Privacy & Cookies

1. Who is responsible

M TWELVE d.o.o. is the controller of personal information covered by this notice.

2. Information we use and why

Enquiries and business correspondence

If you email us, we receive your email address and the name, company details, message, attachments, and other information you choose to provide. We use these to answer you, assess a project, prepare a proposal, and manage the resulting business relationship. If you book a call, we also receive the contact details and appointment information you submit through Google Calendar and use them to arrange and conduct the meeting.

Where you request steps towards a contract with you personally, the basis is Article 6(1)(b) GDPR. For other business enquiries, including messages on behalf of a company, the basis is our legitimate interest in responding to requests and communicating with prospective clients, Article 6(1)(f). Legal record-keeping obligations, where applicable, rely on Article 6(1)(c).

Providing an enquiry is voluntary. We need enough contact and project information to respond, but you do not need to provide unrelated personal or sensitive information.

Website delivery and security

Our hosting provider, GitLab Pages, receives technical request information such as your IP address, requested page, time of access, and browser information to deliver the website and operate its infrastructure. Our basis for providing and protecting the site is legitimate interest, Article 6(1)(f). Fonts and images are served with the website; no Google Fonts connection is needed.

Optional Google Analytics

With your consent under Article 6(1)(a), Google Analytics measures page views, traffic sources, browser and device information, approximate location, and activity on the site. It uses browser identifiers to distinguish visits. Technical information, including your IP address, is transmitted to Google when the service loads.

We also record clicks on our email, appointment-booking, and LinkedIn contact links, and successful copies of the email address. These events identify the action and its position on the page; they do not contain email messages or attachments. A contact click does not tell us whether you sent a message or completed a booking.

Our website tag disables Google signals and advertising personalization. We do not use this website to make automated decisions that have legal or similarly significant effects on you.

3. Cookies and your analytics choice

Before acceptance, we do not load the Google Analytics script or send analytics events. Accepting enables analytics; declining leaves the site and contact options available. Neither silence nor following the privacy link counts as consent.

The local-storage preference is used only to honour your choice. If your browser blocks storage, the choice applies to the current visit and you may be asked again next time.

To withdraw consent, open Analytics settings and select Decline analytics. This stops our tracking, removes accessible Google Analytics cookies for this site, and reloads the page to unload the tag. It does not undo processing that was lawful before withdrawal or automatically erase data already received by Google.

You can also delete cookies and site storage in your browser. Deleting the stored choice means we will ask again. Browser or extension blocking may prevent analytics even after acceptance.

4. How long information is kept

Enquiries: retention depends on whether a discussion is ongoing, a proposal or agreed follow-up remains open, the enquiry becomes a project, or records are needed for legal obligations or a specific dispute. Correspondence should be deleted when these purposes no longer apply. Project, contract, and accounting records may need to be retained separately for applicable legal requirements.

Analytics: detailed user- and event-level data is subject to the GA4 property's retention settings. Standard GA4 supports periods of 2 or 14 months. If identifier retention resets on new activity, that period runs again from the latest activity. Standard aggregated reports are not subject to the same deletion setting. These server-side settings are separate from the 180-day cookie and consent periods described above.

Hosting and service records: providers retain operational and security records under their service terms, including where needed to investigate incidents or comply with law. You can ask us for further information about the retention applicable to your enquiry.

5. Providers and international transfers

• Google Workspace hosts our business email and processes enquiry messages and attachments.
• Google Calendar provides the external appointment-booking page. It receives a visit only when you follow the booking link; the calendar is not embedded on this website. Google processes information entered there under its applicable terms and privacy policy.
• GitLab Pages hosts the website and delivers its pages, fonts, and images.
• Google Analytics receives website measurement data after you accept analytics.
• LinkedIn receives a visit if you follow our profile link. There is no embedded LinkedIn tracking widget. Activity on LinkedIn is governed by its own privacy notice.

These providers and their subprocessors may process information outside Croatia and the European Economic Area, including in the United States. Their applicable transfer terms provide for mechanisms such as European Commission adequacy decisions and Standard Contractual Clauses. The mechanism depends on the provider, destination, and service. You may contact us for information about applicable safeguards.

Provider information: Google Workspace data processing terms, Google Analytics international transfers, Google partner-site data use, GitLab privacy statement, and LinkedIn privacy policy.

Access to enquiry information is limited to people and service providers who need it for the purposes described above. Information may also be disclosed where required by law or necessary to establish, exercise, or defend legal claims.

6. Your rights and how to contact us

Depending on the circumstances and legal basis, you can request access, correction, deletion, restriction of processing, or data portability. You can object to processing based on legitimate interests and withdraw consent at any time without affecting the lawfulness of earlier processing.

Send requests to hi@m-twelve.com. We may need information to verify your identity or locate the records concerned. We respond without undue delay and normally within one month; where the GDPR permits an extension, we will explain it.

You can complain to the Croatian Personal Data Protection Agency, AZOP, or to the supervisory authority in the EU country where you live, work, or believe an infringement occurred.

We update this notice when the site's services or data practices change. The date at the top identifies the latest revision.