Privacy policy and cookies
Short and clear: what data we collect, why, how long we keep it and what your rights are.
Last updated: 9 October 2026
1. Data controller
The controller of personal data on this website is:
METAL KOVANJE, a craft business making costumes and knight’s armor
owner Pavel Butolen
Stanka Vraza 30, 47000 Karlovac, Croatia
Email: pavelklc047@gmail.com · Phone: +385 95 813 0264
For any question about personal data or to exercise your rights, write to the email address above.
2. Inquiries and forms
When you send an inquiry about a product or an idea for a custom piece, we collect the data you enter: first and last name, email address, phone number (optional), your message and, for custom orders, the links and attachments you send. We also record the product the inquiry refers to, the language of the site and the time it was sent.
Purpose: replying to your inquiry, agreeing on the work and making an offer. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in replying to your message (Art. 6(1)(f)).
Inquiries are stored in our database and sent to our addresses as an email notification. We keep inquiries for no more than 2 years after our last communication, unless the inquiry leads to an order — in that case we keep the data needed for invoicing for as long as tax and accounting rules require. On request, we delete an inquiry earlier.
We do not use inquiry data for marketing and we never sell it.
3. Protection against abuse
Our forms are protected by Cloudflare Turnstile, which checks that an inquiry is sent by a person and not by an automated program. In doing so, Cloudflare processes technical browser data and your IP address. The legal basis is our legitimate interest in protecting the site from spam (Art. 6(1)(f) GDPR). Turnstile does not use cookies for tracking or advertising.
The website runs on Cloudflare’s infrastructure, which processes the IP address and technical request data on every visit to keep the site available and secure.
4. Analytics (Google Analytics)
If you allow it in the cookie banner, we use Google Analytics 4 to see how many visitors come to the site and which pages interest them. Google Analytics then sets cookies and processes data about your device, browser, approximate location and use of the site. Google Analytics 4 does not store IP addresses.
Legal basis: your consent (Art. 6(1)(a) GDPR). Without consent, Google Analytics is not loaded. You can withdraw your consent at any time using the “Cookie settings” link at the bottom of the page. We do not use the data for advertising.
The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to the USA; Google is certified under the EU–US Data Privacy Framework.
5. Cookies
Cookies are small files that a website stores in your browser. We always use essential cookies, and analytics cookies only with your consent.
| Cookie | Purpose | Type | Duration |
|---|---|---|---|
mk_consent | Remembers your choice in the cookie banner (also saved in your browser’s local storage). | Essential | 1 year |
mk_lang | Remembers the language you chose in the language menu. | Essential | 1 year |
mk_session, mk_admin | Login to the website administration (administrators only). | Essential | 12 hours |
__cf_bm, cf_clearance | Cloudflare security cookies that protect against malicious traffic; set only when needed. | Essential | up to 30 minutes / up to 1 year |
_ga, _ga_YXT7XTF78L | Google Analytics: distinguishing visitors and visits. | Analytics (with consent) | 2 years |
You can change your choice at any time: . You can also delete cookies in your browser settings.
6. Videos
YouTube videos are not loaded automatically. Only when you click a video is YouTube loaded in privacy-enhanced mode (youtube-nocookie.com), and Google then processes data under its own privacy policy. Links to Facebook and to media articles lead to external sites, which have their own policies.
7. Recipients and data transfers
We do not sell personal data or share it for marketing purposes. Only service providers who help us run the website have access to it, and only to the extent necessary:
- Cloudflare, Inc. — website hosting, database and storage of attachments, abuse protection (Turnstile) and sending email notifications about inquiries.
- Google — the mailbox that receives inquiry notifications (Gmail) and, with your consent, Google Analytics.
- Striboss (a web design and maintenance business) — technical maintenance of the website; receives a copy of inquiry notifications to check that everything works.
Some providers are based or have infrastructure outside the European Economic Area (USA). Such transfers rely on the EU–US Data Privacy Framework or on the European Commission’s standard contractual clauses.
8. Your rights
Under the General Data Protection Regulation (GDPR), you have the right to:
- request access to your data and a copy of it,
- request the correction of inaccurate data,
- request the deletion of your data or the restriction of processing,
- object to processing based on legitimate interest,
- request the transfer of the data you provided to us,
- withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal.
Send your request to pavelklc047@gmail.com; we will reply within one month at the latest. If you believe your data is not processed lawfully, you can lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr, or with the data protection authority in your country.
We do not make decisions based solely on automated processing and we do not create profiles. The website is not intended for children under 16.
9. Changes to this policy
We update this policy when the way the website works or the law changes. The date of the last update is shown at the top of the page.