Legal_
Last updated_ 16 Oct 2026
The controller of your personal data is GESPA KREATIVNI STUDIO j.d.o.o. za usluge i trgovinu (Gespa Creative Studio), Ulica Marka Marulića 57, 44000 Sisak, Croatia, OIB 42393985895. You can reach us about anything related to your data at hey@gespa.agency or +385 97 699 3362. This policy covers gespa.agency and our free GEO audit tool at audit.gespa.agency.
When you open a page, our hosting provider automatically processes technical data such as your IP address, browser type, the page requested and the time of the request. This is necessary to deliver the website and keep it secure (legitimate interest, Art. 6(1)(f) GDPR). Server logs are kept only for a limited period and are not used to identify you.
All fonts are hosted on our own server, so no font service or other third party is contacted when a page loads.
When you send us an enquiry we process the data you enter: first and last name, company or brand, email address, the services you are interested in, your approximate budget and your message. We use it only to answer you and, if you wish, to prepare an offer (steps prior to entering into a contract, Art. 6(1)(b) GDPR). The enquiry is stored in our website database and sent to us by email.
The form also has an optional, unticked box to subscribe to our newsletter. Only if you tick it do we use your first name, email address and the topics you choose for the newsletter, as described in 2.6. Sending an enquiry never subscribes you on its own.
To protect the forms and our free GEO audit tool from spam and abuse we use Cloudflare Turnstile, a service of Cloudflare, Inc. (USA). When the form loads, Turnstile checks technical signals from your browser, such as your IP address and browser and device characteristics, to tell people from automated bots. It does not set tracking cookies, and the data is not used for advertising or to build a profile of you. Legal basis: our legitimate interest in keeping the form free of spam (Art. 6(1)(f) GDPR). More information: Cloudflare Turnstile privacy addendum.
If you contact us directly, we process your contact details and the content of your message to reply to you. If you choose WhatsApp, your message is also processed by WhatsApp (Meta Platforms Ireland Limited) under its own privacy terms.
On our free SEO audit page you can request an audit of a web page. The form is provided by SE Ranking and is loaded only after you click “Load the audit form”. When it loads, SE Ranking may set its own cookies and collect usage statistics. The URL, keyword, name and e-mail you enter are processed by SE Ranking to run the audit and are shared with us so we can send you the report and, if you wish, help you with the results (steps prior to entering into a contract and legitimate interest, Art. 6(1)(b) and (f) GDPR).
If you subscribe to our newsletter (on the Journal, an article, the Freebies page, after a free GEO audit or by ticking the box in the “Start a project” form), we process your email address, your first name if you give it, the topics you choose and a record of your consent: the date and time, your IP address and the wording you agreed to. We use this only to send you the newsletter on the topics you picked and, right after you subscribe, one welcome email. Legal basis: your consent (Art. 6(1)(a) GDPR).
We also note where you signed up (for example the Journal, a specific article or freebie, or the free GEO audit) so we can send you what is relevant. If you sign up after running the free GEO audit, we additionally save the address of the website you checked, the score range of its result (for example “needs work”), its weakest area, and the website you came from if your browser tells us. We use this only to choose relevant newsletter content and to see which pages bring subscribers. In the GEO audit your IP address is kept in the consent record only as a keyed hash (see 2.11). Legal basis: your consent (Art. 6(1)(a) GDPR).
To make sure it was really you who signed up, we first send a short email with a confirmation link (double opt-in). You are only subscribed once you click it, and we record the date and time of that confirmation too. If you don’t confirm, you won’t receive any newsletters.
You can withdraw your consent at any time with the unsubscribe link at the bottom of every email, or by writing to hey@gespa.agency. Withdrawal does not affect emails sent before it.
Newsletters are sent through SendFox, a service of Sumo Group, Inc. (USA). SendFox stores the subscriber list and records whether an email was delivered, opened and which links were clicked, so we can see what is useful and stop sending what isn’t. The sign-up form is protected by Cloudflare Turnstile (see 2.3).
The website remembers your preferred language (English or Croatian) and may open the Croatian version if your browser is set to Croatian. Details are in our Cookies Policy.
Only if you allow analytics cookies, we use Google Analytics 4, loaded through Google Tag Manager, to see how the website is used: which pages are visited, which free tools are used, whether a form was sent and roughly where visitors come from. Google processes your IP address (shortened), device and browser data and a random identifier stored in a cookie. We do not send your name or email address to Google Analytics. Without your consent Google Analytics sets no cookies and receives only anonymous, cookieless signals (Google Consent Mode). Provider: Google Ireland Limited. Legal basis: your consent (Art. 6(1)(a) GDPR).
Only if you allow advertising cookies, we use the Meta Pixel to measure which visits and actions come from our ads on Facebook and Instagram, and to show our ads to people who visited the website. When you then send the “Start a project” form or subscribe to the newsletter, our server also reports this to Meta (Conversions API) together with your email address and first name in hashed (encrypted, non-readable) form, your IP address and browser data, so Meta can match the action to an ad. Without advertising consent nothing is sent to Meta. Provider: Meta Platforms Ireland Limited. Legal basis: your consent (Art. 6(1)(a) GDPR); you can withdraw it at any time via the cookie icon in the bottom-left corner of the page.
