Legal
Privacy Policy
Last updated: July 13, 2026
This policy explains what personal data TOMICZ collects through the public website at tomicz.com, why we collect it, who helps us process it, and the choices you have.
This page covers the public marketing website only. The TOMICZ CMS, admin area, and client tools will have their own privacy policy later and are not covered here.
Who we are
For this public website, the data controller is TOMICZ. This policy states the current public contact details for privacy questions.
- Website
- tomicz.com
- Country
- Bosnia and Herzegovina
- [email protected]
What we collect
We collect only what is needed to run the website, reply to enquiries, protect the form from abuse, and understand whether the site is working.
Contact form messages
When you submit the contact form, we collect your name, email address, optional company, message, the source of the form submission, and anti-spam signals such as the hidden honeypot field and form token. The same message is sent through EmailJS and captured in our CRM lead intake on api.tomicz.com on a best-effort basis.
Legal basis: Your request before a contract, our legitimate interest in replying to enquiries and keeping a record of business leads, and consent where required.
Direct email
If you email us directly, we receive the email address, name, message content, and any other information you choose to include.
Legal basis: Your request before a contract and our legitimate interest in business communication.
First-party website analytics
We use a first-party analytics beacon to understand traffic, popular pages, referrers, rough country, and engagement. It sets no cookies and the backend does not store raw IP addresses or raw user agents. Visitors are counted with a salted daily hash.
Legal basis: Our legitimate interest in measuring and improving the website without identifying individual visitors.
Google Analytics after opt-in
If you accept analytics cookies, Google Analytics 4 may load and process usage data such as page views, device and browser information, approximate location, and interactions. If you decline or ignore the banner, GA4 does not load.
Legal basis: Your consent.
Cloudflare Turnstile
When Turnstile is configured, the contact form loads Cloudflare Turnstile to check whether the submission is likely to be human. It may process technical browser and challenge data and returns a token used by our backend to validate the submission.
Legal basis: Our legitimate interest in protecting the website and contact form from spam and automated abuse.
Social and external links
Links to LinkedIn, Instagram, and other external websites are ordinary links. We do not embed those platforms on the site. If you click through, their own privacy policies apply.
Legal basis: No data is shared with those platforms by this website unless you choose to click a link.
How we use the data
We use personal data to reply to enquiries, discuss possible work, keep a business record of messages you send us, protect the form from spam, operate the website, measure website performance, and improve the content and user experience.
We do not sell personal data. We do not use website contact messages for unrelated advertising lists.
Service providers
We use a small number of providers to run the public website and process enquiries.
EmailJS
Sends contact form submissions from the browser to our email inbox.
United States and other locationsEmailJS privacy policy
Google Analytics
Processes analytics only after you accept analytics cookies.
United States and other locationsGoogle privacy policy
Cloudflare
Provides CDN, security, proxying, and Turnstile anti-spam checks when enabled.
United States and other locationsCloudflare privacy policy
Namecheap
Provides domain and hosting infrastructure for the website.
United States and other locationsNamecheap privacy policy
Some providers may process data outside Bosnia and Herzegovina and outside the European Economic Area. Where required, we rely on appropriate contractual or legal safeguards from those providers.
How long we keep data
Contact enquiries are kept for as long as needed to reply, manage the business relationship, handle follow-up, and meet legal or accounting obligations if work begins.
Analytics data is kept only as long as it is useful for understanding website performance. First-party analytics is designed to be low-identification from the start.
Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict, or object to the processing of your personal data. Where processing is based on consent, you can withdraw that consent at any time.
- Ask what personal data we hold about you.
- Ask us to correct inaccurate data.
- Ask us to delete data when we no longer need it.
- Object to or restrict certain processing.
- Withdraw analytics consent by clearing the site's consent setting in your browser or using your browser privacy controls.
You can also contact the relevant data protection authority in your country if you believe your rights have not been respected.
Security
We use HTTPS, security headers, anti-spam checks, limited public endpoints, and provider-level controls to protect the website and contact form. No website can guarantee perfect security, but we keep the public data surface narrow and do not ask for sensitive information through the contact form.
Changes to this policy
We may update this policy as the website, providers, company details, or law changes. When we do, we will update the date at the top of this page.
Contact
For questions about this policy or how we handle personal data on the public website, email us.
[email protected]