Privacy

How we handle your data.

We collect little, keep it briefly, and never sell it. This page says what we hold, why we hold it, who helps us, and how you can make us stop. It also shows our own test for the one place we rely on "legitimate interest": contacting companies we think we can help.

Version 1.1 · Effective 28 October 2026 · Newton d.o.o., Split, Croatia

Part one

Privacy notice

This website sets no cookies and runs no analytics. Our host still sees your IP address to deliver the page. If you switch to the dark theme, your browser remembers that choice in its own local storage. It is never sent to us.
If you email us, we keep the conversation to answer you and to remember the context.
If you are a client, we keep contract and invoice records for as long as the law requires.
We sometimes write first. We may email a company director about a specific problem we can solve. We use only public business details. One reply from you stops it for good.
When we run Helm for a company, that company decides what happens to its data. We act on its written instructions.
We never sell data, never use it to train AI models, and never make automated decisions about you.

Who we are

The controller of your personal data is Newton d.o.o., Biokovska 5, 21000 Split, Croatia. OIB 55338089178, registered at the Commercial Court in Split under MBS 060394354.

For anything about your data, write to hello@newton.hr or send a letter to the address above. A person reads every message. We have not appointed a data protection officer, because the law does not require one for our activities.

What we process and why

Each row names the data, the purpose, the legal basis under the GDPR, and how long we keep it.

Situation	Data	Purpose	Legal basis	How long
You visit newton.hr	IP address, browser and device type, requested page, time.	Deliver the page, keep the site secure, find faults.	Legitimate interest, Art. 6(1)(f): running a safe website.	Request logs at our host for up to 7 days.
Your browser loads our fonts	IP address and browser details, sent to Google when fonts load.	Show the site in its typefaces.	Legitimate interest, Art. 6(1)(f).	Under Google's own policy. We receive nothing.
You email us	Name, email address, company, role, what you write, any attachments.	Answer you, and prepare an offer if you ask for one.	Steps before a contract, Art. 6(1)(b). Otherwise legitimate interest, Art. 6(1)(f): replying to people who write to us.	2 years after our last exchange, unless you become a client.
You are a client or a client's contact person	Name, business email and phone, role, signatures, contract and invoice data, project correspondence.	Deliver the work, invoice it, keep records.	Contract, Art. 6(1)(b). Legal duty, Art. 6(1)(c): accounting and tax law.	Accounting records 11 years (Croatian Accounting Act). Other contract records 5 years after the contract ends.
We contact your company first	Name, role, company, business email or phone, and public facts about the company. See the assessment below.	Offer a specific, relevant service to a company director or owner.	Legitimate interest, Art. 6(1)(f): direct marketing to businesses.	12 months after our last contact if nothing comes of it. If you object, we keep only your email address on a do-not-contact list, so we never write again.
You open a password-protected page we sent you	Nothing beyond the website row above. The password check runs in your browser.	Share confidential material with one recipient.	Legitimate interest, Art. 6(1)(f).	As for website visits.

You do not have to give us any data. If you don't, we may simply be unable to reply or work together.

Where outreach data comes from. We use only public business sources: the company's own website, the Croatian court register, public financial filings, business news, and public professional profiles. We do not buy contact lists. We never collect private addresses, private phone numbers, or anything about health, beliefs or family.

Helm and data we handle for clients

Helm is the AI platform we build and run for client companies, through our Axon programme. It connects to a client's own systems, such as the till, warehouse, webshop and team work log.

Here the client company is the controller and Newton is its processor. We process that data only on the client's documented instructions, under a data-processing agreement (Art. 28 GDPR). If you are a customer or employee of one of our clients, please contact that company first. We will help them answer you.

Each client's Helm runs on its own dedicated server at Hetzner, in the European Union. No other client shares it.
Helm proposes changes and a person approves them. Every change is logged with who approved it.
Helm can export or pseudonymise one person's data on the client's request.
Client data is never used to train anyone's AI models.
When a contract ends, we hand all client data back to the client in a format it can keep using. Only then do we delete our copies, within 30 days of the contract ending, as the agreement says.

