Manual

Last updated: October 7, 2025

1. INTRODUCTION

4 BY 4 (hereinafter: the "Association", "we" or "us") respects the privacy of its members and users of the manual.hr website (hereinafter: the "Portal").

This Privacy Policy describes how we collect, use, store and protect your personal data when you use our Portal, in accordance with:

the General Data Protection Regulation (GDPR – Regulation (EU) 2016/679)
the Act on the Implementation of the General Data Protection Regulation (Croatian Official Gazette 42/18)
the Electronic Communications Act (Croatian Official Gazette 73/08, 90/11, 133/12, 80/13, 71/14, 72/17)

By using the manual.hr Portal, you accept the practices described in this Privacy Policy.

2. DATA CONTROLLER

Name: 4 BY 4
Address: Ivana Zajca 24, 51000 Rijeka, Croatia
Registration number (OIB): 48269637725
Data protection contact person: Mirko Trkulja
Email: [email protected]
Phone: +385 91 720 0509

For any questions regarding the protection of your personal data, you may contact us via the contact details above.

3. WHAT PERSONAL DATA WE COLLECT

3.1. Data we collect directly from you

When you register on the Portal as a member or user, we collect the following personal data:

Basic data:

First and last name
Email address
Date of birth
OIB (for Croatian members)
ID card number or other identification number (for foreign members)
URL of profile photo

Note on encryption: The following personal data are stored in our database in encrypted form: first and last name, email address, OIB or ID card number, and profile photo URL. Encryption provides additional protection for your data even in the event of a database security breach.

Membership data:

Membership category (regular or user membership)
Date of joining the Association
Membership fee status
Membership fee payment history

Data for accessing the Portal:

Username or email address
Password (stored in encrypted form)

Transaction data:

Data on purchased tickets for events
Payment history
Data required for payment processing (handled by Stripe)

3.2. Data we collect automatically

Technical data:

IP address
Browser and device information
Time of access to the Portal
Pages visited on the Portal

Cookies:

Session cookie – necessary for the functioning of the Portal and for maintaining the logged-in state of the user

4. LEGAL BASIS AND PURPOSE OF DATA PROCESSING

We process your personal data on the basis of the following legal grounds:

4.1. Performance of a contract (Article 6(1)(b) GDPR)

We process your data in order to:

Provide access to the Portal and manage membership
Process your registration and maintain your user account
Enable the purchase of tickets for events and membership fees
Enable the invitation of new members
Provide information about events organized by the Association

4.2. Compliance with legal obligations (Article 6(1)(c) GDPR)

We process your data for the purpose of:

Maintaining the membership register in accordance with the Statute of the Association and the Act on Associations
Fulfilling accounting and tax obligations
Retaining financial documentation within statutory deadlines

4.3. Legitimate interests (Article 6(1)(f) GDPR)

We process your data for:

Internal statistical reporting on the Association's operations
Improving the user experience on the Portal
Protecting the security of the Portal and preventing misuse
Communicating with members of the Association

4.4. Consent (Article 6(1)(a) GDPR)

For sending newsletter messages to Association members, we will request your explicit consent. You may withdraw your consent at any time.

5. HOW WE USE YOUR PERSONAL DATA

We use your personal data for the following purposes:

5.1. Membership management

Processing membership applications
Maintaining the membership register in accordance with the Statute
Tracking membership fee status
Communication related to membership

5.2. Event organization

Informing members about upcoming events
Sale and distribution of tickets
Organizing concerts, listening sessions, festivals and other events

5.3. Financial operations

Processing membership fee payments
Processing ticket purchases
Issuing payment confirmations
Maintaining financial documentation

5.4. Communication

Sending transactional emails (registration confirmations, payment confirmations, event information)
Sending newsletters to members (with consent)
Responding to inquiries and providing customer support

5.5. Internal reporting

Preparing anonymized statistics on the Association's work
Reporting to the Association's bodies (Assembly, Executive Delegate)
Planning future activities

5.6. Security

Protecting the Portal from unauthorized access
Preventing misuse and fraudulent activities
Maintaining data integrity

6. SHARING DATA WITH THIRD PARTIES

6.1. Service providers

We share your personal data only with trusted service providers who assist us in our operations:

Stripe, Inc.

Purpose: Processing online payments (membership fees and tickets)
Data shared: Transaction data, email address
Legal basis: Performance of a contract
Location: USA (certified under the EU-US Data Privacy Framework)
Privacy Policy: https://stripe.com/privacy

Note on hosting: The manual.hr Portal is hosted on the Association's own server. We do not use an external hosting provider, so your data is not exposed to a third party for hosting purposes – all data is stored exclusively on infrastructure owned and controlled by the Association.

