Privacy policy
This page explains how Smitheo d.o.o. processes personal data on smitheo.com. The first section describes, in plain language, what happens when you use our forms and how we measure the website. The full privacy notice below it covers your rights, retention and every other topic required by the GDPR.
Last updated
How this website processes your data
Who is responsible for your data?
Smitheo d.o.o., Ulica kralja Petra Krešimira IV. 41, 42000 Varaždin, Croatia, is the controller for personal data processed on smitheo.com. You can reach us at contact@smitheo.com.
Project brief and contact form
When you send a brief through our contact form, we process the details you enter: your name, email address, company (optional), the service you selected, the description of your project, your budget and your timeline. We use them only to reply to you, prepare a quote and, if we work together, to run the project.
The legal basis is taking steps at your request before entering into a contract (Article 6(1)(b) GDPR). We keep briefs for as long as we need them to answer you and, if a contract follows, for the periods required by accounting and tax law.
Lab waitlist
If you join the Lab list, we store your email address to send you occasional updates about the products we are building. The legal basis is your consent (Article 6(1)(a) GDPR). Every update we send contains an unsubscribe link, and you can ask us to remove you at any time.
Email delivery with Resend
Form submissions and waitlist sign-ups are delivered through Resend, an email service provider that processes the data on our behalf as a processor. Resend may process data outside the European Economic Area; in that case the transfer relies on the safeguards in Resend's data processing terms, such as the EU Standard Contractual Clauses.
Spam protection with Cloudflare Turnstile
Our forms use Cloudflare Turnstile to tell people and bots apart. When a form loads, Cloudflare processes technical information such as your IP address and browser characteristics to run the check. We only receive the result of the check. The legal basis is our legitimate interest in keeping the forms free of spam (Article 6(1)(f) GDPR).
Hosting and performance measurement on Vercel
The website is hosted by Vercel, which processes technical data such as IP addresses in server logs to deliver pages and keep the service secure.
We use Vercel Speed Insights to measure how fast pages load for real visitors. Speed Insights does not use cookies and collects aggregated performance data, not profiles of individual visitors. The legal basis is our legitimate interest in running a secure and fast website (Article 6(1)(f) GDPR).
Analytics with Google Tag Manager, Google Analytics 4 and Cookiehub
We use Google Tag Manager to load Google Analytics 4, which helps us understand how visitors use the site. Tag Manager loads only after your first interaction with a page, and analytics cookies are set only if you agree in the cookie banner provided by Cookiehub. Google Consent Mode keeps analytics storage denied until you consent.
You can change or withdraw your choice at any time through the cookie settings. The legal basis for analytics is your consent (Article 6(1)(a) GDPR).
Your rights
You can ask for access to, correction or deletion of your data, restrict or object to its processing, and receive it in a portable format. Where processing is based on consent, you can withdraw it at any time. To exercise these rights, email contact@smitheo.com. You can also complain to the Croatian data protection authority (Agencija za zaštitu osobnih podataka, AZOP) or the authority in your country.
Full privacy notice
-
Visit our website
at https://www.smitheo.com , or any website of ours that links to this Privacy Notice
-
Engage with us in other related ways, including any sales, marketing, or events
SUMMARY OF KEY POINTS
TABLE OF CONTENTS
1. WHAT INFORMATION DO WE COLLECT?
Personal information you disclose to us
In Short: We collect personal information that you provide to us.-
email addresses
-
mailing addresses
-
names
-
phone numbers
-
job titles
Information automatically collected
In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.-
Log and Usage Data. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type, and settings and information about your activity in the Services (such as the date/time stamps associated with your usage, pages and files viewed, searches, and other actions you take such as which features you use), device event information (such as system activity, error reports (sometimes called
"crash dumps" ), and hardware settings).
-
Device Data. We collect device data such as information about your computer, phone, tablet, or other device you use to access the Services. Depending on the device used, this device data may include information such as your IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, Internet service provider and/or mobile carrier, operating system, and system configuration information.
-
Location Data. We collect location data such as information about your device's location, which can be either precise or imprecise. How much information we collect depends on the type and settings of the device you use to access the Services. For example, we may use GPS and other technologies to collect geolocation data that tells us your current location (based on your IP address). You can opt out of allowing us to collect this information either by refusing access to the information or by disabling your Location setting on your device. However, if you choose to opt out, you may not be able to use certain aspects of the Services.
2. HOW DO WE PROCESS YOUR INFORMATION?
In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.-
To deliver and facilitate delivery of services to the user. We may process your information to provide you with the requested service.
-
To respond to user inquiries/offer support to users. We may process your information to respond to your inquiries and solve any potential issues you might have with the requested service.
-
To send administrative information to you. We may process your information to send you details about our products and services, changes to our terms and policies, and other similar information.
-
To
fulfill and manage your orders. We may process your information to fulfill and manage your orders, payments, returns, and exchanges made through the Services.
