Privacy Notice
Last updated: 2 November 2026
1. About us
The controller of your personal data is the sole proprietor SERGEI SAIGANOV PR NOVI SAD, registration no. 67900359, tax ID 114847514, registered at Železnička 20, 21101 Novi Sad, Serbia (“Comply”, “we”).
Please send any questions about personal data processing to sergei@comply.rs.
2. Scope
This notice is issued under the Serbian Law on Personal Data Protection (Official Gazette RS No. 87/2018, “ZZPL”) and, for individuals in the European Union, the General Data Protection Regulation (GDPR).
It covers data we process when we:
- provide services to clients;
- communicate by email, Telegram or other channels;
- operate the website comply.rs (the “Website”).
3. Purposes, data categories and legal bases
We process data only for the purposes it was collected for:
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Replying to requests sent via the form, email or Telegram | name, company, email, topic and message, correspondence | steps prior to entering into a contract (Art. 12(1)(2) ZZPL; Art. 6(1)(b) GDPR) and legitimate interest (Art. 12(1)(6) ZZPL; Art. 6(1)(f) GDPR) | until the request is resolved, no longer than 12 months; if a contract follows, as for service delivery |
| Providing services and performing contracts | client contact persons: name, position, email, phone, correspondence | performance of a contract; legitimate interest for contact persons of legal entities | term of the contract plus 5 years after it ends |
| Accounting and tax obligations | data in contracts, invoices and statements | legal obligation (Art. 12(1)(3) ZZPL; Art. 6(1)(c) GDPR) | periods required by accounting and tax law |
| News and event updates | name, email | consent (Art. 12(1)(1) ZZPL; Art. 6(1)(a) GDPR) | until consent is withdrawn |
| Website security and operation | IP address, time of access, browser type (server logs) | legitimate interest | up to 30 days |
We do not process special categories of personal data (health, racial or ethnic origin, political opinions, religious beliefs, biometric data, etc.). If we receive data we did not ask for and do not need, we delete it as soon as we notice.
When we receive data from third parties (for example, from a contact person's employer), we do so only where a legal basis exists, usually set out in a contract.
We send marketing messages only with your consent. Without it, we contact you only to answer your requests and to meet legal obligations.
We do not publish personal data on the Website without consent or another legal basis.
4. Cookies and analytics
The Website uses no cookies, web analytics or tracking tools. Fonts and other resources are served from our own server. Data from the contact form is sent to our processors (section 6) only when you press the send button.
5. Data security
We apply organisational and technical safeguards, in particular:
- access to data is limited to people who need it for their work;
- we assess risks before starting new processing;
- we have procedures for handling personal data breaches;
- we use up-to-date tools to protect data against unauthorised access, loss and alteration;
- we review our safeguards regularly;
- our contracts with processors include data protection obligations.
6. Recipients and transfers
We do not sell personal data or share it with third parties for their own purposes. Data may be processed by our processors, strictly on our instructions:
- ishosting: hosting of the Website and of the servers that process contact form requests;
- Microsoft 365 (Microsoft): email and business communication.
We transfer data outside Serbia only to countries and organisations that ensure an adequate level of protection under ZZPL, or subject to appropriate safeguards such as standard contractual clauses.
7. Retention and end of processing
We stop processing when its purpose has been achieved or you withdraw consent, unless another legal basis applies or the law requires us to keep the data longer. Retention periods for each purpose are set out in section 3. We process only the data necessary for a given purpose.
8. Your rights
Under ZZPL and GDPR you have the right to:
- information about processing and access to your data;
- rectification of inaccurate and completion of incomplete data;
- erasure and restriction of processing;
- data portability;
- object to processing based on legitimate interest;
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
We do not make decisions based solely on automated processing. Send requests to sergei@comply.rs; we will reply within 30 days.
You may lodge a complaint with the Serbian Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs) and, if you are in the European Union, with the supervisory authority of your country.
9. Changes
The current version of this notice is always published on this page. We announce material changes on the Website or by email.