1. Controller
The controller of personal data is CraftedPixel, a design and engineering studio based in Novi Sad, Republic of Serbia. Privacy contact: office@getcraftedpixel.com, phone / WhatsApp / Viber: +381 65 43 63 142. Founder: Marko Banović, marko.banovic@craftedpixel.rs.
This policy is a notice of processing within the meaning of the Personal Data Protection Act (“ZZPL”). It covers the public website craftedpixel.rs, forms, job applications, and the studio’s day-to-day communication (email, phone, WhatsApp / Viber). The same policy applies to the English version of the site at craftedpixel.rs/en/.
For paid client work, a contract, NDA, or data processing agreement may also apply. Those documents take precedence for project data. PropertyDesk (propertydesk.app) is a separate product; once it is in public use, it will have its own notice.
2. What data we collect
You don’t need an account to read the Site. We receive data when you give it to us, when you write to us, or automatically through your browser and measurement tools.
Data you send us
- Contact and project inquiry on the contact page: name, email, message; optionally company, topic, and budget range. Submitting requires confirming that we may contact you about that message.
- Other forms (maintenance, site under construction, and similar): name, email, and the content of your request.
- Free website application at free-website.html: full name, role, email, phone / WhatsApp, company name, industry, team size, and any other fields you fill in on the application.
- Job applications through the careers pages: name, email, CV / portfolio links, message, and any details you choose to provide. Applications are sent by email or through the form on the job posting, not through the project contact form.
- Direct communication: email, phone, WhatsApp / Viber, social media. We process whatever you send us (including attachments).
Our forms have a hidden anti-spam field. If a bot fills it in, we don’t treat the message as a real inquiry.
Data collected automatically
- technical data: IP address, approximate location based on IP, device and browser type, language, referrer URL, pages visited, time;
- server and security logs (Cloudflare / hosting) needed to run the Site and protect it from abuse;
- data from cookies and similar technologies, described in the Cookie policy.
We don’t ask for special categories of data (health, religion, biometrics). Please don’t send them through public forms.
3. Purposes and legal bases
We process data only when we have a legal basis under the ZZPL (Serbian Law on Personal Data Protection):
- Taking steps at your request / performing a contract - replying to inquiries, preparing proposals, running projects, delivery, invoicing.
- Consent - non-essential cookies (analytics, marketing) via the banner; a checkbox on the form allowing us to contact you about that specific message. You can withdraw consent at any time, without affecting the lawfulness of processing carried out before that.
- Legitimate interest - Site security, preventing spam and fraud, basic running of the studio, keeping records of correspondence, improving content, defending legal claims. You have the right to object.
- Legal obligation - accounting, tax and other regulations, once the relationship becomes a business one.
We don’t sell personal data or share it for other parties’ marketing. We don’t have a newsletter as of this update; if we launch one, we’ll ask you separately.
4. Who we share data with
Data is seen by team members who need it to reply or to work on the project. Outside the studio, we share it only with processors who do technical work for us, and only as much as needed:
- Web3Forms - submitting forms from the contact page and similar pages;
- Formspree - submitting free website applications;
- hosting and Cloudflare - delivering the Site, DNS, protection;
- Google Analytics 4, Ahrefs Analytics and Microsoft Clarity - measuring visits and behavior, if you consent to analytics;
- email and messaging (email provider, WhatsApp / Viber) - so we can reply to you;
- accountant, tax advisor, lawyer, bank / payment services - when there is a business relationship;
- competent authorities - only when required by law or to protect legal rights.
Each of these providers has its own policy. We don’t control how WhatsApp, Google or Microsoft process data on their platforms when you use them on your own.
5. Transfers outside Serbia
The studio is in Serbia. Some tools (Cloudflare, Google, Microsoft, Ahrefs, Web3Forms, Formspree) may process data in the EU, the US or other countries. We make such transfers only with the safeguards the ZZPL provides for (an adequacy decision, appropriate safeguards or an exemption, e.g. when the transfer is needed to answer your inquiry).
If you write to us from abroad, your data is processed in Serbia and by the providers listed above.
6. Retention period
- Inquiries and forms - until the conversation ends, then up to 24 months, unless it leads to a proposal or contract (in which case business and legal periods apply, usually up to 10 years for accounting records).
- Job applications - until the position is closed, and no longer than 12 months, unless we agree otherwise or an employment / contractual relationship begins.
- Free website applications - until the campaign and selection end, then up to 24 months, or longer if you become a client.
- Technical and security logs - as long as needed for protection and troubleshooting, usually up to 12 months.
- Cookie consent - in your browser (localStorage), until you delete or change it.
When the period expires, we delete or anonymize the data, unless the law requires us to keep it longer.
7. Your rights
Under the ZZPL, the person the data relates to may request:
- confirmation of whether we process their data, and access to it;
- correction of inaccurate data and completion of incomplete data;
- erasure (the “right to be forgotten”), when the legal conditions are met;
- restriction of processing;
- objection to processing based on legitimate interest;
- portability, when processing is automated and based on consent or a contract;
- withdrawal of consent, when consent is the legal basis.
Send your request to office@getcraftedpixel.com. We reply within the legal deadline (usually 30 days). We may ask you to confirm your identity so we don’t give data to the wrong person. These rights are not absolute: we may refuse a request if a legal exemption applies (e.g. keeping an invoice).
You have the right to file a complaint with the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11120 Belgrade, www.poverenik.rs.
8. Cookies
Essential cookies and local storage keep the Site working and remember your consent choice. We turn on analytics and marketing tools only if you accept them in the banner. You can change your choice at any time via “Cookie settings” in the footer. Details: Cookie policy.
9. Automated decision-making
We don’t make decisions with legal or similarly significant effects based solely on automated processing, and we don’t profile visitors for credit scoring or hiring.
10. Children
The Site and services are not intended for people under 16. We don’t knowingly collect their data. If we learn that we have any, we will delete it.
11. Security
We use HTTPS, restricted access to the inbox and forms, a honeypot against spam and standard hosting / CDN measures. No transmission over the internet is completely secure. For confidential client materials after signing, we use an agreed channel, not the public contact form.
12. Changes
We update this policy when our processing or the regulations change. The date at the top shows the latest change. We may announce significant changes on the Site. Continuing to use the Site after a change means you are aware of the new text.
13. Contact
Questions and requests: office@getcraftedpixel.com · CraftedPixel, Novi Sad, Serbia · craftedpixel.rs.