International application
Version: 1.0 for review
Date of preparation and research: 11 October 2026.
Purpose: Site text after review and approval
1. Scope of this notice
This notice supplements public legal information only for international activities that are confirmed: EU, SAD i druge države, samo za potvrđene usluge. For each specific service it must be clear which company provides it, where it is registered, and who determines purposes of data processing.
The Serbian company and the US LLC, if they participate in providing a service, have separate legal identities. LLC is not the name of a single US privacy regime. The contracting party is not determined by site language, currency, or country of the bank account.
2. When the GDPR applies
The GDPR applies when its material and territorial conditions are met, including processing in the context of activities of an establishment in the EU, or a specific offer of goods and services to persons in the EU or monitoring of their behaviour in the EU. Availability of the site from the EU alone is not sufficient. A person's citizenship is not the only or decisive criterion. A business relationship with a client from the EU also does not mean automatically that every processing by a provider from Serbia falls under the GDPR; its direct obligations, contractual obligations to the client, and rules on data transfer are assessed separately. For processing that falls under the GDPR, the appropriate controller, legal basis, purposes, recipients, retention periods, rights, and mechanism for international transfer are stated. A representative under Article 27, when mandatory, and a data protection officer under Article 37, when mandatory or designated, have different roles.
3. Rights and contact in the EU
For processing under the GDPR you may exercise rights provided by that regulation, under its conditions. The deadline for response is as a rule one month, with possible extension for a further two months and timely justification. Details are on the Contact and exercising your rights page.
Contact of the controller and representative for these activities: hi@mensch.rs. You may lodge a complaint with the competent supervisory authority and seek judicial protection. Choice of contract law does not replace data protection rules.
4. Flows between Serbia, the EU, and the US
For transfer from the EU to Serbia or the US, the applicable mechanism from GDPR Chapter V must be established. Alignment of domestic law with the GDPR is not the same as a European Commission adequacy decision. When standard clauses are used, the appropriate type of relationship must be chosen, actual flows regulated, and necessary supplementary measures assessed. For transfer from Serbia, requirements of the PDPA are assessed in particular. An internal agreement within the brand or ownership link is not an independent transfer mechanism. An accurate description of flows and safeguards must be stated in the privacy policy and relevant service documentation. If the EU-US Data Privacy Framework is used for a US recipient, its active status, exact legal name, and scope are verified. This package does not claim that Mensch doo, any LLC, or a supplier is a participant in that programme.
5. US company and information to the user
A registered agent address does not automatically represent a business address or contact for exercising rights. A tax identifier is not published merely because it exists; need and an appropriate delivery channel are assessed. The contract must distinguish obligations of the US company from any engagement of the Serbian company as subcontractor or processor. A change of invoice issuer must not conceal a change of contracting party or recipient of data.
6. Special rights under US regulations
Application of federal, sectoral, and state regulations depends on activity, territorial link, categories of data, and relevant thresholds or exceptions. If a law such as the California CCPA applies to specific processing, additional notice is required with actual categories of data, purposes, recipients, retention periods, rights, and channels for requests. In particular it is assessed whether advertising or another flow constitutes "sale" or "sharing" within the meaning of the relevant law. Absence of monetary consideration alone does not resolve that question. An unverified statement is not made that data are not sold, not shared, or that processing complies with all laws of all US states. Rights and deadlines under a particular US law are also not promised as if applicable to every user.
7. Marketing, minors, and special activities
Commercial communication is subject to regulations of the market it targets. US opt-out rules do not replace prior consent when Serbian or other applicable law requires it. Transactional messages should not be used to circumvent marketing rules. For services aimed at children or processing where relevant knowledge of age exists, additional obligations are assessed, including COPPA when its conditions are met. Health, financial, and other specially regulated data require additional assessment. This document does not claim that MenschOS is suitable for such processing.
8. AI, intermediary services, and consumers
If actual functions and territorial scope require it, the EU AI Act, rules on intermediary digital services, consumer rights, and national rules on electronic communications are checked in particular. Use of the names "platform" or "AI" alone does not determine all those obligations. Required notices must appear at the appropriate moment of using the service. This page is not a general confirmation of international compliance and does not replace functional channels for rights, correct contracting, and appropriate data protection.