This document explains which personal data we collect, on what legal basis we process it, who we share it with and what your rights are.
2Forge Innovation d.o.o. provides its clients with 3PL logistics, warehousing, fulfilment, order processing, packing, dispatch, returns handling and other related logistics services. 3PL.hr is a brand of 2Forge Innovation d.o.o. specialised in third-party logistics.
In the course of our business we process certain personal data, which is why we have adopted this Privacy Policy. This document describes which data 2Forge Innovation d.o.o. collects and processes, the legal basis and purpose of such processing, and the rights of data subjects.
All terms used in this text have the same meaning as in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation; hereinafter: GDPR).
Please read this document carefully to learn how we collect, process, protect and otherwise use your personal data.
The controller is 2Forge Innovation d.o.o., with its registered seat in Zagreb, Ulica Roberta Frangeša - Mihanovića 9, company ID (OIB): 13219190297 (hereinafter: the Controller, or we, our and similar). The operating location of the warehouse and fulfilment centre is Ulica Pere Devčića 61, 10290 Zaprešić, Croatia.
E-mail: info@3pl.hr; office@2forge.io
Phone: +385 95 836 0605
Through our websites 2forge.io, 3pl.hr and warehouse.hr we may collect certain personal data. Specifically, our websites may use cookies and similar technologies, in respect of which we ask you to review our Cookie Policy, and may provide a contact form or another way of submitting an enquiry.
In relation to our websites, the data subject is every visitor. In addition to data collected through cookies, through the contact form or another form of enquiry we may ask for your name and surname, e-mail address, telephone number, the company you work for and the content of your enquiry. We need this data in order to respond to the enquiry you send us and to potentially establish a business relationship with you or with the company on whose behalf you contact us.
Data collected in this way is kept for as long as there is a need for processing, that is, for the duration of talks or negotiations on cooperation, or of the cooperation itself. If cooperation does not materialise, data collected through enquiries is kept for the periods set out in the section on data retention, unless longer storage is necessary for the establishment or defence of legal claims.
A data subject is any identifiable individual, that is, a person who can be identified directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual.
In relation to doing business with us, a data subject may be any of our clients, prospective clients, suppliers, business partners, contact persons of clients or suppliers, representatives of delivery or courier services, users of our websites, job applicants, employees or other persons we contact in order to provide services or run our business.
In addition, when providing 3PL, fulfilment and related logistics services we may process personal data of our clients' end customers, that is, the recipients of shipments. In those cases we generally act as a processor, processing the data on behalf of and according to the instructions of our clients as controllers.
We generally collect your personal data when you provide it to us, for example when you send us an enquiry, request a quote, enter into a contract with us, communicate with us regarding the provision of services or send us data for the performance of a business relationship.
We may also receive personal data from our clients, in particular when a client, as controller, sends us the data needed to carry out an order within our 3PL, fulfilment, warehousing and logistics services.
We may also obtain your personal data from publicly available registers such as the court register, the register of trades, the VAT register and similar, where this is necessary to verify a business relationship, prepare a contract or maintain orderly business operations.
We aim to collect only the data necessary to perform contractual and legal obligations and to provide our services properly and efficiently.
In the course of regular business operations we may process personal data of our clients, prospective clients, suppliers and business partners, or of their employees and contact persons. This data may include name and surname, job title, company or trade name, address, company ID (OIB) where applicable, e-mail address, telephone number, the content of business correspondence, quotes, contracts, purchase orders, invoices, payment data and other data required for the business relationship.
In the course of providing 3PL, fulfilment and related logistics services, the personal data we process on behalf of our clients may include the name and surname of the customer or shipment recipient, delivery address, mobile or telephone number, e-mail address, order number or code, data about the shipment, delivery method, delivery status and tracking data, data about the items in the order to the extent necessary for picking, packing, dispatch, returns or complaints, any notes for delivery, packing or returns, as well as cash-on-delivery data where such a service has been agreed.
In the course of using the WMS, the client portal, API and EDI integrations, e-mail or other agreed communication channels we may process user accounts, business contact data, access data and logs where they exist, and data about orders, stock, statuses, returns and related operational communication.
In the course of recruitment we may process applicant data, including name and surname, address, contact details, data on education and work experience, the CV and other documentation provided by the applicant. From employees we collect and process only the data necessary to establish and manage the employment relationship and to comply with legal obligations. Employees are informed separately and in detail about such processing.
In our regular business operations and within the standard scope of 3PL, fulfilment and logistics services we do not expect to process special categories of personal data under Article 9 GDPR, nor data relating to criminal convictions and offences under Article 10 GDPR. We ask clients and other persons not to send us such data through orders, notes, product descriptions, documentation, e-mail or other communication channels, unless such processing has been expressly agreed in advance and appropriate additional safeguards have been agreed.
