This data protection notice explains how Verdera agency collects and uses personal data when you visit our website, order services, contact us or subscribe to our newsletter. It also covers processing in Verdera Marketing Suite, retention periods and your rights.
Controller and scope
The controller is VERDERA, marketinške in digitalne storitve, Patricia Jarmek s.p., Rakuševa ulica 8, 1000 Ljubljana, Slovenia. info@verdera.agency. This data protection notice covers the website, orders, communications, newsletter and processing for Verdera agency's own purposes in Verdera Marketing Suite. Processing on behalf of business customers is governed by a data processing agreement.
Data, purposes and legal bases
Identification, contact, business and communication data support enquiries, contracts and assistance on a contractual or pre-contractual basis. Business representative communications also rely on legitimate interests.
Order, payment and address data support invoices and statutory records under legal obligations. Necessary technical data supports security and abuse prevention under legitimate interests.
Newsletter email address and selected language are processed on separate consent. Optional analytics and advertising require consent where applicable.
Providers and recipients
Domenca (Webtasy, d.o.o.) provides website and business email hosting as processor for the contracted service.
MailerLite Limited, 88 Harcourt Street, Dublin 2, D02 DK18, Ireland, processes the subscriber list and sends newsletters on our behalf. We use email address, selected language and email signup confirmation.
We track newsletter opens and link clicks to measure interest and adapt content. Technical event and time information is linked to subscribers. Tracking is covered by newsletter consent and appropriate information before signup.
Inactive subscribers are retained for at most two years after the last reliably established activity. Unsubscribing stops sending immediately. A minimal suppression record may prevent renewed mailing.
WooCommerce supports orders. Stripe is intended for payments and subscriptions and Wise for bank transfers. We handle invoices ourselves. Domenca processing, MailerLite privacy.
Verdera Marketing Suite and integrations
The VMS application and database are hosted on Lovable Cloud. AI functions use Lovable AI Gateway, receiving the user question and necessary project summaries (name, domain, audit results) to generate a response. According to the application description, files, passwords and payment details are not sent. The model and provider depend on the feature and configuration and may change. OpenAI is not necessarily the only provider. The project database is in the Europe (Ireland) region. This does not mean all AI processing takes place in the EU.
DataForSEO receives keywords, market and the monitored domain for SEO data. Google Search Console and Google Analytics 4 import authorised data. Permissions can be revoked. Integrations can involve account identifiers and technical requests, so we do not claim that no data is sent to Google. The application receives subscription status. According to its description it does not send project data to WooCommerce/Stripe. Domains, questions and audits can contain personal data. Avoid unnecessary personal or sensitive data.
Lovable Cloud is provided by Lovable Labs Incorporated, 1 Lincoln St, Boston, MA 02111, USA. The project database is in Europe (Ireland). Lovable AI Gateway uses model providers depending on the feature and configuration. AI processing may take place outside the EEA. Lovable states that it does not use app users’ data to train its models.
Model providers may retain requests and responses under the relevant service rules. Extended-retention models retain them for at least 30 days, with longer security or legal exceptions. Deleting a VMS project does not immediately delete every provider record.
Provider and international transfer safeguards information, including applicable standard contractual clauses, is available at https://trust.lovable.dev/subprocessors and https://lovable.dev/privacy. You may request a copy of applicable safeguards from us at info@verdera.agency.
Verdera agency’s technical log and backup periods apply to systems and copies under its management. Separate provider records follow their documented periods and legal obligations.
Retention and transfers
Enquiries that do not lead to a contract are retained for at most 12 months after the last communication. Unpaid, failed and cancelled unpaid orders are retained for at most 90 days after their final status. Ordinary technical logs and rotating backups are retained for at most 30 days, except isolated records needed to investigate a specific incident or statutory logs with a different mandatory period. Data deleted from the active system may remain in restricted backups until their cycle expires. Previous deletions are reapplied after restoration. Invoices are retained for ten years after the end of the year to which they relate, or longer where required by law.
VMS project data is deleted within 30 days after access expires, subject to controller instructions and legal exceptions. Earlier deletion may be requested. Longer retention requires a separate documented agreement with purpose and duration. Invoices and statutory records are retained separately. Inactive newsletter subscribers are removed within two years. Unsubscribing stops mailing immediately. Other data is retained only as required for its purpose, law or specific legal claims.
We retain agency project working materials for no more than 12 months after delivery or completion. Inactive website accounts without an active contract are deleted after 24 months of inactivity. Unconfirmed newsletter registrations are removed after 30 days. Consent evidence is retained for two years after unsubscribing, and longer only to the extent necessary for a specific dispute or legal obligation.
Necessary contractual evidence is retained according to the applicable periods for bringing claims, with a review of necessity at least annually. This does not mean retaining all project materials.
Rights and provision of data
Subject to GDPR conditions, you have rights of access, rectification, erasure, restriction, portability and objection. Consent can be withdrawn without affecting prior lawful processing. Newsletters include unsubscribe options. Contact info@verdera.agency. You may complain to the Slovenian Information Commissioner or another competent authority. Contractually or legally necessary data is required for purchase or performance. Selecting interests is voluntary.
Handling requests
We respond without undue delay and within one month. Complexity or the number of requests may justify up to two additional months. We explain the extension within the first month. Where identity is reasonably in doubt, we may request necessary verification information.
Ljubljana, 1 October 2026.
