LAST UPDATED 24 OCTOBER 2026
Privacy notice
Controller
PROGRAMER, ALEŠ KOVAČIČ, s.p., Žibernik 33, 3250 Rogaška Slatina, Slovenia; VAT ID SI18565441; ales@aleskovacic.com.
Data and purposes
When you email or order, I process the contact and business details you provide, the brief, correspondence, billing and VAT details, payment status and the delivered files. The purposes are answering enquiries and taking pre-contract steps, performing and administering the contract, invoicing and tax compliance, preventing abuse, securing the service and handling legal claims.
Legal bases
The bases are GDPR Article 6(1)(b) for pre-contract steps and the contract, Article 6(1)(c) for accounting and tax duties, and Article 6(1)(f) for proportionate security, abuse prevention and legal claims. I do not use enquiry or order data for unsolicited marketing and do not make solely automated decisions about customers.
Website and email providers
Marketing cookies and third-party analytics services are not used. When you submit an enquiry, the selected service, contact details, description, service-specific answers and optional budget and timeline are stored in the project’s private database and archive. The database is hosted by Neon in the EU. Bunny.net provides website and backend hosting and may process technical request data such as IP address, time, URL and browser information for delivery and security. Proton provides our email inbox and correspondence; Resend delivers transactional email, including sign-in links and notifications. The enquiry form does not place an order or collect a payment.
Optional website analytics and cookies
Only after you choose “Allow analytics”, our own Node analytics measures page views, selected clicks, elapsed time only while a page is visible and focused, the greatest scroll-depth quarter reached (0, 25, 50, 75 or 100%), and a coarse viewport category based on its initial width. These categories approximate the visible browser area, not device hardware. This helps us understand and improve the website. The legal basis is your consent under GDPR Article 6(1)(a). Rejecting has no effect on the website or enquiry form. You can withdraw or change your choice at any time using “Privacy settings” at the bottom of the page. We also respect Do Not Track and Global Privacy Control.
With analytics permission, a short-lived optional token may also link a successfully accepted enquiry to its current measured page. Analytics receives no form content or contact details. If context is unavailable, the enquiry continues normally without attribution. This does not establish a journey across separate document loads.
A first-party Secure cookie named __Host-node.analytics.v2.website stores a random browser identifier for up to 30 days; a session identifier stays only in memory, starts again on a full document navigation and rotates after 30 minutes of inactivity. The browser records your allow/reject choice separately in local storage (site.analytics-choice.v1) for 180 days. This preference is necessary to remember and respect your choice. We do not collect analytics before consent, replay earlier activity, fingerprint devices, or send form content, email, URL query strings, raw referrers, IP addresses or user-agent strings into the analytics dataset. Infrastructure providers may still process technical request data as described above.
The analytics dataset is stored in our private Node database and is not sent to advertising networks or external analytics services. Bunny.net and Neon process it as our hosting providers; these are hosted servers, not equipment we own. Individual analytics events are retained for 30 days. Additive historical totals without browser, session, page or event identifiers cover the current and 12 previous calendar months. Historical totals do not provide distinct-browser or session counts across months or reconstruct individual journeys. Withdrawal stops future collection and clears the browser identifier and unsent data; it does not identify or reverse previous totals. Counts of browsers and sessions estimate browsers and in-memory sessions, not identified people.
AI assistance
Our private administration can use an OpenAI-powered assistant. When an authorised administrator asks it to work with records or correspondence, the selected text and tool results needed for that request are sent to OpenAI. Website analytics collection itself does not contact OpenAI. The assistant can access analytics reports only when an authorised administrator requests it. OpenAI processing is subject to its API terms, data controls and applicable transfer safeguards. See OpenAI API data usage.
Recipients and transfers
Data is available only where needed to the service providers above (including OpenAI when AI assistance is used), professional accounting or legal advisers, and public authorities when legally required. Some providers may process data outside the EEA using an adequacy decision or other safeguards recognised by GDPR. Resend stores email data in the United States under its data-processing agreement and transfer safeguards. See Resend privacy, Resend DPA, Proton privacy, Bunny privacy, Neon privacy.
Retention
Enquiries that do not become an order are normally deleted 12 months after the last contact. Contract, invoice and tax records are retained for the statutory period, normally 10 years where Slovenian tax rules require it. Project files are deleted or returned when no longer needed for delivery, support or legal claims. Provider security logs follow the provider’s documented retention and legal duties.
Your rights
Subject to the conditions in GDPR, you may request access, correction, erasure, restriction, portability or object to processing based on legitimate interests. Write to the controller email above. You may complain to the Information Commissioner of the Republic of Slovenia. The EDPB rights overview explains these rights.
Required data
Contact details and the task brief are needed to answer or perform the request. Business, billing and tax data are needed to take payment and issue a correct invoice. Without them, I may be unable to accept the order.