Privacy policy

Controller

The controller is D. Svilenković, who runs this website and answers enquiries. Where this policy says "I", it means D. Svilenković.

• Email: dimitrije@svilenkovicit.com
• Phone: +381 61 224 8989

For any question about your data, or to make a request under this policy, email dimitrije@svilenkovicit.com or call +381 61 224 8989.

In short

• The site uses no social media pixels or ad networks. Analytics (Google Analytics 4) runs only if you accept it in the cookie banner. Its fonts and scripts load from this server. Without your consent, the only external services the site uses by itself are Cloudflare Turnstile, the enquiry form protection described below, and, only when you run a DNS check, the public DNS service you choose.
• I process your data when you send an enquiry, email or call me, when I send you a business message, and in server logs. The DNS record checker runs in your browser and sends queries directly to the public DNS service you choose, only when you click to run the check; neither the domain nor the result reaches my server.
• I do not sell your data, share it for advertising or use it for profiling.

Enquiry form

The form on the Contact page sends your name, your message and at least one contact method, email or phone, and, if you wish, the domain or system the enquiry is about. The page language and the address of the page you send it from are added automatically. With the enquiry, the server records the time it was received and your browser details (user agent). It does not store your IP address: it stores only a one-way hash that changes every day and cannot be turned back into the address, used to limit the number of enquiries from the same network.

I use enquiry data to reply and, if you ask for a website or maintenance, to prepare an offer. The legal basis is taking steps at your request before entering into a contract (Article 12(1)(2) of the Law; Article 6(1)(b) GDPR). Please do not send passwords, login details or special categories of data such as health or religious information.

Before sending, your browser solves a short computational task issued by my server, and the form has a hidden field that only automated programs fill in. These safeguards collect no further data about you.

The enquiry is stored in the forms service database on the site server, outside the public part of the site, and then forwarded as an email to my mailbox dimitrije@svilenkovic.com on the mail server. If you left an email address, it also receives an automatic confirmation of receipt from no-reply@svilenkovicit.com, without the text of your message. No confirmation is sent if the form was submitted without JavaScript, and the same address receives at most two confirmations in 24 hours. The database record is deleted automatically three months after receipt. The copy in the mailbox is kept as business correspondence (see "When you email or call me").

Form protection: Cloudflare Turnstile

When you open a page with the form, your browser loads Cloudflare Turnstile from challenges.cloudflare.com, a check that tells people apart from automated programs. Cloudflare, Inc. processes your IP address, browser identifier (User-Agent), a technical fingerprint of the encrypted (TLS) connection and the address of the site running the check. Cloudflare does not receive the contents of the form fields. When you send the form, my server verifies the result with Cloudflare.

The legal basis is my legitimate interest in protecting the form from spam and automated submissions (Article 12(1)(6) of the Law; Article 6(1)(f) GDPR). For the check itself Cloudflare acts as my processor. It also uses the same data to improve its bot protection, and for that it is an independent controller. Under its privacy addendum it does not use the data to identify, profile or target individuals (Cloudflare Turnstile Privacy Addendum, linked below). If you prefer to avoid this check, email me directly at dimitrije@svilenkovicit.com.

Cloudflare Turnstile Privacy Addendum

When you email or call me

When you email dimitrije@svilenkovicit.com or call +381 61 224 8989, I use your name, contact details and message to reply and to agree on the work (Article 12(1)(2) of the Law; Article 6(1)(b) GDPR). If we sign a contract, I process the data needed for the contract and invoice to perform the contract and meet legal obligations, mainly accounting ones (Article 12(1)(2) and (3); Article 6(1)(b) and (c) GDPR).

I keep correspondence while we discuss the work or work together, and afterwards only as long as needed for contractual obligations, invoices and possible complaints. Invoices and other accounting records are kept for the periods set by the Serbian Accounting Law. Correspondence that did not lead to a project is deleted earlier on request.

If you received a business message from me

From addresses on this and my other domains I send short business messages to companies and organisations that might benefit from a new or improved website. I find the contact on the company's public website or in a public business directory. I use the company name, business email address, website address and public information from that website, such as its field and location, and I record when I wrote and what you replied.

