Privacy policy

The controller for this website is Sonja Žužek s.p., Prešernova cesta 21A, 1234 Mengeš, Slovenia. The website is operated under the brand name Evipace.

For privacy questions, contact hello@evipace.com. Tim Kogej is an authorized contact for privacy requests.

If you submit an ESG request, the required fields are your name, business email address and company name. You must also attach at least one document. The message and requested deadline fields are optional. Without the required information and documents, Evipace cannot receive and assess the request through this form.

The form also records a submission reference, timestamps, the language version used for the form where available, uploaded-document filenames, declared file size, declared file type and technical storage metadata used to handle the upload securely.

Uploaded documents may contain additional personal data supplied by the submitter. Please do not upload unnecessary personal data, special-category data, identification documents or unrelated confidential information.

The form validates required fields, email format, message length, deadline length, file count, file size, total upload size and allowed file types. A hidden honeypot field is used as an anti-abuse signal.

For rate limiting, the application stores a keyed HMAC value derived from the requester IP address. The raw IP address is not stored in the request database. Rate-limit checks currently use a one-hour window.

When you request services for yourself or as the prospective contractual party, Evipace processes the request to take steps at your request before entering into a contract under GDPR Article 6(1)(b).

When you act for your employer or another company, Evipace processes the request under GDPR Article 6(1)(f), legitimate interests in handling B2B inquiries, communicating with company representatives and preparing the requested ESG service.

The same Article 6(1)(b) and/or Article 6(1)(f) bases apply, depending on the relationship to the prospective engagement, when Evipace stores uploaded documents, notifies the Evipace team, replies to the submitter and assesses the requested ESG work.

Validation, rate limiting, fraud prevention, service security and troubleshooting rely on GDPR Article 6(1)(f), legitimate interests in protecting the website and request service. Where specific information must be retained to comply with an applicable legal obligation, GDPR Article 6(1)(c) may apply to that information only.

Vercel Web Analytics is used, where applicable under GDPR Article 6(1)(f), for legitimate interests in understanding website use and maintaining website performance.

Request data is stored in the inbound request database. Uploaded documents are stored in a private Supabase Storage bucket. The browser receives per-file signed upload tokens used for the upload.

After files are verified, the request is marked as submitted. Resend is used to send an internal notification to Evipace. Internal notifications may include uploaded files or time-limited signed links to them. A visitor confirmation email is sent only if the separate confirmation email feature is enabled.

The internal email contains the request reference, submitted timestamp, recorded locale, name, email address, company, deadline, message and safe file display information.

Vercel hosts the website. Vercel Web Analytics measures aggregated website traffic and performance, operates without third-party analytics cookies and is described by Vercel as storing anonymized analytics data. It is separate from optional Google Analytics 4, and accepting or rejecting Google Analytics does not change Vercel Web Analytics consent.

Evipace also uses technically necessary first-party technologies to operate the website, route pages by language and remember cookie choices.

The cookie evipace_cookie_consent stores whether analytics was accepted or rejected. It is a first-party consent cookie, is used only to remember that choice and is retained for up to 180 days.

Google Analytics 4 is optional. The legal basis is consent under GDPR Article 6(1)(a). Google Analytics is not loaded before analytics consent is accepted. You can reject analytics without losing access to the website. You can change your choice later through the Cookie settings control in the Footer.

If analytics is accepted, Google Analytics cookies such as _ga and _ga_* may be created. Advertising storage, advertising user data and advertising personalization remain denied. Evipace does not intentionally send form contents, uploaded-document information, filenames, email addresses, names or company names to Google Analytics. The verified Google Analytics retention period is 14 months, and reset on new activity is disabled. This applies to user-level and event-level data covered by Google Analytics retention controls; standard aggregated reports may not be governed by the same retention setting.

Evipace uses Supabase for the request database and private uploaded-document storage, Resend for transactional email delivery and internal request notification, Vercel for website hosting and Vercel Web Analytics, and Google for optional Google Analytics 4 after consent.

These providers may process data in the EEA, the United States or other locations according to their services, infrastructure and subprocessors. Where processing outside the EEA occurs, applicable safeguards may include adequacy decisions, the EU Standard Contractual Clauses or equivalent contractual and technical safeguards. Evipace does not sell personal data.

If an inquiry does not result in an engagement, request-form data and uploaded documents are retained for no longer than six months after submission or the last relevant communication, whichever is later.

If an engagement begins, relevant information may be retained for the duration of the engagement and afterwards only as needed for contractual claims, legal obligations or the establishment, exercise or defence of legal claims. Legal obligations apply only to the information that must be retained for that purpose.

The consent-choice cookie is retained for up to 180 days. Security and rate-limit data in the request database is linked to the same request retention process; rate-limit checks use a one-hour window.

The source of request data is normally you or the person submitting the form on behalf of an organization. Subject to legal conditions, you may have the right of access, rectification, erasure, restriction of processing, objection where processing relies on legitimate interests, and data portability where applicable.

Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. For Google Analytics, use the Cookie settings control in the Footer.

You also have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia. This website does not use solely automated decision-making that produces legal or similarly significant effects.