Privacy

Controller

Nenad Bakić, e-mail: maksimirskistadion@gmail.com

What we process when you vote

• A random browser tag: when you send a vote, your browser gets a random number (stored in localStorage). We keep only an irreversible hash of it (HMAC-SHA256 with a secret key), so the same browser has one vote that it can change.
• Selected entries (codes), site language and time of the vote.
• IP address: we keep only a hash of the network (the IPv4 address, or the first part of an IPv6 address), to limit the number of votes from the same network and to detect abuse. Votes that clearly result from abuse may be excluded from the ranking. The hash is deleted after at most 2 days.

This data does not tell us who you are, and we do not link it with any other data.

Purpose and legal basis

The purpose is a poll in which votes are not counted multiple times, and protection against automated voting. The legal basis is legitimate interest (Art. 6(1)(f) GDPR). The data is not used for marketing or profiling and is not shared with third parties.

Processors

• Vercel: website hosting. Votes are processed on servers in the EU (Frankfurt).
• Vercel Web Analytics: aggregate visit statistics (which pages, referring site, country, device type). It uses no cookies or persistent identifiers; visitors are distinguished only by a hash that changes daily, so they cannot be tracked over time.
• Supabase: database with the votes (servers in the EU, Frankfurt).
• Cloudflare Turnstile: bot check. Processes technical browser data and the IP address.

Some processors are US-based companies; any transfer outside the EU is covered by the safeguards of Art. 46 GDPR (standard contractual clauses) or the EU–US Data Privacy Framework, depending on the provider.

How long we keep data

• IP hash: at most 2 days.
• Vote (browser tag hash and selected entries): while the poll is open, and no later than 30 days after it closes.

Your rights

You have the right to access, erasure and to object. You can change your vote yourself by voting again, and delete the browser tag by clearing this site’s data in your browser. Since we do not know who voted, deleting a vote requires the tag from your browser; contact us and we will explain how. You can lodge a complaint with the Croatian Personal Data Protection Agency (azop.hr).

Cookies and local storage

We use no tracking cookies; visit statistics (Vercel Web Analytics) work without cookies. In your browser (localStorage) we keep only what the site needs to work: your selection, the shuffle order, the browser tag and your last vote. Cloudflare Turnstile may use technically necessary data for the check.