Privacy Policy

This policy explains what CartWhy (“we”) collects on cartwhy.com, why, and what you can ask us to do with it.

CartWhy is operated by Vojislav Savičić PR W3UP, Loznica, Serbia, which is responsible for your data (the data controller). Registered with the Serbian Business Registers Agency (APR). Registration number: 67470931. Tax ID (PIB): 114302768. Contact: hello@cartwhy.com.

What we collect

• Inquiry form: your name, email, store URL, the service you’re asking about, your store’s annual revenue range if you give it, what worries you (on the audit forms), and your message.
• Emails you send us: the content of the email and your address.
• Spam check: Cloudflare Turnstile checks that the form is sent by a person. It may process your IP address and browser data for that purpose.
• Analytics and ads, only with your consent: see Cookies below.
• Server logs: our hosting (Cloudflare) keeps standard request logs, such as IP address and pages requested, for security and troubleshooting.

Why we use it

• To answer your inquiry and do the work you order. Legal basis: the steps you ask for before a contract, and the contract itself.
• To keep the site secure and free of spam. Legal basis: our legitimate interest in a site that works and is not abused.
• To keep invoices and client records. Legal basis: tax and accounting law.
• To see how the site is used and whether our ads work. Legal basis: your consent.

The required fields in the form are needed to answer you; without them we can’t reply. We do not sell your data, and we make no automated decisions about you.

Cookies

Nothing is measured until you choose. The banner lets you accept, reject, or choose each kind separately:

• Analytics: Google Analytics 4 shows us which pages are visited and how people move through the site.
• Ads: Microsoft Advertising (Bing UET) measures whether our ads bring visits and inquiries, and may show our ads to people who visited the site.
• Always on: one cookie that remembers your choice for 6 months, and the cookie Cloudflare Zaraz uses to apply it.

Both tools run through Cloudflare Zaraz. If your browser sends a Global Privacy Control signal, ad cookies stay off. You can change your choice at any time with “Cookie settings” at the bottom of every page.

Who processes it for us

• Cloudflare: hosting, Turnstile and Zaraz.
• Resend: sends the inquiry form to our inbox.
• Namecheap Private Email: our email inbox.
• Google and Microsoft: analytics and ad measurement, only if you consent.

Some of these providers are based in the United States. We use providers certified under the EU–U.S. Data Privacy Framework, which Serbian law accepts for countries the EU has found to protect data adequately. Where a provider is not certified, we rely on the other grounds Serbian law allows, such as a transfer needed to answer your inquiry or to carry out our work for you. Write to us if you want details.

Your store during an audit

Audits review the public part of your store, the way any shopper sees it. We do not log in, place orders or collect your customers’ data. For fixes you give us collaborator access, which you can remove at any time and which we ask you to remove when the work ends.

How long we keep it

• Inquiries that do not become a project: deleted within 12 months.
• Client records and invoices: as long as the work and tax and accounting law require.
• Analytics data: no longer than 14 months.

Your rights

You can ask us to:

• show you the data we hold about you and give you a copy;
• correct it or delete it;
• limit how we use it, or stop using it where we rely on our legitimate interest;
• give you the data you gave us in a common, machine-readable format, or send it to another provider.

Write to hello@cartwhy.com. We reply within 30 days. You can withdraw your cookie consent at any time with “Cookie settings”; this does not affect what was measured before.

If you think we handle your data unlawfully, you can complain to the Serbian data protection authority, the Commissioner for Information of Public Importance and Personal Data Protection. If you live in the EU or the UK, you can also complain to the data protection authority in your country.

Changes

If we change this policy, we update the date at the top of this page.