Draft for legal review. Not yet in force.
The short version
- We collect only what we need to answer you, run this site and, if you ask, send you our newsletter.
- We do not sell your data. We do not use advertising trackers. We do not profile you.
- A few trusted providers (hosting, email, CRM, booking, newsletter) handle data for us. They are listed below.
- Some of those providers are outside the EU, the EEA and the UK. We use legal safeguards for that.
- You can ask to see, fix, delete or move your data at any time. Write to [email protected] (subject: Privacy).
- You can also complain to a data protection authority. Details are below.
Who is responsible for your data?
We are. In legal terms we are the “controller”. That means we decide why and how your data is used.
- Legal name: [Legal name]
- Address: [Registered address], Belgrade, Serbia
- Registration number (MB): [MB]
- Tax ID (PIB): [PIB]
- Email: [email protected] (subject: Privacy)
- Phone: [Phone]
We are a consulting company. We help businesses with consulting, standard operating procedures (SOPs), automation and software, and we are a Shopify Partner. Our clients are businesses in the EU, the UK and the US.
EU representative (GDPR Art. 27): [EU representative, if required — confirm with lawyer]
Which laws apply?
- The Serbian Law on Personal Data Protection (ZZPL, Official Gazette RS 87/2018), because we are based in Serbia.
- The EU GDPR, when we offer our services to people in the EU (Article 3(2)).
- The UK GDPR, when we offer our services to people in the UK.
What we collect, why we use it, and our legal reason
Every use of personal data needs a legal reason (a “legal basis”). This table shows ours.
| When | What we collect | Why we use it | Legal basis |
|---|---|---|---|
| You visit the website | Technical data: IP address, browser, device type, pages viewed, approximate country | To deliver the site, keep it secure and count visits in aggregate | Legitimate interest: running and securing our site |
| You send the free audit form | Name, work email, company website (optional), areas of interest, your message | To reply to you and prepare the audit | Steps you ask for before a contract; legitimate interest in answering business enquiries |
| You book a call | Name, email, chosen time and anything you type in the booking form | To schedule and hold the call | Steps you ask for before a contract; legitimate interest |
| You join the newsletter | Email address (and your name if you give it) | To send you our newsletter | Your consent |
| You email us | The email and your contact details | To talk with you | Legitimate interest; contract, if you are a client |
| We have legal duties | Invoices, contracts and related client records | To meet tax, accounting and legal rules | Legal obligation |
“Legitimate interest” means we have a good business reason, and we have checked that it does not override your rights. You can object to it (see “Your rights”).
We do not ask for sensitive personal data. Please do not put it in the free-text field.
Who else sees your data?
A few service providers (called “processors”) handle data for us. They work under written agreements and only on our instructions.
| Provider | What it does for us | Data involved |
|---|---|---|
| Cloudflare | Hosting (Cloudflare Pages), content delivery, security, Turnstile anti-spam on forms, cookieless Web Analytics | Technical data, IP address, form-protection signals |
| Resend | Delivers form submissions to us by email, and sends you a short confirmation. Resend keeps a copy of sent emails for [confirm Resend retention period] | Contents of the audit form |
| Zoho Mail | Our business email, where form submissions and your emails arrive | Audit form data, correspondence |
| HubSpot (CRM) | Only if we start working together: we may add your contact details and our correspondence to keep track of the project | Name, email, company, correspondence |
| Cal.com | Schedules calls. The booking calendar only loads after you click one of our “Book a call” buttons; then Cal.com’s own privacy policy applies. | Name, email, time slot |
| Google Workspace | Business email, calendar and documents | Email correspondence, files |
| Brevo | Sends the newsletter | Email address, subscription status |
We also share data when the law requires it, and with professional advisers (lawyers, accountants) who are bound by confidentiality.
We do not sell your data and we do not share it for advertising.
How long do we keep it?
| Data | How long |
|---|---|
| Audit form and booking enquiries | [24 months] after our last contact with you, unless you become a client |
| Client records | For the length of the contract, then as long as tax, accounting and limitation rules require |
| Newsletter subscription | Until you unsubscribe. After that we keep only a minimal record so we do not email you again. |
| Website technical logs | Kept by Cloudflare for the periods in its documentation [confirm] |
After that we delete the data or make it anonymous.
Does your data leave your country?
Yes, in some cases. We are based in Serbia, which is outside the EU/EEA and the UK. Several of our providers are in the United States or other countries.
When personal data goes outside the EU/EEA or the UK, we rely on legal safeguards. These are Standard Contractual Clauses, or the EU-US Data Privacy Framework where the provider is certified.
[confirm transfer mechanism per provider]
You can ask us for a copy of the safeguards at [email protected] (subject: Privacy).
Cookies
Our site uses no advertising or tracking cookies. Our analytics use no cookies and build no personal profiles. The site stores two small items in your browser so it works the way you expect. See our Cookies page for the full list.
Your rights
You have the right to:
- Access: get a copy of the personal data we hold about you.
- Correct: fix data that is wrong or incomplete.
- Delete: ask us to erase your data, in the cases the law provides.
- Restrict: ask us to limit how we use your data.
- Move: receive your data in a common format (data portability).
- Object: tell us to stop using your data where we rely on legitimate interest.
- Withdraw consent: at any time, for example with the unsubscribe link in any newsletter. This does not affect what we did before you withdrew.
How to use them: email [email protected] (subject: Privacy). We may ask you to confirm who you are. We reply within 30 days. If your request is complex, the law lets us take longer. If that happens, we will tell you and explain why.
What if you want to complain?
Please write to us first. We would like the chance to fix it.
You can also complain to the Serbian Commissioner for Information of Public Importance and Personal Data Protection (Poverenik, poverenik.rs). If you are in the EU or the UK, you can also complain to your local data protection authority.
Do we make automated decisions about you?
No.
- We do not make decisions about you based only on automated processing, and we do not profile you.
- We do not sell personal data.
- We do not use advertising trackers.
How do we keep your data safe?
We use encrypted connections (HTTPS), access controls and a short list of trusted providers. No system is perfectly secure. If a breach puts your rights at serious risk, we will tell you and the authority, as the law requires.
Is the site for children?
No. Our services are for businesses. The site is not aimed at children and we do not knowingly collect their data.
Will this policy change?
It can. The date at the top shows when it last changed. For significant changes, we will say so on the site.