Privacy policy

Who is responsible for your data

The controller (voditelj obrade) is APPOTEKKA, obrt za računalno programiranje i druge usluge, vl. Kristina Knežević, Zagreb, Ulica Rudolfa Kolaka 8. Email: hello@appotekka.com.

Visiting this site

Cloudflare, Inc. (USA) hosts this site. To deliver the pages and protect the site, it processes the technical details of each visit: your IP address, browser, the page and the time. The legal basis is my legitimate interest in a secure site that works (Article 6(1)(f) of the GDPR).

Cloudflare may process this data in the United States. It is certified under the EU-U.S. Data Privacy Framework, which the European Commission has found to protect personal data as well as EU law does. I don’t keep these logs.

Sending me a message

When you write to me through the contact form or by email, I use your message to answer you and, if we decide to work together, to prepare a proposal and agree on the project. The legal basis is steps you ask me to take before we might sign a contract (Article 6(1)(b)). If you write on behalf of a company, or about something other than a project, it is my legitimate interest in answering the people who write to me (Article 6(1)(f)).

You don’t have to give me personal data, but without a name and an email address I can’t reply.

Trampoline Software SRL (Formspark, Belgium) receives what you send through the form, with your IP address, stores it in the EU and forwards it to my email. Google Ireland Limited (Google Workspace) stores my email.

To keep spam out, your browser solves a small calculation when you press Send and sends the answer with your message. Botpoison, run by the same company as Formspark, checks it. It receives your IP address, the type and language of your browser and the address of this site, and works out your approximate location and network from your IP address. It stores this in the EU and keeps a record of each check for up to 12 months. Nothing is saved in your browser. The legal basis is my legitimate interest in keeping the form free of spam (Article 6(1)(f)).

Google may process your data in the United States. It is certified under the EU-U.S. Data Privacy Framework.

I delete messages 12 months after our last exchange, in my email and in Formspark, unless we start working together. Formspark erases a deleted message 30 days later and keeps your IP address for 12 months.

Video calls

If we have a call and I host it, it runs on a video service such as Google Meet, Zoom or Microsoft Teams. The legal basis is the same as for messages. These services may process your data in the United States. Google, Zoom and Microsoft are certified under the EU-U.S. Data Privacy Framework.

Your rights

You can ask me for access to your data, to correct, delete or limit it, and to receive it in a common file format. You can object to processing based on my legitimate interest. To use any of these rights, email me. You can also complain to the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, azop.hr).

I make no automated decisions about you, including profiling.