Privacy policy
Version: 1.0 for review
Date of preparation and research: 11 October 2026.
Purpose: Site text after review and approval
1. Subject of the policy
This policy explains the processing of personal data when using the mensch.rs site, business communication, and other activities listed below. It also covers data of employees and representatives of clients, suppliers, and partners when they can be linked to a specific person. The policy is a processing notice. Opening the site, reading this policy, or sending an inquiry does not constitute general consent for all processing purposes. When consent is required, it is obtained separately, for a specific purpose, before such processing begins. For data that a client enters into MenschOS or another system they manage for their own purposes, the client may be the controller. For such processing, their notice also applies, and the relationship with the service provider is governed by a processing agreement.
2. Who is responsible
Controller for activities of this site: Mensch doo. If that is Mensch doo, the confirmed full registered business name and registered seat from Business data are entered.
The controller's registered seat and address is Hilandarska 38, 31210 Požega, RS (Mensch doo, PIB 114507707, company ID 22032836). Contact for privacy questions and requests is hi@mensch.rs.
A general contact address alone does not mean a data protection officer has been designated.
If a US or other company participates in a specific activity, its identity, specific processing, and role are stated: navedeni u konkretnoj ponudi ili ugovoru, kada je primenljivo. Belonging to the same brand is not sufficient grounds for companies to exchange data without limit.
3. Data, purposes, and legal bases
Non-existent activities are removed, and each additional activity is described before processing begins. | Activity | Data that may be needed | Purpose and appropriate basis | | Responding to an inquiry and preparing an offer | Name, business contact, organisation, content of the inquiry and project data | Pre-contractual steps at the request of the natural person who will be the contracting party; for representatives of legal entities, legitimate interest in business communication, with balancing of interests and the person's rights | | Performance of a contract with a natural person | Contact, agreed deliverables, relevant communication | Performance of that contract, only for processing objectively necessary for it | | Business relationship with an organisation | Data of its contact persons and authorised representatives | Legitimate interest in administering the relationship with the organisation, with appropriate assessment | | Invoices and mandatory records | Identification and billing data, transaction data | Fulfilment of specific accounting and tax obligations | | Security and error remediation | IP address, access time, technical data and relevant logs, to the confirmed extent | Legitimate interest in protecting systems and establishing misuse, with proportionality and retention period | | Email marketing | Email address, choices and consent records | Prior consent for commercial messages; withdrawal enabled | | Non-essential analytics and advertising | Identifiers, events and choices relating to cookies | Consent when required for device access and processing; details in the cookie policy | | Data subject requests and legal disputes | Content of the request, data needed to verify identity and document handling | Legal obligations; for defence of legal claims, appropriate legitimate interest | Data must not be collected merely because it might be useful in the future. If the same data is used for multiple purposes, a legal basis must exist for each purpose. A contract with a legal entity is not by itself a basis of "contract performance" for all data of its employees.
4. Mandatory nature of data and their sources
We may receive data directly from you, from the organisation you represent, or through actual use of the site and service. Additional sources, including public registers or business referrals, must be stated for specific processing: direktno od lica, poslovni sistemi i tehnički zapisi sajta.
The form indicates which data is required and why. If you do not provide contact details for a response, it may not be possible to reply to the inquiry. If data necessary for a legally compliant invoice is missing, such an invoice cannot be issued. Refusing optional marketing does not affect the ability to send an ordinary business inquiry.
When we obtain data from another source, information about processing is provided within the statutory deadline and in the prescribed manner, applying statutory exceptions where they exist. Under the Serbian Personal Data Protection Act (ZZPL), that is, as a rule, no later than within 30 days, or earlier at first contact or first disclosure to another recipient, depending on circumstances. For processing subject to the GDPR, the corresponding deadline is at most one month.
Do not send health data, identity documents, passwords, or other data not needed for your inquiry. Special categories of data, criminal conviction data, and other sensitive content require a separate legal and technical regime.
5. Who may have access to data
Data is accessed by persons who need it for a specific task and recipients for whom an appropriate legal basis exists. Exact overview of recipient categories and their roles: hosting, email, poslovni alati i podrška, po potrebi i ugovoru.
The overview must list actual providers of hosting, email, business systems, support, accounting, and other relevant services. This listing does not confirm that a particular supplier is engaged. The published policy must enable the user to understand who receives which category of data and why.
