Privacy Policy

Effective: 11 October 2026

1. Who is responsible for your data

sourc:co is a brand of LEDGE DIGITAL d.o.o., the controller of the personal data described in this policy (Art. 4(7) GDPR):

Company: LEDGE DIGITAL d.o.o. (LEDGE DIGITAL društvo s ograničenom odgovornošću za informatičke usluge)
Registered office: Ulica Grabrovec 105, 49210 Zabok, Croatia
OIB: 66163174830
VAT ID: HR66163174830
Register: Commercial Court in Zagreb, MBS 06068294
Share capital: 2.500,00 EUR, paid in full
Managing director: Marko Lihter
Bank account: Erste&Steiermärkische Bank d.d., IBAN HR41 2402 0061 1012 6754 7
Email: marko@sourc.co
Web: sourc.co

For anything related to your data, write to marko@sourc.co. We are not required to appoint a data protection officer, so Marko Lihter, managing director, handles these requests himself.

2. What we process, why, and on what legal basis

We only collect what we need for the purposes below. We don't sell personal data or make automated decisions about you. The only profiling is ad retargeting by Google, and only if you allow it.

Situation	Data	Purpose and legal basis (GDPR)
Visiting the website	IP address, browser and device details, requested page, time, referrer	Delivering the site and protecting it from abuse: legitimate interest, Art. 6(1)(f). Processed by Cloudflare, our hosting provider; we don't keep our own access logs.
Showing the right language	Country of your internet connection (from your IP address, passed on by Cloudflare) and the lang cookie if you used the EN/HR switch	Showing visitors from Croatia the Croatian site and keeping the language you picked: legitimate interest, Art. 6(1)(f). Worked out on each request and not stored.
Loading Google Tag Manager (every page)	IP address and browser details in Google's request logs (deleted within 14 days); no cookies	Running our measurement tools only as far as your cookie choice allows: legitimate interest, Art. 6(1)(f). Details in the Cookie Policy.
Analytics (only if you allow it)	Page viewed, scroll depth (25, 50, 75, 90%), referrer and campaign, browser, device type, approximate location (from IP), page-load timings, whether you sent a contact or quote form (the "I am" type you picked and the page it was sent from) and whether you requested the sourcing guide, never what you entered in a form; Google Analytics also sets the cookies _ga and _ga_<ID>	Visit statistics via Cloudflare Web Analytics (cookie-free) and Google Analytics 4 (IP addresses not stored by Google): your consent, Art. 6(1)(a) GDPR and Art. 43(4) of the Croatian Electronic Communications Act (ZEK). Details in the Cookie Policy.
Ad measurement (only if you allow it)	The Google Ads click ID (gclid), the _gcl_au cookie and whether the visit ended in an inquiry	Counting which of our Google ads lead to inquiries: your consent, Art. 6(1)(a) GDPR and Art. 43(4) ZEK.
Personalised ads / retargeting (only if you allow it)	Pages you visited on our site, Google cookies (e.g. IDE), Google signals if you're signed in to Google	Showing our ads to past visitors on Google, YouTube and partner sites: your consent, Art. 6(1)(a) GDPR and Art. 43(4) ZEK. Google is an independent controller for its ad network.
Contact form, email or WhatsApp inquiry	Name, email, WhatsApp number (optional), your message and any files you send, site language	Answering your inquiry and preparing an offer: steps before a contract, Art. 6(1)(b); for general questions, our legitimate interest in replying, Art. 6(1)(f).
Requesting the China sourcing guide	Email, which form you used, language, time and number of requests	Emailing you the guide: Art. 6(1)(b). Occasional sourcing emails afterwards: your consent, which you give by submitting the form (as stated next to it), Art. 6(1)(a).
Newsletter signup	Email, confirmation that you agreed, signup time	Sending the newsletter: your consent, Art. 6(1)(a).
Unsubscribing	Email address	Keeping a suppression list so we never email you again: legitimate interest and compliance with your objection, Art. 6(1)(f) and Art. 21(3).
Working with us (clients, suppliers, partners)	Names and business contact details of contact persons, correspondence, specifications, orders, invoices, payment details	Performing the contract, Art. 6(1)(b); accounting and tax obligations, Art. 6(1)(c); establishing or defending legal claims, Art. 6(1)(f).

