Privacy notice

Updated: 16 October 2026

1. Who is responsible for your data

The controller of personal data collected through this website (amber-sm.com) is:

• Company: Amber IT Solutions d.o.o.
• Registered office: Poljička cesta 26A, 21000 Split, Croatia
• OIB (tax number): 60960247160
• E-mail: finances@amber-it.co

We have not appointed a data protection officer, as the law does not require one for us. For anything about your data, write to finances@amber-it.co.

This notice covers the website. In the Amber School Manager application, each school is the controller of its students’, parents’ and staff’s data, and Amber IT Solutions processes that data on the school’s behalf under a data processing agreement (GDPR art. 28). Questions about data held by a school should go to that school.

2. What we collect, why, on what basis and for how long

Visiting the website

When you open a page, the hosting service automatically processes technical data: IP address, browser and device type, the page requested and the time. We need this to deliver the page and to protect the site from abuse.

• Legal basis: our legitimate interest in running a secure website (GDPR art. 6(1)(f)).
• Kept: in the hosting provider’s logs for a short time (days), then deleted.

Visit counts without cookies

Vercel Web Analytics counts page views, referring sites, country and device type without cookies and without identifying you; the data is aggregated.

• Legal basis: legitimate interest in knowing which pages are useful (art. 6(1)(f)).

Demo requests and contact messages

When you fill in a form we receive what you enter: name, e-mail, and, if you choose to give them, phone, school, country, role, school size, the system you use and your message, together with the page you sent it from and, if you allowed statistics cookies, where you came from (for example a campaign link).

• Purpose: to answer you, to arrange and hold a demo and to prepare an offer.
• Legal basis: steps taken at your request before entering into a contract (art. 6(1)(b)) and our legitimate interest in answering enquiries (art. 6(1)(f)).
• Kept: as long as the conversation is relevant and at most two years after our last contact, unless your school becomes a customer, in which case the contract and accounting rules apply.
• Giving the data is voluntary, but without a name and e-mail we cannot reply.

The chat assistant

Your questions are sent to Anthropic (the provider of the Claude AI model) to produce an answer from our product knowledge base. We do not store the conversation on our server; it is kept only in your browser tab until you close it. Anthropic processes the questions as our processor and, under its commercial terms, does not use them to train its models; it may keep them for a limited time to prevent abuse. Please do not enter personal data in the chat. Answers are generated automatically and may contain mistakes; nothing in them is binding.

• Legal basis: our legitimate interest in answering visitors’ questions about our product (art. 6(1)(f)).

Statistics and marketing cookies

Only if you agree in the cookie notice: Google Analytics (through Google Tag Manager) to count visits and clicks, and measuring our advertising on Google and other networks. See the cookie notice.

• Legal basis: your consent (art. 6(1)(a) GDPR and art. 43(4) of the Croatian Electronic Communications Act). You can withdraw it at any time under "Cookie settings" at the bottom of every page; this does not affect processing before the withdrawal.

We do not make decisions about you based solely on automated processing, and we do not sell personal data.

3. Who else receives the data

We use carefully chosen service providers (processors) who act only on our instructions:

• Vercel Inc. (USA): hosting of the website and visit counts.
• Twilio Inc. (SendGrid) (USA): delivery of form messages by e-mail.
• Anthropic PBC (USA): answers of the chat assistant.
• Google Ireland Ltd. / Google LLC: statistics and advertising measurement, only with your consent.
• Google Workspace e-mail of Amber IT Solutions, where your message is received.

Some of these providers are in the United States. Transfers are based on the European Commission’s adequacy decision for the EU–U.S. Data Privacy Framework where the provider is certified, and otherwise on the Commission’s standard contractual clauses (GDPR art. 45 and 46).

4. Your rights

You have the right to access your data, to have it corrected or erased, to restrict its processing, to data portability, and to object to processing based on legitimate interest (GDPR art. 15–21). Where processing is based on consent, you may withdraw it at any time. Write to finances@amber-it.co; we answer within one month.

You also have the right to lodge a complaint with the supervisory authority: Agencija za zaštitu osobnih podataka (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr.

5. Security

The site is served only over an encrypted connection (HTTPS). Form messages are not stored on the website’s server; they are delivered by e-mail. Access to our mailboxes and systems is limited to the people who need it.

6. Changes

We update this notice when our processing changes. The date of the last change is at the top of the page.