Privacy policy
1. Who is responsible
Spletno oblikovanje, Domen Bevec, s.p., Železna cesta 10a, 1000 Ljubljana, Slovenia. Registration number 7340567000. Email: dbevec@gmail.com. I haven’t appointed a data protection officer, as none is required for a business of this size and kind.
2. What is processed, why, and on which legal basis
2.1 Visiting the website
When you visit this site, the hosting provider Cloudflare, Inc. processes your IP address, browser information, the page you requested and the time, to deliver the site and keep it secure. Legal basis: legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Cloudflare handles these requests under its own privacy policy. This site’s own server code only records its errors, such as an email that couldn’t be sent, without any personal data; these notes are kept for 3 days.
2.2 Contacting me
When you send the contact form, your name, email address, subject and message are passed through this site’s server code on Cloudflare and delivered to my inbox by email; they are not stored on the website. You can also simply email me. I use these details to answer your request. Legal basis: steps taken at your request before a contract, or legitimate interest in replying (Art. 6(1)(b) and (f) GDPR). Email is handled by Google (Gmail). Messages are kept as long as they’re needed to handle your enquiry and any project that follows from it.
2.3 Spam protection
The contact form uses Cloudflare Turnstile to tell people from bots. To do that, Cloudflare processes technical data such as your IP address and browser characteristics when the contact page loads, and again when you send the form (the site’s server code passes the check’s result and your IP address to Cloudflare to confirm it). Legal basis: legitimate interest in keeping the form free of spam (Art. 6(1)(f) GDPR). For this, Cloudflare acts on my behalf and says it can’t identify individuals from these signals. Separately, Cloudflare also uses them as a controller of its own, to improve Turnstile’s bot detection (see Cloudflare’s Turnstile Privacy Addendum).
2.4 Visitor statistics
To see how the site is used, for example which projects people look at, it uses Cloudflare Web Analytics. A small script from Cloudflare reports each page view: the page, the site you came from, your browser, device type and country (worked out from your IP address), and how quickly the page loaded. It sets no cookies, stores nothing on your device and doesn’t follow you across other websites; I only see totals, never individual visitors. Legal basis: legitimate interest in understanding how the site is used and improving it (Art. 6(1)(f) GDPR). Cloudflare processes this on my behalf under its Data Processing Addendum (section 4).
2.5 Interactive visuals
The hero figure and the ASCII portrait react to your pointer. This happens only in your browser; nothing about it is stored or sent anywhere. Fonts and all other files are served from this site itself; apart from the visitor statistics above and the Turnstile check on the contact page, no outside services are loaded.
3. Cookies and similar technologies
This site sets no cookies and stores nothing on your device. Its visitor statistics are cookieless (section 2.4), and it uses no advertising or tracking across sites. On the contact page, the Turnstile check runs in a frame loaded from Cloudflare (challenges.cloudflare.com). It sets no cookies on this site, and what it does on your device is strictly necessary to keep the form free of bots, so it doesn’t need your consent (Art. 5(3) of the ePrivacy Directive 2002/58/EC).
4. Recipients and processors
- Cloudflare, Inc. (hosting, content delivery, visitor statistics, the contact form’s email delivery and Turnstile spam check), under Cloudflare’s Data Processing Addendum.
- Google (Gmail, the mailbox your messages arrive in), under Google’s own terms and privacy policy.
5. Transfers outside the EU/EEA
Cloudflare and Google are based in the USA. Both are certified under the EU-U.S. Data Privacy Framework, which the European Commission has recognised as giving adequate protection (Art. 45 GDPR). Cloudflare also relies on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) should that certification lapse.
6. How long data is kept
Request logs: kept by Cloudflare under its own privacy policy; the site’s own error notes contain no personal data and are deleted after 3 days. Visitor statistics: only as totals, which Cloudflare keeps for a limited time and which don’t identify anyone. Emails: as long as they’re needed for your enquiry and any project that follows. Data that must be kept for accounting or tax purposes is kept for the period the law requires.
7. Your rights
You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16) or erased (Art. 17), and to restrict its processing (Art. 18). For data you gave me to arrange a project (Art. 6(1)(b)), you can ask for a copy in a portable format (Art. 20). You can object at any time to processing based on legitimate interests (Art. 21); I then stop unless I have compelling grounds or need the data for legal claims. Write to dbevec@gmail.com. You may also lodge a complaint with a supervisory authority (Art. 77), in Slovenia the Information Commissioner (Informacijski pooblaščenec, Dunajska cesta 22, 1000 Ljubljana, ip-rs.si).
8. Required data and automated decisions
You don't have to give any personal data to use this site, and no law or contract requires you to. To get a reply, I need an email address to answer to. No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place.
9. Changes
This policy is updated when the processing changes. The date at the top shows the latest version.