Skip to content
Lixum
.agency

Privacy Policy

Last updated: August 6, 2026

This policy describes what this website measures, what we do with information you send us, and who else can see it. It is written to match how the site actually works rather than to cover every theoretical case.

1. Who we are

The controller of your personal data is:

AML Konverzija, Aleksander Malis s.p., trading as Lixum
3310 Žalec, Slovenia
Registration number: 8797153000 · VAT ID: SI33059977
Full registered address on request, and on file with AJPES
Email: info@lixum.agency

We are a small business and have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR. Privacy questions go to the address above and are answered by the owner.

2. Information you give us

  • Booking a call. Scheduling runs on Calendly, which collects your name, email and the details you enter when booking.
  • Forms and questionnaires. The contact and project questionnaires collect what you type into them, typically a name, an email address, a company and a description of what you are trying to solve.
  • Newsletter. If you subscribe, we store your email address until you unsubscribe. Every newsletter carries a one-click unsubscribe link.
  • Live chat. The chat bubble is Chatwoot, running on our own server at chat.lixum.agency. Messages you send there are stored so we can reply.
  • Client portals. If you are a client, your project portal holds the documents, answers and files exchanged during the engagement, reachable through a private link and access code.

3. What the site measures

We do not use Google Analytics or any third-party analytics product. Traffic is measured by a script we wrote, served from this domain, which records:

  • pages viewed, and how long a visit lasts
  • clicks, including the text of the element clicked
  • how far down a page you scroll, and mouse positions used to build aggregate heatmaps
  • the referring site and any UTM campaign parameters on the link you arrived through
  • the country your request came from, as reported by Cloudflare

Three things it deliberately does not do, because they are the difference between measuring traffic and identifying people:

  • It sets no cookie and writes nothing to your device.
  • It does not store your IP address. Your IP is used momentarily, in memory, to rate-limit the endpoint against abuse, and is never written to the database.
  • It ignores the email parameter that newsletter links carry in their query string. Recording it would have attached a direct identifier to otherwise anonymous events.

Because it stores nothing on your device and holds no identifier, this measurement does not rely on consent under Article 5(3) of the ePrivacy Directive. It runs on our legitimate interest in knowing whether the site works. You can still switch it off, and we honour three signals: Global Privacy Control, Do Not Track, and the decline button on the site’s own banner, which stops collection immediately and for future visits.

4. What is stored on your device

The site keeps a few small values in your browser’s local storage. None of them identify you and none are sent to advertisers:

  • lixum-theme: whether you chose light or dark
  • lixum_lang: your language preference
  • lixum-cookie-consent: whether you dismissed the banner
  • lixum-analytics-optout: set only if you decline measurement

Chatwoot sets its own storage so a chat conversation survives a page reload.

5. Why we are allowed to process it

  • Contract, or steps before one. Answering your enquiry, running a project, issuing invoices.
  • Consent. Newsletter subscription only, withdrawable at any time.
  • Legitimate interest. Understanding site usage, and keeping the site available and free of abuse.
  • Legal obligation. Invoices and accounting records, which Slovenian tax law requires us to keep.

6. Who else processes it

We do not sell your data and we do not share it for advertising. These providers process it on our behalf:

  • Hostinger: the server running this site, our chat and our automation, located in the EU.
  • Cloudflare: sits in front of the site for delivery and abuse protection, and tells us the country a request came from.
  • Google Firebase / Firestore: the database behind form submissions, portals and analytics events. Note this stores data in the United States, under the Data Privacy Framework agreed between the EU and the US.
  • Calendly: booking and scheduling.
  • Hostinger Email: sending and receiving mail.

No large language model processes anything you send through this website. The site’s AI assistant was removed in August 2026; where we use AI inside client projects, that is described in the agreement for that project.

7. How long we keep it

  • Analytics events: 90 days. A scheduled job deletes anything older, automatically.
  • Newsletter: until you unsubscribe.
  • Enquiries and chat: for as long as the conversation is live, and afterwards while a working relationship is plausible.
  • Client project data: for the engagement, and afterwards where we are required to keep it.
  • Invoices: as long as Slovenian accounting law requires.

8. Your rights

Under the GDPR you may ask us to:

  • give you a copy of the data we hold about you (access)
  • correct anything inaccurate (rectification)
  • delete it (erasure)
  • pause our use of it while a dispute is resolved (restriction)
  • hand it over in a portable format (portability)
  • stop processing based on legitimate interest (objection)
  • withdraw consent you previously gave, without affecting what came before

Write to info@lixum.agency and we will respond within one month. If you are not satisfied, you can complain to the Slovenian supervisory authority, the Information Commissioner (Informacijski pooblaščenec).

9. Security

Traffic is encrypted in transit with TLS. Our database and stored files are encrypted at rest by the provider. Administrative access is restricted to named accounts, client portals are reachable only with a private link and access code, and internal service calls are authenticated. We describe what we do rather than name a cipher, because the specific algorithm is the provider’s choice and can change without us knowing.

10. Changes

When the site changes what it collects, this page changes with it, and the date at the top moves. This revision reflects the removal of the site’s AI assistant and blog, and corrects a previous version that named hosting and AI providers we do not use.