Privacy policy
Effective Date: 17.3.2023. | Last updated: 11.9.2026.
This Privacy Policy applies to our Website available at https://www.tabu.hr (hereinafter: Website), where we, the company Transparentići d.o.o., headquartered in Zagreb, Ulica Filipa Vukasovića 1, OIB: 99456386807 ("Transparentići," "we," or "our," as applicable), process certain Personal Data when you use specific functionalities of our Website. This Privacy Policy also applies to our web application available at https://app.tabu.hr (hereinafter: Application) and to the Tabu application for business users available at https://business.tabu.hr (hereinafter: Business Application).
Transparentići informs you, in accordance with Articles 12, 13, and 14 of Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016 on the protection of individuals concerning the processing of Personal Data and on the free movement of such data, repealing Directive 95/46/EC (hereinafter: "General Data Protection Regulation" or "GDPR"), about who the data controller is (the person responsible for processing Personal Data), who the data recipients are (persons to whom the data are forwarded under contract and legal provisions), what Personal Data we process, for what purposes, and how long we retain the data.
Transparentići acts as the data controller within the meaning of the GDPR, and this Privacy Policy provides insight into our practices regarding the collection and processing of Personal Data and outlines the terms of using our Website.
Please read this Privacy Policy carefully as it contains important information about why and how we process the Personal Data you provide to us or that we collect in connection with your use of our Website (hereinafter: Personal Data).
"Personal Data" is any data relating to an identified or identifiable natural person ("data subject"). An identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
"Data Subject" is any identified or identifiable natural person whose Personal Data are subject to processing by the data controller.
"Processing" is any operation or set of operations performed on Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction.
"Data Controller" is a natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data.
"Data Processor" is a natural or legal person, public authority, agency, or other body which processes Personal Data on behalf of the data controller.
"Recipient" is a natural or legal person, public authority, agency, or another body to which the Personal Data are disclosed, whether a third party or not. However, public authorities which may receive Personal Data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing.
"Consent" of the data subject is any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of Personal Data relating to them.
"Personal Data Breach" is a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed.
"Supervisory Authority" is an independent public authority established by a Member State pursuant to Article 51 of the GDPR (in the Republic of Croatia: the Croatian Personal Data Protection Agency).
Transparentići collects and processes certain Personal Data about you, namely information that can directly or indirectly identify you, especially through identifiers (hereinafter: "Personal Data"), in the following cases:
We do not collect Personal Data unless you provide it voluntarily, except for certain Personal Data collected through information systems and programs used for the operation of our Website, whose transmission is necessary for the use of Internet communication protocols and will not require more information than necessary to execute a specific activity.
If you do not wish to provide us with Personal Data (except for Personal Data related to the use of Internet communication protocols, which are usually collected when visiting the Website), you can still access our Website, but you may not be able to use certain functionalities of our Website.
Transparentići processes Personal Data of users who contact us via our contact form or email, where the Personal Data may relate to names, surnames, email addresses, and contact phone numbers of users.
We process these Personal Data only during communication with the user who contacted us and retain them for as long as necessary to resolve the user's inquiry.
Personal Data collected when you contact us via the contact form or email are accessible only to authorized persons within our company, bound by a confidentiality statement, for the purpose of responding and resolving your request.
Transparentići processes Personal Data of candidates applying for our job advertisements and retains them until the job competition is completed. After the job competition is completed, we retain candidates' Personal Data until the end of the competition, unless candidates consent to remain in our database, in which case we retain such data for up to 2 (two) years after the application.
Transparentići collects open applications from candidates who wish to work with us. Candidates' Personal Data are retained for up to 2 (two) years from the date of receiving the open application, so we can contact certain candidates if needed.
Personal Data of job candidates and open applications are accessible only to authorized persons within our company, bound by a confidentiality statement, who process and analyze applications for the purpose of contacting candidates and potential employment.
Transparentići has access to Personal Data about its contacts on social networks, such as names, surnames, employer company, likes, comments, connection requests, messages, and memberships in specific groups.
Transparentići uses social networks to respond to possible inquiries from connected persons and to inform social network members about news in its work.
Personal Data collected via our social networks are accessible only to authorized persons within our company, bound by a confidentiality statement, who manage our social networks.
Transparentići conducts marketing activities, such as sending newsletters, promotional messages, and notifications about our services and products.
Such activities are carried out when there is explicit consent from the user for such types of activities, and such consent can be withdrawn at any time by unsubscribing by clicking on the link at the bottom of each newsletter or by sending an email to our email address listed in section 14 of this Policy.
