Privacy Policy

1. Who is responsible

The controller is Flyntech, obrt za računalno programiranje, vl. Ivan Benko, Ulica Mirka Grabera 24, 10410 Velika Gorica, Croatia (OIB 62979576382), the business through which Ivan Benko works. Email: ivan@ib.actor. We aren’t required to appoint a data protection officer, so write to that address about anything in this policy.

2. What we collect, why, and for how long

When you visit the site

• What: your IP address, browser, the page requested and the time, processed by Cloudflare, which hosts the site and protects it from attacks. Cloudflare Web Analytics, a small script from Cloudflare, counts page views without cookies or local storage: the page, the referring site, browser, operating system and device type, country, and how fast the page loaded.
• Why and legal basis: to deliver the site, keep it secure and see which pages are read. Our legitimate interest (GDPR Art. 6(1)(f)) in a working, safe site.
• How long: Cloudflare keeps request logs briefly for security; we see analytics only as totals, never per person. Fonts and scripts come from this site itself, so visiting sends nothing to Google or to any third party other than Cloudflare.

When you use the contact form

• What: your name, email address and message. To tell people from bots, Cloudflare Turnstile checks your browser and IP address; the result, not the details, comes back to us.
• Why and legal basis: to answer you. Steps you asked for before a possible contract (Art. 6(1)(b)), or our legitimate interest in replying to questions (Art. 6(1)(f)); Turnstile, our legitimate interest in keeping spam out.
• How long: the message passes through a Cloudflare queue on its way to our mailbox and is deleted from it once delivered, or after one day at most. From then on it’s an email (next section). The form’s own logs record only whether a message was sent or why it was refused, never your details.

When you email, call or message us

• What: whatever you send: your name, email address or phone number, the message, and any script or file.
• Why and legal basis: to reply, quote and plan the work (Art. 6(1)(b) and (f)).
• How long: if no job follows, we delete the conversation one year after the last message. WhatsApp is optional and run by Meta, which handles your data under its own policy; use email if you prefer.

When you’re a client

• What: contact and billing details (name, company, address, VAT number or OIB), the quote, any agreement or NDA, scripts, recordings, invoices and payments. Billing details are needed to make the contract and issue the invoice the law requires, so without them we can’t take the job.
• Why and legal basis: to do the work and get paid (Art. 6(1)(b)), and to keep the records Croatian tax and accounting law requires (Art. 6(1)(c)).
• How long: project files and correspondence three years after delivery, so files can be sent again and lines added later and in case of a claim (the limitation period for business contracts); for consumers, quotes, agreements and correspondence five years, the general limitation period; invoices and accounting records 11 years (Croatian accounting law; fiscalized e-invoices 6 years); complaints one year, as the Consumer Protection Act requires.

If you choose a theme

Picking light or dark stores that choice in your browser’s local storage, on your device only. It’s never sent to us, and clearing your browser’s site data removes it.

3. Cookies and tracking

We set no cookies for analytics, advertising or tracking. Turnstile, on the pages with the contact form, may keep a short-lived security token to tell people from bots, and nothing else. Your theme choice stays on your device. Because nothing is tracked across sites or sold, there’s nothing for a Do Not Track or Global Privacy Control signal to switch off.

4. Who else handles your data

We don’t sell personal data or share it for advertising. It reaches only:

• Cloudflare, Inc. (USA): hosting, security, Web Analytics, Turnstile, and the Workers, Queues and Email Routing that carry the contact form to our mailbox. A processor under a data processing agreement. For Turnstile, Cloudflare also uses the signals itself, as a controller, to improve its bot detection.
• Heinlein Hosting GmbH (mailbox.org, Germany): our email, where messages and files are stored. A processor under a data processing agreement.
• COAX d.o.o. (Croatia): invoicing and fiscalization, through Solo (solo.com.hr). A processor under the data processing terms in its terms of use. From January 1, 2027, e-invoices to Croatian business clients also go through monoform d.o.o. (Doku, doku.hr, Croatia), a certified information intermediary, and the client’s own intermediary, as the Fiscalization Act requires.
• File transfer, video call and remote recording services: Google Drive, Dropbox, WeTransfer, (S)FTP or Amazon S3 for files, Zoom, Microsoft Teams, Google Meet or Discord for calls, and Cleanfeed, SessionLinkPRO or ipDTL for studio-quality audio. When you send the link or invite us to your session, your provider handles it under your agreement with them. When we do, the provider handles it under its own terms, and under a data processing agreement where it offers one.
• The payment provider you pay through (your bank, Wise, Revolut, the card processor or PayPal), and the Croatian Tax Administration, through Fina’s fiscalization system, where tax and fiscalization law requires it.
• Courts or authorities, only when the law obliges us.

5. Transfers outside the EU

Cloudflare is based in the United States, and so are most of the file transfer and call services in section 4. Transfers to them rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s Standard Contractual Clauses in its terms. Transfers to the UK rely on the Commission’s adequacy decision. Our email stays in Germany, and our invoicing in the EU.

6. Your rights

Under the GDPR (and the UK GDPR), you can:

• see the data we hold about you and get a copy (Art. 15);
• have it corrected (Art. 16) or deleted (Art. 17);
• have its use restricted (Art. 18);
• receive it in a common, machine-readable format (Art. 20);
• object to any use based on our legitimate interest (Art. 21), and we stop unless we have overriding grounds;
• complain to a supervisory authority.

Write to ivan@ib.actor, ideally from the address you used before, so we can confirm it’s you. It’s free, and we answer within one month (in complex cases we may extend that by two months and tell you why). In Croatia the supervisory authority is the Personal Data Protection Agency (AZOP); in the UK, the Information Commissioner’s Office; you can also complain where you live or work.

Data needed for invoices and the law can’t be deleted before its period ends, and we’ll say so if that applies. We make no decisions about you by automated means alone, and we don’t profile anyone.

7. California and other US states

California’s Consumer Privacy Act (CCPA, as amended by the CPRA) applies only to businesses above its thresholds, such as annual revenue over $26.6 million; we’re far below them, as we are for other US state privacy laws. We still give California residents the same answers:

• Categories collected in the last 12 months: identifiers (name, email, phone, IP address), commercial information (quotes, invoices) and limited internet activity (pages visited), from the sources and for the purposes in section 2.
• We don’t sell or share personal information, including for cross-context behavioral advertising, and don’t use sensitive personal information to infer anything about you.
• You can ask to know, correct or delete your information, through an authorized agent if you like, and you won’t be treated differently for asking. Requests go to ivan@ib.actor.

8. Children

The site isn’t aimed at children, and clients must be 18 or represented by a parent or guardian (see the Terms). If you believe a child under 16 has sent us personal data, tell us and we’ll delete it.

9. Security

The site is served only over HTTPS, with a strict content security policy and Cloudflare’s protection. The contact form keeps no personal data in its logs, and form messages are held for one day at most on their way to our mailbox. Access to email and client files is limited to Ivan. No system is perfectly secure; if a breach put your rights at risk, we’d tell you and the supervisory authority as the law requires.

10. Changes to this policy

When this policy changes, the new version is posted here with a new effective date. If a change affects how we use data you’ve already given us, we’ll tell you by email. Every version stays online as a page and a PDF, with the dates it was in effect.

11. Contact

Privacy questions and requests: ivan@ib.actor, or by mail to Flyntech, obrt za računalno programiranje, vl. Ivan Benko, Ulica Mirka Grabera 24, 10410 Velika Gorica, Croatia.