For the people who use Helm at a client, we keep their name, work email, role and activity log. We do this to run their accounts and to keep a reliable record of changes. That record belongs to the client's account and follows the client's agreement.

Who helps us

Only the Newton team sees your data. A few service providers process it for us, under contracts that bind them to our instructions:

Cloudflare: hosting and security for this website, and routing of mail sent to hello@newton.hr.
Google: our email, calendar and documents (Google Workspace), and the fonts on this website.
Hetzner: the servers that run Helm, in the European Union.
Anthropic and OpenAI: AI models that Helm and our own work use to read, summarise and draft text. Under their business terms, neither trains its models on this data.
Ravena d.o.o.: bookkeeping and tax returns.
Zagrebačka banka: payments.

We also share data when the law requires it, for example with the Tax Administration. We never sell or rent personal data.

Transfers outside the EU

Cloudflare, Google, Anthropic and OpenAI are US companies, so some data may reach the United States. Each transfer is covered by the EU–US Data Privacy Framework or the EU Standard Contractual Clauses. You can ask us for a copy of these safeguards.

Your rights

You can ask us, free of charge, to:

tell you what data we hold about you and give you a copy;
correct data that is wrong;
delete your data, or pause its use;
send your data to you or to another company in a common format;
stop using your data for marketing. This works every time, with no reason needed;
stop any other use based on legitimate interest, unless we have a stronger, compelling reason;
withdraw any consent you gave us. Past use stays lawful.

Write to hello@newton.hr. We answer within one month. We may ask you to confirm who you are first.

You can also complain to the Croatian data protection authority: Agencija za zaštitu osobnih podataka (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr. We would rather hear from you first, so we can fix it.

Security

We use encryption in transit, two-factor sign-in, role-based access and backups. Changes inside Helm need a person's approval and leave an audit trail. If a breach puts your rights at risk, we tell the authority within 72 hours and tell you without delay.

Changes to this notice

When we change how we handle data, we update this page and its version date. If a change matters to you as a client, we tell you directly.

Part two

Legitimate-interest assessment: business outreach

The GDPR lets us rely on legitimate interest only if we pass a three-part test. We publish ours so you can check our reasoning.

Processing: First contact with company directors and owners about Helm and Newton's services
Controller: Newton d.o.o., Split
Basis: Art. 6(1)(f) GDPR, with Recital 47 (direct marketing)

Assessed: 28 October 2026
Owner: Grgur Grisogono, director
Next review: October 2027, or sooner if the method changes

1 · Purpose

Is the interest legitimate?

Yes. Newton needs new clients to grow. Telling a business about a service that fits its real problems is a normal commercial interest. Recital 47 names direct marketing as a possible legitimate interest.

The contact also helps the recipient. We write only when public facts point to a problem we can solve, such as stock, pricing or seasonal demand in retail and distribution.

2 · Necessity

Do we need the data for it?

Yes, and only a little. To reach a decision-maker we need a name, a role, a company, and one business channel. Nothing else.

We pick a few companies by hand. No bulk lists, no scraping at scale.
We prefer general company addresses where one exists.
No profiling of the person. Our research is about the company.
We cannot get consent before a first contact, so consent is not a workable basis.

3 · Balance

Do your rights outweigh our interest?

Data: business contact details already public for business purposes. No sensitive data. No data about children.

Expectations: a director listed in the court register or on the company website can reasonably expect occasional relevant business offers. A private person could not, so we never contact private persons.

Impact: low. At most one short message and one follow-up. The message says where we found the details and how to stop us.

Safeguards

What keeps the impact low

Every message names Newton, says where the contact came from, and links to this page (Art. 14 GDPR).
"Not interested" or any objection ends contact at once. We add the address to a do-not-contact list.
No reply means no third message. Data is deleted 12 months after the last contact.
A person writes and sends every message. AI may help research and draft, but never sends.
Data stays in our own email and documents. We never pass it on.
We follow the Croatian Electronic Communications Act rules for electronic marketing.

Conclusion. Our interest is legitimate. The data is the minimum needed. With the safeguards above, the impact on the people we contact is low and expected. Newton may rely on Art. 6(1)(f) for this outreach. Any objection stops it at once.