Legal
Privacy policy.
Effective from 12 October 2026
Confidentiality is the foundation of psychotherapy, and I handle your personal data with the same care. This policy explains what data I collect, why, how long I keep it and what your rights are under the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Croatian Act on the Implementation of the GDPR. The Croatian version prevails.
1. Controller
LOKUS POTENCIJAL, obrt za psihoterapiju i savjetovanje, owner Tamara Dukić
Ul. Nikole Tesle 1, 51000 Rijeka, Croatia
OIB: 44068472070
Email: tamara.dukic@gmail.com · Phone: +385 98 509 601
For any question about personal data, contact me directly at the email or phone above. As a small practice I am not required to appoint a data protection officer.
2. This website: no cookies, no tracking
- This site uses no cookies, no analytics or advertising tools, and does not track you. That is why there is no cookie banner.
- Fonts are served from this site, not from external services.
- The map on the Contact page loads from Google Maps only when you click it. Google (Google Ireland Ltd.) then receives your IP address and may set its own cookies, under Google’s privacy policy.
- The site is served by Cloudflare, Inc. Like any web server, it necessarily processes technical data (IP address, browser type, time of access) to deliver the site and protect it from attacks, and keeps it briefly in security logs. The legal basis is the legitimate interest in running the site securely (Art. 6(1)(f) GDPR).
- I use Google Search Console only to see how the site appears in Google Search. It does not collect data about visitors to this site.
3. When you contact me
When you contact me by phone, text, WhatsApp or email, I process what you send (name, phone number or email address, and the message) to reply and arrange a session. The legal basis is taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR).
Tip: your message can be short. Personal and health details are best kept for our conversation. WhatsApp messages are also processed by WhatsApp Ireland Ltd. (Meta), and emails by my email provider, Google Ireland Ltd.
4. When we work together
If we begin working together, I keep psychotherapy records as required by the Croatian Psychotherapy Act and the related ordinance on records (Official Gazette NN 4/2021). Records contain your basic details, reasons for coming, session dates and recommendations given.
- This is special category data (health data). I process it to provide psychotherapy under a duty of professional secrecy (Art. 9(2)(h) GDPR) and to meet the legal duty to keep records (Art. 6(1)(c)).
- Paper records are kept locked and digital records password-protected, with a backup copy. They are never disclosed without your written consent, except where the law expressly requires it.
Invoices and payment
To issue invoices I process your name, the amount and the date of the service, to meet tax and accounting obligations (Art. 6(1)(c) GDPR). An accountant bound by confidentiality may see this data. Invoices contain nothing about the content of therapy.
5. How long I keep data
| Data | Retention |
|---|---|
| Enquiries and messages where therapy does not start | Until I reply and we have (or have not) arranged a session, at most 12 months |
| Psychotherapy records | At least 5 years after therapy ends; for minors, at least 5 years after they come of age (Art. 11, NN 4/2021) |
| Invoices and accounting documents | As required by tax and accounting law |
| Server logs (Cloudflare) | Briefly, under Cloudflare’s policies |
After the retention period, data is securely destroyed or deleted.
6. Who data may be disclosed to
I never sell your data or share it for marketing. Only processors needed to run the practice may handle it (hosting by Cloudflare, email by Google, WhatsApp for messages you send there, an accountant), and authorities where the law expressly requires it. Some of these providers (Google, Meta, Cloudflare) may transfer data to the USA, under the EU–US Data Privacy Framework or standard contractual clauses.
In supervision I discuss my work only without anything that could identify you.
7. Your rights
- access to your data and a copy of it,
- correction of inaccurate data,
- erasure, except where I must keep data by law (e.g. records and invoices),
- restriction of processing and objection,
- data portability,
- withdrawing consent at any time, where processing is based on consent.
Send requests by email or post. I will reply without delay and at the latest within one month. If you believe your rights have been breached, you can complain to the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop@azop.hr.
8. Security
The site is served only over an encrypted connection (HTTPS). Records are protected as described above. For online therapy I use video tools whose level of protection I have checked, and I tell you about it before our first online session.
9. Minors
Work with children and adolescents is only possible with the written consent of a parent or guardian and prior medical diagnostic documentation, as required by the Croatian Psychotherapy Act.
10. Changes
This policy may change when the way I work or the law changes. The current version is always published here with the date it takes effect.