Legal & business information.

The controller of personal data is PAUMAS, obrt za digitalna rješenja, vl. Thomas Divjak, Flengi 17a, 52450 Vrsar, Croatia. For anything concerning your data, write to thomas@paumas.hr. No data protection officer is appointed, as the conditions in GDPR Art. 37 are not met; requests are handled by the owner personally.

When you use the contact form we process the name, email address and message you provide, plus the optional project type, timeline and budget if you choose them. The sole purpose is to answer your enquiry and, if it goes that way, to agree on working together. The legal basis is GDPR Art. 6(1)(b) — steps taken at your request prior to a contract. We do not use the data for newsletters, profiling or automated decision-making, and we do not sell it to anyone.

We share your data only with the providers listed above, who process it on our instructions as processors, and with authorities where the law requires it. Some of those providers process data outside the European Economic Area, principally in the United States. Such transfers rely on the European Commission's standard contractual clauses and, where the provider is certified, on the EU–US Data Privacy Framework.

Enquiries and the correspondence around them are kept for at most 24 months after the last message, then deleted. If an enquiry turns into an engagement, the data moves into the contract records and is kept for as long as tax and accounting rules require — generally eleven years for accounting documents.

You have the right to access your data, to have it corrected or erased, to restrict or object to processing, and to data portability. Send your request to thomas@paumas.hr and we will answer within one month at the latest. If you believe we are not handling your data lawfully, you may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr.

The site sets no analytics, marketing or other tracking cookies, which is why there is no cookie banner. We count visits with Vercel Web Analytics: it sets no cookies and stores no identifier on your device, recording instead the page opened, where you arrived from, the country and the kind of device. It tells visitors apart using a marker derived from technical request data that changes daily and does not allow tracking across different sites. We also record two contentless events: that the contact form was sent successfully, and which kind of project someone picked in the indicative estimator. What you write in the form is never sent to analytics. The only cookie we set ourselves is essential and remembers your language choice. Google reCAPTCHA loads only once you start filling in the contact form, and only then can it set cookies on Google's own domains; if you never touch the form, its code is not loaded at all.

This notice was last updated in September 2026.