6.2. Legal obligations

We may disclose your personal data if required by law or if we believe in good faith that such action is necessary to:

Comply with a court order or legal request
Protect the rights, property or safety of the Association, our members or the public
Prevent fraud or unlawful activities

6.3. What we do NOT do

We do not sell your personal data to third parties
We do not share your data for marketing purposes
We do not use your data for profiling or automated decision-making
We do not transfer data outside the European Economic Area (except Stripe, which is certified)

7. HOW LONG WE KEEP YOUR DATA

We retain your personal data only for as long as necessary to fulfill the purposes described in this Policy:

Type of dataRetention periodActive members' data (digital, in database)For the duration of membershipFormer members' dataNot kept digitally – see note belowFinancial data (invoices, receipts)11 years (legal obligation)Membership registerPermanent (in accordance with the Statute)Transaction data7 years (accounting obligation)Technical logs12 monthsNewsletter consentsUntil consent is withdrawnUnaccepted invitations to new members6 months from sending

Note on former members: After termination of membership, your personal data is deleted from the Portal's digital database. In accordance with the legal obligation to maintain a membership register (Act on Associations, Statute of the Association), basic data on former members is kept exclusively in paper form, at the Association's registered seat(Ivana Zajca 24, Rijeka), with access restricted to authorized persons.

After the retention period expires, personal data is permanently deleted or anonymized.

8. SECURITY OF YOUR DATA

We apply appropriate technical and organizational measures to protect your personal data from unauthorized access, loss, misuse or disclosure:

8.1. Technical measures

SSL/TLS encryption: All data transmitted between your browser and the Portal is encrypted
Secure password storage: Passwords are stored using advanced hashing algorithms
Regular updates: The system and software are regularly updated with security patches
Attack protection: Measures are in place to protect against common security threats
Backup system: Regular data backups

8.2. Organizational measures

Access to data is limited to authorized persons who need it to perform their duties
Employees and associates sign confidentiality agreements
Regular training on data protection
Security protocols and procedures

8.3. Your responsibility

Keep your access credentials secure
Use strong passwords
Do not share your user account with others
Notify us immediately if you suspect unauthorized access to your account

9. YOUR RIGHTS

In accordance with the GDPR, you have the following rights regarding your personal data:

9.1. Right of access (Article 15 GDPR)

You have the right to request information about which personal data of yours we process and to obtain a copy of that data.

9.2. Right to rectification (Article 16 GDPR)

You have the right to request correction of inaccurate or completion of incomplete personal data.

9.3. Right to erasure – "right to be forgotten" (Article 17 GDPR)

You have the right to request the deletion of your personal data under certain circumstances, unless there are legal obligations requiring retention.

9.4. Right to restriction of processing (Article 18 GDPR)

You have the right to request restriction of the processing of your personal data in certain situations.

9.5. Right to data portability (Article 20 GDPR)

You have the right to receive your personal data in a structured, commonly used and machine-readable format and to transmit that data to another controller.

9.6. Right to object (Article 21 GDPR)

You have the right to object to the processing of your personal data that is based on legitimate interest.

9.7. Right to withdraw consent (Article 7(3) GDPR)

Where processing is based on consent (e.g., newsletter), you have the right to withdraw consent at any time.

9.8. How to exercise your rights

To exercise any of the above rights, please contact us via:

Email: [email protected]
Mail: 4 BY 4, Ivana Zajca 24, 51000 Rijeka, Croatia

We will respond to your request within 30 days.

9.9. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data violates the GDPR:

Croatian Personal Data Protection Agency (AZOP)
Address: Selska cesta 136, 10000 Zagreb, Croatia
Phone: +385 1 4609 000
Email: [email protected]
Web: https://azop.hr

10. COOKIES

10.1. What are cookies?

Cookies are small text files that are stored on your device when you visit a website. Cookies allow the website to "remember" your actions and preferences.

10.2. What cookies do we use?

The manual.hr Portal uses only necessary cookies required for the functioning of the Portal:

Cookie namePurposeDurationTypesession_idMaintaining the user's logged-in stateSession (deleted upon closing the browser)Necessary

10.3. Managing cookies

The session cookie is necessary for the functioning of the Portal, and you cannot disable it if you wish to use the Portal. Without this cookie, you would not be able to stay logged into your account.

You can set your browser to block all cookies, but this will disable the functioning of most websites, including manual.hr.

We do not use:

Analytics cookies
Marketing cookies
Third-party cookies (except Stripe during the payment process)

11. LINKS TO OTHER WEBSITES

The Portal may contain links to third-party websites (e.g., social networks, partners, sponsors). This Privacy Policy does not apply to those websites.

