PRIVACY / 010
This page explains what personal data the website webredesignstudio.com processes, why, on what legal basis, for how long and who has access to it, and how you can exercise your rights. It follows the Serbian Law on Personal Data Protection (Official Gazette of the Republic of Serbia No. 87/2018, the "Law"); for visitors in the European Union the General Data Protection Regulation (GDPR) also applies. Last updated: 16 October 2026.
The controller is D. Svilenković, who runs this website and answers enquiries. Where this policy says "I", it means D. Svilenković.
For any question about your data, or to make a request under this policy, email dimitrije@webredesignstudio.com or call +381 61 224 8989.
The form on the Contact page sends your name, your message and at least one contact method, email or phone, and, if you wish, your website address or project subject. The page language and the address of the page you send it from are added automatically. With the enquiry, the server records the time it was received and your browser details (user agent). It does not store your IP address: it stores only a one-way hash that changes every day and cannot be turned back into the address, used to limit the number of enquiries from the same network.
I use enquiry data to reply and, if you ask for a website or maintenance, to prepare an offer. The legal basis is taking steps at your request before entering into a contract (Article 12(1)(2) of the Law; Article 6(1)(b) GDPR). Please do not send passwords, login details or special categories of data such as health or religious information.
Before sending, your browser solves a short computational task issued by my server, and the form has a hidden field that only automated programs fill in. These safeguards collect no further data about you.
The enquiry is stored in the forms service database on the site server, outside the public part of the site, and then forwarded as an email to my mailbox dimitrije@svilenkovic.com on the mail server. If you left an email address, it also receives an automatic confirmation of receipt from no-reply@webredesignstudio.com, without the text of your message. No confirmation is sent if the form was submitted without JavaScript, and the same address receives at most two confirmations in 24 hours. The database record is deleted automatically three months after receipt. The copy in the mailbox is kept as business correspondence (see "When you email or call me").
When you open a page with the form, your browser loads Cloudflare Turnstile from challenges.cloudflare.com, a check that tells people apart from automated programs. Cloudflare, Inc. processes your IP address, browser identifier (User-Agent), a technical fingerprint of the encrypted (TLS) connection and the address of the site running the check. Cloudflare does not receive the contents of the form fields. When you send the form, my server verifies the result with Cloudflare.
The legal basis is my legitimate interest in protecting the form from spam and automated submissions (Article 12(1)(6) of the Law; Article 6(1)(f) GDPR). For the check itself Cloudflare acts as my processor. It also uses the same data to improve its bot protection, and for that it is an independent controller. Under its privacy addendum it does not use the data to identify, profile or target individuals (Cloudflare Turnstile Privacy Addendum, linked below). If you prefer to avoid this check, email me directly at dimitrije@webredesignstudio.com.
When you email dimitrije@webredesignstudio.com or call +381 61 224 8989, I use your name, contact details and message to reply and to agree on the work (Article 12(1)(2) of the Law; Article 6(1)(b) GDPR). If we sign a contract, I process the data needed for the contract and invoice to perform the contract and meet legal obligations, mainly accounting ones (Article 12(1)(2) and (3); Article 6(1)(b) and (c) GDPR).
I keep correspondence while we discuss the work or work together, and afterwards only as long as needed for contractual obligations, invoices and possible complaints. Invoices and other accounting records are kept for the periods set by the Serbian Accounting Law. Correspondence that did not lead to a project is deleted earlier on request.
From addresses on this and my other domains I send short business messages to companies and organisations that might benefit from a new or improved website. I find the contact on the company's public website or in a public business directory. I use the company name, business email address, website address and public information from that website, such as its field and location, and I record when I wrote and what you replied.
The legal basis is my legitimate interest in offering my services to businesses (Article 12(1)(6) of the Law; Article 6(1)(f) GDPR). You can object at any time: reply with the word "unsubscribe" or email dimitrije@webredesignstudio.com. I then add the address to a suppression list and no further messages are sent to it from any of my addresses. Only the address stays on that list, so that I can respect your request. Other company data is kept while cooperation remains possible and deleted immediately on request.
The tool on the Redesign assessment page runs only in your browser. Your answers to the six questions (keep, change or rebuild) and the working direction derived from them are not sent to the server and are not stored, so they disappear when you close or reload the page.
The tool does not inspect your website, server, analytics or search performance and does not ask for your website address or personal data.
If JavaScript is turned off in your browser, the button only reopens the page and the selected answers are added to its address after the question mark; the server does not write that part of the address into its logs.
