Privacy Policy

01In brief

We process data about you only as far as necessary for you to read, comment and receive the notifications you have chosen to enable. We do not sell it. The text of comments is processed by artificial intelligence systems. Analytics and advertising cookies are set only with your consent.

• Reading requires no data about you; we count only aggregate page views.
• Commenting requires an account (Google, Facebook or a code sent by email) and that you are at least 16 years of age.
• Artificial intelligence checks comments and writes the replies of computer-generated participants in discussions — see section 06.
• The newsletter and device notifications are sent only with your consent, which you can withdraw with a single click.
• Retention periods are enforced automatically, every day — see section 16.

02Data controller

Data controller

News Bar Empire d.o.o.

Registered office

Zagreb

OIB

72949071646

Email

desk@newsbar.hr

Data subject requests

privatnost@mail.newsbar.hr

Telephone

+385 91 555 4268

(1) We are not required to appoint a data protection officer; requests are received and handled by the management board.

(2) This policy applies to the newsbar.hr portal, its English version, the app installed on a device from the portal and our social media profiles. It does not apply to third-party websites to which we link.

(3) Processing is based on Regulation (EU) 2016/679 (General Data Protection Regulation) and the Act on the Implementation of the General Data Protection Regulation (Zakon o provedbi Opće uredbe o zaštiti podataka); for cookies and browser storage, on the Electronic Communications Act (Zakon o elektroničkim komunikacijama).

03When you read

(1) Technical log. The server records the IP address, the time of the request, the page address and browser data. To protect against overload and attacks, the number of requests is limited per IP address and per technical connection fingerprint (Vercel Firewall).

(2) Readership counting. Our own counter stores only daily totals per page, traffic source (direct, search engine, social network) and device type — without the IP address, browser or any identifier. New and returning readers are distinguished only with consent to analytics (section 13).

(3) Live reader count. The browser tab is assigned a random tag which reports to the server every 30 seconds together with the page address; the record is deleted six minutes after the page is closed and is not linked to anything else.

(4) The portal language is chosen on the basis of your browser language and the country from which you access the portal; the country is determined from the IP address by our server provider (Vercel), and we do not store it.

(5) Photographs are delivered from our storage at Cloudflare (slike.newsbar.hr), so your browser contacts Cloudflare when loading the page. YouTube videos load only when you click, in the youtube-nocookie version; the thumbnail shown before the click is delivered by our server.

(6) Legal basis: legitimate interest (operation, security and measurement of the portal).

04When you register

(1) You can sign in with a Google or Facebook account or with a one-time code we send to your email address. There are no passwords and we do not store any.

(2) From Google or Facebook we obtain the unique account identifier, the first name and surname as they appear on that account and the email address (Facebook is not required to pass it on); when signing in with a code, only the email address. We do not obtain friend lists, posts, photographs or other data from those accounts. The sign-in provider learns that you have signed in to newsbar.hr; its own policies apply to this (Google, Meta).

(3) You choose your display name yourself; it may be changed no more than once every 30 days, and previous names are retained for as long as the account exists. When you first choose a name, you confirm that you are at least 16 years of age.

(4) We record the IP address at registration and at the most recent sign-in and, while you are signed in, a hash of the sign-in token, the browser and the IP address for each signed-in session. For email codes we record the address, a hash of the code, the number of attempts and the IP address.

(5) Before sending a code and before newsletter sign-up, we verify that you are not a bot (Cloudflare Turnstile). We do not accept registrations from addresses at certain domains, in particular disposable email services.

(6) Legal basis: performance of a contract (user account) and legitimate interest (security and prevention of abuse).

05When you comment

(1) We process the content of the comment, the time of posting, the IP address and browser data; earlier versions of an edited comment; and removals and measures (warning, muting, suspension, account termination) together with the reasons given.

(2) Comments are public and visible to everyone. Sensitive data (concerning health, religion, political opinions and the like) that you yourself publish in a comment are removed if there is no legitimate purpose for them.

(3) A removed comment, including one you have deleted yourself, disappears from the portal, but the original text is retained for evidential purposes for the period set out in section 16.

