Contact & exercising your rights
Version: 1.0 for review
Date of preparation and research: 11 October 2026.
Purpose: Site text after review and approval
1. Contact details
For inquiries, questions about documentation, and requests, use hi@mensch.rs. The company is Mensch doo, registered seat: Hilandarska 38, 31210 Požega, RS. PIB 114507707, company ID 22032836.
Complaints and other requests can be sent to the same email address. Odgovaramo putem emaila u razumnom roku..
If your request relates to a service of another legal entity, its contact must be stated in the contract and in a separate notice. A shared contact may receive requests only with clear internal allocation, and without denying statutory rights.
2. What to include
Describe what the request relates to, which service or communication you recognise, and what response or action you seek. Provide an address where we can reply. A contract, order, or invoice number may help us find the matter, but not knowing it alone does not make a request invalid. Suggested subject lines are "Personal data", "Complaint", "Report of infringement", or "Security report". A subject line is not a legal condition for handling the request. You do not need to cite an article of law or use specialist terminology. Do not send passwords, complete databases, full payment card details, or a copy of an identity document unless that is specifically and justifiably requested.
3. Requests relating to personal data
You may request information about processing, access and a copy of data, rectification, erasure, restriction, portability, and other forms of protection provided by law. For an objection to legitimate interest, describe special circumstances if they are relevant. To stop direct marketing, no special situation needs to be explained. The controller checks that the request comes from an authorised person, in proportion to the risk of disclosing data. Additional identity information is requested when there is justified doubt, to the necessary extent. A copy of an identity card must not be a routine condition for every request. If you act through a representative, verification of their authority may be required. Verification must not create unjustified obstacles. The response is delivered by an appropriate secure method; if you submit the request electronically, information is as a rule given electronically when possible, unless you ask otherwise.
4. Deadlines and costs
| Regime | Basic deadline | Possible extension | | PDPA of the Republic of Serbia, Article 21 | Without delay, at the latest 30 days from receipt | A further 60 days when justified by complexity and number of requests, with notice of reasons within the first 30 days | | GDPR, when applicable, Article 12 | Without undue delay, at the latest one month from receipt | A further two months when needed, with notice and reasons in the first month | These are deadlines for handling data protection requests, not general deadlines for answering every business message. When both regimes apply, obligations are aligned so that no applicable deadline is exceeded. Handling is, as a rule, free of charge. For manifestly unfounded or excessive requests, statutory exceptions regarding reasonable costs or refusal may apply. The controller must justify such a decision and bears the burden of proving the conditions. A legally permitted fee for additional copies is assessed separately. If a request is not acted upon, the person receives reasons and notice of legal remedies within the prescribed deadline. An unclear request should be clarified, not automatically rejected. A request for supplementation is not permission for unlimited delay.
5. When MENSCH is a processor
If your organisation is the controller of data in MenschOS or another client system, that organisation primarily decides on requests relating to that data. MENSCH as processor provides assistance in accordance with law and contract and does not independently decide on erasure or delivery of an entire database. If a request reaches MENSCH, the responsible organisation must be identified and action taken according to relevant instructions, without unnecessary disclosure of data. For its own processing, for example its own invoicing, the legal entity that determines purpose and means is responsible.
6. Service complaints
State the service, date, description of the problem, evidence of the business relationship, and the desired way of resolving the matter. An original invoice is not the only possible proof. If you are a consumer, special channels and statutory rights are described in the Notice for consumers. For business clients, agreed procedures and statutory rights apply. A unilateral publication of a deadline on the site cannot change an agreed SLA. A request for data erasure and a service complaint follow different legal rules and deadlines even when they arrive in the same message.
7. Security and IP reports
Describe suspected incidents without further accessing other people's data and without publishing confidential information. For an initial report use hi@mensch.rs. Agreement on a more secure channel may follow if needed. This notice does not promise a reward programme, permanent on-call duty, or a fixed deadline for resolving incidents. For copyright, state the URL and the basis of your right. Details are in the IP notice. The possibility to report does not authorise further testing, downloading data, or bypassing protection.
8. Complaints and judicial protection
If you believe processing is contrary to the PDPA, you may lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection. Current instructions and forms are on the Commissioner's website. It is not necessary for MENSCH to approve contact with the authority beforehand. When the GDPR applies, the right to complain includes the competent supervisory authority of a member state, in particular according to habitual residence, place of work, or place of the alleged infringement, in accordance with Article 77. The right to judicial protection and compensation when statutory conditions are met also remains.
9. Voluntary request form
Subject: Request relating to personal data
Contact for reply: [enter]
Relationship with MENSCH or organisation whose system holds the data: [if known]
Request: [describe what information or action you seek]
Data that may help identification: [only necessary data]
Preferred way of reply: [enter]
The form is assistance. A request may also be submitted in free form.