Privacy Policy

1. Who Are We?

This website is operated by StepTo d.o.o. ("StepTo", "we", "us"), a limited liability company registered in the Republic of Serbia (registration number: 21935558, tax ID: 113892993), with its registered office at Bulevar Vudroa Vilsona 6, 11000 Belgrade, Serbia.

We are the data controller for the personal data we process through this website and in connection with our services. For privacy matters, contact us at info@stepto.net.

2. What Data Do We Collect?

StepTo collects 3 categories of data: contact form submissions, server logs, and cookies.

Contact form: When you submit an enquiry via our contact form, we collect your first name, last name, work email address, company name (optional), and a description of your project.

Server logs: Our hosting infrastructure automatically records standard server log data, IP address, browser type, referring URL, pages visited, and timestamps, for security and operational purposes. This data is not used for tracking or profiling.

Cookies: We use technically necessary cookies required to operate the website (e.g. session cookies) at all times. With your consent, given via the cookie banner shown on your first visit, we also use Google Analytics to understand how visitors use the site. Analytics cookies are not set until you click "Accept all"; choosing "Essential only" keeps analytics disabled. We do not use advertising or third-party marketing cookies.

Cookieless analytics: We also use Umami, a privacy-focused analytics service, to count visits and see which pages are read. Umami sets no cookies, stores nothing on your device, and creates no identifier that can follow you between sites or that outlives the day. Because it neither accesses your device storage nor collects personal data, it runs without a consent prompt and is unaffected by your cookie choice. It records the page visited, the referring site, and coarse country and device type, never your name, email, or full IP address.

Changing your mind: You can review or change your cookie choice at any time via the "Cookie Settings" link in the site footer. Switching analytics off stops Google Analytics immediately and deletes the analytics cookies already stored in your browser.

3. Why Do We Process Your Data?

StepTo processes your data for 2 purposes: to respond to your enquiry, and to operate and secure the website.

To respond to your enquiry (legal basis: legitimate interest in pre-contractual communication, Art. 6(1)(f) GDPR; or performance of a contract, Art. 6(1)(b) GDPR where applicable).

To operate and secure our website infrastructure (legal basis: legitimate interest, Art. 6(1)(f) GDPR).

We do not use your data for automated decision-making or profiling.

4. How Long Do We Keep Your Data?

Contact enquiries: We retain your data for as long as necessary to respond to and follow up on your enquiry, and for up to 3 years afterwards for the purpose of maintaining business records. If we enter into a contract with you, standard accounting retention periods apply (up to 10 years).

Server logs: Retained for up to 90 days for security and operational purposes, then deleted.

5. Who Do We Share Your Data With?

StepTo does not sell, rent, or share your personal data with third parties for marketing purposes.

We use the following categories of processors who may handle your data on our behalf, under appropriate data processing agreements:

Cloud hosting and infrastructure providers (servers located within the EU or EEA).

Email delivery services used to transmit your contact form submission to our team.

Google Analytics, only if you consent to analytics cookies via the cookie banner, to help us understand site usage.

Umami Software, Inc., which provides the cookieless analytics described in section 2. It receives no personal data and sets no cookies.

If we are required to disclose data by law or court order, we will do so in compliance with applicable legal obligations.

6. International Transfers

StepTo is based in Serbia. Serbia is not an EU member state and is not covered by a European Commission adequacy decision, so transfers of personal data from the EU/EEA to Serbia require appropriate safeguards. We rely on the EU Standard Contractual Clauses, together with a data processing agreement, for those transfers. Serbia's own Personal Data Protection Act is closely modelled on the GDPR, and Serbia ratified Convention 108+ in 2020.

7. What Are Your Rights?

Under the GDPR, you have the right to:

Access: request a copy of the personal data we hold about you.

Rectification: ask us to correct inaccurate or incomplete data.

Erasure: request deletion of your data, subject to our legal retention obligations.

Restriction: ask us to restrict processing of your data in certain circumstances.

Portability: receive your data in a structured, machine-readable format.

Object: object to processing based on legitimate interests.

Withdraw consent, where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing. For analytics cookies, use the "Cookie Settings" link in the site footer.

To exercise any of these rights, email us at info@stepto.net. We will respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority. In Serbia, this is the Commissioner for Information of Public Importance and Personal Data Protection (www.poverenik.rs). EU residents may also contact their national supervisory authority.

8. How Do We Secure Your Data?

StepTo implements appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Our website is served over HTTPS. Access to personal data is restricted to authorised staff on a need-to-know basis.

9. Links to Other Websites

StepTo's website may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites. We recommend reviewing their privacy policies before submitting any personal data.

10. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or applicable law. The date at the top of this page shows when it was last revised. We encourage you to review this policy periodically.

Questions about this policy? Contact us at info@stepto.net or view our company imprint.