Legal
Privacy policy
What data kavon.dev collects, why, how long it is kept and what you can ask for. In short: the site has no analytics and no cookies, and I only get your data when you write to me yourself.
Last updated
In short
- The site uses no cookies and has no analytics, ads or social media buttons that track your visit.
- I only get data about you when you write to me: through the form, by email, phone, WhatsApp or Viber.
- Form enquiries arrive in my inbox and are not stored in a database.
- Data is never sold, traded or used for advertising.
- You can ask for access, correction or deletion of your data at office@kavon.dev.
Who processes the data
The controller is Kavon, that is Kamber Kamberović, an individual based in Sjenica (36310 Sjenica, Serbia). Kavon is not a registered company. For any question about your data, including the requests under "Your rights", write to office@kavon.dev.
No data protection officer has been appointed, because the scope and type of processing do not require one.
What is collected and why
The contact form
When you send the form, the details you entered arrive in my inbox:
| Data | Required | Why |
|---|---|---|
| full name | yes | so I know who I am replying to |
| email address | yes | so I can reply |
| phone | no | if you want me to call |
| rough budget | no | so the estimate is realistic |
| project description | yes | so I understand what you need |
| page language | automatic | so I reply in the same language |
| IP address | automatic | protection against abuse of the form |
The legal basis is taking steps at your request before entering into a contract (article 12, paragraph 1, point 2 of the Serbian Law on Personal Data Protection). If the conversation leads to a project, further processing is based on performance of the contract. The IP address is included in the email to protect against fake and mass messages, on the basis of legitimate interest (point 6 of the same paragraph).
If you write on behalf of a company, company details such as its name and tax number are not personal data, but your name and contact details are, and this policy applies to them.
Providing the data is not a legal requirement. If you do not provide it, the only consequence is that I cannot reply.
Protecting the form from bots
To stop the form from sending fake messages, the server records how many messages were sent from the same address in the last hour and rejects the sixth. It does not store the IP address itself, but a one way hash of it (SHA-256 with a secret salt), from which the address cannot be read, together with the send times. Each new submission removes times older than one hour. The form also has a hidden field people never see and, if the browser allows it, records when the form was opened, to spot submissions faster than three seconds. None of this is stored in your browser.
Email, phone, WhatsApp and Viber
If you email me, message me or call, I receive what you send: your name, number or address and the content of the message. The legal basis is the same as for the form. When you use WhatsApp or Viber, those messages pass through the services of those companies, and their privacy policies apply.
Server logs
The hosting the site runs on, like any other, records access: IP address, time, requested page and browser type. This is needed for the server to work and stay secure. These logs are kept by the hosting company, unlimited.rs, under its own rules; I do not use them to identify visitors.
What is not collected
The site sets no cookies, uses no Google Analytics or other analytics, loads no fonts, images or scripts from other servers, and does not follow you from page to page. I only see visits in aggregate, in Google Search Console and Bing Webmaster Tools, which show searches and clicks from those search engines, with no data about individual visitors.
There is no automated decision making or profiling.
Cookies and local storage
The site sets no cookies, first party or third party, and writes nothing to your browser's local storage. That is why there is no consent banner either: there is nothing to consent to. The only JavaScript on the site is a small file on the contact page that writes the time the form was opened into the form and stores nothing.
Your customers' data during a project
When I build or maintain a site, store or software for your company, I may see your customers' data: orders, bookings, enquiries or invoices. I am then a processor, and you are the controller of that data. I use it only as far as the work you ordered requires, do not copy it outside your system and do not share it. On request I sign a data processing agreement (DPA).
How long data is kept
- Correspondence (form, email, messages) is kept while we discuss the work, and for at most two years after the last message. After that it is deleted.
- Correspondence that led to a project is kept as long as business and tax record keeping rules require.
- The form rate limit record holds only send times from the last hour.
Form messages exist only as emails. When the email is deleted, the data is gone.
Who else can see the data
- Unlimited.rs, the hosting company that runs the site and email, with servers in Serbia.
- WhatsApp and Viber, only if you message me through them.
Apart from them, data is not shared with anyone. It is never sold, traded or used for advertising.
Transfers outside Serbia
The site and email run on servers in Serbia, so form data is not transferred abroad. A transfer can only happen if you choose a service that operates outside Serbia yourself, such as WhatsApp or Viber.
Your rights
Under the Serbian Law on Personal Data Protection, which follows the same principles as the GDPR, you have the right to:
| Right | What it means | Article |
|---|---|---|
| access | find out whether your data is processed and get a copy | 26 |
| rectification | have inaccurate data corrected and incomplete data completed | 29 |
| erasure | have data deleted when there is no longer a basis for processing | 30 |
| restriction | have processing paused | 31 |
| portability | get the data you provided in a common electronic format | 36 |
| objection | object to processing based on legitimate interest | 37 |
Send your request to office@kavon.dev. It is free. You get a reply without delay and within 30 days at the latest; that period can be extended by another 60 days only where necessary, and you will be told if it is (article 21).
How to make a request
Email office@kavon.dev saying what you are asking for (access, correction, deletion or something else) and, if you can, send it from the same address or number you wrote to me from before. That makes it easier to find the correspondence and confirm the request is really yours. If that is not possible, I may ask for a detail that confirms your identity, only as much as needed, and it is not kept after the request is handled.
Complaints to the supervisory authority
If you believe your data is processed unlawfully, you can lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11120 Belgrade, Serbia (poverenik.rs), under article 82 of the law. If you live in the European Union, you can also complain to the supervisory authority in your country.
Security
The site runs over an encrypted connection (HTTPS). The mailbox that receives enquiries is password protected and only I have access to it. The form settings and the email password are kept outside the public part of the server, and form data is not written to a database, so there is no store of enquiries that could leak.
Changes to this policy
When the way the site handles data changes, this page changes too, and the date of the last update is under the heading. Send questions about this policy to office@kavon.dev.