Privacy

Privacy Policy

1. Data Controller

The data controller is Tomaž Ornik s.p., Zgornja Velka 93d, 2213 Zgornja Velka, Slovenia (info@iteca.si). Referred to below as "Iteca".

2. Data We Collect

Via the contact form on this website we collect:

  • First and last name
  • Company name
  • Email address
  • Phone number (optional)
  • Message content (description of your enquiry)
  • Approximate budget (optional)

Via the lead magnet form we collect: email address and consent to receive the requested material.

Analytics (Google Analytics 4) collects visit data — device type, geographic region, on-site behaviour — without personal identifiers, and only with your consent.

3. Purpose and Legal Basis

Contact form
Responding to your enquiry and establishing business contact. Legal basis: pre-contractual measures (Art. 6(1)(b) GDPR).
Lead magnet
Sending the requested material. Legal basis: consent (Art. 6(1)(a) GDPR). Consent is voluntary and may be withdrawn at any time.
Analytics
Understanding website usage (Google Analytics 4, Consent Mode v2). Legal basis: consent. We collect data only after you give consent via the cookie banner.

4. Recipients of Data

We do not sell your data and do not share it with third parties for marketing purposes. Data is processed by:

Google LLC
Email service (Gmail) and analytics (GA4). Standard Contractual Clauses apply for transfers outside the EU/EEA.
Hetzner Online GmbH
EU-based web server, data centre in Frankfurt, Germany. GDPR-compliant hosting.
Entexia (internal CRM)
Internal customer relationship management system. Same data controller — Tomaž Ornik s.p. Data does not leave the controller.

5. Retention Periods

Contact form enquiries
3 years from the date of the enquiry, or until the pre-contractual relationship no longer requires it.
Email list (lead magnet)
Until consent is withdrawn. You may unsubscribe at any time via the link in any email.
Analytics data
14 months (Google Analytics 4 default retention period).

6. Your Rights

Under GDPR you have the right to:

  • Access — request a copy of the personal data we hold about you
  • Rectification — request correction of inaccurate data
  • Erasure — request deletion ("right to be forgotten"), where no legal obligation requires retention
  • Restriction — request that we limit how we process your data
  • Portability — receive your data in a structured, machine-readable format
  • Objection — object to processing based on legitimate interests
  • Withdraw consent — at any time, without affecting the lawfulness of prior processing

To exercise any of these rights, email info@iteca.si. We will respond within 30 days. You also have the right to lodge a complaint with the Slovenian Information Commissioner (ip-rs.si) or the supervisory authority in your country of residence.

7. Cookies

Necessary
CSRF token cookie required for the contact form to function securely. No consent required. Session-scoped.
Analytics
Google Analytics 4 (_ga, _ga_*). Set only after you accept analytics cookies via the consent banner. Consent Mode v2 is active — without consent, no data is sent to Google.

8. Security

All traffic is encrypted via HTTPS/TLS. The website runs on Hetzner Online infrastructure in Frankfurt, Germany — an EU data centre with ISO 27001 certification. We apply security headers (HSTS, CSP, X-Frame-Options) and keep software dependencies up to date.

9. Changes to This Policy

We may update this policy when our processing activities change. Material changes will be communicated via a notice on this page. The current version always applies.

Last updated
July 2026