Privacy policy
What data we collect, why, who we share it with and how you can have it deleted.
Last updated: 30 July 2026
Who is the data controller
The controller of your personal data is the entity listed below. Contact them for any question or request regarding your data.
- Name
- KAIROS digital, obrt za usluge, vl. Ivan Vinger
- Registered address
- Ul. 43. istarske divizije 8, 51211 Matulji, Croatia
- Tax number (OIB)
- 85377074076
- Phone
- +385 91 601 3692
Given the size and nature of our processing we have not appointed a data protection officer. All requests are handled directly by the controller at the email address above.
What data we collect
We only collect data you send us yourself through the forms on this site. We do not buy databases, we do not gather data from other sources and we do not build visitor profiles.
Contact form
Full name, email address, phone number (optional), the service you selected and your message.
Free digital audit form
Name, business name, Instagram profile or website address, phone number and email address.
Server logs
Our hosting provider automatically records IP address, browser type and access time for security and abuse detection. We do not use these logs for analytics or to identify individual visitors.
Why we collect it and on what legal basis
We use form data solely to reply to your enquiry, prepare a quote or produce the audit you requested. We do not use it for a newsletter, we do not send promotional messages and we do not sell it to anyone.
- Replying to your enquiry and preparing a quote — the legal basis is your consent, given by submitting the form, and steps taken prior to entering into a contract (GDPR Art. 6(1)(a) and 6(1)(b)).
- Automatic confirmation that your enquiry was received — the email we send you immediately is part of the same processing operation.
- Site security and technical logs — our legitimate interest in protecting the system from abuse (GDPR Art. 6(1)(f)).
We do not carry out automated decision-making or profiling that would have a legal effect on you.
Who your data is shared with
To run this site we use external service providers who process data on our behalf and strictly on our instructions. All of them are listed in the table. We do not share your data with anyone else unless required by law.
| Provider | What it processes | Location |
|---|---|---|
| Netlify, Inc. | Site hosting and form submissions (Netlify Forms) | USA |
| Resend, Inc. | Sending the automatic confirmation of your enquiry | USA |
| Google Ireland Ltd. | Displaying the location map on the “About us” page (Google Maps) | EU / USA |
Transfers outside the EU
Netlify and Resend are established in the United States, which means your data is transferred outside the European Economic Area. That transfer relies on the European Commission’s standard contractual clauses, or on the EU–US Data Privacy Framework for providers certified under it.
How long we keep your data
- Enquiries that do not lead to a project — up to 12 months from the last communication, after which they are deleted.
- Enquiries that do lead to a project — for the duration of the contractual relationship and thereafter for as long as accounting and tax rules require.
- Server logs — in line with our hosting provider’s retention policy, typically up to 30 days.
If you ask us to delete your data sooner, we will do so immediately, except for records we are legally required to keep.
Cookies and tracking
This site does not use cookies for tracking, analytics or advertising. There is no Google Analytics, no Meta Pixel, no ad scripts and no profiling. That is also why there is no cookie consent banner — there is nothing to consent to.
The only exception is the Google Maps map embedded on the “About us” page. When you open that page, Google may set its own cookies. If you want to avoid that, simply do not open that page — the map is not loaded anywhere else on the site.
If we introduce any analytics in the future, this policy will be updated before the script goes live, and if that analytics uses cookies you will also be asked for consent.
Your rights
At any time you have the right to:
- request access to the data we hold about you and a copy of that data;
- request correction of inaccurate or incomplete data;
- request erasure of your data (the “right to be forgotten”);
- request restriction of processing;
- request transfer of your data in a machine-readable format;
- object to processing based on legitimate interest;
- withdraw your consent at any time, without giving a reason.
Send your request to ivan@kairosdigital-hr.com. We reply within 30 days at the latest. The request is free and we do not require you to justify it.
Complaint to the supervisory authority
If you believe we process your data unlawfully, you have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr. We would prefer you contact us first — it is most likely a misunderstanding we can settle in a single email.
Security
The site is served exclusively over HTTPS with HSTS enabled, security headers and a restrictive content security policy. Only the controller has access to submitted enquiries, through an account protected by two-factor authentication.
Changes to this policy
If the way we process data changes — for example if we introduce analytics or switch provider — we will update this page and change the date at the top. Material changes will be announced before they take effect.