Privacy Policy

Thank you for visiting. We take your privacy seriously. This policy describes what data we collect, how we use it, who we share it with, and your rights under GDPR and Bosnia & Herzegovina's data protection law.

1. Who we are

Site operator: External marketing partner of Starački dom Park. Hosted on Cloudflare (EU/Frankfurt).

Final data recipient: Starački dom Park, Gornja Jošanica II 1, 71320 Sarajevo, BiH. All admission, placement, and care decisions are made by them — we only forward inquiries.

Privacy contact: [email protected]

2. Data we collect

2.1. Form submissions

• Full name
• Phone number
• Email (optional)
• Who you're inquiring for (parent / spouse / other)
• Your question (optional)
• Consent to be contacted

2.2. Automatically collected

• Technical: IP address (anonymized after 30 days), device type, browser, language, country
• Behavior: pages visited, time on page, referrer, key click events
• UTM tags: if you came from our Facebook/Google ad, we record which campaign
• Cookies: essential cookies for the form; analytics cookies only with consent

3. Why we collect it

• To contact you: we forward your inquiry to Starački dom Park, who calls you from their official number.
• Ad effectiveness: to measure which ads bring inquiries and optimize spend.
• Re-marketing: with your consent, we may show relevant ads on Facebook/Instagram/Google.
• Security: spam and abuse prevention.

4. Who we share data with

• Starački dom Park — the recipient of your inquiry.
• Resend.com (email service, EU) — notification email delivery.
• Cloudflare (hosting + D1 database, EU) — inquiry storage.
• Meta (Facebook/Instagram) — anonymized, hashed conversion signals (with consent).
• Google Analytics 4 — aggregated visitor stats (with consent).

We do not sell your data and do not use it for any purpose beyond those listed.

5. Data retention

• Form submissions: 24 months, then deleted or anonymized.
• Technical logs: 30 days.
• Analytics (GA4): 14 months, aggregated.

6. Your rights (GDPR)

• Right to access your data
• Right to correction
• Right to erasure ("right to be forgotten")
• Right to withdraw consent at any time
• Right to lodge a complaint with the supervisory authority

To exercise these rights, email [email protected] with subject "GDPR request". We respond within 30 days.

7. Cookies

• Essential (always on): form, security, anti-spam.
• Analytics (consent required): Google Analytics 4.
• Marketing (consent required): Meta Pixel — re-targeting and conversion measurement.

8. Security

Data is stored on encrypted Cloudflare D1 servers (EU). The admin panel is protected by strong passwords and HMAC-signed sessions. IPs are anonymized; phones and emails are hashed for marketing signals.

9. Changes to this policy

If we change this policy, we'll update the date at the top. Material changes will be communicated by email if you've provided one.

10. Contact

Questions: [email protected]