Privacy notice
This site belongs to Kenan Kovačević, an independent performance marketing consultant based in Mostar, Bosnia and Herzegovina. I decide what happens with the data described below, which makes me the controller of it. You can reach me any time through the contact form.
I sell measurement for a living, so it would be strange to be vague about my own. Here is exactly what this site does.
What the contact form collects
The form asks for your name, email, optionally a website or ad account, and your message. I use those details to answer your enquiry. The legal basis is your request: you contact me, I reply.
One addition, and only if you have allowed marketing cookies: when the form is sent, your browser turns your email address into a one-way code (a SHA-256 hash), and that code - never the address itself - goes to Google Ads with the enquiry. Google uses it only to match the enquiry to an ad click, so I can see which ads lead to real conversations. The legal basis for this part is your consent. Without marketing consent, nothing from the form is used for advertising.
Web3Forms delivers the message to my inbox and does not keep a copy. I keep the correspondence in my email for up to 24 months in case we pick the conversation back up, then delete it. I never sell your details or add you to a mailing list.
Cookies and analytics
Nothing stores anything and nothing identifies you before you choose. The banner asks first, and the site works exactly the same if you decline.
To be exact about it: Google Tag Manager itself loads on every page, delivered through my server-side container at server.kenankovacevic.com, which means Cloudflare and Stape (below) see the request and your IP address the way any server you visit does. Consent Mode v2 is set to denied before that happens, so until you agree, no cookie is written, no identifier is created and no analytics data is collected. Declining is a complete answer - there is no second banner and no reduced version of the site.
- Necessary - your theme and your cookie choice, stored in your browser’s local storage. This stays on your device and never reaches me.
- Analytics - Google Analytics 4 through Google Tag Manager: which pages you visit, how you got here, roughly where you are. Only with your consent. The data goes first to my own server-side Tag Manager container at server.kenankovacevic.com, which forwards it to Google. Google Analytics 4 does not log or store IP addresses: your address is used in transit to work out an approximate location and then discarded. Reports are kept for 14 months.
- Marketing - Google Ads conversion measurement and remarketing, through the same server-side container: whether a visit that came from a Google ad ended in an enquiry, and the hashed email described above. Off by default, and only switched on if you allow it.
The site runs Google Consent Mode v2. Until you accept, Google’s tags either stay silent or send a cookieless signal that identifies nobody. You can change your mind whenever you like: .
Who else touches the data
- Cloudflare - hosting, DNS and CDN, for this site and for server.kenankovacevic.com. It processes technical request data such as IP addresses to serve pages and block attacks.
- Google Ireland - Analytics 4, Tag Manager and Google Ads, only after you consent.
- Stape - runs my server-side Tag Manager container on server.kenankovacevic.com. Analytics and advertising data passes through it on the way to Google under the same consent rules as above, and it acts on my instructions only.
- Web3Forms - passes form submissions to my inbox.
- Google Workspace / Gmail - where our email conversation lives.
Where these providers process data outside the EEA, they rely on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. Fonts are served from this domain, so no font provider sees your visit.
Your rights
Under the GDPR you can ask me for a copy of your data, correct it, delete it, restrict how I use it, object to it, or take it elsewhere. A message through the contact form is enough, and I will reply within 30 days. If you think I have handled something badly, you can complain to your national data protection authority - or, in Bosnia and Herzegovina, to the Personal Data Protection Agency.
Security and changes
The site runs over HTTPS and I keep access to my accounts locked down with two-factor authentication. If I add anything that collects data, I will update this page and the date at the top before it goes live.