Privacy Policy

Last updated: 26 October 2026.

This policy explains which personal data Orange Agency processes when you visit orangeagency.me, write to us or send a brief, why, for how long, who else receives it and what your rights are.

Who is responsible

The controller of your data is Orange Agency, Peraška 2, Tivat, Montenegro. For any question about your data, and for every request described below, write to [email protected].

What data we process

Contact form. The form on the contact page sends nothing to our server: it opens your own e-mail program with a message addressed to [email protected], and the message goes out only when you send it. We then receive what you wrote: your name, e-mail address and message.
E-mail. Everything you send to [email protected], attachments included.
Website brief. Your name and e-mail address and, if you enter them, your phone and city; the name and description of your business, the goal of the website, the styles, colours and example sites you chose, what you already have and what you want to avoid, prices, pages and languages, a note, a link to your materials and the files you attach (images or PDF, up to 12 files of 8 MB each); your consent to be contacted, the time it was sent, the address of the page it was sent from, your IP address and browser details.
Client list. On the clients page your browser loads the list of the latest web projects directly from orvelo.xyz, the site of Orvelo, the studio we partner with for websites; that server receives your IP address and browser details, as any website you open does, and nothing else.
Server logs. Our server records the IP address, time, requested address and browser details of every visit.
Spam protection. On the contact and brief pages Cloudflare Turnstile checks that the visitor is a person; for that check Cloudflare processes your IP address and technical browser data.

Why we process it, and on what basis

to reply to your enquiry and prepare an offer, at your request, before a contract is concluded, and to perform the contract if we start working together;
to protect the site from abuse and spam and keep it secure (server logs, Turnstile), on the basis of our legitimate interest;
when you tick the consent box in the brief, you also agree that we contact you about that enquiry; you can withdraw that consent at any time.

We do not use your data for advertising, we send no newsletter, we make no automated decisions and build no profiles. We never sell your data.

Who receives it

Orvelo, the web development studio we partner with, receives your brief together with us, to prepare the offer and build the website;
Hetzner Online GmbH (servers in Germany), where this site runs and where briefs and their files are kept;
Hostinger International Ltd. (Cyprus), the provider of our mailbox [email protected];
the services that deliver the notification of a new brief to our mailboxes: our own mail server in the European Union and Mailjet SAS (France);
Cloudflare, Inc. (USA), whose network delivers the site, protects it from attacks and runs the Turnstile check;
state bodies, only where the law requires it.

Transfers outside Europe

The site and the briefs are kept in Germany. Through Cloudflare, data is also processed in the USA; for such transfers Cloudflare applies the European Commission's standard contractual clauses and participates in the EU-U.S. Data Privacy Framework.

How long we keep it

briefs and the attached files: 12 months from receipt, after which they are deleted from the server automatically;
messages in our mailbox (contact form messages, e-mail and brief notifications): as long as we keep that correspondence in the mailbox; at your request we delete them sooner, unless the law requires us to keep them;
if we start working together: what the cooperation needs, for as long as it lasts, and contract and invoice data for as long as accounting and tax rules require;
server logs: 14 days;
your choice on the cookie notice, in your browser: until you delete it.

Your rights

You can ask for access to your data, its correction or deletion, restriction of processing and a copy in a portable format, object to processing based on our legitimate interest, and withdraw a consent at any time, without affecting what was done before. Write to [email protected]; we reply without undue delay.

If you believe we process your data unlawfully, you can lodge a complaint with the Agency for Personal Data Protection and Free Access to Information of Montenegro (Agencija za zaštitu ličnih podataka i slobodan pristup informacijama), Bulevar Revolucije 11, Podgorica, www.azlp.me.

Cookies and browser storage

This site uses no analytics, advertising or tracking cookies and sets no cookie of its own. It keeps only these items in your browser, all of them needed for the site to work, so it asks no consent for them:

oa_cookies_ok (local storage): remembers that you closed the cookie notice; kept until you delete it;
oa_brief_v1 (local storage): keeps what you typed into the brief until you send it, so nothing is lost if you close the page; it stays in your browser only and is deleted when the brief is sent;
oa_bfp (session storage): remembers whether you opened or closed the live preview in the brief; deleted when you close the browser;
Cloudflare Turnstile (contact and brief pages): checks that you are a person; it sets no cookie on this site.

You can delete all of it at any time in your browser settings (site data for orangeagency.me).

Children

The site and our services are meant for businesses and adults; they are not aimed at children under 16. We do not knowingly collect data about children.

Security

The whole site works over an encrypted connection (HTTPS). Briefs are kept in a part of the server that is not publicly accessible, and only we and Orvelo can open them, through a private link. No measure gives complete security, but we take reasonable steps to protect your data.

Changes

We may update this policy; the date of the latest change is shown at the top of this page.