Privacy & cookies

Klartika, vl. Alessio Re. Prilaz baruna Filipovića 24, 10000 Zagreb, Croatia · EU. VAT HR91494145363. I am the data controller for this site. Questions about your data? Email email and I'll get back to you.

Site analytics. Once you accept cookies, Google Analytics 4 records how the site is used: the pages you visit, a rough location from your IP address, your device and browser, and how you arrived. I read it in aggregate to improve the site. It runs only with your consent (GDPR Article 6(1)(a)).

Advertising features. If you also accept the marketing cookies, Google Analytics shares data with Google to build audiences and demographic and interest profiles I could use for advertising later. I'm not running any campaigns or remarketing right now, so nothing is used for ads today, but the data is collected once you allow it. It runs only with your consent (Article 6(1)(a)).

Email and bookings. If you email me or book an intro call, I process the details you share (your name, email, and whatever you tell me) to reply and run the call. The basis is taking steps at your request before any engagement and my legitimate interest in responding (Article 6(1)(b) and (f)).

Consent records. Your cookie choice is logged on my own server so I can honour it and show that consent was given. A record holds a random ID created in your browser, the time, what you chose for each category (allowed or refused) and where (banner or settings), how long the banner was open before you chose, a shortened IP address, your browser's user agent, the site's domain, your country and region, the banner's language, and which version of the rules and of the banner text you saw. A second log entry is kept as an audit trail and deleted together with the record. It repeats the same ID, your choice, the time, the shortened IP address and the user agent, and points to the same site, rules version, country, region and language as the record. Neither holds a page address, a name or an email.

Consent service log. On every page you visit, the consent service writes a line to a technical log: the time, which website it was for, your country and region, the language, whether your browser sends a Global Privacy Control signal, and which consent rules applied. When you make a choice, a further line notes that a choice was saved and which categories it covered, but not what you chose. The log holds no IP address, no page address and no identifier of you or your record. I keep it to run the service and fix its errors (Article 6(1)(f)).

Consent is managed with c15t, an open-source tool I host myself, and Google Consent Mode v2. Until you accept, analytics and advertising storage stay denied. Outside the EU and EEA the default is more permissive, but you can change your choice at any time:

If you decline, Google's tools still load, but in a reduced mode that doesn't read or write cookies. More in the Google Privacy Policy.

Your choice on this device: You haven't chosen yet.

The cookies and browser storage this site uses:

I use a small internal tool, Klartika Ads tools, that connects to the Google Ads API when I sign in with Google. I'm its only user. It asks for one permission, Google Ads (the adwords scope).

What it accesses. Google Ads data in accounts my Google account can already open, which means my clients' accounts under my manager account: campaigns, ads, assets, budgets, bidding, performance reports, keyword ideas, search-volume estimates and traffic forecasts.

How I use it. Only to manage, report on and research keywords for the client who owns the account. I don't use it for my own advertising or to train generalised AI models, and I don't sell it.

Where it's stored. On my own infrastructure. I keep reports and exports only as long as the client engagement needs them, then delete them, and nothing from the API is kept past that point.

Who I share it with. Only the client the data belongs to, and the processors I strictly need to provide the service. It never goes to data brokers or advertising platforms.

Klartika's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking access. You can revoke the tool's access at any time at myaccount.google.com/permissions, or email me at email.

I use a small set of processors, each under a data processing agreement, and no others for this site:

• Google LLC (USA): Google Analytics 4 and Google Tag Manager, served first-party through a server-side container. Analytics, plus advertising features (audiences and demographics) when you accept the marketing cookies, for campaigns I might run later.
• Stape Europe OÜ (Estonia): the server-side container that delivers the Google tag and receives the analytics from my own domain, processed and hosted in the EU (France).
• Cal.com, Inc. (USA): appointment scheduling, when you book an intro call.
• Cloudflare, Inc. (USA / global): hosting, content delivery, and security.
• Oracle Italia S.r.l. (Italy): the server in Milan that keeps the consent records, on Oracle Cloud.
• BorgBase, operated by Peakford Ltd (Malta): an encrypted off-site backup of that server, stored in the EU. It is encrypted before it leaves my server.

Some processors (Google, Cloudflare) are in the United States. Those transfers rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses.

• Analytics: held in GA4 for up to 14 months, then only in aggregate.
• Emails and bookings: only as long as I need them to handle your request and any follow-up, then deleted.
• Consent records: your choice is logged on my own server in the EU (Milan) as proof, and deleted 24 months after you made it. An encrypted backup, also in the EU, is phased out after that: a deleted record can no longer be restored after about six months. You can ask me for your record with the ID stored in your c15t cookie.
• Consent service log: deleted within 30 days.

Under the GDPR you can get a copy of your data, correct it, have it deleted, restrict or object to processing, and ask for portability. You can withdraw consent at any time with Cookie settings, which does not affect anything done beforehand. To exercise any of these, email me at email. I respond within one month.

If you think I've handled your data wrongly, you can complain to the Croatian Personal Data Protection Agency (AZOP, azop.hr) or to the supervisory authority where you live in the EU or EEA.

There is no automated decision-making or profiling that has a legal or similarly significant effect on you. This site is not aimed at children, and I don't knowingly collect their data.

I'll update this page when the site or the tools behind it change. The date at the top is the current version.