Privacy policy

    Last updated: September 2026

    This policy explains which personal data this website processes, why, and what rights you have. It is short because we collect little: there are no user accounts, no newsletter, and no database behind this site.

    Who is responsible

    The controller within the meaning of the GDPR and the Serbian Law on Personal Data Protection (ZZPL) is:

    Insajt Konsalting

    IV Crnogorska 28i

    36000 Kraljevo

    Serbia

    Contact form · Full company details are in the legal notice.

    When you visit this website

    The site is hosted by Vercel Inc. (USA). To deliver pages and keep the service secure, Vercel's servers automatically process technical data about each request: your IP address, the date and time, the page requested, the page you came from, and your browser and operating system. We use this data only to run the site and to investigate faults or abuse, and it is kept only as long as that requires.

    Legal basis: our legitimate interest in a secure, reliable website (Art. 6(1)(f) GDPR). Vercel processes the data on our behalf.

    When you use the contact form

    We process what you enter — your name, email address, and message — together with the page and language you wrote from and the time you sent it. We use this only to answer you and to deal with your enquiry.

    Your message goes from our server function at Vercel to a script in our Google account (Google Apps Script, Google LLC, USA), which delivers it to our email inbox (Gmail). You may receive an automatic confirmation that it arrived; the confirmation contains nothing you wrote. This website does not store your message in any database.

    Legal basis: steps taken at your request before a possible contract (Art. 6(1)(b) GDPR) and our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). Giving us your details is voluntary, but without an email address we cannot reply.

    We keep your enquiry for as long as it takes to deal with it. If it leads to a contract, we keep it for as long as commercial and tax law require; otherwise we delete it once the matter is closed.

    Spam protection

    To keep automated spam out, the contact form uses Cloudflare Turnstile (Cloudflare, Inc., USA). When a page with the form opens, your browser loads Turnstile from Cloudflare; when you send a message, Turnstile checks that the request comes from a person. For this, Cloudflare processes your IP address and technical information about your browser.

    Our server also holds your IP address and email address briefly in working memory to limit repeated submissions; they expire after one hour and are never written to disk or to a database. If a submission is rejected as spam or over the limit, the server logs the reason, which can include the IP or email address; Vercel keeps these logs only briefly.

    Legal basis: our legitimate interest in protecting the form against spam and abuse (Art. 6(1)(f) GDPR). Where information on your device is accessed for this, doing so is strictly necessary to provide the contact form securely (Section 25(2) no. 2 TDDDG).

    Analytics with Hotjar — only with your consent

    If you click “Allow analytics”, we use Hotjar (Hotjar Ltd., Malta) to understand how visitors use the site — for example which pages they read, where they click, and how far they scroll — so that we can improve it. Hotjar sets cookies for this, lasting from a single visit up to one year, and processes your IP address and information about your device.

    Hotjar does not load until you agree. Legal basis: your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time under “Cookie settings” at the bottom of every page; we then delete Hotjar's cookies and stop loading it. Withdrawing consent does not affect processing that took place before.

    What we store in your browser

    This website sets no cookies of its own. It keeps three settings in your browser's local storage: your colour theme, your language, and your analytics choice. They stay on your device and are not sent to us. Legal basis: they are necessary for the functions you choose (Section 25(2) no. 2 TDDDG). You can delete them at any time in your browser settings.

    Links to other websites

    Links to LinkedIn and to the projects in our portfolio are plain links. No data is sent to those sites unless you click one; from then on, their own privacy policies apply.

    Transfers outside the EU

    We are based in Serbia. Because this website is also aimed at people in the EU, we apply the GDPR alongside Serbian law. Some of the providers named above are based in the USA. Transfers there rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the EU standard contractual clauses (Art. 46(2)(c) GDPR).

    Your rights

    You have the right to access your data, to have it corrected or deleted, and to have its processing restricted; the right to data portability; and the right to object to processing based on legitimate interests (Art. 15–18, 20, and 21 GDPR). Where we rely on your consent, you can withdraw it at any time with effect for the future.

    To exercise these rights, use the contact form or write to us at the postal address above. You can also lodge a complaint with a data protection supervisory authority — in the EU, in particular the one where you live or work; in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection.

    We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.