Privacy Policy

Last updated: 9.7.2026, by Tanja Žemva s.p.

This Privacy Policy explains how ALM flow, računalniško programiranje, Tanja Žemva s.p. ("ALM flow", "we", "us", or "our") collects and processes personal data in connection with our website at www.almflow.com (the "Website") and our related business communications.

This Policy covers the processing we carry out for our own marketing website and business operations. It does not govern personal data that we process on behalf of clients as part of a specific development or consulting engagement — that processing is governed by the relevant service agreement and, where applicable, a separate Data Processing Agreement (see Section 3.6).

1. Who we are (Data Controller)

For the processing described in this Policy, the data controller is:

• Legal name: ALM flow, računalniško programiranje, Tanja Žemva s.p.
• Legal form: Sole trader (samostojni podjetnik)
• Registered address: Podhom 10, 4247 Zgornje Gorje, Slovenia
• Registration number (matična številka): 7533225000
• VAT number: SI16564154
• Contact for privacy matters: info@almflow.com

If you have any questions about this Policy or about how we handle your personal data, please contact us at the email address above.

2. Scope of this Policy

This Policy applies to:

• Visitors to our Website.
• People who contact us through our contact form or by email.
• Representatives of prospective and existing business clients whose personal data we process for enquiry handling, proposals, and general business administration.

Our Website is a business-to-business (B2B) marketing website. It is not an online marketplace, e-commerce store, subscription platform, or a service on which visitors create user accounts. Even where an enquiry is submitted on behalf of a company, it may still contain personal data (for example, the name and contact details of the person submitting it), and that personal data is protected under this Policy.

Applications and systems that we build for clients may have their own, separate privacy policies. This Policy does not claim to govern the users of any client application.

3. What personal data we collect, why, and our legal basis

We only collect personal data that we actually need. The categories below reflect the features currently active on our Website.

3.1 Contact form

Our Website includes a "Contact us" form. When you use it, we collect:

• Your name
• Your email address
• Your phone number
• Your company name (if you choose to provide it)
• Your selected services and their tiers or project types
• Your message (if you choose to provide one)

Purpose: to receive and respond to your enquiry, to understand your requirements, and to take any steps you request before deciding whether to enter into a contract.

Legal basis (GDPR Article 6(1)):

• (b) Steps taken at your request prior to entering into a contract — where your enquiry relates to a possible engagement; and/or
• (f) Our legitimate interests — in receiving and responding to business enquiries and managing our commercial relationships. Where we rely on legitimate interests, we have considered your rights and freedoms and believe our interest in responding to a genuine business enquiry does not override them.

Form submissions are transmitted and delivered using Resend (our email delivery provider) and are received and stored in our Gmail email environment. See Section 4 and Section 5.

3.2 Email and other direct communications

If you contact us by email or in the course of discussing a possible project, we may process:

• Your name and email address.
• Your employer or organisation and your role.
• The contents of your messages and any subsequent correspondence.
• Any information necessary to prepare a proposal, quote, or contract.

Purpose: to communicate with you, respond to your requests, and prepare and manage any potential or actual engagement.

Legal basis: Article 6(1)(b) (pre-contractual steps / performance of a contract) and/or Article 6(1)(f) (our legitimate interest in managing business communications and relationships).

We do not offer a file-upload feature on the Website. Confidential project information is exchanged later in an engagement through direct communication, under the terms of the relevant client agreement.

3.3 Hosting, server logs, and security data

Our Website is hosted and served through Netlify. To deliver and secure the Website, Netlify may process technical request data on our behalf, which can include:

• IP addresses.
• Request timestamps.
• Browser / user-agent information.
• Requested URLs.
• Diagnostic, security, and server log information.

Purpose: to deliver the Website reliably, maintain its security and availability, and prevent, detect, and investigate abuse or technical problems.

Legal basis: Article 6(1)(f) (our legitimate interest in operating a secure and functioning website).

3.4 Analytics

Our Website uses Google Analytics, a web analytics service provided by Google. Google Analytics uses cookies and similar technologies to help us understand how visitors use the Website (for example, which pages are viewed and general usage trends), so that we can improve it.

Purpose: to measure and analyse Website usage and improve our content and user experience.

Legal basis: Article 6(1)(a) — your consent, obtained through our cookie consent mechanism (see Section 6). Analytics is only activated where you have given consent, and you can withdraw consent at any time.

