Privacy policy

1. Data controller

The controller of personal data within the meaning of the General Data Protection Regulation (GDPR) is:

• STU DEVELOPMENT, sole proprietorship for services
• Owner: Jurica Stublić
• Address: Oreškovićeva 8f, 10000 Zagreb, Croatia
• VAT/OIB: 46839323933
• Email: jurica@webica.hr

For any question about the processing of your data you can contact me at jurica@webica.hr.

2. What personal data I collect

I collect data directly from you, through the contact form, along with the basic technical data needed for the site to run safely.

2.1. Contact form

• Name and surname
• Email address
• Company or project name (optional)
• Project type, rough budget and preferred timeline (optional)
• The content of your message

The form does not create a user account and the data is not stored in a database. Your enquiry reaches me as an email and stays in my business inbox.

2.2. Technical data

• IP address (security and abuse prevention)
• Browser and device type
• Date and time of access

2.3. Analytics (only with your consent)

If you accept analytics cookies, Google Analytics 4 records the pages visited, the source of the visit, an approximate location at city level, and the device and browser type. Google Analytics is configured so that the IP address is not stored. Without your consent the script does not load and no cookie is set, see section 7.

3. Purposes and legal bases for processing

• Replying to your enquiry and preparing a proposal, processed on the basis of steps taken prior to entering into a contract (Art. 6(1)(b) GDPR).
• Site security and abuse prevention, processed on the basis of legitimate interest (Art. 6(1)(f) GDPR).
• Measuring traffic and improving the site, processed on the basis of your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

I do not send a newsletter or marketing messages, and I do not use your data for profiling or for automated decision-making.

4. Third parties processing data

I use established technical partners to run the site. I have a data processing agreement (DPA) in place with each of them:

• Resend (USA, EU-US Data Privacy Framework), delivery of email from the contact form.
• Vercel (USA, EU-US Data Privacy Framework), hosting and CDN.
• Google Ireland Limited, Google Analytics 4, only with your consent.
• Calendly (USA, EU-US Data Privacy Framework), call scheduling, only if you click the link.

I do not sell your data and do not share it with anyone outside that circle, unless required by law.

5. Retention periods

• Contact enquiries: 12 months from the last communication. If an engagement follows from the enquiry, the documentation is kept for the statutory periods (accounting and tax rules).
• Technical logs: 90 days.
• Analytics data in Google Analytics: at most 14 months, after which it is deleted automatically.
• Your cookie choice: until you change it yourself or clear your browser data.

After those periods the data is permanently deleted, unless the law requires longer retention.

6. Your rights

Under the GDPR you have the following rights in relation to your personal data:

• Right of access (Art. 15)
• Right to rectification of inaccurate data (Art. 16)
• Right to erasure, the "right to be forgotten" (Art. 17)
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object to processing (Art. 21)
• Right to withdraw consent at any time

To exercise any of these rights, write to me at jurica@webica.hr.

Erasure: send the request by email from the address you used. I handle the request without undue delay and within one month at the latest, and confirm the erasure once done. Erasure is free of charge; exceptionally I may retain only data I am legally obliged to keep.

Withdrawing consent for analytics: at the foot of every page there is a "Cookies" link that reopens the choice. Withdrawing consent stops the analytics script from loading and deletes the associated cookies.

You also have the right to lodge a complaint with the supervisory authority: the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr.

7. Cookies

The site itself sets no cookie at all. Your analytics choice is remembered locally in the browser (localStorage, the webica-analytics-consent entry) and is not sent to the server.

Analytics cookies are set by Google Analytics 4, and only after you accept them:

• _ga, distinguishing visitors, duration 2 years.
• _ga_WZB1DMF23G, session state for this site, duration 2 years.

If you decline, the Google Analytics script does not load and none of those cookies are set. You can change your choice at any time through the "Cookies" link in the footer.

8. Changes to this privacy policy

I update this policy from time to time to keep it aligned with the law or with changes in how I work. The current version is always available on this page, and the date of the last change is given at the top of the document.