Privacy policy
Your information deserves the same care as your project. Here is what we use, why we use it, and the choices you have.
Last updated: 3 October 2026
Business information
NARDO STUDIO, obrt za izradu web stranica i marketing, vl. Leonardo Grginčić
Slave Raškaj 10, Karlovac
- Business registration number (MB)
- 99318725
- Studio hours
- Mon–Fri, 08:00–16:00
- Croatia local time
- Contact details
- leo@nardo.studio+385 95 396 4661
Who is responsible
The controller of personal data processed through this website is NARDO STUDIO, obrt za izradu web stranica i marketing, vl. Leonardo Grginčić, Slave Raškaj 10, Karlovac, Croatia. Business registration number (MB): 99318725. For privacy requests, contact leo@nardo.studio or use our contact page.
When you get in touch
When you submit the contact form, we receive your name, email address and message, plus your website, selected services and budget if you provide them. Vercel hosts the website and processes the request; Resend delivers the enquiry to leo@nardo.studio. Typing into the form alone does not send your details.
We answer project enquiries and prepare proposals at your request under Article 6(1)(b) GDPR (steps before entering a contract). We manage agreed projects on the same contractual basis. For general business correspondence, our basis is Article 6(1)(f): our legitimate interest in answering questions and maintaining business communications.
Providing an enquiry is voluntary. Name, email and message are required to send the form and receive a useful reply; the other fields are optional. Without the required details, the form cannot be submitted. You can instead contact us by phone or email. Please do not include sensitive personal information that your enquiry does not need.
Browsing & local storage
The website stores your explicit language selection in the nardo-language cookie for one year. Your cookie choices are stored locally under nardo-cookie-consent for up to 180 days. The nardo-intro-seen sessionStorage flag remembers that the introduction has played, so it appears only once per browser tab; this flag expires when the tab is closed.
Vercel processes technical connection data, including IP address, requested URL, browser information and request time, to deliver the website and protect it against abuse. Our legal basis is Article 6(1)(f) GDPR: our legitimate interest in a functioning, secure website. A country indicator supplied by the hosting infrastructure can select the initial language; we do not request precise location.
No analytics tags, advertising pixels, or remarketing tools are installed in this website. Fonts and the showreel are served with the site. Optional third-party booking content remains blocked until you allow it.
Booking a call
If you enable external booking content and open the call option, the calendar is provided by Cal.com. Loading it shares connection information with Cal.com; submitting a booking shares the details you enter so the meeting can be arranged. You can decline the embed and contact us by email instead. Opening the separate Cal.com booking page takes you to their service and privacy settings.
Loading the embedded calendar is optional and based on your consent under Article 6(1)(a) GDPR. Necessary scheduling correspondence and the booking details you submit are used to arrange the meeting at your request under Article 6(1)(b). You can withdraw permission to load the embed in Cookie settings; contact us to cancel a meeting or request deletion of booking details.
Providers & international transfers
Our website providers are Vercel (hosting and request processing), Resend (delivery of contact-form email) and Cal.com (optional scheduling). The studio also receives your enquiry in its business email inbox. Only information needed for the relevant service is shared. We do not sell your personal data.
These providers and their subprocessors may process information outside the European Economic Area, including in the United States. Their published data-processing terms describe international transfers and safeguards, including standard contractual clauses where applicable. You can request details of the safeguards applicable to your data and a copy from leo@nardo.studio. A provider’s privacy policy does not replace this notice or your rights against the studio.
How long we keep it
Enquiries that do not become projects are kept for 12 months after our last correspondence, then deleted from the studio’s active enquiry records. If an enquiry becomes a project, relevant correspondence becomes part of the project record.
Contract and invoice records are retained according to the statutory period applicable to the record and the studio’s accounting obligations. Correspondence needed for a specific dispute is retained until the proceedings and relevant claim periods expire. Written consumer complaint records are kept for one year from receipt under Article 10 of the Croatian Consumer Protection Act; records needed for a continuing legal claim may be retained longer on that separate basis.
Browser storage expires after the periods shown in Cookie settings. Technical logs, email-delivery records and provider backups follow the relevant provider’s service settings and retention periods; they are distinct from the studio’s 12-month enquiry period. You can ask us which records remain in your particular case.
Complaints & legal obligations
We process the contact details and information in a written consumer complaint to acknowledge it, investigate it and provide a response. The legal basis is Article 6(1)(c) GDPR and Article 10 of the Croatian Consumer Protection Act. Accounting data is processed on the same legal-obligation basis where required by tax and accounting rules. Relevant records may be disclosed to competent authorities or professional advisers where legally required or necessary to establish, exercise or defend legal claims.
Your rights & choices
You may request access to your data and a copy, correction of inaccurate data, erasure or restriction where the GDPR conditions are met. For processing based on legitimate interests, you may object for reasons relating to your particular situation. Portability applies to data you provided where processing is automated and based on consent or a contract. Some records must remain where a legal obligation or justified legal claim prevents erasure.
Withdraw optional booking-content consent at any time through Cookie settings. Withdrawal does not affect processing that was lawful before it. We do not use your enquiry or browsing data for automated decisions with legal or similarly significant effects, or for profiling of that kind.
Send privacy requests to leo@nardo.studio or to the studio’s postal address. We respond without undue delay and within one month of receipt. For complex or numerous requests, the GDPR permits an extension of up to two further months; we will explain the reason within the first month. Requests are normally free, and we ask for additional identity information only where reasonably needed.
You may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Ulica Metela Ožegovića 16, 10000 Zagreb, azop@azop.hr, or with the supervisory authority in your habitual residence, place of work or place of the alleged infringement.