Privacy policy.

1. Who we are

Vira is a web design and development studio based in Ljubljana, Slovenia. For the purposes of the EU General Data Protection Regulation (GDPR), Vira is the controller of personal data collected through this website.

Contact for any privacy matter: projects@viraweb.co.

2. What data we collect

• Contact form and e-mail: your name, e-mail address, a short description of what you need, project details and anything else you choose to send us.
• Technical data: our hosting provider records standard server logs (such as IP address, browser type, pages requested and time of access) for security and reliable operation of the site.
• Theme preference: if you switch between light and dark mode, your choice is stored in your own browser (local storage). It stays on your device and is not sent to us.
• Advertising measurement data (only if you accept): if you accept advertising cookies, the Google tag may collect data about your visit — such as the pages viewed, the ad you clicked and whether you sent us an enquiry — to measure how well our ads work.

3. Why we use it and on what basis

• To reply to your enquiry and prepare a proposal — steps taken at your request before a contract, and our legitimate interest in answering business enquiries (Art. 6(1)(b) and (f) GDPR).
• To carry out and administer a project once we work together — performance of a contract (Art. 6(1)(b)).
• To keep accounting and tax records — legal obligation (Art. 6(1)(c)).
• To secure and operate the website — legitimate interest (Art. 6(1)(f)).
• To measure the performance of our advertising — your consent (Art. 6(1)(a)); you can withdraw it at any time.

We do not sell personal data and we do not use it for automated decision-making or profiling.

4. Who we share it with

We use a small number of service providers who process data on our behalf:

• Formspree — receives and forwards contact form submissions (United States).
• Netlify — hosts the website (United States).
• Zoho Mail — e-mail service for projects@viraweb.co.
• WhatsApp (Meta) — only if you contact us on WhatsApp: your phone number and messages are then handled by WhatsApp under its own terms and privacy policy.
• Google Fonts — the site loads its typefaces from Google's servers, which means your IP address is sent to Google when a page loads.
• Google (Google Ads) — only if you accept advertising cookies: measures ad performance and conversions.

Where data is transferred outside the European Economic Area, this relies on an adequacy decision or the standard contractual clauses offered by the provider. We may also disclose data where required by law.

5. Cookies and advertising measurement

When you first visit, we ask whether you accept advertising cookies. If you accept, the Google tag (Google Ads) is loaded and may set cookies to measure how well our ads work. If you decline, no advertising tag is loaded. We do not use analytics cookies.

You can change your choice at any time with “Cookie settings” in the footer. Your cookie choice and your theme preference are stored in your browser's local storage. Data processed by Google is subject to Google's own privacy policy.

6. How long we keep it

• Enquiries that do not lead to a project: up to 24 months, then deleted.
• Client projects: for the duration of the contract, then for as long as the law requires us to keep accounting and tax records.
• Server logs: for a short period, as set by our hosting provider.

7. Your rights

You have the right to access your personal data, have it corrected or erased, restrict or object to its processing, and receive a copy in a portable format. Where processing is based on consent, you can withdraw it at any time. To use any of these rights, write to projects@viraweb.co.

You also have the right to lodge a complaint with a supervisory authority. In Slovenia this is the Information Commissioner (Informacijski pooblaščenec), www.ip-rs.si.

8. Security

We take reasonable technical and organisational measures to protect personal data, including encrypted (HTTPS) connections and access limited to those who need it. No system is completely secure, so we cannot guarantee absolute security.

9. Changes to this policy

We may update this policy from time to time. The date above shows when it was last changed.