(4) Legal basis: performance of a contract (publication) and legitimate interest (order and security of discussion, evidence).

06Artificial intelligence and automated decisions

(1) Comment checks. Every comment, before or after publication, is checked by an artificial intelligence system. We send the processors Anthropic and Google the text of the comment, your display name and the title and section of the article. As examples for future checks, we also send the system the text of earlier comments for which the editorial board corrected the automated assessment.

(2) Computer-generated discussion participants. When a computer-generated participant replies to your comment, we send the same processors the text of your comment, your display name, the text of the discussion and the text of the article. The published reply may mention you by name, of which you are notified on the portal and, if you have enabled them, on your device.

(3) The processors process the data solely on our instructions and are contractually prohibited from using it to train their models. We do not send your email address, IP address or other account data to artificial intelligence systems.

(4) Automated decisions. A comment that the system assesses as contrary to the Commenting Rules may be automatically removed or withheld from publication; a comment assessed as uncertain, on which the editorial board does not decide within 24 hours, is removed pending review. Measures against accounts are taken exclusively by the editorial board. You have the right to human review of any decision, by means of a complaint under section 08.

(5) Legal basis: legitimate interest (moderation of discussion and the portal's satirical content).

07Votes and polls

(1) Comment votes. Only the total is shown publicly. If you are signed in, we record your display name with a ‘like’ vote, and that name is visible to the author of the comment in their notifications; nobody else can see it. If you are not signed in or have enabled anonymous voting in your account settings, you are shown to the author as ‘Anonymous’. The link between name and vote is retained for the period set out in section 16, after which only the total remains.

(2) Poll votes. We do not record who voted how. To prevent multiple voting, we store with each vote, for 90 days, a pseudonymous hash of the IP address and browser, from which neither can be directly read.

(3) Legal basis: performance of a contract (discussion features) and legitimate interest (reliability of results).

08Reporting content and complaints

(1) Reporting a comment using the REPORT button is anonymous: we record only the comment and the rule selected, without any data about the person making the report.

(2) For reports and complaints sent to desk@newsbar.hr, we process the address, the content of the message and the decision on it. A complaint against a decision concerning a comment or an account must be lodged within six months and is decided by the editorial board, not by a machine (Terms of Use and Commenting Rules).

(3) Legal basis: legal obligation (Digital Services Act) and legitimate interest.

09Newsletter

(1) We process your email address, the editions you have selected, the language and place of subscription, and proof of consent: the verbatim text you agreed to, the time and the IP address. The subscription takes effect immediately, with a welcome message.

(2) Every message contains a one-click unsubscribe link. For each message sent, we record whether it was delivered and opened and whether a link was clicked, for measurement and list hygiene purposes. Messages are sent by Resend as our processor.

(3) Addresses taken over from the earlier subscriber list will not receive the newsletter until they give consent again.

(4) The newsletter is separate from the user account: deleting your account does not end your subscription, and unsubscribing from the newsletter does not delete your account.

(5) Legal basis: consent, which you withdraw by unsubscribing.

10Push notifications

(1) When you click, your browser or app requests permission and opens a delivery address with its push service (Apple, Google or Mozilla). We store that address together with the message encryption keys, language, device type, whether NewsBar® has been added to the home screen, the types of notifications you have enabled and, if you are logged in, the link to your account. We do not store your name, email address or IP address with it.

(2) Each notification travels encrypted through your device's push service. For each notification we count, in aggregate, how many were delivered, opened or dismissed, with no link to any individual device.

(3) Legal basis: consent, which you withdraw by turning off notifications on the portal or in your device settings; the delivery address and keys are then deleted immediately.

11When you write to us

We process your address and the content of your message in order to reply and keep records. Legal basis: legitimate interest.

12Social media

When you comment on our Facebook and Instagram profiles, we see and moderate your name and comment, but we do not store them. Processing on the networks themselves is governed by the policies of Meta, with which we are joint controllers in respect of page statistics.

13Cookies and browser storage

(1) Cookies are small files that the portal stores in your browser; local storage works in a similar way but is not sent to the server. We divide them into necessary, analytics and advertising.

