Privacy

Who runs this site

This site is run by Phillip Zoghbi of ZM5J, a registered game studio in Croatia. I am the data controller for everything described here.

Registered address: Vukovarska cesta 21A, 31000 Osijek, Croatia.

For anything on this page, including a request to delete your data, email me.

What the contact form collects

If you submit the form on the contact page, it records what you typed into it:

• Your brand or venue type
• What you want a visitor to do
• Your project description
• The platforms you selected
• Your budget range and timeline
• Your email address, your phone number, or both

Filling in the form is voluntary. At least one of email or phone is required, because without it I cannot reply. Everything else is there so my reply is useful rather than a request for the same details again.

The form does not ask for payment details, identity documents, or any special category of personal data. Please do not send them.

Why I hold it, and on what basis

I use your enquiry to answer it and, if we go ahead, to scope and deliver the work. The lawful basis is Article 6(1)(b) of the GDPR: steps taken at your own request before entering into a contract.

Analytics runs on a different basis, your consent under Article 6(1)(a), which you give or refuse on the notice described below.

There is no automated decision-making and no profiling. I do not sell or rent your data, and submitting the form does not add you to a mailing list.

Who else processes it

Three services are involved in getting your message to me, each doing one job:

• Vercel hosts the site and serves every page.
• Neon stores form submissions in a managed PostgreSQL database.
• Resend delivers the notification email that reaches my inbox.

These providers are based in the United States and may process data outside the European Economic Area. Where they do, the transfer relies on the safeguards set out in their own data processing terms, which use the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

Analytics and cookies

This site uses Google Analytics to count visits and see which pages people read. It loads only after you press Accept on the consent notice. Choose Decline and the analytics script is never loaded at all, so no analytics cookies are set.

Your choice is stored in your own browser under cookie_consent. You can withdraw consent at any time by clearing your browser storage for this site, which resets the choice and brings the notice back. Withdrawing does not affect anything collected before you did.

There are no advertising cookies, no tracking pixels, and no third-party embeds beyond the analytics described here.

How long it is kept

Enquiries that do not lead to work are deleted within 24 months of our last contact. If we do work together, I keep the enquiry for as long as the working relationship lasts, and after that for as long as I am legally required to keep business records.

You can ask me to delete yours sooner at any time.

Your rights

Under the GDPR you have the right to access your data, to have it corrected, to have it erased, to restrict how it is processed, to object to it being processed, and to receive it in a portable format. Where processing rests on consent, you can withdraw that consent.

To exercise any of these, email me. The law gives me one month to respond. You also have the right to complain to the Croatian Personal Data Protection Agency (AZOP).

Changes

If this policy changes, the updated version replaces this page. Last updated 17 September 2026.