Privacy policy

Data controller

The data controller is P Kontis, Patricija Klinc s.p., računovodske in knjigovodske storitve, Partizanska cesta 5, 2000 Maribor, Slovenia. For questions about the processing of personal data, contact us at info@pkontis.si.

What data is processed

When you submit the contact form, we process your name, email address, selected topic and message. Company name and telephone number are optional. We also process the page language, confirmation that you have read this policy and a technical submission identifier.

When you visit the website, technical data may be processed automatically, including your IP address, access date and time, requested URL, browser and device type, and information needed to operate the website securely and prevent abuse.

Purpose and legal basis

We process contact-form data to answer your enquiry, communicate with you and, where relevant, prepare a proposal. The legal basis is taking steps at your request before entering into a contract under Article 6(1)(b) GDPR, or our legitimate interest in responding to general business enquiries under Article 6(1)(f) GDPR.

We process technical data to operate and secure the website, prevent spam and detect abuse based on our legitimate interest in providing a secure and reliable website under Article 6(1)(f) GDPR.

Service providers and recipients

The website is hosted by Vercel Inc., which provides hosting, content delivery and technical logs. We send contact-form messages through Plus Five Five, Inc. (Resend), which processes the data needed to deliver the email.

The contact form is protected by Cloudflare Turnstile, provided by Cloudflare, Inc. The service processes technical signals about the browser, device and connection to distinguish people from automated abuse; it does not receive the contents of the contact-form fields.

Public posts and images are managed through Sanity, provided by Sanity AS or its affiliates. Standard technical web-request data may be processed when content or images are loaded. These providers act as processors or, for their own legitimate processing purposes, as independent controllers.

Transfers outside the EEA

Some providers or their subprocessors are based or operate infrastructure outside the European Economic Area, particularly in the United States. Where such transfers take place, appropriate safeguards are used, such as an adequacy decision by the European Commission, the EU-US Data Privacy Framework or Standard Contractual Clauses.

Retention

We retain enquiry data for as long as needed to respond and complete any follow-up discussions. If no business relationship follows, we generally delete it no later than 12 months after the communication ends, unless longer retention is needed to establish, exercise or defend legal claims. If a business relationship begins, statutory retention periods for business records apply.

Technical and security logs are retained for a limited period according to each provider's settings and retention periods.

Your rights

Subject to the conditions in the GDPR, you may request access to, correction or erasure of your personal data, restriction of processing and data portability, and you may object to processing based on legitimate interests. Send your request to info@pkontis.si. To protect your data, we may verify your identity before acting on a request.

If you believe your personal data is being processed unlawfully, you may lodge a complaint with the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana.

Cookies and external services

We save your privacy preferences in this browser's local storage (localStorage). You can change your choice at any time using the Cookie settings button in the footer.

On the production website pkontis.si, Analytics consent enables Google Analytics 4 to measure visits, and Marketing consent enables Google Ads for base advertising measurement and remarketing. These services may use cookies and send visit data to Google. Both optional categories are off by default; Google tags are not loaded before consent. Changes or withdrawal are sent to Google through Consent Mode v2. Already loaded tags may send cookieless signals when consent is denied. Both services are disabled by default in development and preview environments. On pkontis.si and www.pkontis.si, with Marketing consent, we record a Google Ads conversion only after Resend confirms a successful contact-form send. Form contents are not sent to Google with this event. On those same production domains, with Marketing consent, we also record a Google Ads conversion when you click a phone link. We measure the click, not whether a call connects or its duration. With Marketing consent, we also record a Google Ads conversion when you click an email link; with Analytics consent, we record that click as a click_email event in Google Analytics 4. A click does not confirm an email was sent; the email address and message contents are not added to these events. Form, phone-click and email-click conversions are not sent to Google in development or preview environments. Cloudflare Turnstile may use strictly necessary browser mechanisms to perform the contact form's security check. A draft-preview cookie is used only for authorised editors and is not set for ordinary visitors.

Links to external websites, such as Google Maps, load only when you choose to open them. The selected provider's privacy policy then applies.

Security and automated decisions

We use appropriate technical and organisational measures to protect personal data. We do not sell your data or use it for direct marketing. We do not use data collected through this website for profiling or decisions that produce legal or similarly significant effects. Turnstile automatically assesses only whether a form submission is likely to be legitimate or automated.