Necessary and functional

Without them the portal does not work or does not remember a choice you have made yourself; they do not require consent (Article 100 of the Electronic Communications Act (Zakon o elektroničkim komunikacijama)).

In addition, while the tab is open, the browser keeps temporary records that are deleted when it is closed: whether the page has already been counted, a random identifier for the live reader count, an unfinished comment while you are signing in, and your position on the page when the language is changed. If you add NewsBar® to your home screen as an app, the browser also keeps the permanent parts of the portal (style, fonts, icons) and the page displayed when offline; news and data about you are not stored there.

Analytics

Only with consent.

Third-party measurement tools (e.g. Google Analytics) are not currently enabled. If they are enabled, they will be listed here and in the Cookie Settings before they are first set, and only with consent.

Advertising

Only with consent. They are set by our advertising partners in order to display advertisements, limit repetition and measure performance; some partners tailor advertisements to your interests (profiling). A list of partners and their cookies is available in the Cookie Settings.

Consent

On your first visit we ask for your consent to analytics and advertising cookies: “Accept and close” accepts both categories, while “Learn more” opens the settings in which you can enable or disable each category, or reject all. We record your consent for 12 months, after which we ask for it again. You may withdraw it at any time, as easily as you gave it, via the “Cookie Settings” link in the footer of every page; on withdrawal, analytics cookies are deleted. If you reject them, the portal works in the same way, only without personalised advertisements.

14Advertising

(1) The portal is funded by advertising. We display our own advertisements (for example an invitation to subscribe to the newsletter) ourselves, without partner cookies, and count only aggregate impressions and clicks.

(2) Partner advertisements are displayed by Google Ad Manager, which is loaded in your browser only if you have given consent to advertising cookies. With the ad request we send the language, page type, topic and article address in order to display a suitable advertisement — not data about you.

(3) We provide advertisers only with aggregate metrics (for example “the advertisement was seen by 500 readers”). Sponsored content is labelled as EPP. We do not sell your data.

15Data processors and data transfers

(1) Data processors are contractually bound by our instructions:

(2) We record cookie consent ourselves, without an external processor. Transfers outside the European Economic Area are based on the EU–US Data Privacy Framework for certified providers and otherwise on standard contractual clauses. We review our processors at least once a year.

(3) We disclose data to public authorities only on the basis of a lawful order; we will inform you of this unless notification is prohibited.

16Retention periods

Retention periods are applied automatically once a day.

17Your rights

(1) You have the right of access and to a copy, the right to rectification, erasure, restriction of processing and data portability, the right to object to processing based on legitimate interest, the right to withdraw consent without affecting the lawfulness of processing carried out before withdrawal, and the right not to be subject to a decision based solely on automated processing.

(2) You can delete your account yourself in the account settings; you can view your comments on the account page. Other requests, including a copy of your data in a machine-readable format, should be sent to privatnost@mail.newsbar.hr from the address associated with your account, for reliable identification. We respond within 30 days at the latest and will notify you if an extension is necessary.

(3) You may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP) (azop.hr).

18Children

Commenting and user accounts are not intended for persons under the age of 16 (Article 19 of the Act on the Implementation of the General Data Protection Regulation (Zakon o provedbi Opće uredbe o zaštiti podataka)). If we learn that an account has been opened by a younger person, we delete the account and the data.

19People in photographs

Photographs on the portal are created with the help of artificial intelligence or by photomontage. Politicians and other public figures are deliberately depicted in a recognisable manner, in a fictional satirical context; such processing is carried out under the exemption for journalistic, artistic and literary expression in Article 85 of the General Data Protection Regulation (GDPR) (see the Terms of Use). We do not publish recognisable depictions of private individuals, and we do not process biometric data.

20Security

Only the editorial board has access to the data, subject to login and a record of who entered, modified or removed what; data are transmitted in encrypted form; backups are stored encrypted and separately. In the event of a data breach that could put your rights at risk, we will notify you and the Croatian Personal Data Protection Agency within the statutory time limit.

21Changes

The date of the last change is shown in the header. We announce material changes by means of a notice on the portal and, for registered users, also by a message to the account address.