Privacy policy

Controller

The controller is D. Svilenković, who runs this website and answers enquiries. Where this policy says "I", it means D. Svilenković.

For any question about your data, or to make a request under this policy, email dimitrije@sajtzafirmu.com or call +381 61 224 8989.

• Email: dimitrije@sajtzafirmu.com
• Phone: +381 61 224 8989

In short

The site uses no social media pixels or ad networks. Analytics (Google Analytics 4) runs only if you accept it in the cookie banner. Its fonts and scripts load from this server. Without your consent, the only external service the site loads by itself is Cloudflare Turnstile, the protection for the enquiry form and the website check, described below.

I process your data when you send an enquiry, email or call me, when I send you a business message, and in server logs. The brief, the privacy policy generator and the preparation list run in your browser and send nothing. The only tool that runs on the server is the website check: it sends the server the address of the site you check. I do not sell your data, share it for advertising or use it for profiling.

Enquiry form

The form at the bottom of every page sends your full name, your message and at least one contact method, email or phone. The page language and the address of the page you send it from are added automatically. With the enquiry, the server records the time it was received and your browser details (user agent). It does not store your IP address: it stores only a one-way hash that changes every day and cannot be turned back into the address, used to limit the number of enquiries from the same network.

I use enquiry data to reply and, if you ask for a website or maintenance, to prepare an offer. The legal basis is taking steps at your request before entering into a contract (Article 12(1)(2) of the Law; Article 6(1)(b) GDPR). Please do not send passwords, login details or special categories of data such as health or religious information.

Before sending, your browser solves a short computational task issued by my server, and the form has a hidden field that only automated programs fill in. These safeguards collect no further data about you.

The enquiry is stored in the forms service database on the site server, outside the public part of the site, and then forwarded as an email to my mailbox dimitrije@svilenkovic.com on the mail server. If you left an email address, it also receives an automatic confirmation of receipt from no-reply@sajtzafirmu.com, without the text of your message. No confirmation is sent if the form was submitted without JavaScript, and the same address receives at most two confirmations in 24 hours. The database record is deleted automatically three months after receipt. The copy in the mailbox is kept as business correspondence (see "When you email or call me").

Form protection: Cloudflare Turnstile

Your browser loads Cloudflare Turnstile from challenges.cloudflare.com, a check that tells people apart from automated programs, only when you start using the form, that is, when you click or tap it or enter one of its fields. Cloudflare, Inc. processes your IP address, browser identifier (User-Agent), a technical fingerprint of the encrypted (TLS) connection and the address of the site running the check. Cloudflare does not receive the contents of the form fields. When you send the form, my server verifies the result with Cloudflare.

The same Turnstile protects the website check. On the website check page your browser completes a separate Turnstile check, and my server verifies its result with Cloudflare before it starts the check.

The legal basis is my legitimate interest in protecting the form and the tool from spam and automated requests (Article 12(1)(6) of the Law; Article 6(1)(f) GDPR). For the check itself Cloudflare acts as my processor. It also uses the same data to improve its bot protection, and for that it is an independent controller. Under its privacy addendum, linked below, it does not use the data to identify, profile or target individuals. If you prefer to avoid this check, email me directly at dimitrije@sajtzafirmu.com.

Cloudflare Turnstile Privacy Addendum

When you email or call me

When you email dimitrije@sajtzafirmu.com or call +381 61 224 8989, I use your name, contact details and message to reply and to agree on the work (Article 12(1)(2) of the Law; Article 6(1)(b) GDPR). If we sign a contract, I process the data needed for the contract and invoice to perform the contract and meet legal obligations, mainly accounting ones (Article 12(1)(2) and (3); Article 6(1)(b) and (c) GDPR).

I keep correspondence while we discuss the work or work together, and afterwards only as long as needed for contractual obligations, invoices and possible complaints. Invoices and other accounting records are kept for the periods set by the Serbian Accounting Law. Correspondence that did not lead to a project is deleted earlier on request.

If you received a business message from me

From addresses on this and my other domains I send short business messages to companies and organisations that might benefit from a new or improved website. I find the contact on the company's public website or in a public business directory. I use the company name, business email address, website address and public information from that website, such as its field and location, and I record when I wrote and what you replied.

The legal basis is my legitimate interest in offering my services to businesses (Article 12(1)(6) of the Law; Article 6(1)(f) GDPR). You can object at any time: reply with the word "unsubscribe" or email dimitrije@sajtzafirmu.com. I then add the address to a suppression list and no further messages are sent to it from any of my addresses. Only the address stays on that list, so that I can respect your request. Other company data is kept while cooperation remains possible and deleted immediately on request.

Website check

When you enter a website address in the website check, in Serbian or in English, the address is sent to my server only to run the check. The server sends that site at most twelve requests, like an ordinary visitor: without cookies, without submitting forms, identified as "SajtZaFirmu-Provera/1.0". The checked site sees those requests in its own logs, like any other visit.

The legal basis is my legitimate interest (Article 12(1)(6) of the Law; Article 6(1)(f) GDPR) in keeping the tool working and preventing its misuse to overload other people's websites.

• The address you enter is not written to the server logs. When you start a check from the Serbian home page, the address travels in the part of the page address after #, which the browser does not send to the server.
• The server keeps the result for the same site for up to 10 minutes, so a repeated check does not send new requests. The result is stored encrypted, under a hash of the site address, so the database does not show which site was checked.
• To limit the number of checks, the server keeps a hash of your IP address (a computed fingerprint, not the address itself) for no longer than 24 hours.

