Privacy Policy

1. Controller

The controller responsible for processing personal data in connection with this website is:

2. Scope

This Privacy Policy explains how Borut Zemljic processes personal data in connection with this website (borutzemljic.com), its contact form and related communications.

This Policy is governed by the Swiss Federal Act on Data Protection (“revFADP”, in force since 1 September 2023) and, where applicable, the EU General Data Protection Regulation (“GDPR”).

3. Personal Data We Collect

Homepage contact form

When you submit the contact form on the homepage, I may process the following data:

• Identity and contact data: first and last name, email address and telephone number.
• Professional data: company or organisation.
• Communication data: inquiry type and message.
• Event data: event date and location or format, where relevant to your inquiry.

Technical data required to operate the website

When you visit this website, I and my service providers process technical data to deliver the website, maintain its operation, diagnose errors and protect its security:

• Connection and device data: IP address and browser and device information.
• Request and navigation data: requested pages, referring information, timestamps and request identifiers.
• Operational and security data: response status, error information and security data.

Please limit your inquiry to information needed to understand it. Do not include sensitive personal data.

4. Purpose of Processing

I process personal data for the following purposes:

• Operate, maintain and secure this website (GDPR Art. 6(1)(f)).
• Respond to inquiries and take requested pre-contractual steps (GDPR Art. 6(1)(b), (f)).
• Establish and administer professional and business relationships (GDPR Art. 6(1)(b), (f)).
• Prevent misuse, investigate security events and protect confidential information (revFADP Art. 8; GDPR Arts. 6(1)(f), 32).
• Fulfil applicable information, access and breach-notification duties (revFADP Arts. 19, 24, 25; GDPR Arts. 6(1)(c), 12–22, 33–34).
• Establish, exercise or defend legal claims (revFADP Art. 31; GDPR Art. 6(1)(f)).
• Provide optional third-party content where consent is required (GDPR Art. 6(1)(a)).

I do not sell personal data and do not use website data for third-party advertising.

5. Contact Form and Communication

Contact-form submissions are collected and stored by Netlify Forms and transmitted via Resend. Resend processes names, email addresses, subject, message content and delivery metadata to deliver the email.

I use your inquiry and related correspondence to respond, follow up and meet security, compliance and recordkeeping requirements.

6. Website Hosting

This website is hosted by Netlify. Netlify may process IP addresses, browser and device information, requested paths and search parameters, timestamps, request identifiers, response status, function-execution information, errors and security information to deliver, protect and maintain the website.

Hoststar provides DNS services for the domain. DNS requests may involve domain queries and technical information about the requesting resolver or connection.

7. Analytics, Cookies, Service Providers and Third-Party Content

Analytics

This website does not use analytics tools or tracking cookies.

Cookies and similar technologies

I do not use advertising or analytics cookies. The website does not use first-party cookies to remember your language or maintain an account, and does not use local storage, session storage or IndexedDB for persistent account or analytics data.

These statements do not extend to an activated YouTube player or third-party websites you visit through external links.

YouTube videos

The YouTube player loads only when you choose to activate it, using privacy-enhanced mode. Activation connects your browser to Google/YouTube, which may receive your IP address, browser and device information, the requested video and playback information, and may use cookies or similar technologies.

Privacy-enhanced mode does not prevent all personal-data processing. You can use the rest of the website without activating the player. Further information is available in Google’s privacy policy.

Service providers

• Netlify: hosts and delivers this website and processes the technical data.
• Hoststar: provides DNS services for the domain.
• Resend: delivers contact-form notifications.
• Google/YouTube: provides embedded video playback when activated.
• Email service providers: process received inquiries and related correspondence.

Links to Partner and Third-Party Websites

This website may contain links to third-party websites. When you follow an external link, the privacy policy of the destination website applies. I have no control over the content or privacy practices of third-party websites.

8. Data Transfers Abroad

Netlify, Inc. (United States and subprocessors)

Netlify’s hosting and delivery infrastructure may involve processing in the United States and countries where its subprocessors operate. Its processing documentation describes applicable safeguards for international transfers. Processing documentation and subprocessors

Plus Five Five, Inc. / Resend (United States)

Resend stores email content, recipient information and delivery logs in the United States. Its data processing terms include standard contractual clauses and provisions for transfers from Switzerland. Data Processing Addendum

Google/YouTube (Ireland, United States and international infrastructure)

Activating a YouTube player may involve processing by Google Ireland Limited and Google LLC in the United States, as well as other countries where Google operates. Its privacy policy describes international processing and the transfer safeguards it uses. Privacy policy

Transfers to countries without recognised adequate protection require appropriate safeguards, such as standard contractual clauses with Swiss adaptations, or a statutory exception (revFADP Arts. 16–17; GDPR Arts. 44–49). Information about the safeguards applicable to your data is available at privacy@borutzemljic.com.

9. Data Retention

Routine inquiries and correspondence are retained for as long as needed to respond and complete necessary follow-up.

Contact data are retained as needed to manage the relationship. After the end of the relationship, these data and correspondence are retained only where needed for outstanding obligations or legal claims.

Where statutory accounting retention duties apply, accounting records, supporting vouchers and annual and audit reports are retained for ten years from the end of the relevant financial year (Swiss Code of Obligations, Art. 958f). This period does not apply automatically to all emails or inquiry data.

Technical and security logs are retained for as long as needed to operate and protect the website or investigate incidents. Retention is limited to what these purposes and applicable legal duties require.

10. Your Rights

Under Swiss data protection law, and additionally under the GDPR where it applies, you have the following rights. The scope of each right is subject to applicable legal requirements and exceptions:

• The right to obtain confirmation and information about my processing
• The right to access your personal data and obtain a copy
• The right to have your data corrected or completed
• The right to request deletion or destruction of personal data
• The right to request restriction of processing
• The right to receive certain personal data in a portable format
• The right to object to processing in the circumstances provided by law and based on legitimate interest
• The right to withdraw consent at any time where processing is based on consent, without affecting prior lawful processing
• The right to not be subject to a decision based solely on automated processing where the applicable legal requirements are met
• The right to raise concerns with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, where the GDPR applies, lodge a complaint with the competent European data protection authority.

Requests may be sent to privacy@borutzemljic.com. I may ask for information needed to verify your identity and will respond in accordance with applicable law.

11. Data Security

I take appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration, disclosure or destruction. Measures include encrypted website connections and access controls appropriate to the information involved.

No internet transmission or electronic storage system can be guaranteed to be completely secure. Please avoid sending confidential or highly sensitive information through the general website contact form unless a suitable secure channel has been agreed.

12. Updates to This Policy

I may update this Privacy Policy when the website, service providers, processing activities or legal obligations change. The version published on the website is the current version.

13. Contact

If you have questions about this Privacy Policy or my processing of personal data, please contact: