GDPR Data Protection Notice

The data controller for the Project Lab website is:

For any question about this notice or to exercise your rights, contact upit.ifix@gmail.com.

• Operating and securing the website (serving pages, protecting against abuse).
• Responding to messages you send us (project questions, collaboration, website issues, privacy requests, general inquiries).
• Enabling voluntary financial support for a specific project through the external platform Ko-fi, and — once the Ko-fi webhook confirms a payment — recording that contribution against the correct project.
• Displaying an optional public supporter name/nickname and message on the Project Wall, if you choose to provide them.
• Keeping basic records required for accounting and legal compliance.

• Art. 6(1)(f) — legitimate interests: replying to messages you send us, keeping the site available and secure, preventing abuse, and understanding which projects receive support.
• Art. 6(1)(b) — where applicable: processing that is necessary to take steps at your request prior to entering into a contract, or to perform a contract. Whether and how this applies to a support transaction will depend on how the support/payment model is finalised; support is described neutrally here until then.
• Art. 6(1)(c) — legal obligation: retaining accounting and tax records where the law requires it.
• Art. 6(1)(a) — consent: any non-essential cookies, and publication of a supporter name/nickname and optional message on the Project Wall. Publication takes place only according to the supporter’s selected publication preference, and consent can be withdrawn at any time.

Support transaction records (amount, currency, project, date, payment status) are processed separately from any public Project Wall entry, for payment administration, project accounting and legal compliance.

Contact data. When you email us: your email address, your name if you provide it, and the content of your message.

Supporter data. If you choose to provide it when supporting a project: an optional public name or nickname and an optional short message. You may support anonymously where the payment platform allows it.

Project Wall data. An optional name/nickname and an optional short message. These are published only according to the supporter’s selected publication preference. Email addresses are never shown on the Project Wall.

Support / payment metadata. The amount, currency, project, date and a payment status/reference for a contribution, kept as an internal record for payment administration, project accounting and legal compliance — separate from any public Project Wall entry. The payment itself is carried out on an external platform (Ko-fi); the exact data flow between that platform and Project Lab will be confirmed once the support setup is finalised. Project Lab does not operate a checkout and does not ask you to enter card details on this site.

Technical data. Standard server and CDN logs generated by the hosting provider (e.g. IP address, request time, user agent), used for delivery, security and troubleshooting.

• Email correspondence: kept for as long as needed to deal with your matter and a reasonable period afterwards, then deleted.
• Project Wall entries: kept while the relevant project is shown, unless you ask us to remove yours.
• Support / accounting records: kept for the period required by Croatian accounting and tax law.
• Hosting/CDN logs: kept for a short period by the hosting provider under its own retention policy.

Project Lab uses the services below. The GDPR role of each provider (processor, joint or independent controller) depends on the actual relationship and contracts in place; it is not assumed here.

• Ko-fi — the external platform used for voluntary financial support. When you choose to support a project you leave Project Lab and complete the payment on that platform, under its own terms and privacy notice; it and its payment providers process the payment. See Ko-fi’s privacy information.
• Cloudflare Pages / Cloudflare — provides static hosting and content delivery for this site, and handles standard request logs and security.
• YouTube (Google) — a project walk-through video is available on one Realized project. It is not loaded automatically: nothing is requested from YouTube until you press play. When you do, the player loads from youtube-nocookie.com and YouTube/Google may then receive technical data (such as your IP address and device information).

Project Lab does not use myPOS. myPOS is used only by the separate ESP32 CAN Bus Sniffer website, which has its own controller and privacy documentation. The two are not connected and their data is not merged.

Some providers above (e.g. Ko-fi, Cloudflare, YouTube) may process data outside the European Economic Area. Where that happens, transfers rely on the safeguards those providers put in place, such as the European Commission’s Standard Contractual Clauses or an adequacy decision.

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased, where the conditions are met;
• restrict or object to certain processing;
• data portability, where applicable;
• withdraw consent at any time, without affecting prior processing.

To exercise any of these, email upit.ifix@gmail.com. You can also ask us to remove your Project Wall entry at any time.

We will respond to requests without undue delay and, in any event, within one month of receiving the request. Where permitted by the GDPR, this period may be extended by up to two additional months due to the complexity or number of requests; in such cases, you will be informed within the first month.

You also have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), the competent supervisory authority for data protection in Croatia:

Agencija za zaštitu osobnih podataka (AZOP)

Project Lab is built to use as little as possible:

• No analytics, marketing or tracking cookies are set, and no analytics provider is installed.
• The only item Project Lab stores in your browser is your cookie/privacy choice (kept in local storage), so the notice does not reappear.
• Web fonts are served from this site, not from a third-party font service.
• The Ko-fi support control is a plain link — no third-party script or widget loads on Project Lab.
• The project video is not loaded until you press play (see section 6).
• The hosting/CDN provider (Cloudflare) may set a strictly necessary cookie for security or load balancing. This is not used for analytics or tracking.

If a non-essential technology (for example website analytics) is ever added, it will load only after you consent. You can accept or reject non-essential cookies just as easily, and you can change or withdraw your choice at any time via Cookie Settings in the footer.

Project Lab links to external websites — including the separate ESP32 CAN Bus Sniffer website (esp32canbus.pages.dev), Ko-fi, Instagram and YouTube. Those sites are operated independently and have their own privacy notices and payment systems. This notice does not cover them.