Privacy policy.

This is a translation for convenience. The Slovenian version is the authoritative one.

1. Introduction

This policy explains which personal data I process when you use leonkercmar.com, why, who receives it, how long it is kept and what rights you have. It follows the General Data Protection Regulation (Regulation (EU) 2016/679, GDPR), the Slovenian Personal Data Protection Act (ZVOP-2) and the Electronic Communications Act (ZEKom-2).

2. Data controller

Izdelava spletnih strani in spletne rešitve, Leon Kerčmar s.p.
Veščica 8B, 9000 Murska Sobota, Slovenia
Registration number: 7629028000
Email: kercmar.leon@gmail.com

Please send any questions about data processing, and any request to exercise your rights, to the email address above.

3. Data I process

• Contact form data: name, email address, message and any optional details you enter or select (company, project type, estimated budget). On a project page the project name is added automatically as the subject.
• Technical data when you submit the form: IP address and time of submission.
• Data for protecting the form against bots: when you start filling in the form, Google reCAPTCHA receives data about your device, browser and use of the page, including your IP address.
• Session data: a session cookie needed for the site to work and to protect the form.
• Analytics data (only with your consent): usage data collected by Google Analytics, such as pages viewed, approximate location, device and browser type.

The website does not collect special categories of personal data. Please do not include them in your message.

4. Contact and inquiry forms

All forms on the website (home page, service and project pages, About and Contact) use the same processing. When you submit a form:

• your message with the details you entered, your IP address and the time of submission is stored in the website database,
• a notification with the content of your message (without the IP address) is sent by email to my Gmail mailbox.
• before the message is stored, Google reCAPTCHA checks that the form is filled in by a person (see section 6).

The required fields (name, email address and message, and on some forms the project type) are needed to reply to your inquiry. All other fields are optional. With the checkbox you confirm that you have read this policy. This confirmation is not consent to processing; the legal bases are listed in the next section.

5. Purposes and legal bases

Where processing is based on legitimate interest, you can object to it at any time (see section 12).

6. Technical and security data

• To limit the number of messages, the IP address is used as an attempt counter that is deleted automatically after 10 minutes. At most 5 messages can be sent from the same IP address within that time.
• The form is protected by Google reCAPTCHA v3. The script loads only when you click into the form, so visitors who only read the page send nothing to Google. On submission Google assesses whether the form is filled in by a person; messages with a low score are not stored. Google may set or read its own cookies. Google's Privacy Policy and Terms of Service apply.
• The session cookie october_session expires after 2 hours and also protects the form against forged requests (CSRF).
• The hosting provider's server may automatically log technical data for each visit, such as the IP address, time of the request and the page requested. These logs are kept by the hosting provider to keep the server running and secure.

7. Analytics and cookies

The website uses Google Analytics 4 only if you allow it in the cookie notice. Until you choose “Accept”, the Google Analytics script is not loaded, no analytics cookies are set and your browser sends no requests to Google services, except for the reCAPTCHA protection, which loads only when you use the form (section 6).

According to Google, Google Analytics does not log or store IP addresses of users in the European Union; the IP address is used only to derive an approximate location on EU servers and is then discarded. Analytics cookies on this site expire after at most 13 months. Your choice is remembered for 12 months, after which you are asked again. You can withdraw consent at any time via “Cookie settings” in the footer; withdrawal does not affect the lawfulness of processing before it.

The list of cookies and how long they last is in the cookie policy.

8. Recipients and processors

I do not sell personal data or share it with anyone for marketing. Data can only be received by:

• NEOSERV d.o.o. (Slovenia), the hosting provider where the website server and database are located, as a processor,
• Google Ireland Limited (Ireland) as the provider of Gmail, where I receive message notifications,
• Google Ireland Limited as the provider of reCAPTCHA, when you use the contact form,
• Google Ireland Limited as the provider of Google Analytics, only if you have consented to analytics,
• competent authorities where required by law.

The live template previews are standalone pages without analytics. The contact page of the CONSTRUX preview contains a Google Maps map that loads only when you choose to show it; your browser then sends its IP address to Google. The other previews load no content from external servers.

9. Transfers to third countries

Google may also process data from Gmail, reCAPTCHA and Google Analytics in the United States. Such transfers rely on the European Commission's adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework, in which Google LLC participates.

10. Retention and deletion

• Form messages are deleted automatically from the website database 12 months after they are received.
• Message notifications and any further email correspondence in my mailbox are deleted at the latest 12 months after our last communication, unless we enter into a contract.
• If we enter into a contract, data needed to perform it is kept according to the contract and the statutory retention periods (for example for accounting records).
• The rate-limit counter is deleted after 10 minutes; the session cookie expires after 2 hours.
• Analytics cookies expire after at most 13 months. Data in Google Analytics is kept according to the retention setting of my Google Analytics account.
• If the hosting provider makes backups, deleted data remains in them until the backups are overwritten.

You can also ask me to delete your data at any time.

11. Data protection measures

• an encrypted HTTPS connection,
• protection of the form against forged requests (CSRF), a limit on the number of messages, a trap for automated submissions and Google reCAPTCHA,
• server-side validation and cleaning of submitted data,
• access to received messages only through the password-protected administration interface.

12. Your rights

Under the GDPR you have the right to:

• access your personal data (Art. 15),
• rectification of inaccurate data (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability where processing is based on a contract or consent (Art. 20),
• object to processing based on legitimate interest (Art. 21),
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3)).

13. How to exercise your rights

Send your request to kercmar.leon@gmail.com. I will reply without undue delay and at the latest within one month of receiving it. If I have reasonable doubts about your identity, I may ask for additional information to confirm it.

14. Complaints to the supervisory authority

If you believe the processing of your data breaches the law, you can lodge a complaint with the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, email gp.ip@ip-rs.si, website www.ip-rs.si.

15. Do you have to provide data

Providing data is not a statutory or contractual requirement, but without the required form fields I cannot reply. You can also email me directly instead of using the form.

16. Automated decision-making

I do not carry out automated decision-making or profiling that has legal or similarly significant effects on you.

17. Changes to this policy

I update this policy when the processing or the law changes. The current version is always published on this page, with the date of the last update at the top.