Privacy policy

The controller of any personal data described here is KriPa Web, obrt za računalno programiranje, vl. Kristijan Pavlic Tumpa, with its registered office at Vankina ulica 8, 10000 Zagreb, Croatia, European Union, OIB 27744574396.

For anything to do with your data, write to kripaweb@kripaweb.com. Full registration details are on our legal notice.

When you use the contact form. The form asks for:

• Name, so we know who we are replying to.
• Email address, so we can reply at all.
• Company, optional, and only to understand the context of the enquiry.
• Your message, the description of what you need.

Nothing on the form is hidden. What you type is what we receive. We do not enrich it with data from anywhere else, and we do not add you to a mailing list.

Your message is saved as a record and also sent to us as an email. The record exists so that a message is not lost if email delivery fails, which would otherwise mean nobody ever knew you had written.

Before it is accepted, the form runs two checks. A count of recent submissions stops the form being flooded, and a spam check tells a person from a script. The count is kept against a one-way fingerprint of your network address rather than the address itself, so nothing that could identify you is stored. Neither check is used to build a picture of you. The spam check is provided by Cloudflare and runs inside a frame served by them, so it happens on their page rather than on ours. Most people never see anything at all.

When you simply visit. Our hosting provider records ordinary server logs: the IP address of the request, the page asked for, the time, and the browser identification string your browser sends. These are kept briefly and used to keep the site running and to investigate faults or abuse.

Your answer to the measurement question is recorded. When you choose, we keep a note of the choice, which version of this policy it was given against, when it was made, and a one-way fingerprint of your network address. We do this because the law requires us to be able to show that consent was actually given, and an answer kept only in your own browser proves nothing to anybody else.

What that note deliberately does not contain is your address or your browser identification. Proving that somebody agreed does not require a picture of them, and keeping the most detail about the people who declined would be the worst possible shape for such a record. Your browser keeps the reference to the matching entry, so you can quote it to us; we cannot look you up with it.

Only if you allow it, which pages get visited. We count page views: which page was opened, where the visit came from if you arrived by following a link, your country, and the sort of browser and device you used. It tells us whether anyone is finding the site and which pages are worth improving. No cookie is involved and nothing is stored on your device. So that one person reading three pages is not counted as three people, a short-lived value is worked out from your request and used for nothing else. It is not kept as a lasting identifier and it is not used to follow you anywhere.

Only if you allow it, how quickly the page loaded. Your browser reports timing measurements back to us: how long the page took to become visible and usable, along with which page it was, your browser and device type, and an approximate location worked out from the connection. We use it to find pages that are slow for real visitors on real connections, rather than fast on our own machines. No cookie is involved, nothing is stored on your device, and it is not used to identify you or to recognise you on a later visit.

• We set no cookies on any page you can reach. The only thing kept on your device is your answer to the measurement question, which stays in your browser and never reaches us as data about you. A private area used to answer enquiries sits behind a sign-in and does use a session cookie, but there is nothing there for a visitor to reach. See our cookie policy.
• We use no advertising or marketing trackers: no tracking pixels, no ad networks, no social buttons reporting back, no session recording, and no heatmaps. What we measure is described above and goes no further than it says.
• Our fonts are served from our own site, so visiting does not tell any font provider that you were here.
• We do not build a profile of you, and no decision about you is made automatically. What we see are numbers about pages, not histories about people.
• We never sell personal data. There is nothing to sell.

Under the General Data Protection Regulation we rely on two grounds:

• Steps taken at your request before entering a contract (Article 6(1)(b)). You asked us a question about work; we need your details to answer it.
• Your consent (Article 6(1)(a)) for the page view counting and the loading measurements. Nothing is loaded until you allow it, and you can withdraw at any time from cookie settings or the small button in the corner of any page, as easily as you gave it. Withdrawing stops it immediately and does not make what went before unlawful.
• Our legitimate interests (Article 6(1)(f)) in keeping the site available, secure, and free of automated abuse. This covers the server logs, the submission counting and the spam check, none of which we can switch off without losing the ability to run the site safely.

We keep the list of parties who handle data on our behalf short, and each is bound by a data processing agreement:

• Our hosting provider (United States). Hosts the site and serves it to your browser. Its servers keep short-lived request logs, which include IP addresses, and it receives the page loading times your browser reports back to us.
• Resend (United States). Delivers the message you send through the contact form to our inbox.
• Supabase (Stored in the European Union, provider established in the United States). Stores the enquiry you send, so that a message is not lost if email delivery fails, and keeps the record of your answer to the measurement question.
• Upstash (Stored in the European Union, provider established in the United States). Counts recent submissions so that the form cannot be flooded. It holds a count against a one-way fingerprint of your network address, never the address itself, and never your message.
• Cloudflare (Global network). Runs the spam check on the contact form. It sees the request in order to tell a person from a script, and is not used to profile you.
• Google Workspace (European Union and United States). Hosts our mailbox, so it stores the correspondence once it arrives and any reply we send you.

Beyond these, we disclose personal data only where the law requires it of us.

Some of the providers above are established in the United States. Where personal data reaches them, the transfer is covered by the European Commission’s Standard Contractual Clauses, or by the provider’s certification under the EU-US Data Privacy Framework, together with the technical safeguards those instruments require.

• An enquiry that does not lead to work: 12 months from the day you wrote, then deleted, both the stored record and the correspondence. The deletion runs on a schedule rather than waiting for somebody to remember. No law requires us to keep any of it, so we do not keep it long.
• Correspondence with clients: for as long as we are working together, and 5 years after that. That matches the general limitation period for claims under Croatian law, so that we can still answer a claim if one is made.
• Invoices and business records: 6 years from the end of the year the record belongs to, which is how long Croatian tax law requires us to be able to produce them. This period is set by law rather than chosen by us, and we cannot delete these records early even if you ask us to.
• The record of your measurement choice: 24 months from the day it was made. Proof of consent has to outlive the consent itself, or it says nothing about the period it covered.
• Server logs: kept briefly by our hosting provider and then discarded automatically.

You can ask us for a copy of your data, to correct it, to delete it, to restrict what we do with it, to receive it in a portable form, or to object to our use of it. These are set out in full, with how to use them and how quickly we answer, on our data protection rights page.

If you think we have handled your data badly, we would rather hear it from you first. You are also entitled to complain to the Croatian supervisory authority, Agencija za zaštitu osobnih podataka (AZOP), Ulica Metela Ožegovića 16, 10000 Zagreb, Croatia, +385 1 4609 000, azop.hr, or to the authority in the country where you live.

This site sells professional services to businesses. It is not directed at children, and we do not knowingly collect their data.

If what we do changes, this page changes first, and the date at the top changes with it. We do not make quiet edits.