MenschOS & related services
Version: 1.0 for review
Date of preparation and research: 11 October 2026.
Purpose: Site text after review and approval
1. What this notice covers
This notice is intended for users of MenschOS and clients who use MENSCH's digital environment under agreed services. It applies only to functions that are confirmed and available for the specific product. Description of confirmed functions and domains: MenschOS Luna i povezani moduli po ugovoru.
Service provider: Mensch doo. Holder of relevant rights in the product: Mensch doo, osim komponenti trećih lica. Documents governing concrete use: ugovor, DPA i specifikacija usluge.
This is a public notice. It does not replace a subscription or project contract, a data processing agreement, a service specification, or a service level agreement. The name MenschOS alone does not confirm the existence of all possible functions of a business system.
2. Allocation of roles in data processing
| Situation | Role determined according to actual activities |
| An organisation determines why it uses data of its employees, clients, or other persons | The organisation is as a rule controller for that processing |
| The provider maintains the system and processes content solely according to the organisation's documented instructions | The provider is processor for that content |
| The provider keeps its own accounts, statutory records, or separately justified own processing | The provider may be an independent controller for those purposes |
| Another supplier processes data in the chain on instructions | Its role may be sub-processor, with required approvals and contract |
| Two parties jointly determine purposes and means | Joint controllership and an appropriate agreement are assessed |
For the specific service the confirmed matrix reads: prema matrici u ovom obaveštenju. The name of a contract cannot change the actual legal role. An organisation administrator is not automatically a separate controller merely because they manage user accounts.
3. Accounts and authorisations
Rules for opening accounts, assigning roles, support access, and revoking access: individualni nalozi, uloge i revizija pristupa po ugovoru. The user should use assigned access within the limits of authorisation and report suspected misuse.
The organisation determines who is authorised to act on its behalf in accordance with the contract. A change of employee or administrator requires alignment of access. It is not assumed that every member of the organisation may approve data erasure, transfer a contract, or enable a new integration.
This text does not confirm multi-factor authentication, precise isolation levels, or complete audit trails. If such functions are offered, they are described precisely, with scope and any limitations.
4. Content, permitted use, and confidentiality
The user should enter content they are authorised to use and that is needed for the agreed purpose. Special categories of data, criminal conviction data, and content under special regimes must not be entered without prior assessment of suitability of the service and appropriate conditions. Providing technical access alone does not give an independent right to use client content for advertising, a public portfolio, or development of unrelated products. Required legal bases, contractual rights, and notices are assessed for each additional purpose. Contractual confidentiality, data protection rules, and intellectual property rights apply according to their subject matter. Deleting a business account does not end statutory obligations to retain separate accounting data.
5. Infrastructure, suppliers, and international flows
Processing and support locations, list of relevant sub-processors, and regime for changing suppliers: u ugovoru o obradi i dokumentaciji usluge. The list must identify the legal entity, function, relevant location, and transfer mechanism when one exists.
Before entrusting data to a processor, a contract is required that governs subject matter and duration, purpose and nature of processing, types of data, categories of persons, and obligations of the parties. Confidentiality, protection measures, engagement of other processors, assistance to the controller, return or erasure, and proof of compliance are also regulated.
Platform availability does not confirm that a processing agreement has already been concluded. A public notice does not replace that agreement. An appropriate contractual annex is delivered before processing begins for which it is required.
6. AI functions and integrations
Status of AI functions: AI funkcije samo ako su ugovorene i uključene. If there are none, no claims about AI processing are published. If they exist, before use each function states purpose, provider, data sent, countries of processing, retention periods, possibility of human review, and relevant settings.
Use of inputs and results for training or improving models: bez obuke modela na podacima klijenta, osim izričite pisane saglasnosti. Neither that the supplier uses data for training nor that such use is excluded is assumed. The statement must match the specific contract, account, product, and setting.
An AI result may contain factual errors or infringe third-party rights. Review appropriate to its purpose is required before publication or reliance on the result. That does not release the provider from its own statutory and contractual obligations.
For decisions with legal or similarly significant effect, special rules on automated decision-making are assessed. When the EU AI Act applies, information on interaction with AI and labelling of certain generated content is placed at the point of use, in line with the specific role and obligation. General text in the footer is not sufficient for every transparency obligation.
7. Availability, support, and incidents
Scope of support, working hours, response times, and any SLA: prema ugovoru o nivou usluge. No percentage of availability, recovery time, or number of backups is agreed by this general notice.
In the event of a personal data breach, the processor notifies the controller without undue delay in accordance with law and contract. The controller assesses notification to the supervisory authority and to data subjects. The statutory 72-hour deadline, when applicable for the controller's notification to the supervisory authority, is not a general deadline for resolving an incident nor justification for the processor to delay notification.
For an initial problem report use the agreed support channel or hi@mensch.rs. Do not send a complete database as an attachment to a report.
8. End of use, export, and erasure
Conditions for export, format, period of availability, fee if permitted and agreed, and procedure for return or erasure of data: prema ugovoru i DPA.
After processing on behalf of the controller ends, data are returned or erased according to their choice and the applicable contract, except where statutory retention applies. Backups require a separate regulated period and access regime. An unverified claim that all copies are erased immediately is not made.
Contractual export of business data differs from an individual's right to portability. For consumer digital services there may also be special rights to retrieve content and statutory rights on termination of the contract.
9. Notices in special projects
When building a client website, responsibility for content, legal texts, and choice of technologies is separated from technical implementation of agreed settings. Delivering cookie policy text does not prove correct blocking of technologies. For photo, video, and event streaming, the organiser, purpose of recording, notice to those present, legal basis, and rights in the recording are established. Attendance at an event is not universal consent for every promotional use. For digital marketing, the advertiser, roles of platforms, audience sources, and basis for delivering data are established. For security testing, clear authorisation, scope of systems, and permitted activities are required. Contracting one service does not give unlimited authorisation for processing in another.