Website privacy policy
Last updated: 1 October 2026.
1. Scope
This policy covers the mojausluga.hr website. The MojaUsluga Android app has a separate app privacy policy.
2. Website data, cookies and advertising
We process limited technical information to keep the website secure and reliable. With analytics consent, we also measure visits using first-party analytics and Google Analytics. This may include the page opened, search terms entered on the website, date and time, referring site, general device type and random session or browser identifiers.
With analytics consent, Google Analytics may derive an approximate location (country, region, city) from the IP address and record the browser, operating system, device model and screen resolution. If you also allow ads personalization, Google signals may link visits to a Google account you are signed in to, and we then see aggregated reports on visitors' age, gender and interests, never data about an individual person.
Google AdSense serves ads on the website. Consent settings determine whether Google may use storage for advertising measurement or personalized ads. The Google tag may load with storage denied before a choice is made, but analytics cookies and visit-measurement events are enabled only when analytics consent allows them.
mu_sid
Keeps one consented first-party analytics session together.
First-party HttpOnly cookie, 30 minutes, renewed during an active session. Used after analytics consent.
mu_vid
Recognizes a returning browser in first-party analytics.
First-party HttpOnly cookie, up to 365 days. Used after analytics consent.
_ga and _ga_<ID>
Distinguish browsers and retain Google Analytics session state.
Google Analytics first-party cookies, up to two years. Used after analytics consent.
mu_phone_votes
Remembers a submitted phone-number vote so the same browser does not vote repeatedly.
Local browser storage, up to 5 years. Used after the visitor submits a vote.
Google consent and advertising identifiers
Remember privacy choices and, if allowed, support advertising measurement or personalization.
Google and its authorized partners use identifiers whose names and durations may vary according to the consent choice and Google's rules.
Google maintains more information about its cookies and how it uses information from partner websites. Cookie choices can be changed at any time through Cookie settings in the footer.
3. Messages and directory data
When you contact us, report incorrect directory information or vote on a displayed phone number, we use the details you choose to send to deal with the request. These actions are optional. Without the information needed to identify the request, reply to you or verify a correction, we may be unable to complete it. We also process limited technical information to prevent misuse.
The public directory may contain a professional name and title, specialty, workplace or organization, business address and contact details, opening hours, services, public ratings and other information relevant to finding healthcare services. It comes from official and public records, practice websites, professional directories, publicly available business information and submitted corrections.
Distances and nearby results use your location only when you choose it, by tapping a button and allowing location access in your browser, or by entering a place. The location is sent to our server only to calculate distances and results. Your browser saves it on your device and reuses it for up to 30 minutes, so you are not asked again.
Our legitimate interest is to provide an accurate and useful public healthcare directory. Practices and other affected people may ask us to correct, add to or remove information. We verify requested changes against reliable sources.
4. Legal bases and controller
| Purpose | Legal basis |
|---|---|
| Operate and secure the website, keep the service available and prevent misuse | Our legitimate interests in operating and protecting the service (Article 6(1)(f) GDPR) |
| First-party analytics, Google Analytics, Google Signals and personalized website advertising | Consent (Article 6(1)(a)) |
| Answer messages, investigate reports, process phone-number votes and maintain directory accuracy | Our legitimate interests in responding, supporting users and maintaining an accurate directory (Article 6(1)(f)) |
| Meet legal obligations and establish, exercise or defend legal claims | Legal obligation and applicable legitimate interests (Article 6(1)(c) and (f)) |
The data controller is VIRTO, obrt za informatičke i digitalne usluge, owned by Tomislav Vorih, Podgora Krapinska 94, Krapina, Croatia, OIB 91404144561. Privacy and support requests can be sent to info@mojausluga.hr.
5. Service providers and transfers
Cloudflare helps with DNS, network delivery, HTTPS termination, security and network analytics. netcup provides the European Union origin server and website application database. Google provides website consent management, analytics, advertising and support email. The Virto support system, operated by the controller on netcup infrastructure, handles user requests.
Cloudflare uses a global network, and Cloudflare or Google may process data outside the European Economic Area, including in the United States. Depending on the provider and service, transfers rely on an applicable adequacy decision, including the EU-US Data Privacy Framework for participating organizations, or European Commission standard contractual clauses and related safeguards. You may request information or a copy of the applicable safeguard at info@mojausluga.hr.
We do not sell personal or health-related data.
6. Retention and deletion
- Raw first-party website analytics is kept for up to 25 months.
- Phone-number votes are kept for up to 5 years.
- Support messages and directory corrections are kept for up to 3 years after the request is resolved or closed, unless longer retention is required by law or for a legal claim.
- Application and server logs are kept for up to 90 days.
- Website Google Analytics user-level and event-level data is kept for up to 14 months.
7. Your rights and contact
Under data protection law, you may have the right to access, correct, delete, restrict or receive your data, object to processing, withdraw consent and complain to a supervisory authority. Send requests to info@mojausluga.hr.
The Croatian supervisory authority is the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr.
8. Security and changes
Data sent between the website and our services is protected in transit. We restrict access to systems and data and review our software and security controls regularly. No online service is completely secure.
We update this policy when our services or legal obligations change.