Privacy Policy
Last updated: 21 Sep 2026
1. Who we are (data controller)
The controller of personal data processed through grafeio.si is GRAFEIO.
Phone: 051 845 307
Email: grafeio.creative@gmail.com
Registration number: 7584474
Tax number: 83235256
GRAFEIO is not registered for VAT.
Referred to below as "GRAFEIO", "we" or "us".
Sole trader: Miran Vugrinski s.p., Regentova ulica 20, 2000 Maribor, Slovenia.
2. What data we collect
We only collect data you give us directly, or automatically through analytics tools (and only with your consent):
- Contact form / enquiry data: name, email address, and the content of the message you submit through the form on the site.
- Newsletter signup data: email address and a record of your consent. Subscription is completed only after you confirm it through the link sent to your email address.
- Site visit data (analytics): anonymised data about how you use the site (pages visited, time on site, general location, device/browser) — only if you accept the "Analytics" category in the cookie banner. Details are in the cookie policy.
- Digital business card data: if you download a vCard (digital business card) from the site, it's saved locally to your own device — we don't log or receive any data from that action.
We do not collect special categories of personal data (e.g. health data, religious beliefs) and we don't use the site for profiling or automated decision-making.
3. Why we process data (purpose & legal basis)
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Responding to your enquiry / preparing a quote | name, email, message | Art. 6(1)(b) — steps taken at your request prior to entering a contract |
| Sending the newsletter | email address, consent record | Art. 6(1)(a) — your explicit consent |
| Site visit analytics | anonymised visit data | Art. 6(1)(a) — your explicit consent (cookies) |
| Meeting legal obligations (e.g. bookkeeping, if an order goes ahead) | data from issued invoices | Art. 6(1)(c) — legal obligation |
4. Who we share data with (processors)
We don't sell your data and don't use it for third-party advertising. For the site's technical operation we use the following providers, who act as our data processors:
| Provider | Purpose | Location / data transfer |
|---|---|---|
| Google Ireland Limited (Google Analytics) | anonymised visit analytics, only with consent | EU/EEA and US — under standard contractual clauses |
| Formspree, Inc. | processing messages submitted through the contact form | US — under standard contractual clauses |
| Netlify, Inc. | website hosting | US — under standard contractual clauses |
| Brevo (Sendinblue SAS) | newsletter subscriptions and delivery | EU — data hosted in France, Germany and Belgium |
Where we transfer data outside the EU/EEA, we do so under an appropriate safeguard (the European Commission's standard contractual clauses).
5. How long we keep data
- Contact form messages: until the project concludes + 1 year; if no project results from the enquiry, we delete the message no later than one year after the last contact.
- Newsletter data: until you unsubscribe or withdraw your consent. We may retain the minimum suppression record needed to ensure that no further newsletters are sent to you.
- Cookie choice: stored locally in your browser (localStorage) for 365 days, after which consent is asked again.
- Analytics data (Google Analytics): per Google Analytics 4's default settings (typically up to 14 months).
- Records from concluded business (invoices): per the statutory bookkeeping retention obligation (in Slovenia, typically 10 years).
6. Your rights
Under GDPR, you have the right to:
- access your personal data,
- rectify inaccurate data,
- erase your data ("right to be forgotten"),
- restrict processing,
- data portability,
- object to processing,
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (e.g. via the "Settings" button in the cookie banner),
- lodge a complaint with a supervisory authority.
Send any request about your data to grafeio.creative@gmail.com or 051 845 307. We respond within the statutory deadline (generally one month).
You may also lodge a complaint with the competent supervisory authority: Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec RS), Dunajska cesta 22, 1000 Ljubljana, ip-rs.si.
7. Cookies
The site uses cookies in line with your consent. The full list and purpose of cookies is described in the cookie policy.
8. Data security
The site is hosted by a provider that transmits data encrypted (HTTPS). Access to received messages/emails is limited to people who process them as part of GRAFEIO's business.
9. Changes to this policy
We may update this policy from time to time, for example when the law or the tools we use change. The date of the last change is shown at the top of the page.
10. Contact
For any questions about the protection of personal data, contact us at grafeio.creative@gmail.com or 051 845 307.