Controller
The controller is D. Svilenković, who runs this website and answers enquiries. Where this policy says “I”, it means D. Svilenković.
- Email: dimitrije@svilenkovicweb.com
- Phone: +381 61 224 8989
For any question about your data, or to make a request under this policy, email dimitrije@svilenkovicweb.com or call +381 61 224 8989.
In short
- The site uses no social media pixels or ad networks. Analytics (Google Analytics 4) runs only if you accept it in the cookie banner. Its fonts and scripts load from this server. Without your consent, the only external service the site loads by itself is Cloudflare Turnstile, the enquiry form protection described below.
- I process your data when you send an enquiry, email or call me, when I send you a business message, and in server logs. The mini configurator on the home page runs in your browser and does not store your choice on the server.
- I do not sell your data, share it for advertising or use it for profiling.
Enquiry form
The form on the Contact page sends your name, your message and at least one contact method, email or phone. The page language, the enquiry subject and the address of the page you send it from are added automatically. With the enquiry, the server records the time it was received and your browser details (user agent). It does not store your IP address: it stores only a one-way hash that changes every day and cannot be turned back into the address, used to limit the number of enquiries from the same network.
I use enquiry data to reply and, if you ask for a website or maintenance, to prepare an offer. The legal basis is taking steps at your request before entering into a contract (Article 12(1)(2) of the Law; Article 6(1)(b) GDPR). Please do not send passwords, login details or special categories of data such as health or religious information.
Before sending, your browser solves a short computational task issued by my server, and the form has a hidden field that only automated programs fill in. These safeguards collect no further data about you.
The enquiry is stored in the forms service database on the site server, outside the public part of the site, and then forwarded as an email to my mailbox dimitrije@svilenkovic.com on the mail server. If you left an email address, it also receives an automatic confirmation of receipt from no-reply@svilenkovicweb.com, without the text of your message. No confirmation is sent if the form was submitted without JavaScript, and the same address receives at most two confirmations in 24 hours. The database record is deleted automatically three months after receipt. The copy in the mailbox is kept as business correspondence (see “When you email or call me”).
Form protection: Cloudflare Turnstile
When you open a page with the form, your browser loads Cloudflare Turnstile from challenges.cloudflare.com, a check that tells people apart from automated programs. Cloudflare, Inc. processes your IP address, browser identifier (User-Agent), a technical fingerprint of the encrypted (TLS) connection and the address of the site running the check. Cloudflare does not receive the contents of the form fields. When you send the form, my server verifies the result with Cloudflare.
The legal basis is my legitimate interest in protecting the form from spam and automated submissions (Article 12(1)(6) of the Law; Article 6(1)(f) GDPR). For the check itself Cloudflare acts as my processor. It also uses the same data to improve its bot protection, and for that it is an independent controller. Under its privacy addendum it does not use the data to identify, profile or target individuals: Cloudflare Turnstile Privacy Addendum. If you prefer to avoid this check, email me directly at dimitrije@svilenkovicweb.com.
When you email or call me
When you email dimitrije@svilenkovicweb.com or call +381 61 224 8989, I use your name, contact details and message to reply and to agree on the work (Article 12(1)(2) of the Law; Article 6(1)(b) GDPR). If we sign a contract, I process the data needed for the contract and invoice to perform the contract and meet legal obligations, mainly accounting ones (Article 12(1)(2) and (3); Article 6(1)(b) and (c) GDPR).
I keep correspondence while we discuss the work or work together, and afterwards only as long as needed for contractual obligations, invoices and possible complaints. Invoices and other accounting records are kept for the periods set by the Serbian Accounting Law. Correspondence that did not lead to a project is deleted earlier on request.
If you received a business message from me
From addresses on this and my other domains I send short business messages to companies and organisations that might benefit from a new or improved website. I find the contact on the company’s public website or in a public business directory. I use the company name, business email address, website address and public information from that website, such as its field and location, and I record when I wrote and what you replied.
The legal basis is my legitimate interest in offering my services to businesses (Article 12(1)(6) of the Law; Article 6(1)(f) GDPR). You can object at any time: reply with the word “unsubscribe” or email dimitrije@svilenkovicweb.com. I then add the address to a suppression list and no further messages are sent to it from any of my addresses. Only the address stays on that list, so that I can respect your request. Other company data is kept while cooperation remains possible and deleted immediately on request.
Catalogue mini configurator
The mini configurator on the home page (“Try the catalogue logic”) uses the offer type and quantity you choose to suggest which enquiry flow to plan, without pricing. It runs with JavaScript in your browser. Your choice is not sent with the contact form or stored on the server, and it is not kept in browser storage.