As part of these marketing activities, the Company measures the delivery and opening of sent email messages. For this purpose, messages may contain an invisible image (a so-called pixel) which, when the message is opened, allows the Company to determine whether and when the message was delivered and opened. This information is used solely to improve the content and frequency of our communication and to identify users who no longer open our messages. This measurement is carried out on the basis of the same consent under which marketing messages are sent, and consent can be withdrawn in the same manner - by unsubscribing via the link at the bottom of each message or by sending an email to our email address. For sending email messages, the Company uses an external service provider (Brevo), which processes the aforementioned data on behalf of the Company as a data processor.
Clients of Transparentići are persons with whom we have entered into appropriate agreements and contracts for the provision of services (hereinafter: "Clients"). The contractual relationship with Clients is governed by appropriate agreements on Personal Data processing and the Personal Data Processing Policy, which further specify our rights and obligations regarding the contractual relationship and Personal Data processing.
To make visiting our Website as pleasant, functional, and convenient as possible, our Website stores a certain amount of information on your computer, known as “cookies.” When you first visit our Website, a form will appear where you can agree to the use of cookies and, if so, which ones. If you do not accept cookies, you will still be able to browse the Website, but some options and functionalities of our Website may not be available to you.
A cookie is a piece of information stored on your computer, mobile device, or tablet, which may be delivered directly by the website you visit (first-party cookies) or in cooperation and for the needs of the website from a third party (third-party cookies). Cookies generally store your settings, website settings, and the like. When you open the Website again, your Internet browser sends back the cookies that belong to this Website. This allows the Website to display information tailored to your needs. Cookies can have a wide range of information, including Personal Data. Such Personal Data can be stored only if you allow it. The Website cannot access information that you have not provided, nor can it access any other file on your computer.
To measure traffic on our website and app we also use Plausible Analytics, a tool that sets no cookies and collects no personal data. Plausible processes data only in aggregate, anonymous form (for example the number of visits, pages viewed and traffic source) and does not track you across other websites. Because it uses no cookies or other identifiers stored on your device, no consent is required for its use. Data is processed within the European Union.
Cookies are used for the purpose of:
Cookies can be categorized by their source as:
Cookies can be categorized by their duration as:
Cookies used by Transparentići
FIRST CATEGORY – NECESSARY COOKIES
Necessary cookies are essential for the proper functioning of the website, improving user experience, and collecting data about website usage without identifying the visitor. This includes cookie acceptance status, privacy settings, login, form filling, and notification statuses on our website. Without these cookies, we cannot guarantee the best user experience, and some parts of the website may not work correctly.
SECOND CATEGORY – PERFORMANCE COOKIES
We currently do not use any performance cookies. We measure website and app traffic with Plausible Analytics, a tool that sets no cookies and collects no personal data.
THIRD CATEGORY – MARKETING COOKIES
We use Facebook pixel and LinkedIn Insight Tag cookies for marketing purposes. These cookies are not necessary; you do not have to accept them and can disable them at any time.
The Facebook pixel is an analytical tool used by Facebook to measure the effectiveness of our ads for statistical and marketing purposes and to optimize ads for the future. The collected data does not contain personal data but anonymous data, meaning we cannot link the collected data to a specific person. However, Facebook itself stores and processes personal data, so your Facebook profile may be used by Facebook for its own advertising purposes following Facebook's data policy (https://www.facebook.com/about/privacy/). You can allow Facebook and its partners to place ads on and off Facebook. A cookie may also be stored on your computer for these purposes.
LinkedIn Insight Tag is a tracking technology used by LinkedIn to show LinkedIn users more relevant ads based on their interests. Based on this cookie, we receive aggregated and anonymous reports from LinkedIn about advertising activities and information on how you interact with our website. The data obtained through the cookie is used to collect anonymous statistics and the previously mentioned reports and to display ads based on your interests. More information on LinkedIn data protection can be found at https://www.linkedin.com/legal/privacy-policy.
Enabling and Disabling Cookies
Cookies that are not strictly necessary are activated only after visitor consent. If you visit our website for the first time, a notification will appear inviting you to consent to the use of cookies. If you give your consent, we will store a cookie on your computer, and this notification will not appear again until the cookie expires. After the cookie expires or if you actively delete it beforehand, the notification will reappear on your next visit, inviting you to consent again.
You can also accept or decline some or all cookies by adjusting your browser settings. Some browsers allow you to browse websites in "anonymous" mode, limiting the amount of data placed on your computer and automatically deleting persistent cookies when you end your browsing session. There are also many third-party applications that you can add to your browser to block or manage cookies. You can also delete cookies previously set in your browser by selecting the option to delete browsing history and including the option to delete cookies. More detailed information about cookies and adjusting browser settings can be found at www.allaboutcookies.org.
Cookie Retention Period
The lifespan of cookies we collect as the first party is up to 2 years, while the lifespan of third-party cookies is determined by third-party policies. The retention period for third-party cookies can be checked for each third party individually, and we have no influence on their duration.
Website users can easily compare their salaries with other workers employed in the same position with other employers by filling out a short online form.
