B2B website visitor identification in Croatia

It is workable under the GDPR and the Zakon o provedbi Opće uredbe o zaštiti podataka, so long as the output stays at company level and does not identify a person. The usual legal basis is legitimate interest under Art. 6(1)(f) GDPR, backed by a written balancing test weighing your commercial interest in recognising researching accounts against the visitor's reasonable expectations, and disclosed in your privacy policy. AZOP tends to act on complaints and published guidance rather than run broad proactive sweeps, so a compact but well-reasoned assessment usually matters more here than a lengthy compliance binder. lead.box operates as your processor under a signed Art. 28 agreement, but the final lawfulness call for your specific site remains yours as controller, and it is worth having your own legal advisor confirm the basis fits your setup, particularly if other tracking tools already run alongside it.

AZOP, the Agencija za zaštitu osobnih podataka, is Croatia's supervisory authority under the GDPR and the national implementation act, and it is a comparatively small body that acts primarily on complaints and issues sector guidance rather than running continuous large-scale audits of the kind seen in some larger member states. Its published opinions on legitimate interest and on video or website monitoring are a practical reference for how it applies the balancing test, and Croatian legal reviewers frequently cite them directly rather than working from GDPR text alone. Because AZOP's approach favours a clearly reasoned position over a thick paper trail, having a plain, specific explanation of what lead.box resolves and discards tends to satisfy a reviewer faster than a generic compliance statement, though your counsel should confirm this against your own risk tolerance and site setup.

Company-level identification through lead.box does not place advertising identifiers, device fingerprints or persistent tracking cookies, so on its own it falls outside the consent requirement in the Zakon o elektroničkim komunikacijama, Croatia's implementation of the ePrivacy Directive that governs storing or reading information on a visitor's device. Most Croatian B2B sites run other tools, such as analytics platforms or advertising pixels, that do trigger this requirement, and your existing banner configuration for those should not need to change just because lead.box is added. HAKOM, the national electronic communications regulator, is not typically the enforcement contact for cookie consent in practice, which sits with AZOP under the GDPR framework instead, but whether your specific implementation needs adjustment and how you document the snippet remains your own assessment as controller, ideally confirmed with legal advice familiar with current practice.

Data concerning EU visitors is processed in ISO-certified EU data centres and is not routed or stored outside the EU for this purpose, which matters to Croatian IT and legal teams that often ask this question first, before moving on to legal basis, given how compact these reviews tend to be. Retention is limited to what is needed to resolve and deliver company-level matches rather than kept indefinitely, and the versioned sub-processor list is published so it can be checked before approval rather than requested separately partway through negotiation. A signed data processing agreement under Art. 28 GDPR is available upfront, which tends to matter more to Croatian buyers than a long formal questionnaire, since review here is usually handled directly by a small legal or IT team rather than a dedicated procurement function with its own standard process.

There is no separate legal regime specifically for EU-co-funded projects, but a meaningful share of Croatian B2B activity, particularly in manufacturing modernisation and digital infrastructure, runs on EU programme funding, and the teams managing such projects are used to documentation-heavy reporting requirements that extend to vendor selection. They tend to ask precisely for evidence that a tool's processing fits within an already-approved data protection framework, rather than accepting a general assurance that everything is compliant, since that evidence often needs to be filed alongside the project's own reporting. lead.box's published processor agreement and sub-processor list are structured to make that kind of check straightforward, and it is worth confirming with your project's compliance officer exactly what form of evidence their specific funding body expects to see filed.

Croatian companies are identified for tax and invoicing purposes by their OIB (Osobni identifikacijski broj, personal identification number, which also applies to legal entities), and a subscription contract should reference the correct OIB together with the registered company name from the sudski registar, since Croatian finance teams generally will not process a supplier invoice with a mismatched OIB. For cross-border B2B services within the EU, VAT is typically handled through the reverse-charge mechanism rather than charged directly on the invoice, but your own finance or tax advisor should confirm the applicable treatment for your entity, since this can depend on registration status and how your business is structured. Getting the OIB and legal entity name correct at contracting stage avoids the invoice-matching delays that Croatian accounting teams commonly flag during procurement.

Company-level identification resolves a website visit to the organisation behind it, typically through IP-to-company matching combined with first-party signals collected on your own site, and it deliberately stops before identifying, profiling or contacting the individual browsing, which is the distinction a Croatian reviewer will focus on given how AZOP's guidance treats personal-level monitoring versus aggregate business signals. No name, email address or individual browsing history tied to a specific person is produced or retained as part of the process; the result is a company name with firmographic context for your sales team to act on, not a personal profile of the visitor. This is also the reasoning behind treating legitimate interest under Art. 6(1)(f) GDPR as a workable basis here, though your own data protection officer or counsel should confirm this fits your specific configuration and any other data sources you combine it with.

Timelines vary, but because Croatian vendor review is typically handled directly by a compact in-house legal or IT team rather than a dedicated procurement department, having documentation ready upfront tends to matter more than in larger markets with formal multi-step approval chains. Supplying the Art. 28 data processing agreement, the sub-processor list and a plain-language description of the mechanism before the first call removes several rounds of clarifying questions that otherwise stretch a review out over weeks. Since AZOP's own guidance favours a clearly reasoned position over volume of paperwork, being able to state precisely what is resolved to a company, what is discarded, and where your own responsibility as controller begins is usually the single factor that most shortens approval for Croatian teams evaluating lead.box against their internal criteria.