Like any web server, the server logs each request: IP address, time, page address without the part after the question mark, referring page (also without that part), server response and browser details. Error logs may contain the IP address and page address. I use logs only for security and troubleshooting, based on my legitimate interest in keeping the site running and protecting it from attacks and abuse (Article 12(1)(6) of the Law; Article 6(1)(f) GDPR). They are deleted automatically after 14 days.
Until you choose in the cookie banner, the site sets no cookies and loads no analytics. The cc_consent cookie remembers your choice for one year, and Google Analytics cookies are set only if you choose “Accept” (see “Analytics (Google Analytics 4)”). Browser storage holds only what a feature you chose needs:
This storage needs no separate consent because it only serves a function you explicitly requested (Serbian Electronic Communications Law, Article 160(5)). That is why the cookie banner asks only about analytics. You can clear it by deleting this site's data in your browser settings. Turnstile runs in a separate frame from a Cloudflare address, under the rules in the form protection section.
I do not sell or share your data, except where the law or an order of a competent authority requires it. Access is limited to those without whom the site and email cannot run, and only as needed:
The site and mail servers are in Germany, and the backups are in the Netherlands. States party to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, including Germany and the Netherlands, are considered to provide an adequate level of protection (Article 64(2) of the Law), so no separate authorisation is needed.
Cloudflare may process check data in the USA as well. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has found an adequate level of protection (Article 64(2) of the Law; Article 45 GDPR), and provides for standard contractual clauses should that certification lapse.
You have the right to:
Where processing is based on your consent, you can withdraw it at any time, as easily as you gave it, without affecting processing before the withdrawal (Article 15(3) of the Law; Article 7(3) GDPR). This site currently processes no data based on consent; if that changes, it will be listed here.
Send your request to dimitrije@webredesignstudio.com or call +381 61 224 8989. If I cannot reliably confirm that the request comes from you, I may ask for additional information to verify your identity.
I reply without undue delay and within 30 days of receiving the request at the latest. If the request is complex or there are several, I may extend this by another 60 days and will tell you so, with the reasons, within the first 30 days. Exercising your rights is free of charge. For a manifestly unfounded or excessive request, in particular a repeated one, I may charge the necessary administrative costs or refuse to act (Article 21 of the Law; Article 12 GDPR).
If you believe the processing of your data breaches the Law, you can lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (Article 82): Bulevar kralja Aleksandra 15, 11120 Belgrade, Serbia, office@poverenik.rs, +381 11 3408 900, www.poverenik.rs. A complaint does not affect your right to judicial protection. If you live in the European Union, you can also contact the supervisory authority in your country.
Providing data is neither a legal nor a contractual requirement. Without a name, a message and one contact method the enquiry cannot be sent, so I cannot reply; instead of the form you can email or call me. No personal data is needed to read the site or use the tool.
I do not make decisions based solely on automated processing, including profiling, that produce legal effects for you or similarly significantly affect you. The automated form protection only stops submissions that look like a program; in that case you can email me directly.
The site and email work only over encrypted connections (HTTPS and TLS). Enquiries are stored outside the public part of the site, in a database accessible only to a dedicated system account for the form. The server is updated regularly and only I have access to the data. The site server makes encrypted backups every night, so deleted data may remain in those backups for up to seven months until newer ones replace them.
The site and the form are meant for businesses and adults. A person under 15 should not send an enquiry without the consent of a parent or guardian. If I learn that this happened, I delete the data.
When the way data is processed changes, I update this page and its last-updated date. The terms of use are on the Terms of use page.
If you choose “Accept” in the cookie banner, the site measures visits with Google Analytics 4, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). The purpose is to see which pages are read and where visitors come from, so I can improve the site. The legal basis is your consent (Serbian Personal Data Protection Law, Article 12(1)(1), and Electronic Communications Law, Article 160). Consent is optional and the site works the same without it.
Until you choose, and if you choose “Necessary only”, Google Analytics is not loaded and sets no cookies. The site uses Consent Mode v2: everything is denied by default, and advertising signals and Google signals are turned off. Google Analytics 4 does not store IP addresses. Event data is kept for 14 months. Data may be transferred to the USA. Google LLC is certified under the EU–US Data Privacy Framework, for which the European Commission has found an adequate level of protection (Personal Data Protection Law, Article 64(2)). Google also applies standard contractual clauses.
Cookies: cc_consent remembers your choice for one year. Google Analytics sets _ga and _ga_<ID> only with consent, and they last up to 2 years.
You can change or withdraw your choice at any time with the “Cookie settings” button in the page footer. When you withdraw consent, the analytics cookies are deleted.