3.5 Fonts

Our Website uses Google fonts loaded through the Next.js font system. Next.js font optimisation typically allows font files to be served locally by the Website rather than requested from Google by each visitor's browser.

3.6 Personal data processed in client projects

When we work on a client project, our role under the GDPR depends on the circumstances. We may act as:

• An independent controller for our own client administration, invoicing, security, and legal-compliance purposes;
• A processor, where we handle personal data solely on a client's documented instructions; or
• In less common cases, a joint controller or separate controller, depending on the specific project.

Processing that we carry out for a client is governed by the relevant service agreement and, where required, a Data Processing Agreement (DPA) — not by this Website Privacy Policy.

3.7 AI-assisted development

We use modern AI-assisted development tooling internally to improve the speed and quality of our work. Any AI-assisted output is kept under human oversight and review, and our tooling is not permitted to make independent decisions about client work.

We do not automatically submit all client information to public AI systems. The specific handling of client code, credentials, personal data, and confidential information — including any applicable safeguards and provider settings — is defined in the relevant client contract and our internal procedures.

4. Service providers (processors)

We share personal data with a limited number of service providers who process it on our behalf, under appropriate data processing terms. Currently these are:

We do not sell your personal data, and we do not share it with third parties except as described in this Policy or where required by law.

5. International transfers

Some of our service providers (including Resend, Google, and Netlify) are established in the United States or may process data outside the European Economic Area (EEA). This means your personal data may be transferred to, or accessed from, countries outside the EEA.

Where such transfers take place, they must be protected by an appropriate transfer mechanism under Chapter V of the GDPR, such as an adequacy decision, the EU–US Data Privacy Framework, or Standard Contractual Clauses (SCCs) together with any necessary supplementary measures.

You may request more information about the safeguards applied to a particular transfer by contacting us at info@almflow.com.

6. Cookies and similar technologies

Our Website uses cookies and similar browser-storage technologies. Some are essential; others are only set with your consent.

We use the following categories:

• Essential cookies — necessary for the Website to function and to remember your cookie preferences. These do not require consent.
• Functional cookies — support optional functionality and preferences.
• Analytics cookies — used by Google Analytics to help us understand how the Website is used. Set only with your consent.

Because our Website sets non-essential cookies (Analytics and Functional), we present a cookie consent banner that lets you accept or reject non-essential categories before they are activated, and to change your choice at any time. Non-essential cookies are not set until you consent.

You can also control cookies through your browser settings, your consent will be visible in your local storage under the name cookie_consent. Disabling essential cookies may affect how the Website works.

7. How long we keep your data

We keep personal data only for as long as necessary for the purposes described in this Policy, or as required by law.

Enquiries, correspondence, proposals, and related business records are retained within our email environment (Gmail) for as long as needed to respond to you, to manage a potential or ongoing business relationship, and to comply with our legal, accounting, and tax obligations.

8. Your rights

Under the GDPR, and subject to its conditions and exceptions, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten").
• Restrict or object to certain processing, including processing based on our legitimate interests.
• Data portability, where applicable.
• Withdraw consent at any time, where processing is based on consent (such as analytics cookies). Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact us at info@almflow.com. Requests for access, deletion, correction, or improvement are handled directly by our team by email. We may need to verify your identity before acting on a request, and we will respond within the time limits set by the GDPR.

9. Complaints and supervisory authority

If you believe we have not handled your personal data lawfully, you have the right to lodge a complaint with the Slovenian data protection supervisory authority:

Informacijski pooblaščenec (Information Commissioner of the Republic of Slovenia) Dunajska cesta 22, 1000 Ljubljana, Slovenia Web: www.ip-rs.si

You may also contact the supervisory authority in your country of residence within the EEA.

10. Children

Our Website and services are directed at businesses and professional audiences. We do not intentionally direct our services to children or knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to delete it.

11. Testimonials, case studies, and client references

We may display case studies, testimonials, client logos, or other identifiable client information on our Website. We only do so with the relevant client's agreement. If you are featured and wish to be removed, please contact us at info@almflow.com.

12. Security

We take serious technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or alteration. Access to enquiries and business communications is limited to our team. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will comply with our notification obligations under the GDPR.

13. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices, technologies, or legal requirements. The "Last updated" date at the top indicates when it was last revised. Where changes are material, we will take reasonable steps to make them apparent.

14. Contact

For any privacy-related question or request:

ALM flow, računalniško programiranje, Tanja Žemva s.p. Podhom 10, 4247 Zgornje Gorje, Slovenia Email: info@almflow.com