We process data primarily in order to fulfil contractual and legal obligations relating to our line of business, to respond to enquiries, prepare and perform contracts, provide 3PL, fulfilment, warehousing and logistics services, conduct business communication, issue invoices, collect payments, keep business records, act on requests from data subjects and competent authorities, and protect our legal and business interests.
It is not excluded that official authorities which, within the scope of their powers, have the right to inspect documentation that may contain personal data will address requests to us.
We do not take decisions based solely on automated processing that would produce legal effects for data subjects or similarly significantly affect them.
The legal basis for processing depends on the circumstances of each case. Below is an overview of the usual situations:
When we provide 3PL, fulfilment, warehousing and related logistics services to our business clients, we generally process the data of end customers or shipment recipients as a processor. This means that our client determines the purposes and essential means of processing, while we process the data in order to carry out the order, prepare the shipment, pack it, dispatch it, hand it over to a delivery or courier service, track the shipment status, handle returns and perform other related logistics activities.
If you are an end customer or shipment recipient, for information on the legal basis of processing, the purpose of processing, data subject rights and other questions relating to the processing of your data, you should primarily contact the merchant, that is, our client from whom you ordered the goods or service. Where applicable and technically feasible, we will assist our client in responding to your request.
Our basic aim is to share your data with the smallest possible number of parties, and only where there are justified circumstances, as a rule a contractual or legal obligation, the performance of a service, a legitimate interest or the documented instruction of a controller. We take care to always share only the minimum of necessary personal data.
Depending on the circumstances, we may share data with:
Delivery and courier services may, at certain stages of delivery, act as independent controllers or as other recipients of personal data under their own rules and applicable regulations.
As a rule we seek to ensure that personal data is processed within the European Union or the European Economic Area. If in an individual case personal data is transferred or may be transferred outside the European Union or the European Economic Area, such a transfer is carried out only where there is an appropriate legal basis and appropriate safeguards in accordance with the GDPR, such as an adequacy decision, standard contractual clauses or another permitted transfer mechanism.
We process data only for as long as necessary to achieve the purpose for which it was collected, that is, for as long as required to fulfil contractual, legal and business obligations, act on requests from data subjects, establish or defend legal claims, or comply with an order of a competent authority.
Data collected through website enquiries is generally kept for 3 years from the last communication, unless a contract is concluded, business communication continues, or longer storage is necessary for the establishment or defence of legal claims.
Where data is processed for accounting purposes, that is, where it is contained in an accounting document such as an invoice, it is stored in accordance with applicable accounting and tax regulations.
Data we process as a processor on behalf of our clients is kept in accordance with the data processing agreement, the client's documented instructions and the technical settings of the agreed systems, unless further storage is necessary to fulfil a legal obligation, defend legal claims, evidence the performance of a service or comply with an order of a competent authority.
The Controller maintains a record of personal data processing activities which describes in more detail how long individual categories of data are processed.
In order to protect people and property, ensure the security of warehouse and business premises, control access and protect goods, certain premises under our control may be covered by video surveillance, an alarm system and other physical security measures. Premises under video surveillance are marked with an appropriate notice no later than upon entering the recording perimeter.
Video surveillance recordings are kept for a maximum of 6 months, unless longer storage is necessary because the recording is used as evidence in court, administrative, arbitration or other equivalent proceedings, or unless a longer period is prescribed by a specific regulation. Only authorised persons have access to the recordings.
In order to protect the personal data you have entrusted to us, we use physical, technical and organisational security measures. We continuously upgrade and test our security technology. We limit access to your personal data to those employees who need to know that information in order to provide you with a benefit or service. In addition, we educate our employees on the importance of data confidentiality and on protecting your privacy and your data.
Please send all enquiries relating to the exercise of your rights concerning personal data, including cookies, to the contact details stated above. We respond to your enquiries and requests within one month of receiving the request, unless an extension is necessary due to the complexity or number of requests, in accordance with the GDPR.
Subject to the conditions set out in the GDPR, you have the following rights:
If we process data solely as a processor on behalf of our client, we do not decide independently on a data subject request, but forward the request to the controller or refer the data subject to the controller, unless the controller authorises us to act otherwise.
If you are not satisfied with our response to your enquiry, or if you have not received a response within the prescribed period, you have the right to lodge a complaint with the supervisory authority, the Croatian Personal Data Protection Agency (AZOP). A request for a determination of a violation of rights may be submitted to the Agency in person, in writing to the address: Agencija za zaštitu osobnih podataka, Ulica Metela Ožegovića 16, 10 000 Zagreb, Croatia, by completing the online form on the Agency's website, by e-mail to azop@azop.hr or through another available communication channel of the supervisory authority.
Member of the German-Croatian Chamber of Industry and Commerce (AHK Kroatien).
© 2026 2Forge Innovation d.o.o. · 3PL.hr | Privacy Policy | Cookie Policy