To prevent false data entries, multiple entries, and misrepresentation of average salaries for specific positions, and to verify the accuracy of the entered data, website users must enter their email address when filling out the online salary comparison form.
Since the email address can be considered personal data under the General Data Protection Regulation (GDPR), it is necessary to obtain the user's consent before submitting their email address for processing personal data.
Only authorized persons within our company, bound by a confidentiality statement, have access to these personal data, verify the accuracy of the entered data, and prevent multiple entries via the online form.
The Application allows users who have entered their data via the online form referred to in section 3.7 to view a comparison of their salary with market data. Only a person who is already our user can sign in to the Application; the Application does not create new users.
You sign in to the Application with your Google account, in which case we process the following Personal Data from your Google account: your email address, name, and profile picture. You can also sign in with a one-time code sent to your email address, in which case we process only your email address. In addition, the Application stores data necessary for the operation of sign-in and sessions (authentication tokens and sign-in records) and an internal identifier linking your Application account to your existing data in our central database.
We process these Personal Data for the purpose of enabling you to sign in to the Application and access your data and results. All Application data is stored on servers within the European Union and is not transferred to third countries. Salary amounts are not permanently stored in the Application database; they are read from our central database at the time of display. A newly submitted online form response, including the salary amount, is temporarily retained in the Application until it is processed.
We retain the above data for as long as you are our user. You can request the deletion of your Application account at any time, which deletes all data referred to in this section, in accordance with section 6 of this Policy.
For the purpose of providing user support and verifying that data is displayed correctly, an authorized person within our company, bound by a confidentiality statement, may temporarily open the Application view as seen by an individual user (including salary, benefits, and profile data). Such access does not expand the scope of data we process - it concerns data we already process as the data controller in accordance with this Policy. Each such access is limited to a maximum of one hour, and we keep a record of who accessed the view and when. Support access is also possible for a user who has never signed in to the Application; in that case, a record containing their email address and internal identifier is created in the Application database, derived solely from data we already process, and is deleted in the same way as all other data referred to in this section.
To detect and remedy technical errors in our systems, we use the error monitoring tool Sentry. When an error occurs during processing, a technical record of that error is sent to Sentry - the type of error, the part of our program code in which it occurred, a label of the processing stage, the sequence number within the batch being processed, and the time it occurred. The system is deliberately configured so that no Personal Data is included in these records: the sending of values from the program's working memory (so-called local variables) is disabled, and before being sent each record is additionally cleaned automatically of data such as salary amounts, user identifiers, gender, city and job position. The data is processed on servers in the Federal Republic of Germany, within the European Union. A data processing agreement in accordance with Article 28 of the General Data Protection Regulation has been concluded with Sentry.
For users who have submitted their data through the online form referred to in section 3.7, we create personalised advice on what they could do regarding their salary. The advice is displayed in the Application alongside your results.
The advice is created for us by an external artificial intelligence service provider (OpenAI), which processes the data on behalf of the Company as a data processor. We send that provider the data from your submission needed for comparison - salary amount, job position and seniority level, years of work experience, education, technologies, gender, country and city, and employer type and size - together with an internal identifier that distinguishes your submission from others. We do not send your email address or your name. For the purpose of market comparison, we also make available to the provider the salary data of other users in the same form, without any identifier.
A data processing agreement in accordance with Article 28 of the General Data Protection Regulation has been concluded with the provider, and transfers outside the European Union are subject to the measures described in section 8 of this Policy. The data is not used to train the provider's models.
The Business Application allows the Clients referred to in section 3.5 to view aggregated market salary data and the reports we prepare on the basis of that data. Only a person whom the Client, as their employer, has added as a member of its organisation can sign in to the Business Application; the Business Application does not create new users.
You sign in to the Business Application with your Google or Microsoft account, in which case we process the following Personal Data from that account: your email address, name, and profile picture. You can also sign in with a one-time code sent to your email address, in which case we process only your email address. To send the code we use an external service provider (Brevo), which processes the email address on behalf of the Company as a data processor. In addition, the Business Application stores data necessary for the operation of sign-in and sessions (authentication tokens and sign-in records).
About you as a user, the Business Application stores your membership in your employer's organisation and your display preferences (selected filters, target percentile, language and display measure). A record of which filters are used is kept without any link to your account. To measure usage we use Plausible Analytics, described in section 3.6, which sets no cookies and collects no Personal Data.
The market data you view in the Business Application is owned by the Company, is aggregated and is displayed only for segments with at least five entries, so that no individual data subject can be identified from it. Data about the Client's employees that the Client enters into the Business Application is processed solely on behalf of and according to the instructions of the Client as the data controller, on the basis of the data processing agreement referred to in section 3.5; with respect to that data, the Company is the data processor.