Brief, policy generator and preparation list

The website brief, the privacy policy generator and the list of what to prepare run only in your browser and send nothing. Copying, printing and downloading the finished document happen on your device. The English brief worksheet and the English privacy data map store nothing. What the Serbian brief and list remember in the browser, when you turn it on, is described under "Cookies and browser storage".

Server logs

Like any web server, the server logs each request: IP address, time, page address without the part after the question mark, referring page (also without that part), server response and browser details. Error logs may contain the IP address and page address. I use logs only for security and troubleshooting, based on my legitimate interest in keeping the site running and protecting it from attacks and abuse (Article 12(1)(6) of the Law; Article 6(1)(f) GDPR). They are deleted automatically after 14 days.

Cookies and browser storage

Until you choose in the cookie banner, the site sets no cookies and loads no analytics. The cc_consent cookie remembers your choice for one year, and Google Analytics cookies are set only if you choose “Accept” (see “Analytics (Google Analytics 4)”). Browser storage (localStorage), on your device only, holds only what a feature you chose needs, as listed below. The privacy policy generator and the website check store nothing in the browser.

This data does not leave your device and is not used for tracking. This storage needs no separate consent because it only serves a function you explicitly requested (Serbian Electronic Communications Law, Article 160(5)). That is why the cookie banner asks only about analytics. You can also clear it by deleting this site's data in your browser settings. Turnstile runs in a separate frame from a Cloudflare address, under the rules in the form protection section.

• Brief draft, under the key sajtzafirmu:brif-nacrt: all brief answers, the chosen document version and the save time. It is stored only after you click the button to save the draft in this browser, and afterwards every change is saved automatically until you delete the draft with the delete button. If you entered a name, phone number or email in the brief, they also stay only on your device.
• Ticks on the preparation list, under the key sajtzafirmu:spisak-pripreme, only if you turn on remembering them in this browser. Turning it off deletes the record.

Who else has access

I do not sell or share your data, except where the law or an order of a competent authority requires it. Access is limited to those without whom the site and email cannot run, and only as needed:

• netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany, as processor: the site, the enquiry database, website check data and server logs are on its server in Nuremberg
• Hetzner Online GmbH, Gunzenhausen, Germany, as processor: email is on its server
• Backblaze, Inc., as processor: encrypted server backups are kept in its storage in Amsterdam, the Netherlands, and Backblaze does not hold the key
• Cloudflare, Inc., USA, for form and website check protection (Turnstile)

International transfers

The site and mail servers are in Germany, and the backups are in the Netherlands. States party to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, including Germany and the Netherlands, are considered to provide an adequate level of protection (Article 64(2) of the Law), so no separate authorisation is needed.

Cloudflare may process check data in the USA as well. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has found an adequate level of protection (Article 64(2) of the Law; Article 45 GDPR), and provides for standard contractual clauses should that certification lapse.

Your rights

You have the right to:

• find out whether I process your data and obtain access and a copy (Article 26 of the Law; Article 15 GDPR)
• have inaccurate data corrected and incomplete data completed (Article 29; Article 16 GDPR)
• have your data erased (Article 30; Article 17 GDPR)
• restrict processing (Article 31; Article 18 GDPR)
• receive the data you gave me in a common machine-readable format and transfer it to another controller, where processing is based on consent or a contract (Article 36; Article 20 GDPR)
• object to processing based on legitimate interest; an objection to business messages is always accepted (Article 37; Article 21 GDPR)
• not be subject to a decision based solely on automated processing (Article 38; Article 22 GDPR)

Withdrawing consent

Where processing is based on your consent, you can withdraw it at any time, as easily as you gave it, without affecting processing before the withdrawal (Article 15(3) of the Law; Article 7(3) GDPR). This site currently processes no data based on consent; if that changes, it will be listed here.

How to exercise your rights

Send your request to dimitrije@sajtzafirmu.com or call +381 61 224 8989. If I cannot reliably confirm that the request comes from you, I may ask for additional information to verify your identity.

I reply without undue delay and within 30 days of receiving the request at the latest. If the request is complex or there are several, I may extend this by another 60 days and will tell you so, with the reasons, within the first 30 days. Exercising your rights is free of charge. For a manifestly unfounded or excessive request, in particular a repeated one, I may charge the necessary administrative costs or refuse to act (Article 21 of the Law; Article 12 GDPR).

Complaint to the supervisory authority

If you believe the processing of your data breaches the Law, you can lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (Article 82): Bulevar kralja Aleksandra 15, 11120 Belgrade, Serbia, office@poverenik.rs, +381 11 3408 900. A complaint does not affect your right to judicial protection. If you live in the European Union, you can also contact the supervisory authority in your country.

www.poverenik.rs

Do you have to provide data?

Providing data is neither a legal nor a contractual requirement. Without a name, a message and one contact method the enquiry cannot be sent, so I cannot reply; instead of the form you can email or call me. No personal data is needed to read the site or use the tools.

Automated decision-making

I do not make decisions based solely on automated processing, including profiling, that produce legal effects for you or similarly significantly affect you. The automated form protection only stops submissions that look like a program; in that case you can email me directly. The website check report is an automated review of public pages, not a decision about you.

Security

The site and email work only over encrypted connections (HTTPS and TLS). Enquiries are stored outside the public part of the site, in a database accessible only to a dedicated system account for the form. The server is updated regularly and only I have access to the data. The site server makes encrypted backups every night, so deleted data may remain in those backups for up to seven months until newer ones replace them.

Children

The site and the form are meant for businesses and adults. A person under 15 should not send an enquiry without the consent of a parent or guardian. If I learn that this happened, I delete the data.

Changes

When the way data is processed changes, I update this page and its last-updated date. The terms of use are on the Terms of use page.

Terms of use