Privacy Policy

What we collect

We only collect data that is needed to run the website, respond to inquiries, prepare offers, deliver services, protect the site, and measure performance when you consent.

• Contact form data: name, email, phone, subject, budget range, message, consent confirmation, and language.
• Communication data: emails, project notes you send to us, and call scheduling information if you use Calendly.
• Technical data: IP address, browser, device, pages visited, referrer, consent choices, and cookie identifiers where applicable.
• Client data: billing details, project content, files, approvals, and service-related communication when we work together.

Why we use it

• To answer your inquiry and take steps before entering into a contract.
• To prepare offers, plan projects, and deliver agreed services.
• To keep the site secure, prevent misuse, and maintain basic functionality.
• To comply with legal, tax, accounting, and record-keeping obligations.
• To understand site performance through analytics, only when you give consent.
• To measure advertising and remarketing performance through Google Ads and Meta Pixel, only when you give consent.

Legal bases

• Contract or pre-contract steps when you contact us about a project.
• Legal obligation for invoices, accounting, and tax records.
• Legitimate interest for site security, basic business communication, and service improvement where this does not override your rights.
• Consent for analytics, marketing cookies, tracking pixels, and optional preference cookies.

Tools and processors

We use trusted service providers only where needed. They process data on our behalf or as independent providers under their own terms.

• Vercel for website hosting and infrastructure.
• Resend for contact form email delivery.
• Google Workspace for email and business communication.
• Google Analytics, Vercel Analytics, Google Ads, and Meta Pixel when the relevant consent is given.
• Calendly if you use a booking link to schedule a call.

International transfers

Some providers may process data outside the EU/EEA. Where this happens, we rely on appropriate safeguards such as adequacy decisions, standard contractual clauses, provider data processing terms, and account-level privacy controls.

How long we keep data

• Project inquiries that do not become client work are usually kept for up to 12 months.
• Client and accounting records are kept for as long as required by law and legitimate business needs.
• Cookie consent records are kept for up to 12 months unless you update them earlier.
• Analytics and advertising retention depends on the provider settings and only applies when you consent.

Your rights

Under GDPR you can request access, correction, deletion, restriction, portability, objection, and withdrawal of consent. You can also lodge a complaint with AZOP, the Croatian Personal Data Protection Agency.

• To exercise your rights, email leo@nardo.studio.
• Withdrawing consent does not affect processing that happened before withdrawal.
• We do not intentionally collect sensitive personal data or target children.