Privacy policy

Controller

The controller is D. Svilenković, who runs this website and answers enquiries. Where this policy says "I", it means D. Svilenković.

Email: dimitrije@novisajtovi.com. Phone: +381 61 224 8989.

For any question about your data, or to make a request under this policy, email dimitrije@novisajtovi.com or call +381 61 224 8989.

In short

The site uses no social media pixels or ad networks. Analytics (Google Analytics 4) runs only if you accept it in the cookie banner. Its fonts and scripts load from this server. Without your consent, the only external service the site loads by itself is Cloudflare Turnstile, the enquiry form protection described below.

I process your data when you send an enquiry, email or call me, when I send you a business message, and in server logs.

The pre-launch checklist and the 301 redirect generator run in your browser and send nothing to the server. In the browser they remember only the generator settings and, if you enable it, the checklist marks.

I do not sell your data, share it for advertising or use it for profiling.

Enquiry form

The form at the bottom of every page sends your full name, your message and at least one contact method, email or phone. The page language and the address of the page you send it from are added automatically. With the enquiry, the server records the time it was received and your browser details (user agent). It does not store your IP address: it stores only a one-way hash that changes every day and cannot be turned back into the address, used to limit the number of enquiries from the same network.

I use enquiry data to reply and, if you ask for a launch, migration, new website or maintenance, to prepare an offer. The legal basis is taking steps at your request before entering into a contract (Article 12(1)(2) of the Law; Article 6(1)(b) GDPR). Please do not send passwords, login details or special categories of data such as health or religious information.

Before sending, your browser solves a short computational task issued by my server, and the form has a hidden field that only automated programs fill in. These safeguards collect no further data about you.

The enquiry is stored in the forms service database on the site server, outside the public part of the site, and then forwarded as an email to my mailbox dimitrije@svilenkovic.com on the mail server. If you left an email address, it also receives an automatic confirmation of receipt from no-reply@novisajtovi.com, without the text of your message. No confirmation is sent if the form was submitted without JavaScript, and the same address receives at most two confirmations in 24 hours. The database record is deleted automatically three months after receipt. The copy in the mailbox is kept as business correspondence (see "When you email or call me").

Form protection: Cloudflare Turnstile

Your browser loads Cloudflare Turnstile from challenges.cloudflare.com, a check that tells people apart from automated programs, only when you start using the form, that is, when you click or tap it or enter one of its fields. Cloudflare, Inc. processes your IP address, browser identifier (User-Agent), a technical fingerprint of the encrypted (TLS) connection and the address of the site running the check. Cloudflare does not receive the contents of the form fields. When you send the form, my server verifies the result with Cloudflare.

The legal basis is my legitimate interest in protecting the form from spam and automated submissions (Article 12(1)(6) of the Law; Article 6(1)(f) GDPR). For the check itself Cloudflare acts as my processor. It also uses the same data to improve its bot protection, and for that it is an independent controller. Under its privacy addendum, linked below, it does not use the data to identify, profile or target individuals. If you prefer to avoid this check, email me directly at dimitrije@novisajtovi.com.

Cloudflare Turnstile Privacy Addendum

When you email or call me

When you email dimitrije@novisajtovi.com or call +381 61 224 8989, I use your name, contact details and message to reply and to agree on the work (Article 12(1)(2) of the Law; Article 6(1)(b) GDPR). If we sign a contract, I process the data needed for the contract and invoice to perform the contract and meet legal obligations, mainly accounting ones (Article 12(1)(2) and (3); Article 6(1)(b) and (c) GDPR).

I keep correspondence while we discuss the work or work together, and afterwards only as long as needed for contractual obligations, invoices and possible complaints. Invoices and other accounting records are kept for the periods set by the Serbian Accounting Law. Correspondence that did not lead to a project is deleted earlier on request.

If you received a business message from me

From addresses on this and my other domains I send short business messages to companies and organisations that might benefit from a new or improved website. I find the contact on the company's public website or in a public business directory. I use the company name, business email address, website address and public information from that website, such as its field and location, and I record when I wrote and what you replied.

The legal basis is my legitimate interest in offering my services to businesses (Article 12(1)(6) of the Law; Article 6(1)(f) GDPR). You can object at any time: reply with the word "unsubscribe" or email dimitrije@novisajtovi.com. I then add the address to a suppression list and no further messages are sent to it from any of my addresses. Only the address stays on that list, so that I can respect your request. Other company data is kept while cooperation remains possible and deleted immediately on request.

Checklist and generator

The pre-launch checklist and the 301 redirect generator, in Serbian and in English, run only in your browser and send nothing to the server. The URLs and domains you enter in the generator are not stored anywhere, neither on the server nor in the browser. Copied lists and rules go to your device's clipboard, and a downloaded rules file is created in the browser.

What exactly the tools remember in the browser, and how to clear it, is described under "Cookies and browser storage".

Server logs

Like any web server, the server logs each request: IP address, time, page address without the part after the question mark, referring page (also without that part), server response and browser details. Error logs may contain the IP address and page address. I use logs only for security and troubleshooting, based on my legitimate interest in keeping the site running and protecting it from attacks and abuse (Article 12(1)(6) of the Law; Article 6(1)(f) GDPR). They are deleted automatically after 14 days.

