Privacy notice
How we handle information when you visit our website, discuss a project or apply to work with us.
Last updated: 2 October 2026
1. Who we are and how to contact us
This notice covers dexcode.eu, enquiries about Dexcode’s services and applications for roles at Dexcode. Dexcode is a founder-led software studio based in Zagreb, Croatia.
Location: Zagreb, Croatia.
For questions about personal data or to exercise your rights, email hello@dexcode.eu. Please explain your request and how you have interacted with us so we can locate the relevant information.
2. Information we receive
When you use the contact form, we receive your name, company, work email, selected service and project message. A budget is optional. We also receive the information you include in emails and subsequent correspondence.
When you apply for a role by emailing careers@dexcode.eu, we receive your email address, CV or profile link, introduction, project examples, location, availability and any other information you choose to provide. If you send a professional profile or portfolio link, we may review the relevant information at that link when considering your application.
When you browse the website, our hosting and security providers process technical information such as IP addresses, requested URLs, timestamps, browser and device information, and security or error events. Turnstile also processes browser and connection signals to distinguish legitimate visitors from bots.
Please send only information relevant to your enquiry or application. The website does not ask for identity documents, financial account details or sensitive personal information. Without sufficient contact or application details, we may be unable to respond or assess your request.
3. Why we use personal data
We use enquiry details to understand your request, reply, arrange conversations and prepare proposals. Where you ask about entering a contract with us personally, this is processing needed to take steps at your request before a contract. For business representatives and general enquiries, our legitimate interest is communicating about and providing our services.
We use job-application information to consider you for the role and communicate about recruitment. The basis is taking steps at your request before a possible employment or services contract, and our legitimate interest in assessing relevant experience and managing recruitment.
We use technical information to deliver the website, prevent spam and abuse, and investigate faults. Our legitimate interest is operating a reliable and secure website. Where necessary, we also keep information to meet legal obligations or establish, exercise or defend legal claims.
Sending an enquiry or application does not subscribe you to marketing emails. The website has no automated applicant scoring or automated hiring decision feature.
4. Services involved in handling your data
The founders handle enquiries and applications through our business email. Service providers also process information needed to operate the website and deliver communications:
- Vercel hosts the website and runs the contact-form endpoint. Requests and operational or security information pass through its infrastructure.
- Sentry helps us detect website errors, failed enquiry submissions and email delivery failures. We configure monitoring to exclude enquiry contents, request bodies, cookies and user identity fields. Error reports can contain technical details such as page paths, stack traces and delivery identifiers. Session replay and product analytics are not enabled.
- Resend delivers website enquiries to our business inbox. It receives the form contents and sender/reply information. The contact form does not save enquiries in a separate website database.
- Google Workspace receives and stores business emails, including enquiries, application attachments and our replies. Messages sent to hello@dexcode.eu are routed to the founders.
- Cloudflare Turnstile protects the contact form. Cloudflare processes technical signals for verification and also processes signals as a controller to improve its bot detection, as explained in its Turnstile Privacy Addendum.
- The website uses Satoshi fonts from Fontshare, hosted with our website. Loading these fonts does not connect your browser to Fontshare.
5. International processing
Some providers operate internationally, so information may be processed outside Croatia and the European Economic Area. Selecting a European hosting or sending region does not by itself mean that all provider processing stays in Europe.
Transfers requiring safeguards under data-protection law must be covered by an applicable adequacy decision or appropriate safeguards, such as the European Commission’s Standard Contractual Clauses. You can contact us for information about the safeguards applicable to your data.
6. How long information is kept
Enquiries that do not lead to a contract are kept for up to 12 months after the last meaningful contact. Unsuccessful job applications are kept for up to 6 months after the hiring decision is communicated.
If an enquiry becomes a client relationship or an applicant joins us, relevant information moves into the separate client, contractor or employment record. Legal obligations and specific disputes may require selected records to be kept longer; this does not justify retaining every enquiry or application indefinitely. We would ask separately before keeping an application for future vacancies beyond the normal period.
The relevant records can exist in email inboxes, attachments, provider delivery logs and backups. Deleting a website delivery log does not delete the email in Google Workspace. Provider retention also depends on the service and account configuration.
You can ask about the retention of a particular enquiry or application, or request deletion, by emailing hello@dexcode.eu. Deletion rights can be limited where records must be retained for legal obligations or claims.
8. Your rights
Subject to the conditions in applicable data-protection law, you can request access to your personal data, correction, deletion, restriction of processing and a portable copy of eligible data. You may object to processing based on legitimate interests. If processing relies on consent, you may withdraw it without affecting earlier lawful processing.
Send requests to hello@dexcode.eu. We may need proportionate information to verify your identity. We normally respond within one month; where a lawful extension is needed, we will explain it.
You may complain to a supervisory authority, including the Croatian Personal Data Protection Agency (AZOP), or the authority where you live or work or where an alleged infringement occurred. You do not have to contact us first.
9. Updates to this notice
We will update this page when our website, services or data-handling arrangements change. The date at the top identifies the latest revision.