This policy describes exactly what this website collects, why, and what happens to it. It describes the real behaviour of the site, not a template.
Who is responsible
The controller of any personal data processed through this website is:
- STEVAN ANTIĆ PR ELEVIO SOLUTIONS (trading as Elevio Solutions)
- Registered in Belgrade, Republic of Serbia
- Company registration number (matični broj): 68239532
- Tax number (PIB): 115278168
- Email: hello@eleviosolutions.com
For anything in this policy, including any request about your data, write to that address. A person reads it, not a ticketing system.
What this site collects
When you send us a message
The contact form, the project inquiry form, and the form in the sidebar of case studies each collect the same core fields: your name, your email address, and your message. Depending on the form, they may also collect a subject line, the service you are interested in, an indicative budget range, and which page you started from.
These submissions are not stored in this website’s database. They are composed into an email and delivered to our own inbox through an external mail service, and they then live in that mailbox like any other email. We keep them for as long as the enquiry is commercially relevant, and we delete them on request.
The legal basis is Article 6(1)(b) GDPR: taking steps at your request before entering into a contract.
Anti-spam and rate limiting
Every form carries two invisible anti-spam checks: a hidden field that a human never fills in, and a timestamp that rejects submissions completed impossibly fast. Neither collects anything about you.
We also limit how many times the same visitor can submit a form in a short window. To do that we store a one-way hash of the IP address together with a counter, for a few minutes. The IP address itself is never written down, and the hash cannot be turned back into it. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in keeping the forms usable.
Server logs and security
This site sits behind Cloudflare, which handles security filtering and content delivery. Cloudflare and our web hosting provider process standard connection data, including IP address, request time, requested URL, and browser user agent, in order to serve pages and to block abuse. This is ordinary web server operation and it applies to every website. The legal basis is Article 6(1)(f) GDPR.
Analytics
We use Cloudflare Web Analytics, which measures page views without cookies and without building a profile of you across sites. We do not use Google Analytics, advertising pixels, session recording, heatmaps, or any cross-site tracking.
What this site does not do
- It sets no tracking cookies. WordPress sets cookies only for people who log in to administer the site, which is us.
- It runs no advertising or social media pixels.
- It does not sell, rent, or share personal data with anyone for marketing.
- It does not profile you or make automated decisions about you.
- It does not subscribe you to anything. Writing to us does not add you to a mailing list.
Who else processes your data
We keep the list of third parties deliberately short. Each one is here because the site cannot work without it.
- Cloudflare, Inc. (United States and global edge network) for security, content delivery, DNS, and cookieless analytics.
- Brevo (Sendinblue SAS) (France) as the mail relay that delivers form submissions to our inbox, and email routing for our own address.
- Our web hosting provider, which stores the website files and database.
Where a provider processes data outside the European Economic Area, that transfer relies on the European Commission’s Standard Contractual Clauses.
How long we keep things
- Enquiries by email: for as long as the conversation or the resulting engagement is live, and afterwards for as long as we may need it for accounting or legal reasons. Deleted sooner on request.
- Rate limiting hashes: minutes.
- Server and security logs: retained by Cloudflare and by our host according to their own schedules, typically days to weeks.
Your rights
If you are in the EU, the EEA, or the UK, you have the right to ask for a copy of the personal data we hold about you, to have it corrected, to have it deleted, to restrict or object to how we use it, and to receive it in a portable form. You also have the right to complain to a supervisory authority. In Serbia that is the Commissioner for Information of Public Importance and Personal Data Protection.
To exercise any of these, email hello@eleviosolutions.com. We answer within 30 days, usually much sooner.
Children
This site sells business services and is not directed at children. We do not knowingly collect data from anyone under 16.
Changes
If this policy changes in a way that affects you, we update the date below. We do not backdate.
Last updated: 6 August 2026.