We process the Personal Data referred to in this section for the purpose of enabling you to sign in to the Business Application and providing the contracted service to the Client. All Business Application data is stored on servers in the Federal Republic of Germany, within the European Union, and is not transferred to third countries. To detect and remedy technical errors we use the tool Sentry, on servers within the European Union and with the same measures for excluding Personal Data from error records as described in section 3.8.
For the purpose of providing support and verifying that data is displayed correctly, an authorized person within our company, bound by a confidentiality statement, may temporarily open the Business Application view as seen by an individual user. Such access does not expand the scope of data we process. Each such access is limited to a maximum of one hour, and we keep a record of who accessed the view and when.
We retain the above data for as long as your membership in the Client's organisation lasts, or for as long as the agreement with the Client is in force. You can request the deletion of your data at any time in accordance with section 6 of this Policy.
When you provide your personal data, we will limit the processing to the purpose for which it was collected, following the terms of these Rules. Processing your personal data includes:
Providing personal data for the above purposes from 1 to 2 is voluntary, but any refusal to provide such data may prevent Transparentići from entering into a contract with you, responding to your requests, providing services, receiving and processing your application, and complying with legal obligations to which the company is subject.
Providing personal data for the purposes described in point 4 is also voluntary. Refusal to provide such personal data or objection to data processing on relevant grounds related to your specific situation may prevent the company from conducting data analytics or communicating with you in certain situations. We may still contact you for administrative purposes, such as confirming an application or processing your further requests.
If you have given consent for a specific purpose, you may withdraw your consent at any time, and we will no longer process your personal data for that purpose.
Personal data must be:
Transparentići specifically commit to:
Every user of our website has the right to:
Your personal data may be disclosed, closely related to the above-mentioned purposes, to:
The central database of our systems, where the personal data we collect and process is stored, is located on servers within the European Union.
Certain Personal Data we collect may also be stored with providers of cloud storage and analytics services located outside the European Union, primarily in the United States. For such transfers, we ensure appropriate safeguards in accordance with Chapter V of the General Data Protection Regulation: the transfer is based on the Standard Contractual Clauses adopted by the European Commission and, in the case of providers established in the United States, additionally on the EU-U.S. Data Privacy Framework where the provider is certified under that framework. With providers of storage and analytics services, i.e. data processors, we conclude data processing agreements in accordance with Article 28 of the General Data Protection Regulation.
Transparentići will process your personal data only for the time necessary to achieve the purposes described under Article 4 of these Rules. After the purpose for which they were collected ceases, we no longer use your personal data, and they remain in our storage system and are kept for the duration required by legal regulations on the retention of archival material. After these periods expire, we delete personal data.
Our site may contain links to other websites that are not owned, operated, or maintained by Transparentići. When you leave our site, you should note and read the terms and privacy policies of each website you visit. You should also independently assess the authenticity of any website that appears or claims to be one of our sites (including those linked via e-mail).
Despite any links that may exist on our website, unless otherwise stated, we do not control, recommend, or endorse and are not associated with these websites or their content, products, services, or privacy policies. Downloading materials from certain websites may result in the violation of intellectual property rights or the introduction of viruses into your computer system.
Also, Transparentići has no influence on possible changes in the rules and terms of service use of cookies provided by third parties.
The security of your personal data is extremely important to us, so we have set up appropriate technical and organizational measures and physical, electronic, and managerial procedures to protect the data we collect. Due to the open nature of the Internet, we cannot guarantee that communication between you and us or information stored on our website or on our servers will be completely secure from unauthorized access by third parties.
Only authorized persons have access to personal data, are aware of their responsibilities, and are obliged to maintain the confidentiality of personal data and the privacy of all our users.
For this purpose, we regularly analyze and check the technical and organizational measures we use to always maintain the highest level of security and protection of personal data.
All matters relating to our site and these Rules are governed by Croatian law. You agree that in connection with proceedings relating to this site and these Rules, the exclusive and local jurisdiction of the courts in the Republic of Croatia shall apply.
We do not guarantee or imply that our content/materials on our site are suitable for use outside the Republic of Croatia.
If any provision of these Rules is null, void, or unenforceable, such provision shall not apply to the extent that it is null, void, or unenforceable, and this shall not affect the validity of the remaining provisions of these Rules.
Transparentići reserves the right to change or update these Rules at any time and without prior notice. Please check for any changes or updates to our Rules from time to time, which will be posted here and will show the updated effective date on the first page of the Rules if any changes or updates are made.
All rights not expressly provided for in this document will be governed by the General Terms of Transparentići or applicable Croatian legal regulations.
For any questions related to the Privacy Policy, as well as for exercising rights under the General Data Protection Regulation, you can contact us via our online form available at https://www.tabu.hr/contact or via email at info@tabu.hr.
Do you have questions related to the Tabu survey, your results or salary analysis? Fill out an anoymous contact form!
Contact us
.png)
.png)
