Privacy policy
Last updated: 9 November 2026
This page explains which personal data we collect on the webfreaks.eu website, why we collect it, who we share it with and what you can request regarding it. We have done our best to write everything clearly, without unnecessary legal jargon. This is an English translation; if it differs from the Slovenian version, the Slovenian version applies.
Who processes your data
The controller of your personal data is:
ALTTAB, multimedijske storitve, Jernej Drnovšek s.p.
Dolenja vas 21, 1410 Zagorje ob Savi, Slovenia
VAT ID: SI91269849
Email: info@webfreaks.eu
Web Freaks and Control Freaks (ctrlfreaks.eu) are brands of this company. For anything concerning your data, write to us at the email address above.
What data we collect
Data you enter in the enquiry form: first and last name, email, phone, company or project name, the chosen package, what you already have (for example copy, logo, domain), additional needs, desired timeline, approximate budget, a description of your business, a website you like, your message and photos if you upload them (optional; before sending, your browser downsizes them and converts them to JPG, which also removes EXIF data such as location).
Technical data when the form is submitted: IP address, time of submission, browser type, landing page, traffic source and UTM parameters. Meta's click parameter (fbclid) and Meta's browser identifiers (_fbp, _fbc) are stored and passed on only if you accepted marketing cookies in the banner. In that case our server also passes your IP address and browser type to Meta when you view a page (see What goes to Meta below).
Server logs: on every visit, the hosting server automatically records the IP address, time, requested page and browser type. We use the logs only for security and troubleshooting and keep them for a short time.
Cookies and analytics: data about your visit collected by Google Analytics 4 and Meta Pixel, but only if you consent to analytics or marketing cookies in the banner. Until you choose, none of these services is loaded. Details, the list of cookies and the legal basis are in the cookie policy.
Record of consents: each time you make a choice in the cookie banner, we record a random consent ID, the time, the selected categories, the version of the cookie policy and the type of action (acceptance, rejection, change, withdrawal). We do not record your IP address or browser.
The form is intended for companies and individuals looking for a website build. Do not enter data we do not need to prepare a quote.
Why we process data and on what legal basis
- Replying to your enquiry and preparing a quote. We use the form data to contact you, understand the project and prepare a quote. The legal basis is steps taken prior to entering into a contract (Article 6(1)(b) GDPR).
- Analytics and marketing. Measuring visits, measuring conversions and showing ads based on your visit. The legal basis is your consent (Article 6(1)(a) GDPR), which you can withdraw at any time.
- Spam protection and security. We keep technical data from form submissions and server logs so that we can detect abuse and automated submissions. The legal basis is our legitimate interest (Article 6(1)(f) GDPR).
- Proof of consent. We keep a record of cookie consents because, as the controller, we must be able to demonstrate that you gave consent (Article 7(1) GDPR). The legal basis is our legal obligation (Article 6(1)(c) GDPR).
Where data is stored and for how long
When you submit the form, the data is sent to our team by email. At the same time it is written to a log (CSV file) on the hosting server. So there are two copies: in the mailbox and on the server. Uploaded photos are attached to the email and stored in a closed folder on the server that is not accessible from the internet; the same retention period applies to them.
We keep enquiry data for no more than 24 months after our last contact with you, or less if you request erasure earlier. If the enquiry leads to an order, data that forms part of the contract and invoices is kept for as long as tax and accounting regulations require. We keep the record of cookie consents for no more than 2 years.
Who we share data with
We do not sell data. In our work, however, we use services of external providers who process data on our behalf or as independent controllers:
| Provider | Purpose | Where |
|---|---|---|
| Neoserv d.o.o. | Website hosting and email | Slovenia |
| Google Ireland Ltd. | Google Analytics 4 (visit analytics, only with consent), Google Search Console, Google Ads if needed. We host the fonts ourselves; they are not loaded from Google's servers. | EU, possible transfer to the USA |
| Meta Platforms Ireland Ltd. | Meta Pixel and Conversions API: advertising, conversion measurement, remarketing and analytics of ad campaigns | EU, possible transfer to the USA |
What goes to Meta. If you accepted marketing cookies, Meta Pixel records in your browser page views, package views and clicks on our contact details. Our server also sends the same events to Meta (Conversions API), together with your IP address, browser type and Meta's click and browser identifiers (_fbc, _fbp), so that Meta recognizes the browser event and the server event as one. When you submit the form, we also send Meta your hashed email, phone and name, so Meta can measure which campaign led to the enquiry. The content of your message is never sent to Meta. If you did not accept marketing cookies, we send Meta nothing, neither from the browser nor from the server, and we do not store these identifiers.
Transfers of data outside the EU
Google and Meta may also process data on servers in the United States of America. The transfer is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework, under which both companies are certified, and on standard contractual clauses approved by the European Commission.
Your rights
Regarding your personal data, you can request from us at any time:
- access: that we tell you what data we hold about you,
- rectification: that we correct inaccurate or incomplete data,
- erasure: that we delete data when we no longer need it,
- restriction of processing: that we only store the data but do not use it,
- portability: that we hand over the data you gave us in a machine-readable format,
- objection: that you object to processing based on legitimate interest,
- withdrawal of consent: at any time, without affecting the lawfulness of processing before the withdrawal. You withdraw cookie consent via the Cookie settings link in the footer.
Send your request to info@webfreaks.eu. We reply within one month at the latest. Before handing over or deleting data, we may ask you to confirm your identity.
If you believe we process your data in breach of the regulations, you can lodge a complaint with the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si.
Security
The site runs over an encrypted connection (HTTPS). Access to email and the server is password-protected and limited to the team that handles enquiries. Even so, no data transfer over the internet is completely secure, so do not enter sensitive data in the form that we do not need for a quote.
Changes to this policy
We may update this policy when the tools we use or the regulations change. The version published on this page always applies, with the date of the last update at the top.