Server logs
Like any web server, the server logs each request: IP address, time, page address without the part after the question mark, referring page (also without that part), server response and browser details. Error logs may contain the IP address and page address. I use logs only for security and troubleshooting, based on my legitimate interest in keeping the site running and protecting it from attacks and abuse (Article 12(1)(6) of the Law; Article 6(1)(f) GDPR). They are deleted automatically after 14 days.
Cookies and browser storage
Until you choose in the cookie banner, the site sets no cookies and loads no analytics. The cc_consent cookie remembers your choice for one year, and Google Analytics cookies are set only if you choose “Accept” (see “Analytics (Google Analytics 4)”). Browser storage holds only what a feature you chose needs:
- your choice to pause animations, in tab storage (sessionStorage, key pokret-pauziran), only when you press the pause motion button on the home page; it is cleared when you close the tab.
This storage needs no separate consent because it only serves a function you explicitly requested (Serbian Electronic Communications Law, Article 160(5)). That is why the cookie banner asks only about analytics. You can clear it by deleting this site’s data in your browser settings. Turnstile runs in a separate frame from a Cloudflare address, under the rules in the form protection section.
Who else has access
I do not sell or share your data, except where the law or an order of a competent authority requires it. Access is limited to those without whom the site and email cannot run, and only as needed:
- netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany, as processor: the site, the enquiry database and server logs are on its server in Nuremberg;
- Hetzner Online GmbH, Gunzenhausen, Germany, as processor: email is on its server;
- Backblaze, Inc., as processor: encrypted server backups are kept in its storage in Amsterdam, the Netherlands, and Backblaze does not hold the key;
- Cloudflare, Inc., USA, for form protection (Turnstile).
International transfers
The site and mail servers are in Germany, and the backups are in the Netherlands. States party to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, including Germany and the Netherlands, are considered to provide an adequate level of protection (Article 64(2) of the Law), so no separate authorisation is needed.
Cloudflare may process check data in the USA as well. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has found an adequate level of protection (Article 64(2) of the Law; Article 45 GDPR), and provides for standard contractual clauses should that certification lapse.
Your rights
You have the right to:
- find out whether I process your data and obtain access and a copy (Article 26 of the Law; Article 15 GDPR);
- have inaccurate data corrected and incomplete data completed (Article 29; Article 16 GDPR);
- have your data erased (Article 30; Article 17 GDPR);
- restrict processing (Article 31; Article 18 GDPR);
- receive the data you gave me in a common machine-readable format and transfer it to another controller, where processing is based on consent or a contract (Article 36; Article 20 GDPR);
- object to processing based on legitimate interest; an objection to business messages is always accepted (Article 37; Article 21 GDPR);
- not be subject to a decision based solely on automated processing (Article 38; Article 22 GDPR).
Where processing is based on your consent, you can withdraw it at any time, as easily as you gave it, without affecting processing before the withdrawal (Article 15(3) of the Law; Article 7(3) GDPR). This site currently processes no data based on consent; if that changes, it will be listed here.
How to exercise your rights
Send your request to dimitrije@svilenkovicweb.com or call +381 61 224 8989. If I cannot reliably confirm that the request comes from you, I may ask for additional information to verify your identity.
I reply without undue delay and within 30 days of receiving the request at the latest. If the request is complex or there are several, I may extend this by another 60 days and will tell you so, with the reasons, within the first 30 days. Exercising your rights is free of charge. For a manifestly unfounded or excessive request, in particular a repeated one, I may charge the necessary administrative costs or refuse to act (Article 21 of the Law; Article 12 GDPR).
Complaint to the supervisory authority
If you believe the processing of your data breaches the Law, you can lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (Article 82): Bulevar kralja Aleksandra 15, 11120 Belgrade, Serbia, office@poverenik.rs, +381 11 3408 900, www.poverenik.rs. A complaint does not affect your right to judicial protection. If you live in the European Union, you can also contact the supervisory authority in your country.
Do you have to provide data?
Providing data is neither a legal nor a contractual requirement. Without a name, a message and one contact method the enquiry cannot be sent, so I cannot reply; instead of the form you can email or call me. No personal data is needed to read the site or use the configurator.
Automated decision-making
I do not make decisions based solely on automated processing, including profiling, that produce legal effects for you or similarly significantly affect you. The automated form protection only stops submissions that look like a program; in that case you can email me directly.
Security
The site and email work only over encrypted connections (HTTPS and TLS). Enquiries are stored outside the public part of the site, in a database accessible only to a dedicated system account for the form. The server is updated regularly and only I have access to the data. The site server makes encrypted backups every night, so deleted data may remain in those backups for up to seven months until newer ones replace them.
Children
The site and the form are meant for businesses and adults. A person under 15 should not send an enquiry without the consent of a parent or guardian. If I learn that this happened, I delete the data.
Changes
When the way data is processed changes, I update this page and its last-updated date. The terms of use are on the Terms of use page.