Privacy Policy

This site is operated by Damjan Marković PR Orange Banana, a sole proprietorship registered in Belgrade, Serbia, tax ID (PIB) 114838659, registered with the Serbian Business Registers Agency under decision BP 7474/2025 of 22 January 2025. In this policy, "we" and "us" mean that business, and "Orange Banana" is the name we trade under.

We are the data controller for everything described here. That means you gave it to us directly and we decide what happens to it. We do not act as a processor for anyone else's data, and we do not handle personal data on behalf of our clients as part of what we sell.

We are established in Serbia, so we are subject to the Serbian Law on Personal Data Protection. Where you are in the European Economic Area or the United Kingdom, the GDPR applies to us as well. Where you are in California, the CCPA and CPRA apply. You can reach us at damjan@orangebanana.co and we will give you our full registered address on request.

What you give us. The contact form on this site asks for three things: your name, your work email address, and the type of firm you work for. If you write to us directly instead, we hold whatever you chose to put in that message.

What is collected automatically. Our hosting provider keeps standard server logs, which include IP addresses, browser type, and which pages were requested. Those exist to keep the site running and to spot abuse.

Spam protection. The contact form is protected by Google reCAPTCHA, which loads only on the contact page. To tell a person from a bot it collects information about your device and how you interact with the page, such as your IP address, browser details, and mouse and keyboard activity, and sends it to Google.

Analytics. Google Analytics, and only if you accept it. Section 8 covers this and how to change your mind later.

What we do not collect. The messaging audit runs entirely inside your browser. Your answers and your score are never sent to us, never stored, and never visible to us. We do not run a live chat, we do not accept job applications through this site, and we do not run surveys.

We use what you give us to reply to you, to arrange and hold a conversation, and to send you whatever we said we would send. The legal basis is our legitimate interest in answering a business enquiry that you started, and, if work follows, performance of a contract.

reCAPTCHA runs on the basis of our legitimate interest in keeping the contact form free of spam and automated abuse.

Analytics run on the basis of your consent, which you give through the cookie banner and can withdraw at any time.

We do not sell personal information and we do not share it for cross-context behavioural advertising. Getting in touch does not put you on a mailing list. If we ever want to send you something you did not ask for, we will ask first.

A small number of service providers process data on our behalf and only on our instructions. At the time of writing, that means our website host and form handling provider, Google reCAPTCHA on the contact form, our email provider, and, where you have consented, Google Analytics. Some of them are based outside your country, which means data reaches servers elsewhere, including in the United States.

reCAPTCHA is subject to Google's Privacy Policy and Terms of Service.

We put contractual arrangements in place with each of them, and we do not pass your details to anyone else. We may disclose information where we are legally required to, and we will do so no more widely than the law requires.

We operate from Serbia and several of our providers are based in the United States, so your information may be transferred and stored outside your own country. Where that involves a transfer out of the EEA or the UK, we rely on the safeguards available under data protection law, including standard contractual clauses where they apply.

Enquiries that do not lead to work are kept for up to twenty four months, so that we recognise you if you come back, and then deleted. Records relating to work we actually do are kept for as long as the engagement needs and for the period our accounting and tax obligations require.

You can ask us to delete your details sooner, and we will, unless we are required to keep them.

This site is served over an encrypted connection. Access to enquiries is limited to the people who need it, which at present is a very short list. We use established providers for hosting, forms, and email rather than building our own.

We are not going to claim more than that. We hold no security certification, and no set of measures makes any system perfectly secure. What we can say is that we keep the amount of data we hold deliberately small, which is the most effective protection available to a practice this size.

This site uses a small number of cookies. Some are strictly necessary to make it work, to remember your cookie choice, and, on the contact page only, to let reCAPTCHA protect the form. The rest are Google Analytics cookies, and they are only set if you accept them.

You accept or decline non-essential cookies when you first arrive, and you can change that decision at any time from the Cookie Policy page, which is linked in the footer of every page. Declining limits nothing on this site.

The site also loads its typeface from Google Fonts so that it displays correctly. If you would rather avoid that, most browsers let you block third party requests.

Every cookie we set is listed by name, with what it does and how long it lasts, in the Cookie Policy.

Our articles link out to the sources behind the figures we quote, and the footer links to our LinkedIn page. We do not control those sites, we are not responsible for their content or their privacy practices, and a link is not an endorsement. Read their policies if you go there.

If you arrived here from somebody else's site, the same applies in reverse. We have no say in how they handle your data.

You can ask us to tell you what we hold about you and why, give you a copy of it, correct anything inaccurate, delete it, restrict what we do with it while a question is being resolved, or object to us using it at all. Where we rely on your consent, you can withdraw it at any time and we will stop.

If you are in California, you also have the right to know what has been collected and for what purpose, to request deletion or correction, and to opt out of any sale or sharing of your information. We do not sell or share personal information as those terms are defined by the CCPA and CPRA, and we will not treat you differently for exercising any right.

To use any of these, write to damjan@orangebanana.co and we will check that the request is really coming from you, and then respond within thirty days. If we need longer because the request is complex, we will tell you why before that period is up.

If you think we have handled your data badly, tell us first, because most things are quicker to fix directly. If that does not resolve it, you have the right to complain to a supervisory authority.

In Serbia that is the Commissioner for Information of Public Importance and Personal Data Protection, at poverenik.rs. If you are in the EEA or the UK, you may also complain to the supervisory authority where you live or work.

This site is aimed at people acting in a professional capacity and is not directed at anyone under sixteen. We do not knowingly collect information from children. If you believe a child has sent us something, tell us and we will delete it.

We will update this page when what we do changes, and the date at the top tells you when it was last revised. If a change is significant we will say so on the page rather than quietly amend it.

Write to damjan@orangebanana.co with any question about this policy or about anything we hold. If you need to reach us by post, ask and we will give you the registered address.