Privacy and cookie policy

1. Who is responsible

The data controller for this website is Marko Miljkovic, an independent SEO and AEO consultant, trading as an individual. Contact: marko@markomiljkovic.com. There is no appointed data protection officer, as none is required for a business of this size; questions about this policy go to the same address.

2. What is collected, why, and for how long

Contact form and email

When you send the contact form or email me, I receive what you typed: your name, email address, your website address if you gave it, and your message. I use it to answer you and, if we go on to work together, to prepare and deliver that work. The legal basis under the GDPR is your request before entering a contract (Article 6(1)(b)) and my legitimate interest in answering enquiries (Article 6(1)(f)). The form submits by email; the message is delivered through Cloudflare Email Routing to a Google Workspace / Gmail mailbox. Enquiries that do not lead to work are deleted within 12 months; correspondence with clients is kept for the duration of the engagement plus the period required for tax and accounting records.

Server and security logs

The site is served by Cloudflare. Cloudflare records standard request data (IP address, user agent, requested URL, time) in its logs to deliver the site, defend against abuse and diagnose faults. This is Cloudflare's own processing as my hosting provider under a data processing agreement; logs are retained for a short period as described in Cloudflare's documentation. Legal basis: legitimate interest in running a secure site (Article 6(1)(f)).

Analytics

Cloudflare Web Analytics runs always. It does not set cookies, does not use local storage, does not fingerprint devices and does not track you across sites; it gives me aggregate figures such as page views, referrers, countries and Core Web Vitals. Because nothing is stored on your device, it needs no consent and rests on my legitimate interest in understanding how the site performs (Article 6(1)(f)).

Google Analytics 4 runs only if you accept “Analytics” in the cookie banner (Article 6(1)(a), consent). It sets the _ga and _ga_* cookies to tell returning visits apart and sends page views and interactions to Google Ireland Ltd, with IP addresses truncated before storage. Google Consent Mode v2 is set to “denied” by default, so until you choose, Google receives no cookies and no identifiers. Withdrawing consent stops the tag and deletes its cookies from your browser. Data in Google Analytics is retained for 14 months.

Marketing

No advertising or social pixels are active today. If any are added (for example LinkedIn Insight or Meta Pixel), they will run only if you accept “Marketing” in the banner, and this section will list them. Links to LinkedIn, YouTube and client sites open those sites directly; their own policies apply once you are there.

3. Cookies and similar technologies

On your first visit a banner asks what you allow. “Accept all” and “Reject all” carry equal weight, nothing is pre-ticked, and you can change your choice at any time under “Cookie settings” in the footer. Your choice is kept for 12 months in your browser’s local storage under the key mm-consent, then you are asked again. Browsers that send the Global Privacy Control signal are treated as having declined marketing.

Video appearances on the Speaking page are first-party thumbnails that link out to YouTube rather than embedded players, so YouTube sets nothing while you are here. No other storage is used.

4. Who receives data

• Cloudflare, Inc. (hosting, DNS, email forwarding, analytics), under Cloudflare's data processing terms, with EU data handled under the EU–US Data Privacy Framework and standard contractual clauses.
• Google Ireland Ltd / Google LLC (the mailbox that receives your message; Google Analytics 4 if you accept analytics), under Google's data processing terms, the EU–US Data Privacy Framework and standard contractual clauses.
• Sanity AS hosts the site's published content (services, case studies); it does not receive visitor data.

I do not sell personal data, do not share it for cross-context behavioural advertising, and do not disclose it to anyone else unless the law requires it.

5. Your rights

EU/EEA, UK and Switzerland. You can ask for access to your data, correction, deletion, restriction, portability, and you can object to processing based on legitimate interest. You can withdraw consent at any time under “Cookie settings” in the footer; that stops Google Analytics and removes its cookies. You can complain to your data protection authority; in the EU that is the authority of your country of residence, in the UK the Information Commissioner's Office, in Switzerland the Federal Data Protection and Information Commissioner.

United States. This site is run by a sole practitioner well below the revenue and volume thresholds of the state privacy laws (California CCPA/CPRA, Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, Texas TDPSA, Oregon OCPA, Montana MCDPA and the other state acts). I nevertheless honour the rights those laws describe for everyone in the US: to know what is collected, to delete it, to correct it, and to opt out of sale, sharing and targeted advertising. There is no sale or sharing of personal data; Global Privacy Control signals are honoured and switch marketing off automatically, and “Reject all” in the banner opts you out of analytics as well. I will not treat you differently for exercising a right.

To exercise any right, email marko@markomiljkovic.com. I answer within 30 days (45 days where a US state law allows it) and may ask you to confirm you own the email address the data relates to.

6. Security, children, changes

The site is served over HTTPS with HSTS. The mailbox is protected by two-factor authentication. The site is not directed at children and I do not knowingly collect data from anyone under 16. When this policy changes, the date at the top changes with it; material changes will be noted here.