The legal basis is my legitimate interest in offering my services to businesses (Article 12(1)(6) of the Law; Article 6(1)(f) GDPR). You can object at any time: reply with the word "unsubscribe" or email dimitrije@svilenkovicit.com. I then add the address to a suppression list and no further messages are sent to it from any of my addresses. Only the address stays on that list, so that I can respect your request. Other company data is kept while cooperation remains possible and deleted immediately on request.

DNS record check

When you click "Check DNS" on the DNS checker page, or "Proveri" on the Serbian page Provera DNS zapisa, your browser sends DNS queries for the domain you entered directly to the public DNS service you choose: Cloudflare (1.1.1.1), the default, or Google Public DNS. The queries do not pass through my server and I do not see them. Neither the domain nor the result of the check reaches my server.

The chosen service sees your IP address and the names being checked: the domain and names derived from it, for example _dmarc.yourcompany.com. It processes this data under its own privacy policy:

Cloudflare 1.1.1.1 privacy policy · Google Public DNS privacy

• Cloudflare 1.1.1.1 privacy policy: under it, Cloudflare keeps a truncated IP address and deletes logs within 25 hours;
• Google Public DNS privacy: under it, Google deletes temporary logs with the IP address within 24 to 48 hours and permanently keeps only a sample without the IP address, with location at city or region level.

When you choose Google, the tool asks with each query that no part of your IP address be passed on to the servers of the domain you are checking. Before you click, the page sends nothing to either service, and if one does not respond, the tool does not switch to the other by itself: you choose the service.

The result is created in your browser and stays only there while the page is open. If you enter a domain in the field on the Serbian home page or at the bottom of a Serbian guide, it reaches the tool page in the part of the address after #, which the browser does not send to the server. Tab storage (sessionStorage) then holds only a marker that you clicked "Proveri", so that the check starts by itself. The tool deletes it as soon as it reads it, and if that does not happen, the browser deletes it when you close the tab. This is technical storage for a service you requested, so it needs no separate consent (Serbian Electronic Communications Law, Article 160(5)).

After a check, the domain appears in the page address after #, so that you can share the link. The browser does not send that part of the address to the server either, and for the person you send the link to, the tool only fills in the field: the check starts only when they click.

DNS records are public data. The check does not access your email and does not send messages.

Server logs

Like any web server, the server logs each request: IP address, time, page address without the part after the question mark, referring page (also without that part), server response and browser details. Error logs may contain the IP address and page address. I use logs only for security and troubleshooting, based on my legitimate interest in keeping the site running and protecting it from attacks and abuse (Article 12(1)(6) of the Law; Article 6(1)(f) GDPR). They are deleted automatically after 14 days.

Cookies and browser storage

Until you choose in the cookie banner, the site sets no cookies and loads no analytics. The cc_consent cookie remembers your choice for one year, and Google Analytics cookies are set only if you choose “Accept” (see “Analytics (Google Analytics 4)”). Browser storage holds only what a feature you chose needs:

• a marker that you clicked "Proveri" in the domain field on a Serbian page, in tab storage (sessionStorage, key provera-dns-klik), so that the check on the tool page starts by itself; the tool deletes it as soon as it reads it, and at the latest it is deleted when you close the tab;
• your choice to pause animations, when you click the pause motion button on the English pages, in tab storage (sessionStorage, key pokret-pauziran), until you close the tab.

This storage needs no separate consent because it only serves a function you explicitly requested (Serbian Electronic Communications Law, Article 160(5)). That is why the cookie banner asks only about analytics. You can clear it by deleting this site's data in your browser settings. Turnstile runs in a separate frame from a Cloudflare address, under the rules in the form protection section.

