Rivermind
Sales Anomaly Detection — How a distributor protected €2.1M in revenue

Privacy Policy

Last updated: 21 October 2026

This Privacy Policy explains how personal data is collected and used when you visit www.getrivermind.com (the “Website”), contact us, or sign up for updates. It is written to meet the requirements of the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Croatian Act on the Implementation of the GDPR.

1. Who we are

Rivermind is a technology owned and operated by Margins d.o.o., a company registered in Croatia (“Margins”, “we”, “us”). Margins is the data controller for the personal data described in this policy.

  • Margins d.o.o., Slavonska avenija 6, 10000 Zagreb, Croatia
  • OIB (company ID): 30100320285
  • Email for privacy requests: hello@margins.agency

2. What this policy covers

This policy covers the Website and the forms on it. It does not cover:

  • Data we process for our customers. When a customer uses the Rivermind platform, we process their business data on their behalf as a processor, under a separate data processing agreement. That customer is the controller of that data.
  • Other websites. Links to other sites (for example LinkedIn or margins.agency) are governed by those sites’ own policies.
  • Rivermind tools on separate subdomains (such as the revenue leak calculator or the readiness assessment). Where a tool collects personal data, it explains this on the tool itself.

3. Personal data we collect and why

We only collect personal data that you give us or that is technically necessary to deliver the Website. We do not buy personal data and we do not sell it.

3.1 Contact and AI Strategy Session requests

  • Data: name, business email address, phone number, company and job title, plus anything you write to us.
  • Purpose: to answer your enquiry, arrange a meeting and discuss how we might work together.
  • Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in responding to business enquiries (Art. 6(1)(f) GDPR).
  • Retention: up to 24 months after our last contact, unless it leads to a business relationship, in which case we keep it for as long as that relationship and our legal obligations require.

3.2 AI Production Readiness Index participation

  • Data: first and last name, job title, company, company size and revenue band, business email address and phone number.
  • Purpose: to arrange your participation in the research, contact you about it and send you the results. Published findings are aggregated and anonymised; we never publish individual answers or names without your separate permission.
  • Legal basis: steps taken at your request (Art. 6(1)(b) GDPR) and our legitimate interest in carrying out industry research (Art. 6(1)(f) GDPR).
  • Retention: for the duration of the research programme and up to 24 months after the related report is published.

3.3 Newsletter and updates

  • Data: your email address and the date you signed up.
  • Purpose: to send you news, insights and event invitations about Rivermind.
  • Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time using the unsubscribe link in any email or by writing to us; this does not affect processing before the withdrawal.
  • Retention: until you unsubscribe. After that we keep only a minimal record that you opted out, so we do not contact you again.

3.4 Technical data when you visit the Website

  • Data: IP address, date and time of the request, the page requested, browser and device information, and referring page, recorded in server logs.
  • Purpose: to deliver the Website, keep it secure, prevent abuse and fix errors.
  • Legal basis: our legitimate interest in operating a secure and reliable website (Art. 6(1)(f) GDPR).
  • Retention: server logs are kept for a short period, normally no longer than 30 days, unless needed to investigate a security incident.

3.5 Emails and other correspondence

If you email us directly, we use your message and contact details to reply and to manage our relationship with you, on the basis of our legitimate interest (Art. 6(1)(f) GDPR), and keep them for as long as needed for that purpose.

Providing personal data through our forms is voluntary. Fields marked as required are needed to handle your request; without them we cannot respond.

4. Cookies and tracking

The public Website does not use analytics, advertising or social media tracking, and does not set cookies when you browse it. Fonts and media are served from our own infrastructure, so visiting the Website does not send your data to third parties such as Google Fonts or video platforms.

Our content management system, used only by authorised Margins staff, sets strictly necessary cookies to keep staff signed in. See our Cookie Policy for details. If we ever introduce non-essential cookies, we will ask for your consent first and update these policies.

5. Who we share personal data with

We share personal data only with service providers that help us run the Website and our business, acting as our processors under written data processing agreements, and only as far as they need it:

  • Vercel Inc. – website hosting and delivery. Our application runs in Vercel’s Frankfurt (EU) region; content is delivered through Vercel’s global network.
  • Neon – database hosting for form submissions, located in Frankfurt (EU).
  • Resend – delivery of the notification emails we receive when you submit a form.
  • Google (Google Workspace) – our business email, where form notifications and your emails are received, and sign-in for our staff.

We may also disclose personal data where required by law, to a court or public authority, or to protect our rights. If Margins or Rivermind is involved in a merger, acquisition or sale of assets, personal data may be transferred to the new owner under the same protections.

6. Transfers outside the EU/EEA

We store form submissions in the EU. Some of our providers are based in, or have staff or sub-processors in, countries outside the EU/EEA, including the United States. Where personal data is transferred there, we rely on an adequacy decision of the European Commission (including the EU–US Data Privacy Framework for certified companies) or on the European Commission’s Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for more information about these safeguards.

7. How we protect personal data

We use appropriate technical and organisational measures to protect personal data, including encrypted connections (HTTPS), encryption of stored data by our hosting providers, access limited to authorised staff with individual accounts, and regular review of who has access.

8. Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you and receive a copy;
  • rectification of inaccurate or incomplete data;
  • erasure of your data (“right to be forgotten”);
  • restriction of processing in certain cases;
  • data portability – to receive data you gave us in a structured, machine-readable format;
  • object at any time to processing based on our legitimate interests, and to direct marketing;
  • withdraw your consent at any time, where processing is based on consent.

To exercise these rights, email hello@margins.agency. We will respond within one month, which may be extended by two further months for complex requests; we will tell you if that happens. We may ask you to confirm your identity before acting on a request.

We do not use automated decision-making or profiling that produces legal or similarly significant effects for you.

9. Complaints

If you believe we have not handled your personal data properly, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live or work or where the alleged infringement took place. In Croatia this is:

  • Agencija za zaštitu osobnih podataka (AZOP), Ulica Metela Ožegovića 16, 10000 Zagreb, Croatia
  • azop.hr · azop@azop.hr · +385 1 4609 000

10. Children

The Website is intended for business users and is not directed at children under 16. We do not knowingly collect their personal data.

11. Changes to this policy

We may update this policy when our services or legal requirements change. The current version is always published on this page with its “last updated” date. If we make significant changes, we will make this clear on the Website or notify you directly where appropriate.

12. Contact

For any question about this policy or your personal data, contact Margins d.o.o., Slavonska avenija 6, 10000 Zagreb, Croatia, or email hello@margins.agency.