Privacy Policy
Last updated
This policy explains what personal data is collected when you visit lavastro.com or contact me, and what your rights are under the EU General Data Protection Regulation (GDPR).
Who is responsible
lavastro.com is operated by Lavastro, vl. Damir Bogadi, a sole proprietorship (obrt), Poljski put 4, Bestovje, Croatia, OIB 45058525808. Lavastro is the “controller” of your personal data under the GDPR.
For questions or requests about your data, use the contact form.
What I collect and why
When you send the contact form: your name, email address, company (optional), topic and message. I use it only to reply to you and prepare an offer. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR). The form is delivered to my business mailbox by Web3Forms.
When you become a client: the contact and billing details needed to deliver the work and issue invoices. Legal basis: the contract (Art. 6(1)(b)) and legal obligations such as accounting and tax law (Art. 6(1)(c)).
Files you share for a project are used only for that project, protected by an NDA on request, and deleted when the project ends unless we agree otherwise.
When you visit the site: the hosting provider processes technical data such as your IP address, browser type and the pages requested, to deliver the site and protect it against abuse. Legal basis: legitimate interest in running a secure website (Art. 6(1)(f)).
Analytics, only with your consent: if you click Accept in the cookie banner, Google Analytics cookies measure how visitors find and use the site. Legal basis: consent (Art. 6(1)(a)). If you click Reject (and in the EU, EEA, UK and Switzerland until you choose), these cookies are not set; Google may still receive limited, cookieless signals without identifiers.
I don’t sell personal data, and I don’t use it for automated decision-making or profiling.
Cookies
| Name | Provider | Purpose | Duration | Needs consent |
|---|---|---|---|---|
consent (local storage) |
this site | Remembers your cookie choice | 12 months | No |
_ga, _ga_* |
Google Analytics | Counts visits and visitor journeys | Up to 2 years | Yes |
Fonts are served from this site, so no requests go to Google Fonts. You can change your choice at any time with Cookie settings at the bottom of every page, or by deleting cookies in your browser.
Who processes data on my behalf
| Service | What for | Location |
|---|---|---|
| Hawk Host Inc. | Website hosting and server logs | Canada (EU adequacy decision) |
| Web3Forms | Delivering contact-form messages by email (privacy policy) | Outside the EU |
| Microsoft | Business email (Microsoft 365) | EU / USA |
| Analytics (with consent) | EU / USA |
Where data is transferred outside the EU/EEA, it’s protected by an adequacy decision, the EU-U.S. Data Privacy Framework or the European Commission’s standard contractual clauses, as applicable.
How long data is kept
- Enquiries that don’t lead to a project: up to 2 years after our last contact, then deleted.
- Client records and invoices: as long as Croatian accounting and tax law requires.
- Project files: deleted when the project ends, unless we agree otherwise.
- Server logs: kept by the hosting provider for a short period for security.
- Analytics cookies: see the cookie table above.
Your rights
You have the right to access your data, have it corrected or deleted, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time (this doesn’t affect processing before the withdrawal). Send a request through the contact form and I’ll reply within one month.
You can also complain to the Croatian data protection authority, the Agencija za zaštitu osobnih podataka (AZOP), azop.hr, or the authority in your own EU country.
Changes to this policy
If this policy changes, the new version will be published here with a new date.