Privacy and cookies

The controller is DIGITAL AGE, vl. Davorin Prišlin, Kukoljina 14, 10090 Zagreb, OIB 41113852994 (Digital Age). Send questions about your data to davorin@digitalage.hr.

What I collect and why

When you submit the audit form, you enter your website address and email. I use them to produce and send the audit, follow up on it and answer your enquiry. There is no newsletter. The legal basis is a step you asked for before any contract (Art. 6(1)(b) GDPR).

When you leave an email for the waiting list, I use it only to tell you when a slot opens, on the same basis.

When you book a call, Cal.com collects your name, email, the time slot and any note you add, and emails them to me; I use them for the call and to answer your enquiry.

Alongside the form I store the enquiry reference, your cookie choice and, if you arrived through an ad or a tagged link, where the visit came from (UTM tags, referrer). To prevent abuse I use a hash of your IP address, never the address itself. The legal basis is my legitimate interest in keeping the forms safe and knowing where enquiries come from (Art. 6(1)(f)).

Cookies and third-party requests

Until you consent or start filling in a form, the site sets no cookies and makes no requests to third-party services. In your browser’s storage, not in a cookie, the site keeps only what it needs: your cookie choice, your display theme, where the visit came from until you submit a form, and the reference of a submitted enquiry.

I turn on Google Analytics (through Google Tag Manager) only if you consent (Art. 6(1)(a)). Google then sets its own cookies and receives data about the visit. You can withdraw consent as easily as you gave it, in the footer under “Cookie settings”.

The Cloudflare Turnstile security check loads only when you start filling in a form. The Cal.com calendar loads only when you click “Show calendar”, and Cal.com, as a third party, may set its own cookies.

Who else processes data

Cloudflare (serving the site, the enquiry database and the Turnstile check), Resend (sending emails), Cal.com (call bookings) and Google (the mailbox enquiries arrive in; Google Analytics only with consent). Each processes data only to provide that service. Some of them also process data in the United States; those transfers rely on the EU-US Data Privacy Framework or standard contractual clauses. I do not sell data or share it for advertising.

How long I keep data

An enquiry arrives in my email and in a database on Cloudflare. The database copy is a backup until I move the enquiry into my CRM, and it is deleted within 30 days of that move. The IP hash is deleted after two hours.

Enquiries that do not turn into work are deleted no later than 24 months after the last contact, or sooner if you ask. If you become a client, I keep business records for as long as accounting and tax law requires.

Your rights

You can ask for access to your data, correction, deletion, restriction of processing, portability or object to processing, and withdraw consent at any time. Write to davorin@digitalage.hr; I answer within one month. You also have the right to complain to the Croatian data protection authority (AZOP, azop.hr).