Privacy notice

Last updated: 30 September 2026

Draft for review. Researched and written by F Koncept on 28 September 2026; to be reviewed by Steady Rocket and their legal adviser before launch. Details in square brackets are to be supplied.

This website does not track you. It counts visits without cookies, has no advertising, and sets no cookies of its own. This notice explains the little it does collect, when you visit, write to us, book a call or apply for a role, and what you can ask of us.

Who is responsible

The controller of your personal data is Registered company name, registered address, Sarajevo, Bosnia and Herzegovina, trading as Steady Rocket. You can reach us about anything in this notice at hello@steadyrocket.agency. Our full company details are in the Legal notice.

We handle personal data under the Law on Personal Data Protection of Bosnia and Herzegovina (Službeni glasnik BiH 12/25). Where the EU General Data Protection Regulation or the UK GDPR applies to you, we meet it as well. We have not appointed a data protection officer, because the law does not require one for what we do.

When you visit the website

The website is hosted by Vercel. Like any web server, Vercel records each request: your IP address, the page you asked for, the time, and what your browser says about itself (its type and version, and your device's). We need these records to deliver the pages and to keep the site secure, which is our legitimate interest. Vercel keeps them for one day and then deletes them. We do not use them to identify you or to build a profile of you.

We count visits with Vercel Web Analytics and measure how fast pages load with Vercel Speed Insights, both part of the same hosting. They record the page, the page you came from, your country, and the type of your device, operating system and browser, and, for speed, how long the page took to load and the kind of connection you had. They set no cookies and store nothing in your browser: a visit is recognised by a one-way hash of the request, which Vercel discards after 24 hours, so the counts cannot be tied to you. We see only totals, which tell us which pages people read and whether the site is fast enough, our legitimate interest.

The fonts, images and scripts all come from our own server. Opening a page sends nothing to Google, to social networks, or to any other third party.

When you email us

If you write to us, we receive your name, your email address and whatever you include in your message. We use them to answer you and, if you want to work with us, to prepare and agree that work. Our legal basis is our legitimate interest in replying to people who contact us about our services or, if you contact us on your own behalf, the steps you have asked us to take before a contract.

Our email is provided by Globalhost d.o.o., in Sarajevo. If we do not go on to work together, we delete the conversation 12 months after the last message. If we do, we keep it while we work together, and afterwards for as long as the law requires us to keep business records.

Our emails show our logo, which your mail app loads from this website: the request is recorded like a visit to a page, as described above. It is the same picture for everyone, so it does not track who opens an email.

When you book a call

Calls are booked through Cal.com, a scheduling service that handles bookings for us, as our processor. When you book, you give Cal.com your name, your email address, your company or website, the service you are asking about, the time you choose, your time zone and anything you add as a note. Cal.com emails you a confirmation and a calendar invitation, and the booking is added to our calendar, which is provided by calendar provider.

We use this to hold the call and prepare for it, on the same basis as an email: our legitimate interest in talking to people who ask to talk to us, or the steps you have asked us to take before a contract. We keep bookings for 12 months after the call unless we go on to work together.

The calendar on our Contact page loads only when you choose to open it. What Cal.com then stores in your browser is set out under Cookies and your browser, below.

When you apply for a role

Applications come to their own address, careers@steadyrocket.agency. When you apply, you send us your CV, examples of your work, your contact details and anything else you choose to include. We use them to consider you for the role and to contact you about it. Our legal basis is the steps you have asked us to take before a possible employment contract.

If you apply for a specific role, we keep your application until 6 months after the role is filled and then delete it, unless you ask us to keep it for future roles.

If you send an open application, or ask us to keep your details, we keep them among our candidates for future roles, with your consent, for up to 2 years from our last contact. You can ask us to delete them at any time, and we will.

Please do not send sensitive information we have not asked for, such as details of your health, religion or political opinions.

Cookies and your browser

Our website sets no cookies and stores nothing in your browser.

The one exception is the booking calendar, which is Cal.com's and loads only when you ask for it. Once it loads, Cal.com sets the cookies it needs to take a booking securely: a bot-protection cookie from its network provider, Cloudflare, which lasts 30 minutes, and sign-in security cookies that last until you close your browser. It also keeps a few settings in your browser, such as whether you prefer a 12 or 24-hour clock, and sends performance measurements to its error-monitoring service, Sentry. We do not control these, and Cal.com's privacy policy describes them. If you would rather not open the calendar, email us and we will find a time.

Data outside Bosnia and Herzegovina

Vercel and Cal.com are based in the United States, so your data may be processed there, and wherever their own providers operate.

Vercel is certified under the EU-U.S. Data Privacy Framework and its UK Extension, which the European Commission has found to protect personal data adequately; the Law on Personal Data Protection of Bosnia and Herzegovina accepts such a finding (Article 47). Cal.com is not certified, and protects transfers with the European Commission's standard contractual clauses. Whether the Council of Ministers of Bosnia and Herzegovina has made its own adequacy decision for the United States, which Article 15 of the Law asks us to state: to be confirmed by our legal adviser.

How long we keep it

Request records: One day, kept and then deleted by Vercel
Visit counts: Totals only, with nothing that identifies you, for up to 12 months
Emails that do not lead to work: 12 months after the last message
Bookings: 12 months after the call
Applications for a specific role: 6 months after the role is filled
Open applications, and candidates who ask us to keep their details: Up to 2 years from our last contact, or until you ask us to delete them
Correspondence with clients: While we work together, then as long as the law requires us to keep business records

Your rights

You can ask us:

for a copy of the personal data we hold about you;
to correct it if it is wrong;
to delete it;
to limit what we do with it while a question about it is settled;
to give it to you, or to another organisation, in a common format;
to stop using it where we rely on our legitimate interest;
and, where we rely on your consent, to withdraw it at any time, which does not affect what we did before.

Write to us at hello@steadyrocket.agency. We answer within 30 days. If a request is complex we may need up to 60 days more, and we tell you why within the first 30. We may ask you to confirm who you are before we act on a request.

Complaints

If you think we have handled your data wrongly, please tell us first: we acknowledge a complaint within 30 days and try to put it right. You also have the right to complain to a supervisory authority at any time:

In Bosnia and Herzegovina: Personal Data Protection Agency in Bosnia and Herzegovina (Agencija za zaštitu ličnih podataka u BiH), Dubrovačka 6, 71000 Sarajevo, azlpinfo@azlp.ba, www.azlp.ba
In the European Union: The data protection authority in the country where you live or work, or where you believe the problem happened. The European Data Protection Board lists them all at edpb.europa.eu.
In the United Kingdom: The Information Commission, which replaces the Information Commissioner's Office on 30 September 2026, at ico.org.uk.

You can also take the matter to court.

Security, children and changes

We protect personal data with access controls and encrypted connections, and give access only to the people who need it for their work.

This website is for businesses. It is not directed at children under 16, and we do not knowingly collect their data.

We update this notice when what we do with personal data changes. The date at the top of the page shows when it last changed.