Privacy and personal data

Who is the controller

Controller: Javni trag Association (MOCK), OIB 00000000000, <mock> Ulica primjer 1, 10000 Zagreb.

Data-protection contact: privatnost@javni-trag.example. Corrections and objections: ispravci@javni-trag.example.

No data-protection officer is designated; requests go to the address above.

What we publish

The site shows how public money is planned, contracted and paid. We publish everything public bodies or officials have themselves officially published that can be traced to that source. Personal data appears in these cases:

• Recipients of public money (procurement contracts, contract registers, EU funds, grants): sole traders, family farms (OPG) and natural persons are named exactly as the public body published them, with amount, purpose and date. Where the source also prints their OIB, address, e-mail, phone or bank account, we reproduce those exactly as printed, linked to the source.
• Name search: the public search finds natural persons and sole traders by name. The project owner made this decision knowingly accepting the risk the EU Court of Justice described in Schecke (C-92/09): searchable publication of individuals’ names next to amounts intrudes more on privacy than a list alone.
• Public servants: name, job title, institution and office, as published on official institutional pages. A record means “listed on date X”, not proof of current employment.
• Curated cases: short summaries of audit findings, indictments and judgments with links to the source. An indictment is not a verdict; acquittals stay visible.
• Citizen air-quality sensor readings: no owner data, location rounded to about 100 m, indoor devices skipped.

Where the data comes from

From public publications: the Croatian public procurement portal (EOJN), public bodies’ contract registers, EU funding beneficiary lists (Kohesio, EU FTS), TED, official ministry and institution pages, State Audit Office reports, EPPO and USKOK press releases, court decisions, Sensor.Community and, for Portugal, Portal BASE. Every value links to the original publication.

Legal basis

Legitimate interest (GDPR Art. 6(1)(f)): public scrutiny of how public money is spent and how public bodies work.

The Croatian Right of Access to Information Act (ZPPI Art. 16(3), as amended in NN 69/2022) makes information on the disposal of public funds — personal name or business name, amount and purpose — available to the public without a proportionality test, unless classified. The implementing Instruction (Naputak, NN 59/2023) has legal persons, sole traders, family farms and natural persons receiving grants via public calls or supplying goods and services published by name, without the OIB of natural persons and of person-owned trades/farms, and other natural persons only in aggregate. We publish no more than the public bodies themselves published; if a body publishes more than the Instruction requires, we reproduce it as published.

The balancing of interests is documented in an internal legitimate-interest assessment. A legal review before public launch is still in progress.

ZPPI, NN 69/2022·Naputak, NN 59/2023·AZOP opinion on minors·GDPR

What we never publish

We do not do or publish the following, even where it is available elsewhere:

• data the source did not publish: we add nothing, do not enrich from other sources and do not infer;
• lists of welfare, scholarship or household recipients, health or client records, tax data;
• names of minors;
• linking the same person across sources, person profiles or rankings of people;
• face recognition, photographs of people, or sensor owners’ data.

Who sees the data

Published data is public and available to anyone without an account. A hosting provider processes it on the operator’s behalf in the EU under a processing agreement (GDPR Art. 28). We do not sell data or share it for advertising.

How long

A record stays published while the public body publishes it and while it is relevant to public scrutiny. When the source corrects or removes a record, or when we accept an objection, we correct or withdraw it. The exact retention periods (including private evidence copies and server logs) are published here by the operator before public launch.

Your rights

Send any request to privatnost@javni-trag.example. We answer without undue delay and within one month at the latest (GDPR Art. 12(3)).

• access: which data about you we show and where it comes from (Art. 15);
• rectification of inaccurate data (Art. 16);
• objection on grounds relating to your particular situation (Art. 21): we stop unless there are compelling legitimate grounds that override your interests, and we explain the decision;
• erasure where its conditions are met (Art. 17), for example when a record is no longer needed or an objection is upheld;
• restriction while we check accuracy or an objection (Art. 18).

Corrections, objections and right of reply

Complaint to the supervisory authority

You may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Ulica Metela Ožegovića 16, HR-10000 Zagreb.

azop.hr — contact

Using the site

No account is needed to read. There is no analytics, advertising or third-party script. One cookie (javni_trag_theme) remembers your colour theme; some display settings are stored only in your browser. The server-log retention period is set by the operator when hosting is chosen and stated here.

Changes

This notice was reviewed on 2026-10-18. Material changes are published on this page with a new date.