Privacy Policy
This policy describes what personal data this website collects, why, who else sees it and what you can do about it. It describes what the site actually does, checked against the browser rather than copied from a template. Last reviewed 21 July 2026.
The short version
This is a static website. There is no account to create, nothing to buy and no newsletter to join. The only information you can hand us directly is what you type into the contact form, and we use that to reply to you. Beyond that we measure traffic with Google Analytics, and articles in the blog carry Google ads. Both are described in full below, including the part where the ads are not behind our consent button.
We do not sell personal data, we do not share it for anyone else's marketing, and we do not build profiles of visitors.
Who is responsible
Visual Media Factory is a freelancing agency based in Sarajevo, Bosnia and Herzegovina, and is responsible for the data described here. For anything in this policy, including any request about your own data, email pr@visualmediafactory.com and a person will answer.
Bosnia and Herzegovina sits outside the European Union, but much of our work is for clients and visitors in the EU, so we apply the standards of the General Data Protection Regulation to everyone who contacts us, wherever you are.
What we collect, and why
1. What you type into the contact form
The form asks for your name, email address, company, website, a topic and your message. Only the name, email and message are needed; company and website are optional and exist so we can look at what you are asking about before replying.
That message is emailed to us and read by a person. We use it to answer you and, if it turns into work, to carry on that conversation. We do not add you to any mailing list, because there is no mailing list. The contact page says "No newsletter, no sales sequence, no passing it on", and this policy is the same promise in longer form.
The lawful basis is either taking steps at your request before entering a contract, or our legitimate interest in replying to people who write to us.
The form also carries a hidden field and a timing check to absorb automated spam. Both live in the page, neither sets a cookie, and both are discarded once the message is sent.
2. Analytics
We use Google Analytics 4 (measurement ID G-8HVEDQR2H4) to understand which pages are read and where visitors arrive from. It runs under Google Consent Mode.
Until you press Accept it stores nothing on your device and sends only an anonymous signal that counts the visit without identifying you. That signal still reaches Google and still carries your IP address, so we should be plain about it: before you answer the banner we are relying on our legitimate interest in knowing how many people read the site, not on your consent. If you would rather not be counted at all, press Reject and the signal stays anonymous permanently, or use a browser or extension that blocks Google Analytics outright.
Pressing Accept additionally sets the two cookies that let a returning visit be recognised, and the lawful basis for those is your consent. If you reject, or change your mind later, those cookies are actively deleted and it returns to the anonymous state.
In every state it is configured with IP anonymisation on, Google Signals off and ad personalisation off, so it is not used to build an advertising profile of you. Your consent choice is stored in your browser's local storage under vmf-consent, together with the date you made it, so that a rejection can be left alone for six months before the banner asks once more. That is not a cookie, it is never transmitted, and clearing your browser data for this site removes it. You can change the choice at any time with the Privacy choices button on any page.
3. Advertising, on blog articles only
Articles in the blog carry Google AdSense (publisher ID ca-pub-2734052961790226). The home, services, about and contact pages carry no advertising at all.
AdSense is not currently behind our Accept button. On an article it loads as the page loads, before you have answered our banner, and Google runs its own consent flow inside it for visitors in the EU and UK. We would rather state that plainly than imply a control we do not yet apply. For those cookies Google is acting as its own controller, and its handling is governed by Google's advertising policies. The cookie policy lists the individual cookies it can set.
4. Server logs
The web server keeps standard access logs: IP address, timestamp, the URL requested, the referring page, and the browser's user agent string. Every web server does this and it is how we investigate errors, abuse and attacks. The lawful basis is our legitimate interest in keeping the site up and secure. These logs are not joined to anything else and are not used for analytics.
What we do not do
No accounts and no logins. No newsletter or mailing list. No Facebook pixel, no LinkedIn insight tag, no retargeting of our own, no session recording, no heatmaps and no A/B testing tools. We do not sell or rent personal data, and we do not pass your enquiry to anyone else to market to you.
Note that this policy covers this website only. If you become a client, the work itself is covered by the agreement we sign with you, which is a separate document.
Who else sees the data
| Who | What they handle | Why |
|---|---|---|
| Contabo | The server and its logs | They host the site |
| Analytics data, ad cookies on articles, and the mailbox your enquiry is delivered to | Measurement, advertising and email |
Both are outside Bosnia and Herzegovina, and Google is based in the United States. Google is certified under the EU US Data Privacy Framework, which is the mechanism the European Commission recognises for those transfers.
How long we keep it
Contact form enquiries stay in our mailbox for up to 24 months, so we can pick up a conversation someone started last year. If the enquiry becomes a client relationship, the correspondence is kept for as long as we are required to keep business records. Ask us to delete yours sooner and we will.
Server logs rotate on the hosting account and are not archived. Analytics data is deleted by Google on the retention schedule configured in the property.
Your rights
You can ask us to do any of the following, and none of it costs anything:
- See what we hold. Ask for a copy of your personal data.
- Correct it. Ask us to fix anything inaccurate or fill in anything incomplete.
- Delete it. Ask us to erase it, subject to any records we are legally required to keep.
- Restrict or object. Ask us to stop or limit a particular use, including anything we do on the basis of legitimate interest.
- Take it with you. Ask for it in a portable format, or ask us to send it to someone else.
- Withdraw consent. For analytics cookies, the Privacy choices button on any page does this instantly. Withdrawing does not undo anything done before you withdrew.
Email pr@visualmediafactory.com and we will respond within one month. If you are in the EU, the UK or the EEA and you think we have handled your data badly, you also have the right to complain to your national data protection authority, and you can do that without asking us first.
Children
Nothing here is aimed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has sent us something through the contact form, email us and we will delete it.
Changes to this policy
If what the site does changes, this page changes with it, and the review date at the top moves. We will not quietly widen what we collect and leave the old wording up.
Questions
Email pr@visualmediafactory.com and a person will answer. See also the cookie policy for the cookie by cookie detail and the terms and conditions for the rules covering use of the site.