Privacy

Last updated: 8 October 2026

1. Who is responsible

Studio Hugo d.o.o., Ulica Josipa Schrotta 30, 10000 Zagreb, Croatia, represented by Alan Hugo Ajanovic. Email: alan@hugo.studio. I am not required to appoint a data protection officer; for any question about your data, write to the address above.

2. In short

This website sets no cookies of its own and does not build user profiles. I only process what is needed to show the site, to understand anonymously how it is used, and to answer your enquiry or booking.

3. Hosting

The website runs on my own server, rented from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, located in the EU. To deliver a page, the server necessarily processes your IP address and technical data about your browser. I do not keep access logs. The connection is encrypted (TLS). Legal basis: Art. 6(1)(f) GDPR, my legitimate interest in a secure, working website. A data processing agreement with Hetzner is in place.

4. Visitor statistics

I use Umami, which I run myself on the same server. Umami sets no cookies and stores no IP addresses or other data that would identify you; visits are counted anonymously (page, referring site, campaign parameters in the link, browser type, country, clicks on buttons). Data does not leave my server. Legal basis: Art. 6(1)(f) GDPR, my legitimate interest in understanding which pages and channels work. Because this data does not identify you, I keep it for long-term statistics.

5. Contact form and email

If you write to me through the form, your name, email address, message, the optional answer “How did you hear about me?”, the page language and, if you came from a link with campaign parameters (for example utm_source or gclid), those parameters are sent to me. The form is processed on my own server in the EU and forwarded straight to my mailbox; it is not stored on the server and no other service is involved. My email is hosted by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Workspace), under a data processing agreement.

I use this data only to answer your enquiry and, if we work together, to prepare and carry out the contract. Legal basis: Art. 6(1)(b) GDPR (steps before a contract) and Art. 6(1)(f) GDPR (answering enquiries). I delete enquiries that do not lead to a project after 12 months; business correspondence is kept for as long as Croatian law requires.

6. Booking a call (Cal.com)

The booking calendar is provided by Cal.com, Inc., USA. It is only loaded when you click “Pick a time”; before that, no connection to Cal.com is made. When it loads, Cal.com receives your IP address and technical data, and Cal.com may set cookies needed for the calendar to work. When you book, Cal.com processes the name, email address and any notes you enter, and sends me the booking. Legal basis: Art. 6(1)(a) GDPR (your click to load the calendar) and Art. 6(1)(b) GDPR (the booking). Data is transferred to the USA on the basis of the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) in Cal.com’s data processing agreement. You can also book without the embedded calendar by writing to me.

7. Links to LinkedIn

The site links to my LinkedIn profile. It is a plain link, not a plugin: LinkedIn receives no data until you click it. After that, LinkedIn’s privacy policy applies.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict processing, to data portability, and to object to processing based on legitimate interest (Art. 15 to 21 GDPR). Where processing is based on consent, you can withdraw it at any time with effect for the future. Just write to alan@hugo.studio.

You can also complain to a supervisory authority, in Croatia the Agencija za zaštitu osobnih podataka (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr, or the authority in your country.

Automated decisions

I do not use automated decision-making or profiling.

Changes

I update this policy when the website or the law changes. The current version is always on this page.