Privacy Policy

Last updated: October 13, 2026

This page explains what personal data kangler.eu processes, why, how long it’s kept, and what your rights are.

1. Who I am

I’m Tihomir Kangler, a product designer in Zagreb, Croatia. This is my personal portfolio, and I run it as a private individual. That makes me the one responsible for your data here (in GDPR terms, the “controller”).

You can reach me at hi@kangler.eu. I don’t have a data protection officer, because I’m not required to have one.

2. When you visit the site

The site runs on a server at SETCOR d.o.o. (myDataKnox), a hosting provider in Croatia. Like most web servers, it keeps an access log. For each request, it records:

• your IP address
• the date and time
• the page or file requested
• the page you came from (the referrer)
• your browser and operating system (the user agent)
• whether the request worked (the status code)

This happens whether or not you accept cookies. It’s needed to deliver the site, keep it secure and find errors. The legal basis is my legitimate interest in a site that works and is safe (GDPR art. 6(1)(f)).

The logs are kept for a short period under the host’s standard log rotation, then deleted. SETCOR handles them for me as a processor.

3. Usage statistics with Google Analytics

If you click Accept in the cookie banner, the site loads Google Analytics 4 so I can see which pages get read. If you decline or don’t choose, it doesn’t load at all.

The legal basis is your consent (GDPR art. 6(1)(a) and art. 43(4) of the Croatian Electronic Communications Act).

With your consent, Google Analytics collects:

• a random ID stored in the _ga cookie, so repeat visits can be told apart
• the pages you view, when, and for how long
• the page or site that brought you here
• general details about your device and browser, such as device type, screen size and language
• your approximate location, such as country or city

Google receives your IP address with each request, uses it on servers in the EU to work out your approximate location, and then discards it without storing it. Google signals and ad personalization are turned off, so Analytics doesn’t connect your visits to a Google account or use them to personalize ads.

Google handles this data for me as a processor, under the Google Ads Data Processing Terms that apply to Google Analytics. Analytics keeps data tied to the cookie ID for up to 14 months. Overall totals, like page views per day, stay in the reports after that, but they don’t identify anyone.

Google explains more here: How Google uses information from sites or apps that use our services.

4. Cookies

These are all the cookies the site can set. If you decline, only the first one is stored.

Both Analytics cookies are stored under kangler.eu, but Google’s script reads them and sends the ID to Google along with the usage data.

The site also uses one entry in your browser’s session storage, cookieFocus. It’s set for a moment after you click Cookie settings, so keyboard focus lands on the banner when the page reloads, and then it’s removed. It’s strictly necessary, so it doesn’t need consent.

5. Your choice

The banner has two buttons, Decline and Accept. Each takes one click, and everything on the site works the same if you decline.

You can change your mind anytime with Cookie settings in the footer. It deletes the consent cookie and both Analytics cookies from your browser and shows the banner again.

Withdrawing doesn’t affect what was processed while you had agreed. It only stops anything new from being sent.

6. If you email me

If you write to hi@kangler.eu, I get your name, your email address, your message and anything you attach, like a job description or a CV.

I use it to reply and to talk about a job or a project. The legal basis is taking steps you asked for before a possible contract (GDPR art. 6(1)(b)), or otherwise my legitimate interest in replying to messages (art. 6(1)(f)).

My email is hosted by the same company as the site, SETCOR d.o.o. (myDataKnox), on the same server in Croatia.

I delete emails within 12 months after our conversation ends, unless we end up working together. If we do, I keep them while we work together and for as long as the law requires after that.

7. LinkedIn

The site links to my LinkedIn profile. It’s a plain link, with no LinkedIn buttons, scripts or embeds, so nothing goes to LinkedIn unless you click it.

If you do, your browser tells LinkedIn you came from kangler.eu. From there, LinkedIn’s own privacy policy applies.

8. Who receives data

• SETCOR d.o.o. (myDataKnox), Croatia, hosts the site and my email, so it handles the server logs and any emails you send me. It acts as my processor.
• Google receives Analytics data, but only if you accept.

I don’t sell your data, and I don’t use it for advertising.

9. Transfers outside the EU

Google LLC in the United States may process the Analytics data. Google LLC is certified under the EU-U.S. Data Privacy Framework, and the European Commission has decided that the framework protects data adequately (Implementing Decision (EU) 2023/1795, GDPR art. 45).

The server logs and emails are stored on my host’s server in Croatia.

10. Your rights

Under the GDPR, you can ask me to:

• show you the personal data I have about you (access)
• correct it if it’s wrong (rectification)
• delete it (erasure)
• limit how I use it (restriction)
• give it to you in a common format, so you can take it elsewhere (portability)

You can also withdraw your consent to Analytics at any time, as described under Your choice.

You can object at any time to processing based on my legitimate interest, such as the server logs or how I handle your emails. If you’d like to know how I weighed my interest against yours, ask me and I’ll explain.

I don’t make any automated decisions about you, by profiling or otherwise.

To use any of these rights, email me at hi@kangler.eu. It’s free, and I’ll reply within one month. If I can’t tell that a request comes from you, I may ask for a detail to confirm it. For Analytics data, send me the value of your _ga cookie, because that ID is the only way I can find it; for the server logs, your IP address and roughly when you visited.

11. Complaints

If you think I’ve handled your data wrongly, you can complain to the Croatian data protection authority:

Agencija za zaštitu osobnih podataka (AZOP)
Ulica Metela Ožegovića 16
10000 Zagreb, Croatia
Email: azop@azop.hr
Phone: +385 1 4609 000
Website: azop.hr

You can also complain to the data protection authority in the EU country where you live or work, or where you think the problem happened.

12. Do you have to give data?

No law or contract requires you to give me any data. Your browser sends the technical data in the server log to every website you open, so the site can’t be shown without it. Analytics is optional, and declining changes nothing. Emailing me is up to you, but I can’t reply without your email address.

13. Changes

When I change this policy, the date at the top changes too. If I change why I use data or who receives it, the cookie banner will ask you again.

← Back to home