Cookies and browser storage

Until you choose in the cookie banner, the site sets no cookies and loads no analytics. The cc_consent cookie remembers your choice for one year, and Google Analytics cookies are set only if you choose “Accept” (see “Analytics (Google Analytics 4)”). Browser storage (localStorage), on your device only, holds only what a feature you chose needs:

Serbian 301 redirect generator settings, under the key novisajtovi:generator:v1: the server (nginx, Apache or both), the redirect code (301 or 308), whether query parameters are kept or dropped, and three options (trailing slash, letter case, whole domain). They are written as soon as you change one, so you do not have to choose them again. URLs, domains and the system chosen for the check commands are not stored. The English generator stores nothing.

Serbian pre-launch checklist marks, only if you turn on remembering, under the key novisajtovi:checklista:v1: the selected mode, the items marked as done or not applicable, and the time of the last change. Turning remembering off deletes the record. The clear-all button removes the marks; while remembering is on, only the mode and the time of the change then stay in the record.

English checklist marks, only if you turn on remembering, under the key novisajtovi:checklist:en:v1: the selected mode and the marked items. Turning remembering off or resetting the list deletes the record.

This data does not leave your device and is not used for tracking. This storage needs no separate consent because it only serves a function you explicitly requested (Serbian Electronic Communications Law, Article 160(5)). That is why the cookie banner asks only about analytics. You can clear it by deleting this site's data in your browser settings. Turnstile runs in a separate frame from a Cloudflare address, under the rules in the form protection section.

Who else has access

I do not sell or share your data, except where the law or an order of a competent authority requires it. Access is limited to those without whom the site and email cannot run, and only as needed: netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany, as processor: the site, the enquiry database and server logs are on its server in Nuremberg; Hetzner Online GmbH, Gunzenhausen, Germany, as processor: email is on its server; Backblaze, Inc., as processor: encrypted server backups are kept in its storage in Amsterdam, the Netherlands, and Backblaze does not hold the key; Cloudflare, Inc., USA, for form protection (Turnstile).

International transfers

The site and mail servers are in Germany, and the backups are in the Netherlands. States party to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, including Germany and the Netherlands, are considered to provide an adequate level of protection (Article 64(2) of the Law), so no separate authorisation is needed.

Cloudflare may process check data in the USA as well. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has found an adequate level of protection (Article 64(2) of the Law; Article 45 GDPR), and provides for standard contractual clauses should that certification lapse.

Your rights

You have the right to: find out whether I process your data and obtain access and a copy (Article 26 of the Law; Article 15 GDPR); have inaccurate data corrected and incomplete data completed (Article 29; Article 16 GDPR); have your data erased (Article 30; Article 17 GDPR); restrict processing (Article 31; Article 18 GDPR); receive the data you gave me in a common machine-readable format and transfer it to another controller, where processing is based on consent or a contract (Article 36; Article 20 GDPR); object to processing based on legitimate interest, and an objection to business messages is always accepted (Article 37; Article 21 GDPR); not be subject to a decision based solely on automated processing (Article 38; Article 22 GDPR).

Where processing is based on your consent, you can withdraw it at any time, as easily as you gave it, without affecting processing before the withdrawal (Article 15(3) of the Law; Article 7(3) GDPR). This site currently processes no data based on consent; if that changes, it will be listed here.

How to exercise your rights

Send your request to dimitrije@novisajtovi.com or call +381 61 224 8989. If I cannot reliably confirm that the request comes from you, I may ask for additional information to verify your identity.

I reply without undue delay and within 30 days of receiving the request at the latest. If the request is complex or there are several, I may extend this by another 60 days and will tell you so, with the reasons, within the first 30 days. Exercising your rights is free of charge. For a manifestly unfounded or excessive request, in particular a repeated one, I may charge the necessary administrative costs or refuse to act (Article 21 of the Law; Article 12 GDPR).

Complaint to the supervisory authority

If you believe the processing of your data breaches the Law, you can lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (Article 82): Bulevar kralja Aleksandra 15, 11120 Belgrade, Serbia, office@poverenik.rs, +381 11 3408 900. A complaint does not affect your right to judicial protection. If you live in the European Union, you can also contact the supervisory authority in your country.

www.poverenik.rs

Do you have to provide data?

Providing data is neither a legal nor a contractual requirement. Without a name, a message and one contact method the enquiry cannot be sent, so I cannot reply; instead of the form you can email or call me. No personal data is needed to read the site or use the tools.

Automated decision-making

I do not make decisions based solely on automated processing, including profiling, that produce legal effects for you or similarly significantly affect you. The automated form protection only stops submissions that look like a program; in that case you can email me directly.

Security

The site and email work only over encrypted connections (HTTPS and TLS). Enquiries are stored outside the public part of the site, in a database accessible only to a dedicated system account for the form. The server is updated regularly and only I have access to the data. The site server makes encrypted backups every night, so deleted data may remain in those backups for up to seven months until newer ones replace them.

Children

The site and the form are meant for businesses and adults. A person under 15 should not send an enquiry without the consent of a parent or guardian. If I learn that this happened, I delete the data.

Changes

When the way data is processed changes, I update this page and its last-updated date. The terms of use are on the Terms of use page.

Terms of use