The website offers an optional accessibility tool (Ally, by Elementor Ltd.) for adjusting, for example, text size, contrast, animations and reading aids. The tool is not loaded when you open a page. Only when you click the accessibility icon at the bottom left does your browser load it from Elementor’s servers (cdn.elementor.com). Elementor then receives technical data such as your IP address and browser details, and its content delivery network (Cloudflare) may set a technical cookie (__cf_bm) for bot protection. The tool saves your chosen settings only in your browser (ea11y-global-state in local storage and ea11y-session-state in session storage). Legal basis: your own request when you click the icon, and our legitimate interest in an accessible website (Art. 6(1)(f) GDPR). More information: Elementor privacy policy.
Our free GEO audit checks whether a website is ready to be found and cited by AI search engines. It runs on its own address, audit.gespa.agency, and is hosted by Cloudflare, Inc. (USA).
The address you enter. To run the audit we visit the address you enter and read publicly available files and pages from it, for example robots.txt, llms.txt, the sitemap and the page itself. The address and the result are shown to you in your browser and are not stored by us, unless you then subscribe to the newsletter (see 2.6). Legal basis: our legitimate interest in providing the tool you asked to use (Art. 6(1)(f) GDPR).
Protection against abuse. To keep the tool free for everyone we limit how often it can be used. For this, Cloudflare processes your IP address when you use the tool, and we keep short-lived counters, for example how many audits were started from one address in the last ten minutes. The IP address in these counters is stored only as a shortened one-way code (a keyed hash), never in readable form, and the counters are deleted automatically within about two days. The tool is also protected by Cloudflare Turnstile (see 2.3), which checks technical browser signals to tell people from bots and does not set cookies. Legal basis: our legitimate interest in keeping the tool secure and available (Art. 6(1)(f) GDPR).
Newsletter sign-up. After the audit you can subscribe to our newsletter. The sign-up is protected by Cloudflare Turnstile (see 2.3) and limited per email address and per IP address, using the same short-lived counters. If you subscribe, we process the data described in 2.6 and keep the consent record in our database at Cloudflare (EU region) for 3 years. Legal basis: your consent (Art. 6(1)(a) GDPR).
The tool does not use cookies, advertising or analytics. Its fonts are hosted on our own server.
On the Freebies page you can send us an idea for a new free tool or plugin, anonymously. We only ask for the idea: no name, no sign-up, and we do not store your IP address. Your message reaches us by email and is also kept in our website for 12 months, then deleted automatically. Please do not put personal data of other people in it. Legal basis: our legitimate interest in receiving the ideas you choose to send us (Art. 6(1)(f) GDPR).
If you tick “Let me know once when it is ready”, we also process the email address you enter, only to write to you once when that tool is ready: not for the newsletter and not for any other purpose. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by writing to hey@gespa.agency. The form is protected by Cloudflare Turnstile (see 2.3).
The cookie banner is provided by the Cookiez plugin (Elementor Ltd.). Every time you make a choice in the banner (accept all, reject all or your own settings), your browser sends a record of that choice to Elementor’s servers (my.elementor.com), so that we can prove your consent if asked. The record contains the website address, your choice, the cookie categories you allowed or refused, the list of cookies on this website with their category and whether they were blocked, and your browser’s user agent. It contains no name, email address or other identifier, but, as with any connection, Elementor’s server also receives your IP address. This happens when you reject cookies too. The choice itself stays on your device in the cookiez-user-consent cookie. Legal basis: our obligation to be able to demonstrate your consent (Art. 7(1) GDPR) and our legitimate interest in keeping proof of it (Art. 6(1)(f) GDPR). Elementor keeps the records as described in its privacy policy.
We do not sell your data. We use it for advertising measurement only with your consent, as described in 2.9. Where data is transferred outside the European Economic Area, the transfer is based on an adequacy decision of the European Commission (including the EU–US Data Privacy Framework) or the European Commission’s Standard Contractual Clauses.
Enquiries are kept as long as needed to answer them and for at most 12 months afterwards, unless they lead to a contract; in that case we keep the data for as long as the law requires (for example, accounting rules). Technical logs are deleted automatically after a short period.
Newsletter data is kept in SendFox until you unsubscribe. After that we keep only your email address and the date you unsubscribed, so we never email you again by mistake. The record of your sign-up on our website (including the consent record) is deleted automatically after 3 years.
Free GEO audit: the addresses you enter and the audit results are not stored, unless you subscribe to the newsletter after the audit (then 2.6 and the retention of the newsletter record above apply). The pseudonymised abuse-protection counters are deleted automatically within about two days.
Freebie ideas: the message and, if you gave it, your email address are kept for 12 months, then deleted automatically.
You have the right to access your data, to have it corrected or erased, to restrict or object to its processing and to data portability. Where processing is based on your consent, you can withdraw it at any time. To use any of these rights, write to hey@gespa.agency.
You can also lodge a complaint with the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, azop.hr).
We do not use automated decision-making or profiling.
We will update this policy when our services change. The date of the latest version is shown at the top of this page.
