Last updated: 14 August 2026
1. Who is responsible for your data
The controller for personal data processed through the website ballastprotocol.com and in connection with the process-documentation services we provide is BEAVELA, obrt za informatičke usluge, vl. Beata Parun.
2. What this policy covers
This policy explains what personal data we process, why, where it is processed, how long it is kept, and what rights you have. It covers two situations: visiting the website, and working with us as a customer of our services.
3. Website visitors
Contact form. If you send us a message through the contact form, we process the details you enter (such as your name, email address, and message) to answer your inquiry. The form submission is delivered to our inbox by the form provider Web3Forms. Legal basis: taking steps at your request before entering into a contract, and our legitimate interest in answering inquiries.
Recording Guide requests. If you leave your email address to receive the Recording Guide, we process it to send you the guide and to answer any direct questions you send us. If you also tick the optional news checkbox, we use your address to send you occasional news about our products and services. The checkbox is not pre-ticked, and leaving it unticked has no effect on receiving the guide. Legal basis for the news emails: your consent, which you can withdraw at any time by using the unsubscribe option in any such email or by writing to info@ballastprotocol.com.
Analytics. We use Google Analytics 4 only if you accept analytics cookies in the consent banner. Before you accept, no analytics cookies are set and no analytics data is collected. You can withdraw your consent at any time through the cookie settings in the banner.
Hosting and server logs. The website is hosted in the European Union. Standard server logs (such as IP address, time of access, and the page requested) are processed for the security and operation of the website. Legal basis: our legitimate interest in running the website securely.
4. Customers of our services
When you engage us, we process the following categories of data:
- Contact and engagement data: the names, email addresses, and business details of the people we correspond with, and the correspondence itself, to prepare and perform the engagement.
- Billing data: the details needed to issue and account for invoices. We do not store payment card numbers.
- Content you provide and content produced from it: recordings, screenshots, plain-text supporting files, and system export files you provide, together with the transcripts, draft documents, and question lists produced during the work, and the answers and corrections you give during review.
- Processing records: technical records of the work performed (such as timestamps and processing logs) needed to operate, account for, and invoice the engagement.
Legal bases: performance of the contract with you (providing the services and invoicing); compliance with legal obligations (in particular accounting and tax rules); and our legitimate interests in keeping our systems secure and preventing abuse.
5. Where processing happens
Your material is received by email or by a transfer method agreed for the engagement, and is stored and processed on our own systems in the European Union. Audio transcription is performed through AssemblyAI’s EU endpoint; the transcript copy held at AssemblyAI is deleted after our system stores it, and a failed deletion attempt is retried. AI text generation runs on Anthropic’s US-based API under its data processing agreement and the EU standard contractual clauses, while storage remains in the EU. Where any other provider processes data outside the European Economic Area, the transfer is safeguarded by the EU standard contractual clauses or an applicable adequacy decision.
6. Service providers (subprocessors)
We use the following providers to run the website and deliver our services:
- AssemblyAI — audio transcription (EU endpoint)
- Anthropic — AI document generation (US; DPA and standard contractual clauses)
- Proton — business email (correspondence and receipt of customer material)
- Hostinger — website hosting (EU)
- Web3Forms — website form delivery
7. How long data is kept, and deletion
Your content is kept until you ask us to delete it. On request we delete per process or everything we hold for you, and we confirm the deletion in writing. Deletion cannot be undone.
What remains after deletion: only the accounting records we are legally required to keep (invoices and the data on them). We do not perform any time-based purge beyond this: data stays until you ask for deletion. Deletion requests go to info@ballastprotocol.com.
8. Prepared material and special categories of data
Before we process your material, customers confirm that it has been prepared for processing, including masking of: names of people; personal identifiers such as email addresses, phone numbers, and staff or customer numbers; bank and payment details; and visible or spoken login credentials. Special categories of personal data (such as data concerning health, religion, ethnicity, trade-union membership, political opinions, or sexual orientation) may not be processed at all and must not be provided to us.
9. Cookies
On the website, strictly necessary cookies are used for the site to function, and analytics cookies (Google Analytics 4) are set only after you accept them in the consent banner; you can change your choice at any time in the banner settings.
10. Your rights
You have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable format. Where processing is based on consent (such as analytics cookies or news emails), you can withdraw consent at any time. To exercise any of these rights, write to info@ballastprotocol.com. You also have the right to lodge a complaint with the Croatian supervisory authority: Agencija za zaštitu osobnih podataka (AZOP), Zagreb, azop.hr.
11. Security
Data is transmitted over encrypted connections, and access to personal data is limited to what providing the services requires.
12. Children
Our website and services are intended for business use and are not directed at persons under 18.
13. Changes to this policy
We may update this policy. The current version is always published on this page, with the date of the last update shown at the top.
14. Contact
Questions about this policy or your data: info@ballastprotocol.com.
BEAVELA, obrt za informatičke usluge, vl. Beata Parun
Ulica Grada Chicaga 33, Zagreb, Republic of Croatia
OIB: 90296650690 · Matični broj obrta (MBO): 99336375
Email: info@ballastprotocol.com