Privacy statement

Effective 16 October 2026.

Who handles your data

The controller is Filip Herceg, owner of the sole proprietorship Herc-Net obrt za programiranje i usluge, Filip Herceg (Ulica Rudolfa Jakuša-Španca 19, 49221 Lug Poznanovečki, OIB 27324627455). For anything about your data, email filip@hercnet.hr.

What I collect

Only what you type into the form: your name, email, website address if you give one, and your message.

If you arrived through an ad, the form also sends the tags in the page address: the click identifier (gclid for Google, fbclid for Facebook and Instagram) and campaign tags (utm). They tell me which ad the enquiry came from. They end up only in my inbox; I don't send them to Meta.

Cloudflare Turnstile, the spam check, looks at technical browser data and your IP address when you submit.

I count visits with Cloudflare Web Analytics. It uses no cookies and doesn't identify you; it only totals visits by page, country and where people came from. The site has no tracking cookies.

Why, and on what legal basis

I use the form details to reply to you and, if we agree, to prepare a quote. The legal basis is taking steps at your request before entering a contract (GDPR Art. 6(1)(b)).

Spam protection and measuring ad performance rest on my legitimate interest (Art. 6(1)(f)).

The checkbox on the form confirms you've read this statement. It is not consent and doesn't change the legal basis.

Who receives it

Cloudflare, Inc. (USA) serves the site, runs the Turnstile check and counts visits.

Resend (USA) delivers the form message to my inbox.

Fastmail Pty Limited (Australia) hosts my mailbox. The data sits on servers in the EU (Netherlands), with a replica and backups in the USA.

Google Ireland Limited receives only the click identifier (gclid), and only if you came from a Google ad, so the enquiry can be credited to the ad.

I don't sell your data or pass it to anyone else.

Transfers outside the EU

Cloudflare and Resend also process data in the USA. These transfers rely on the EU-US Data Privacy Framework and Standard Contractual Clauses.

Fastmail is an Australian company and keeps a copy of the data in the USA. That transfer relies on the European Commission's Standard Contractual Clauses.

How long it's kept

The site itself stores nothing. Messages aren't written to any database.

Resend keeps a record of the sent message for up to 30 days, then deletes it.

In my inbox, a message stays while we're in touch and is deleted no later than 12 months after our last contact. If you become a client, I keep what invoicing requires for as long as accounting law says.

Your rights

You can ask to see, correct or delete your data, restrict its processing, or object to processing based on legitimate interest. Email filip@hercnet.hr; I reply within one month.

If you think your rights have been breached, you can complain to the Croatian Personal Data Protection Agency (AZOP), azop.hr, or the data protection authority where you live.

Changes

If I change how data is handled, for example by adding cookies or ad pixels, I'll publish it here and update the date at the top.