Privacy policy
Short and without small print: which data this site processes, why, and how you can control it.
Last updated: 26 September 2026
1. Controller
The controller of personal data is Jaka Krčovnik — Jack on the Box, e-mail info@jackonthebox.si. For any data-protection questions write to this address.
2. Which data is processed and why
| Where | Data | Purpose and legal basis | Retention |
|---|---|---|---|
| Contact form | full name, e-mail; optionally company, phone, type of collaboration, budget, timing, message | replying to your inquiry and preparing an offer (pre-contractual steps, Art. 6(1)(b) GDPR) | until the inquiry or collaboration is concluded; offers and business correspondence as required by statutory retention periods |
| the content of the message and your contact details | communication initiated by you (Art. 6(1)(b) and (f) GDPR) | for as long as the communication or collaboration lasts | |
| Visitor statistics (Google Analytics 4) | pseudonymous visitor identifier, pages viewed, traffic source, device, approximate location | measuring traffic and improving the site — only with your consent (Art. 6(1)(a) GDPR, Slovenian ZEKom-2) | consent is valid for 12 months; event data is kept in Google Analytics for at most 14 months |
| Server logs | IP address, time of access, requested page, browser | server security and operation (Art. 6(1)(f) GDPR) | according to the hosting provider’s policy, usually a few weeks at most |
3. Cookies and similar technologies
The site sets no tracking cookies without your consent. On your first visit a banner appears where you can accept or decline visitor statistics:
- Accept: Google Analytics 4 is loaded (cookies
_ga,_ga_*, lasting up to 2 years). Your choice is stored in your browser (localStorage, keyjotb_consent) for 12 months. - Decline: no statistics are collected; only your decision is stored so the banner does not appear again.
You can change your decision at any time by clicking (the link is also in the footer of every page) or by clearing the site data in your browser.
4. Third-party content
YouTube
Videos are embedded in “click-to-play” mode: until you start a video, no script is loaded from YouTube and no cookie is set. Before the click, only the video thumbnail is loaded from Google’s server i.ytimg.com (your IP address is transmitted to Google in the process). On click the video loads via youtube-nocookie.com (privacy-enhanced mode). From that moment on Google’s privacy policy applies.
Form delivery (Web3Forms)
Messages from the contact form are forwarded to my e-mail address via the Web3Forms service. The provider processes the message only for delivery; web3forms.com.
Fonts and hosting
Fonts are hosted on this server — no connection to Google Fonts is made when you visit. Details of the hosting provider and server location are available on request.
5. Who receives the data
I do not sell or pass on data to third parties for their own purposes. The processors I use to run the site are listed above (hosting provider, Web3Forms, Google — the latter only with your consent or when you start a video). With Google, data may be transferred to the USA under the EU-US Data Privacy Framework and standard contractual clauses.
6. Your rights
- access to the data I process about you, and its rectification or erasure,
- restriction of processing and objection to processing,
- withdrawal of consent (for visitor statistics) at any time, without affecting the lawfulness of prior processing,
- data portability, where technically feasible,
- a complaint to the Information Commissioner of the Republic of Slovenia (ip-rs.si).
Send your request to info@jackonthebox.si. I usually reply within 30 days.
7. Changes
I may update this policy when services or legislation change. The version published on this page, with the last-updated date above, applies.