Privacy, in plain terms.

This policy covers metathema.agency — the website you are reading. It is written to be read, not to be survived. If anything here is unclear, write to us and we will answer in the same plain register.

Who is responsible

The data controller is MetaThema DOO, a company registered in Serbia and based in Belgrade. We decide what this website collects and why. You can reach us about anything on this page at [email protected].

What we collect

This website has one form: the contact form. When you send it, we receive the fields you filled in.

• Your name.
• Your email address, so we can reply.
• Your company, if you give one.
• An indication of budget, if you select one.
• The message you write.

Alongside the form, we receive the IP address and browser user agent the request came from. We use them to tell a genuine enquiry from automated spam, and for nothing else. There is no account to create, no newsletter to join and no profile built about you.

Why we use it

• To read your enquiry and reply to it.
• To continue the conversation that follows, and to keep a record of what was agreed.
• To keep the form usable by blocking abuse and automated submissions.
• To understand, in aggregate, which pages people read — without identifying anyone.

The legal basis

We rely on your consent when you choose to send the form, and on our legitimate interest in answering enquiries, keeping business correspondence and protecting the site from abuse. Where a conversation becomes a contract, we process what the contract needs. This holds under the EU General Data Protection Regulation (GDPR) and the Serbian Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti).

Cookies and local storage

We set no advertising cookies, no tracking pixels and no third-party marketing scripts. One cookie and one local-storage value are kept in your own browser so the site behaves the way you left it. Clearing your browser data removes them.

• mt-theme — a value in your browser's local storage: whether you chose the dark or light theme.
• mt-locale — a cookie, kept for a year: the language you last read the site in.

Analytics

We use Cloudflare Web Analytics, which is cookieless and does not fingerprint visitors or follow them across sites. It gives us page counts and referrers, nothing that identifies you. Cloudflare also serves this site as a CDN and proxy, so its network sees the technical details of every request — IP address, user agent, the URL requested — as part of delivering the page and filtering attacks.

Who else sees your data

We do not sell data and we do not share it for advertising. Two service providers process it on our behalf, under their own data-processing terms.

• Amazon Web Services (Amazon SES) — delivers the contact form to our mailbox as an email. The submission is sent by mail and is not written to any database of ours.
• Cloudflare — DNS, CDN, proxy, bot filtering and the cookieless analytics described above.

Transfers outside Serbia and the EEA

Both providers operate global infrastructure, so your data may be processed outside Serbia and the European Economic Area. Each offers standard contractual clauses and equivalent safeguards for those transfers, and we rely on them.

How long we keep it

Your message and our replies are kept as business correspondence in our mailbox — for as long as the enquiry is live, and afterwards as a record of what was discussed. We do not keep a separate copy anywhere else. Ask us to delete the correspondence and we will, unless we are required to keep it for accounting or legal reasons.

How it is protected

The site is served over HTTPS, mailbox access is restricted to the people who need it and protected by two-factor authentication, and access to the providers above is limited to named accounts. No transmission over the internet is ever guaranteed secure; we tell you plainly if anything relevant to you goes wrong.

Your rights

Under the GDPR and the Serbian Law on Personal Data Protection you have the following rights over the data described here.

• Access — a copy of what we hold about you.
• Rectification — correction of anything inaccurate.
• Erasure — deletion of your data where nothing obliges us to keep it.
• Restriction — a pause on processing while a question is settled.
• Objection — to processing based on our legitimate interest.
• Portability — your data in a structured, machine-readable form.
• Withdrawal of consent — at any time, without affecting what was lawful before.

Write to [email protected] with what you want done. We answer within thirty days, and sooner where we can. We may ask a question to confirm the request comes from you.

Changes to this policy

When the site changes what it collects or which providers it uses, this page changes with it and the date above changes too. We do not backdate. There is no archived version to compare against yet; when there is, we will link it here.

Contact

Questions about this policy, or about anything we hold, go to [email protected]. A person reads that address.