Who else has access

I do not sell or share your data, except where the law or an order of a competent authority requires it. Access is limited to those without whom the site and email cannot run, and only as needed:

• netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany, as processor: the site, the enquiry database and server logs are on its server in Nuremberg;
• Hetzner Online GmbH, Gunzenhausen, Germany, as processor: email is on its server;
• Backblaze, Inc., as processor: encrypted server backups are kept in its storage in Amsterdam, the Netherlands, and Backblaze does not hold the key;
• Cloudflare, Inc., USA, for form protection (Turnstile);
• Cloudflare, Inc., USA, as the public DNS service 1.1.1.1, the default choice in the DNS record checker;
• Google LLC, USA, as Google Public DNS, if you choose it in that tool.

DNS queries are sent to the DNS service by your browser, and only when you click to run the check. The chosen service then sees your IP address and the names being checked and processes them under its own privacy policy, as described in the DNS record check section.

International transfers

The site and mail servers are in Germany, and the backups are in the Netherlands. States party to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, including Germany and the Netherlands, are considered to provide an adequate level of protection (Article 64(2) of the Law), so no separate authorisation is needed.

Cloudflare may process check data in the USA as well. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has found an adequate level of protection (Article 64(2) of the Law; Article 45 GDPR), and provides for standard contractual clauses should that certification lapse. The same framework also covers the queries your browser sends to Cloudflare's DNS service 1.1.1.1. The same applies to Google LLC when you choose Google Public DNS: it is certified under the same framework and also applies standard contractual clauses.

Your rights

You have the right to:

• find out whether I process your data and obtain access and a copy (Article 26 of the Law; Article 15 GDPR);
• have inaccurate data corrected and incomplete data completed (Article 29; Article 16 GDPR);
• have your data erased (Article 30; Article 17 GDPR);
• restrict processing (Article 31; Article 18 GDPR);
• receive the data you gave me in a common machine-readable format and transfer it to another controller, where processing is based on consent or a contract (Article 36; Article 20 GDPR);
• object to processing based on legitimate interest; an objection to business messages is always accepted (Article 37; Article 21 GDPR);
• not be subject to a decision based solely on automated processing (Article 38; Article 22 GDPR).

Where processing is based on your consent, you can withdraw it at any time, as easily as you gave it, without affecting processing before the withdrawal (Article 15(3) of the Law; Article 7(3) GDPR). This site currently processes no data based on consent; if that changes, it will be listed here.

How to exercise your rights

Send your request to dimitrije@svilenkovicit.com or call +381 61 224 8989. If I cannot reliably confirm that the request comes from you, I may ask for additional information to verify your identity.

I reply without undue delay and within 30 days of receiving the request at the latest. If the request is complex or there are several, I may extend this by another 60 days and will tell you so, with the reasons, within the first 30 days. Exercising your rights is free of charge. For a manifestly unfounded or excessive request, in particular a repeated one, I may charge the necessary administrative costs or refuse to act (Article 21 of the Law; Article 12 GDPR).

Complaint to the supervisory authority

If you believe the processing of your data breaches the Law, you can lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (Article 82): Bulevar kralja Aleksandra 15, 11120 Belgrade, Serbia, office@poverenik.rs, +381 11 3408 900, www.poverenik.rs. A complaint does not affect your right to judicial protection. If you live in the European Union, you can also contact the supervisory authority in your country.

www.poverenik.rs

Do you have to provide data?

Providing data is neither a legal nor a contractual requirement. Without a name, a message and one contact method the enquiry cannot be sent, so I cannot reply; instead of the form you can email or call me. No personal data is needed to read the site or use the tool.

Automated decision-making

I do not make decisions based solely on automated processing, including profiling, that produce legal effects for you or similarly significantly affect you. The automated form protection only stops submissions that look like a program; in that case you can email me directly.

Security

The site and email work only over encrypted connections (HTTPS and TLS). Enquiries are stored outside the public part of the site, in a database accessible only to a dedicated system account for the form. The server is updated regularly and only I have access to the data. The site server makes encrypted backups every night, so deleted data may remain in those backups for up to seven months until newer ones replace them.

Children

The site and the form are meant for businesses and adults. A person under 15 should not send an enquiry without the consent of a parent or guardian. If I learn that this happened, I delete the data.

Changes

When the way data is processed changes, I update this page and its last-updated date. The terms of use are on the Terms of use page.

Terms of use