We are not responsible for the privacy practices of other websites. We recommend that you read the privacy policies of any websites you visit.

12. AGE RESTRICTIONS

The manual.hr Portal is intended for persons over 18 years of age.

We do not knowingly collect personal data from children under 18 years of age. If we discover that we have inadvertently collected data from a child under 18, we will delete that data immediately.

If you are a parent or guardian and believe that your child has provided us with personal data, please contact us.

13. INTERNATIONAL DATA TRANSFERS

Your personal data is stored on the Association's own server, located in the Republic of Croatia, within the European Union. We do not use external hosting providers.

The exception is payment processing through Stripe, whose servers are located in the United States. Stripe is certified under the EU-US Data Privacy Framework, ensuring an adequate level of data protection equivalent to EU standards.

For more information about Stripe's data protection measures, visit: https://stripe.com/privacy

14. CHANGES TO THE PRIVACY POLICY

We reserve the right to update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational or regulatory reasons.

We will notify you of any significant changes via:

Notice on the Portal
Email to your registered address
Newsletter (if subscribed)

The date of the last update is always indicated at the top of this document.

We recommend that you periodically review this Privacy Policy to stay informed about how we protect your data.

15. NEWSLETTER

15.1. Consent

We send the newsletter exclusively to members of the Association who have given explicit consent to receive such messages.

You give your consent:

During registration (by checking the corresponding box)
Subsequently, by activating it in your account settings

15.2. Newsletter content

The newsletter contains:

Notices about upcoming events and concerts
Information about the Association's work
News from the music scene
Articles from the Portal's blog
Special offers for members

15.3. Unsubscribing

At any time, you may:

Click the "Unsubscribe" link at the bottom of each newsletter message
Disable the newsletter in your account settings on the Portal
Contact us with a request to unsubscribe

After unsubscribing, you will no longer receive newsletter messages, but you will continue to receive transactional emails necessary for the functioning of your account (payment confirmations, membership notices, etc.).

16. TRANSACTIONAL EMAILS

Regardless of your newsletter settings, we send you necessary transactional emails required for providing the service:

Registration confirmation
Forgotten password / password reset
Membership fee payment confirmations
E-tickets for events
Membership status notices
Account security notices

These messages cannot be disabled, as they are necessary for the functioning of your account.

17. INVITING NEW MEMBERS

17.1. Invitation functionality

As a regular member of the Association, you have the option to invite new members to the Portal. This functionality is in accordance with the Statute of the Association, which requires a recommendation from an existing member for joining the Association.

17.2. Your responsibility

When inviting a new person:

Ensure that you have that person's consent to be invited
Do not misuse the invitation functionality for spam
Only share email addresses of persons who have expressed interest in membership

17.3. Processing of invitees' data

The email addresses of the persons you invite are used exclusively for:

Sending the registration invitation
Tracking the registration process

If the invited person does not accept the invitation within 6 months, their data is automatically deleted from the system.

18. ACCOUNT DELETION

18.1. Voluntary deletion

You may request deletion of your user account at any time by contacting the Executive Delegate of the Association.

Upon receipt of the request:

We will check for any outstanding obligations (membership fees, tickets)
We will archive financial documentation (legal obligation)
We will delete all other personal data within 30 days
We will send you confirmation of account deletion

18.2. Automatic deletion

Your account will be automatically flagged for deletion if you have not been active (logged in) on the Portal for a period of 1 year.

Before permanent deletion, we will send you a warning to your registered email address.

18.3. Exceptions

Certain data may be retained after account deletion due to:

Legal retention obligations (financial documentation – 11 years)
Protection of the Association's legitimate interests
Concluded disputes or legal proceedings

19. CONTACT

For any questions, requests or complaints regarding this Privacy Policy or the protection of your personal data, please contact:

4 BY 4
Ivana Zajca 24
51000 Rijeka
Croatia

Executive Delegate / Data protection contact person:
Mirko Trkulja

Email: [email protected]
Phone: +385 91 720 0509

We aim to respond to all inquiries within 5 business days.

20. ACCEPTANCE OF THE PRIVACY POLICY

By using the manual.hr Portal, you confirm that you have read, understood and accepted this Privacy Policy.

If you do not agree with any part of this Privacy Policy, please do not use the Portal.

Effective date: October 7, 2025

4 BY 4
Mirko Trkulja, Executive Delegate

This English version is a translation provided for informational purposes. In case of any discrepancy, the original Croatian version shall prevail.

PRIVACY POLICY