Legal

Privacy policy

Effective date: 8 October 2026 · Version 2026-10-08.1

This notice explains how we handle personal data when you visit scalentra.com, contact Scalentra or request a demonstration. It covers this marketing website. Processing within the Scalentra product or on behalf of business customers is governed by the relevant service agreement, data processing agreement and product privacy information.

1. Who is responsible for your data?

Scalentra is operated by MarTech5, informacijske storitve, d.o.o.
Registered office: Erjavčeva ulica 13, 1234 Mengeš, Slovenia
Company registration number: 9411844000 · VAT ID: SI23694068
Registered in the Slovenian Business Register, registration authority: District Court of Ljubljana.
Contact: info@scalentra.com

The company identified above is the data controller for the activities described here. Send privacy questions or requests to exercise your rights to info@scalentra.com or our registered office. Include “Scalentra privacy request” in the email subject line or on the envelope.

2. What we collect and why

Website processing purposes and legal bases
Activity and data	Purpose and legal basis
Website operation and security: IP address, request path, time, browser information and technical errors.	Provide the website, detect abuse and investigate technical faults. The legal basis is our legitimate interest in maintaining a secure, functioning website under GDPR Article 6(1)(f). We limit access to the data and its use to these purposes.
Demo enquiries: name, email, optional phone number, meeting date and time, duration and any message you provide.	Respond to your enquiry and arrange a demo. The legal basis is Article 6(1)(b) for steps you request before entering a contract when you are the prospective contracting party, or Article 6(1)(f) for business enquiries made on behalf of an organisation and related correspondence.
Cookie choices: category selections, notice version, choice time and expiry time stored in your browser.	Remember and apply your choices and keep a record of consent. Article 6(1)(c) supports compliance with legal obligations relating to consent. Essential device storage allows us to apply the privacy settings you request.
Optional Google Analytics 4: browser and device information, page visits, online identifiers and successful demo request events.	Understand website traffic and campaign performance, based on your prior consent under Article 6(1)(a), ePrivacy rules and Article 225 of Slovenia’s ZEKom-2. Google advertising signals and advertising personalisation are disabled in this integration.
Optional Microsoft Clarity: interaction, scrolling and click information, device identifiers, heatmaps and masked session recordings.	Understand usability and improve the website, based on separate consent to experience analysis under Article 6(1)(a) and applicable rules for accessing information on your device. Page text and form areas are masked; Clarity advertising storage is disabled.
Optional HubSpot website tracking, LinkedIn Insight Tag and Meta Pixel: page visits, campaign and conversion information, device information and cookie identifiers.	Measure advertising and marketing activity and, when enabled in the provider’s account, build advertising audiences. This requires prior consent to marketing tracking under Article 6(1)(a) and applicable rules for accessing information on your device. LinkedIn and Meta may match this information with data about their own users.
Records required to meet legal obligations or establish, exercise or defend claims.	Article 6(1)(c) where retention is legally required; Article 6(1)(f) for proportionate handling of disputes and claims.

We receive enquiry data directly from you and technical or interaction data from your browser. Do not include passwords, payment information, health information or other sensitive personal data in a demo message. We do not need these details.

We need the required form fields to respond to your enquiry and arrange the demo. Your phone number and additional information are optional. You can browse the website and request a demo if you reject optional tracking. A demo request does not subscribe you to newsletters or other promotional emails.

3. Optional tracking and your choices

We load optional tracking scripts only after you accept their category and only when that integration is configured. Google Analytics uses basic consent mode: the Google tag does not load before analytics consent. We do not send Google advertising-consent signals as granted. Clarity has a separate experience-analysis choice; HubSpot website tracking and advertising tags use the marketing choice.

The site’s manually defined analytics and advertising conversion events do not include your email address, phone number, name or message. Demo confirmation details are kept temporarily in the current browser tab rather than added to the confirmation URL. Unsupported URL parameters are removed before optional tags load. Campaign links must use labels that do not identify individuals.

You can open at any time. Withdrawing consent stops future optional tracking and reloads the page to disable tags that have already loaded. We remove accessible tracking cookies on our own domain. Manage cookies on other domains through the provider’s settings or your browser. Withdrawal does not affect the lawfulness of processing carried out before you withdrew consent.

Our Cookie policy lists storage names, providers and retention periods. Optional integrations may remain inactive until configured; their inclusion here does not mean they load on every visit.