You don't have to give us any data. Without an email address we can't reply to you or send the guide, and without the details needed for an order we can't work together.

3. Who we share data with

We use these service providers (processors) under data processing agreements (Art. 28 GDPR):

Cloudflare, Inc. (USA): hosting, content delivery, security, form storage (Workers KV) and Web Analytics.
Plus Five Five, Inc. (Resend) (USA): sending emails from the website (form notifications, the guide email).
Google Cloud EMEA Limited (Ireland), Google Workspace: our email inboxes and documents.
Google Ireland Limited (Ireland): Google Tag Manager on every page (no cookies) and, only with your consent, Google Analytics, Google Ads conversion measurement and, if you allow it, retargeting.
Our external accounting service, only for data on invoices and payments.

Other recipients, only when needed:

Manufacturers, inspection companies, freight forwarders and customs brokers working on your order, many of them in China. First enquiries to factories go out without your name or company; later we share only what the order needs.
WhatsApp (WhatsApp Ireland Limited), if you choose to message us there. WhatsApp processes that data under its own privacy policy.
Banks, courts and public authorities, where the law requires it.

4. Transfers outside the EU

Cloudflare, Resend and Google may process data in the USA. Those transfers rely on the EU-U.S. Data Privacy Framework, for providers certified under it, and on the European Commission's Standard Contractual Clauses (Art. 45 and 46 GDPR).

Sharing order details with suppliers and logistics partners outside the EU (e.g. in China) is necessary to perform the contract you asked for (Art. 49(1)(b) and (c) GDPR). We keep what we share to the minimum.

5. How long we keep data

Inquiries that don't lead to a contract: deleted within 12 months of our last contact.
Guide requests and newsletter: until you unsubscribe or ask us to delete them. After that we keep only your address on the suppression list.
Email delivery logs at Resend: 30 days.
Invoices and accounting records: 11 years, as required by the Croatian Accounting Act.
Other contract correspondence: up to 5 years after the engagement ends, the general limitation period for claims.
Google Analytics statistics: event data is kept for 14 months, then Google deletes it.
Your cookie choice: stored only in your browser for 12 months (see the Cookie Policy).

6. Your rights

Under the GDPR you can ask us to:

give you a copy of your data (access, Art. 15);
correct it (Art. 16) or delete it (Art. 17);
restrict processing (Art. 18);
send it to you or another company in a machine-readable format (portability, Art. 20).

Right to object (Art. 21): you can object at any time to processing based on our legitimate interest, on grounds relating to your particular situation. You can object to marketing emails at any time, without giving a reason, using the unsubscribe link in every email or by writing to us.

Withdrawing consent: you can withdraw consent at any time, for analytics, ad measurement and personalised ads via "Cookie settings" in the footer and for emails via the unsubscribe link. Processing before the withdrawal stays lawful.

Write to marko@sourc.co. We reply within one month. For complex requests that can be extended by up to two more months, and we'll tell you if it is. We may ask you to confirm your identity.

Complaints: you can lodge a complaint with a supervisory authority. In Croatia that is the Croatian Personal Data Protection Agency (AZOP), Ulica Metela Ožegovića 16, 10000 Zagreb, azop@azop.hr, azop.hr. You can also contact the authority in the EU country where you live or work.

7. Security

The site is served only over HTTPS. Access to form data and inboxes is limited to the people who need it, and we choose providers with recognised security certifications. No system is perfectly secure. If a breach puts your rights at risk, we will notify AZOP and, where required, you (Art. 33–34 GDPR).

8. Children

Our services are for businesses. We don't knowingly collect data from anyone under 16.

9. Changes to this policy

We update this policy when our processing changes. The date at the top shows the current version. If the changes are significant and we have your email for an ongoing relationship, we'll tell you before they take effect. This policy applies to https://sourc.co.