to processing, and receive your data in a portable form. Write to info@maisonproof.com. You may also complain to the Croatian Personal Data Protection Agency (AZOP).
If you are the recipient
The House received your name, and your email address when it delivers, from the person who made the declaration. You may ask at any time to have your details removed from the Register or not to be contacted again.
The House on Facebook
The House keeps a Page on Facebook, facebook.com/maisonproof, where it publishes its own posts. When you visit the Page or interact with it, Meta Platforms Ireland Limited processes your data as its own controller, under the Meta Privacy Policy (facebook.com/privacy/policy).
For Page Insights, the statistics Meta compiles about visits to the Page, the House and Meta are joint controllers under Article 26 GDPR, as the Court of Justice of the EU held in case C-210/16 (Wirtschaftsakademie). Their arrangement is the Page Insights Controller Addendum (facebook.com/legal/terms/page_controller_addendum): Meta takes primary responsibility for this processing and for answering requests about it. In Page Insights the House sees only aggregate figures. If you comment on or react to a post, your name and comment are visible to the House and to others, as Facebook shows them. The House's legal basis is its legitimate interest in presenting its work, Art. 6(1)(f).
You may exercise your rights with Meta or with the House; the House will pass on any request that concerns Meta. Publishing on the Page sends Meta no data about visitors to this site.
Cookies
The site sets one strictly necessary cookie, mp_sess, when you first use the request form or submit it. It keeps your session secure and is marked Secure, HttpOnly and SameSite=Strict. Register pages set no cookies. Fonts are served from maisonproof.com, so no third party receives your visit.
Changes
This notice was last updated on 17 October 2026.
Maison Proof is operated by MP-Dizajn, Croatia.
Return to the House