-
To enable user-to-user communications. We may process your information if you choose to use any of our offerings that allow for communication with another user.
-
To save or protect an individual's vital interest. We may process your information when necessary to save or protect an individual’s vital interest, such as to prevent harm.
3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?
In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e.-
Consent. We may process your information if you have given us permission (i.e.
, consent) to use your personal information for a specific purpose. You can withdraw your consent at any time. Learn more about withdrawing your consent.
-
Performance of a Contract. We may process your personal information when we believe it is necessary to
fulfill our contractual obligations to you, including providing our Services or at your request prior to entering into a contract with you.
-
Legal Obligations. We may process your information where we believe it is necessary for compliance with our legal obligations, such as to cooperate with a law enforcement body or regulatory agency, exercise or defend our legal rights, or disclose your information as evidence in litigation in which we are involved.
-
Vital Interests. We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to the safety of any person.
- If collection is clearly in the interests of an individual and consent cannot be obtained in a timely way
-
For investigations and fraud detection and prevention
-
For business transactions provided certain conditions are met
-
If it is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim
-
For identifying injured, ill, or deceased persons and communicating with next of kin
-
If we have reasonable grounds to believe an individual has been, is, or may be victim of financial abuse
-
If it is reasonable to expect collection and use with consent would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province
-
If disclosure is required to comply with a subpoena, warrant, court order, or rules of the court relating to the production of records
-
If it was produced by an individual in the course of their employment, business, or profession and the collection is consistent with the purposes for which the information was produced
-
If the collection is solely for journalistic, artistic, or literary purposes
-
If the information is publicly available and is specified by the regulations
- Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
Google Analytics
We may share your information with Google Analytics to track and6. HOW LONG DO WE KEEP YOUR INFORMATION?
In Short: We keep your information for as long as necessary to7. HOW DO WE KEEP YOUR INFORMATION SAFE?
In Short: We aim to protect your personal information through a system of8. DO WE COLLECT INFORMATION FROM MINORS?
In Short: We do not knowingly collect data from or market to9. WHAT ARE YOUR PRIVACY RIGHTS?
In Short:10. CONTROLS FOR DO-NOT-TRACK FEATURES
Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track (11. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
In Short: If you are a resident ofCategories of Personal Information We Collect
We have collected the following categories of personal information in the past twelve (12) months:| Category | Examples | Collected |
|
A. Identifiers
|
Contact details, such as real name, alias, postal address, telephone or mobile contact number, unique personal identifier, online identifier, Internet Protocol address, email address, and account name
|
|
|
B. Personal information as defined in the California Customer Records statute
|
Name, contact information, education, employment, employment history, and financial information
|
|
|
|
Gender, age, date of birth, race and ethnicity, national origin, marital status, and other demographic data
|
|
|
|
Transaction information, purchase history, financial details, and payment information
|
|
|
|
Fingerprints and voiceprints
|
|
|
|
Browsing history, search history, online
|
|
Device location | ||
Images and audio, video or call recordings created in connection with our business activities | ||
Business contact details in order to provide you our Services at a business level or job title, work history, and professional qualifications if you apply for a job with us | ||
Student records and directory information | ||
Inferences drawn from any of the collected personal information listed above to create a profile or summary about, for example, an individual’s preferences and characteristics | ||
- Receiving help through our customer support channels;
- Participation in customer surveys or contests; and
- Facilitation in the delivery of our Services and to respond to your inquiries.
- Category
C - As long as the user has an account with us
- Category
H - As long as the user has an account with us
Sources of Personal Information
Learn more about the sources of personal information we collect inHow We Use and Share Personal Information
Your Rights
You have rights under certain US state data protection laws. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law. These rights include:- Right to know whether or not we are processing your personal data
- Right to access your personal data
- Right to correct inaccuracies in your personal data
- Right to request the deletion of your personal data
- Right to obtain a copy of the personal data you previously shared with us
- Right to non-discrimination for exercising your rights
- Right to opt out of the processing of your personal data if it is used for targeted advertising
(or sharing as defined under California’s privacy law) , the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects ( "profiling" )
- Right to access the categories of personal data being processed (as permitted by applicable law, including Minnesota’s privacy law)
- Right to obtain a list of the categories of third parties to which we have disclosed personal data (as permitted by applicable law, including
California's and Delaware's privacy law)
- Right to obtain a list of specific third parties to which we have disclosed personal data (as permitted by applicable law, including
Minnesota's and Oregon's privacy law)
- Right to review, understand, question, and correct how personal data has been profiled (as permitted by applicable law, including Minnesota’s privacy law)
- Right to limit use and disclosure of sensitive personal data (as permitted by applicable law, including California’s privacy law)
- Right to opt out of the collection of sensitive data and personal data collected through the operation of a voice or facial recognition feature (as permitted by applicable law, including Florida’s privacy law)