4. Who receives information?

Hosting: Vercel provides website hosting and request handling.
Demo correspondence: Microsoft 365 receives your contact and meeting details through Microsoft Graph to reserve the demo in our calendar, send your invitation and host the meeting in Teams. Our authorised team can access your booking.
Enquiry management: if the server-side HubSpot CRM integration is enabled, HubSpot receives your name, email address and optional phone number to manage your demo enquiry. This is separate from optional browser tracking and does not subscribe you to marketing emails.
Optional measurement: Google provides GA4 and Microsoft provides Clarity after you accept their respective categories.
Optional marketing: HubSpot provides website marketing tracking. LinkedIn Ireland Unlimited Company and Meta Platforms Ireland Limited provide advertising tags. Their affiliated companies may also process the data.
Technical diagnostics: if configured, Sentry receives limited information about server errors. Sentry session replay and browser monitoring are disabled on this website.
Other recipients: professional advisers or public authorities when needed to meet a legal obligation or pursue a proportionate legal claim.

Service providers act under the applicable contractual arrangements. Advertising providers can also process information for their own purposes under their privacy notices. In particular, website collection and disclosure through social advertising tools may involve joint-controller responsibilities under the provider’s applicable terms; that does not make us responsible for every subsequent use by that provider.

Provider information: Vercel, HubSpot, Google, Microsoft, LinkedIn, Meta and Sentry.

5. International transfers

These providers operate internationally. Personal data may be processed outside the European Economic Area, including in the United States, even when a regional hosting or account option is selected. Transfers must have an applicable GDPR Chapter V mechanism: an adequacy decision where applicable, or appropriate safeguards such as the European Commission’s Standard Contractual Clauses, with assessments and additional safeguards where necessary.

For US recipients, the EU–US Data Privacy Framework can be used only where the recipient has an active certification covering the relevant processing and the framework applies. Cookie consent does not replace these transfer safeguards. Contact us for details or a copy of relevant safeguards, subject to appropriate redactions.

6. How long we keep information

Demo enquiries: up to 12 months after the enquiry is closed or the last substantive interaction, unless a customer relationship, legal obligation or dispute requires a different documented period. This applies to copies in our mailbox and CRM.
Cookie choices: 180 days, after which the website asks you to choose again. A significant change in purposes or providers also requires a new choice.
Booking management: new invitations include a private management link valid for 120 days. Its access token is stored in the current browser tab’s session after booking or opening the link, so the demo calendar can show your appointment. Anyone with the link can view and change the booking, so keep it private. Available times are cached in the tab for 30 seconds. Optional tracking does not load on the management page.
Demo confirmation: details remain valid in the current tab for up to two hours. Expired entries are ignored and deleted when read. Session storage ends with the tab’s session.
Analytics and advertising: cookie retention periods are listed in the Cookie policy. Event data retention also depends on each provider and its account settings; cookie expiry does not delete events already collected. We use settings that minimise data collection and review retained data regularly. You can request details about active account settings.
Clarity recordings: Microsoft specifies 30-day retention for ordinary session recordings. Saved recordings and recordings marked as favourites may be retained for longer. We do not routinely save identifiable sessions as favourites or export them. Aggregated interaction data may have different retention periods.
Technical records: retention of hosting and diagnostic data depends on the provider and account plan. We keep incident or claim records only as long as needed for their purpose or a legal requirement.

7. Your rights

Subject to the conditions in the GDPR, you may request access, correction, erasure, restriction and data portability. You may object to processing based on legitimate interests because of your particular situation, and object at any time to direct marketing, including related profiling. You can withdraw consent at any time, as described above.

Send requests to info@scalentra.com. We may ask for proportionate information to verify your identity. We normally respond within one month. Complex or numerous requests may require up to two additional months; we will explain the reasons within the first month. Requests are normally free of charge.

You may complain to the Slovenian Information Commissioner (Informacijski pooblaščenec), www.ip-rs.si, email gp.ip@ip-rs.si, or to the supervisory authority in the EU/EEA country of your habitual residence, place of work or the alleged infringement.

8. Security, children and automated decisions

We use HTTPS, limit staff access and keep integration credentials on the server. No system is completely secure. Please notify us if you believe personal information has been exposed through the site.

This website promotes business services and is not directed at children. We do not knowingly solicit children’s personal data. Contact us if you believe a child has supplied information so we can investigate and take appropriate action.

We do not use website enquiry data to make decisions based solely on automated processing that produce legal or similarly significant effects. Optional advertising providers may use audience matching or profiling under their own notices and your consent settings.

9. Legal framework and changes

This notice is informed by the GDPR, the ePrivacy Directive, Slovenia’s ZEKom-2 and ZVOP-2. We update it when our processing changes and show the effective date above. Where a new processing purpose requires consent, we obtain it before enabling that purpose.