Legal
Privacy
This site sets no cookies, runs no analytics, and loads nothing from third parties. What little is processed is described below in full.
Last updated 2026-08-20
Who is responsible
Denis Šehić, Bunarić V 6, 23234 Vir, OIB 02520053309, is the controller of any personal data described here. You can reach us at hello@lumentalabs.studio.
What this site does not do
There is no analytics, no advertising, no tracking pixels, no embedded fonts from other domains, and no social widgets. Every file the page loads comes from lumentalabs.studioitself. The contact form below is the one place the site talks to another service on your behalf, and it is described in full.
The one exception: the video
The homepage offers a introductory film hosted on YouTube. We deliberately do not embed it the usual way, because a normal embed contacts Google the moment the page opens. What you see before clicking is a still image served from lumentalabs.studio, and nothing else.
Only when you press play does the player load, and it loads from youtube-nocookie.com, YouTube's privacy-enhanced mode. From that point YouTube receives your IP address and may store data on your device under Google's privacy policy, which we do not control. If you never press play, none of that happens.
What is unavoidably processed
Like every website, this one is served by a web server that keeps access logs. Those logs typically contain your IP address, the time of the request, the page requested, and your browser's user agent string. We do not use them to build a profile of you; they exist so the site can be operated, debugged and defended against abuse.
The legal basis is our legitimate interest in keeping the site running and secure (Article 6(1)(f) GDPR). The logs are held by our hosting provider and retained for the period that provider applies to server logs.
If you email us, or use the contact form
When you write to us — by email or through the contact form — we receive your name, your email address, the message you type, and, on the form, the package you selected if you picked one. We use it to answer you and, if it leads to work together, to carry out that work. The basis is your request and the steps taken before any contract (Article 6(1)(b) GDPR), or our legitimate interest in replying to enquiries.
The form itself sets nothing on your device — no cookie, no local storage — it only sends what you typed to our server when you press submit. Submissions are rate-limited by IP address to stop abuse, and a hidden field designed to catch automated bots is discarded without being read if a real visitor never touches it.
We keep correspondence for as long as it is relevant to an ongoing or possible engagement, and delete it when it no longer is.
Who else is involved
The contact form is stored in a database run by our database provider, and, when configured, triggers one notification email sent through our email delivery provider so we see your message promptly. Our hosting provider serves the site and keeps the access logs described above. Each acts as our processor under a contract that limits what they may do with your data. We do not sell or share personal data with anyone else, and we do not transfer it outside the European Economic Area on purpose.
Links to our other projects
Pages under Work link to separate sites we operate. Those sites have their own privacy notices and their own processing — this one does not cover them.
Your rights
You may request access to your data, its correction or erasure, restriction of processing, or portability, and you may object to processing based on legitimate interest. Write to hello@lumentalabs.studio and we will answer within the statutory deadline.
If you believe we have handled your data badly, you may complain to the Croatian Personal Data Protection Agency (AZOP) or to the supervisory authority where you live.
Changes
If this notice changes, the date at the top changes with it. There is no mailing list to notify, because we do not keep one.