+381 60 180 8855 Available for new projects Start a project

Privacy Policy

Last updated: 2 November 2026

This policy explains what personal data is processed when you visit nstudio.rs or contact me, why, and what your rights are. The site is built to collect as little as possible: there is no analytics, no advertising or tracking cookies, and no third-party fonts, maps or video embeds.

1. Who is responsible

The controller of your personal data is Nemanja Janjić, nstudio, Subotica, Serbia.
Email: janjic.nemanja988@gmail.com
Phone / WhatsApp: +381 60 180 8855

I process personal data in line with the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), which applies when I offer my services to people in the European Union, and the Serbian Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti, Official Gazette of RS no. 87/2018).

2. What data I process and why

2.1 Visiting the website

When you open a page, the web server automatically records technical data: IP address, date and time, the page requested, browser and operating system, and the referring page. This is needed to deliver the site, keep it secure and fix errors.

  • Legal basis: legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).
  • Storage: server logs are kept for a limited period and deleted automatically, unless they are needed to investigate a security incident.

Failed login attempts to the WordPress admin area are recorded with the IP address to block brute-force attacks. This only concerns the login page, not normal visits.

2.2 Contact form

When you send the contact form, I receive your name, email address, the optional Figma or website link, and your message. I use them only to reply to you and to prepare an offer.

  • Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and my legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).
  • How it works: the form sends an email to my inbox. Submissions are not stored in the website database.
  • Storage: as long as our conversation needs it. If no project follows, I delete the enquiry within 24 months of the last message. If we work together, project correspondence is kept for as long as the contract and statutory accounting obligations require.

Name, email and message are required, because I cannot reply without them.

2.3 Email, phone and WhatsApp

If you contact me directly, I process the details you send in the same way and for the same purposes as the contact form. WhatsApp is operated by WhatsApp Ireland Limited (Meta), and its own privacy policy applies to messages sent through it.

2.4 Links to other websites

The portfolio links to client websites, Upwork and LinkedIn. These open in your browser and are governed by the privacy policies of those websites. No data is passed to them by this site before you click.

3. Cookies

This site only uses cookies that are strictly necessary:

  • Consent cookies (names starting with cmplz_), set by the cookie banner to remember your choice, for up to 365 days.
  • WordPress login cookies, only set when an administrator logs in. Regular visitors never receive them.

Necessary cookies do not need consent (Art. 5(3) ePrivacy Directive). If statistics or embedded content are ever added, they will only load after you agree, and this policy will be updated. You can change your choice at any time with the Cookie settings link at the bottom of every page.

4. Fonts and other resources

All fonts, images and scripts are served from this website’s own server. No request is made to Google Fonts or any other external content provider while you browse.

5. Who receives your data

  • Hosting provider: stores the website and server logs on my behalf, as a processor under a data processing agreement.
  • Email provider: my inbox is hosted by Google (Gmail). Google may process data outside the EU; such transfers are covered by the EU–US Data Privacy Framework and Standard Contractual Clauses.
  • Authorities: only where the law requires it.

I never sell your data or use it for advertising.

6. Transfers outside the EU

I am based in Serbia, which is outside the EU/EEA. When you send me an enquiry from the EU, your data is transferred to Serbia because it is necessary to answer your request and to prepare or perform a contract with you (Art. 49(1)(b) GDPR). Serbian data protection law is closely aligned with the GDPR.

7. Your rights

You have the right to:

  • access your personal data and get a copy of it;
  • have incorrect data corrected;
  • have your data erased (“right to be forgotten”);
  • restrict processing;
  • receive your data in a portable format;
  • object to processing based on legitimate interest;
  • withdraw consent at any time, without affecting processing that happened before.

To use any of these rights, email janjic.nemanja988@gmail.com. I reply within one month.

You can also lodge a complaint with a supervisory authority: the data protection authority in the EU country where you live or work, or in Serbia the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11120 Belgrade, www.poverenik.rs, office@poverenik.rs.

8. Security

The site uses HTTPS encryption, up-to-date software, limited administrator access and protection against login attacks.

9. Automated decisions and children

There is no automated decision-making or profiling. The site is not directed at children under 16.

10. Changes

I will update this policy when the website or the law changes. The date at the top shows the latest version.