When a provider processes data on behalf of the controller, the relationship is governed by a processing agreement and appropriate instructions. When a recipient independently determines the purpose and means of its processing, its role is not described as processor role solely because of the contract name. If there are joint controllers, the essence of the arrangement and information on exercising rights are published.
Disclosure to competent authorities is based on applicable obligation or another valid basis and is limited to data necessary for that request. A general right to disclose all data for an undefined "business need" is not introduced.
6. Transfers to other countries
Countries where data is stored, countries from which it may be accessed, and applied safeguards: u skladu sa politikom privatnosti i stranicom Međunarodna primena.
Access from another country may be relevant even when the server is in Serbia or the European Economic Area. Transfer between the Serbian company and a US LLC is assessed as a concrete data flow, with identified recipient, purpose, and legal mechanism.
For transfers from Serbia, the conditions of the ZZPL apply. For transfers to which the GDPR applies, its Chapter V also applies. Standard contractual clauses of the European Commission are not automatically a substitute for verifying requirements of Serbian law. Participation of a US recipient in the EU-US Data Privacy Framework must be verified for the exact legal entity and relevant data; it is not assumed based on country of incorporation.
Information on applied safeguards and how to obtain a copy is available via the privacy contact, with protection of others' rights and lawfully protected information. If there are no transfers, that conclusion must cover support, backups, and remote access by suppliers as well.
7. Retention periods
Data is kept to the extent and for the duration necessary for the specific purpose and legal obligations. Precise periods or sufficiently defined criteria are stated in the table, after confirmation of actual systems: prema svrsi, ugovoru i zakonskim obavezama.
| Category | Data that must be determined before publication |
| Inquiries that did not lead to a contract | Period from last relevant communication and justification for that period |
| Contract documentation | Duration of the relationship and periods needed for legal obligations and legal claims |
| Accounting documents | Statutory period according to the specific document type; not one period for all data |
| Technical and security logs | Period according to log type, purpose, and risk |
| Marketing and consent records | End of active use upon withdrawal, period of proof of consent and minimal records of prohibition of further sending |
| Requests for exercising rights | Period of documenting handling and protecting legal claims |
| Backups | Replacement cycle, access restrictions, and how deletion is carried out after restore from backup |
If a document is needed for a specific dispute or legal obligation, relevant data may be kept longer in an appropriately limited regime. That does not justify continued marketing or retention of unrelated data.
8. Your rights
Depending on legal basis and statutory conditions, you have the right to information, access and copy of data, rectification, erasure, restriction of processing, and portability. Portability applies to data you provided when processing is based on consent or contract and is carried out by automated means, under statutory conditions. You may object to processing based on legitimate interest because of your particular situation. The controller must then stop processing unless it demonstrates overriding grounds foreseen by law or needs relating to legal claims. Objection to direct marketing leads to cessation of processing for that purpose, including related profiling. You may withdraw consent at any time, without affecting the lawfulness of processing before withdrawal. Erasure is not unconditional when there is an obligation to retain or another statutory exception. You must be informed of reasons for any limitation of a request. Send requests to hi@mensch.rs. Procedure, deadlines, identity verification, and legal remedies are described on Contact and exercising rights. You may contact the Commissioner, and when the GDPR applies, the competent supervisory authority in the EU, as well as a court under statutory conditions.
9. Automated decision-making, AI, and profiling
Status of such processing: nema odlučivanja sa pravno značajnim posledicama bez ljudskog pregleda. Before publication it must be established whether there is decision-making based solely on automated processing that produces legal or similarly significant effects, not merely whether an AI tool is used.
If such processing exists, the basis, meaningful information about the logic, significance and expected consequences, and safeguards are stated here, including human intervention and contestation when the law provides for them. Ordinary generation of draft text does not automatically mean such decision-making exists. MenschOS rules do not replace the obligation of the specific controller to inform the person.
10. Minors and special audiences
Purpose of the site and any processing of minors' data: sajt nije namenjen maloletnicima. If an information society service is offered directly to a minor and processing relies on consent, the ZZPL sets special rules, including a threshold of 15 years. For the GDPR, the applicable national threshold and territorial application are verified. These thresholds do not represent a general rule of business capacity for concluding contracts.
11. Data protection and policy changes
The controller must implement safeguards appropriate to the nature of processing and risks. This policy is not confirmation of a specific certificate, architecture, hosting location, or absence of all risks. Report suspected misuse via the contact on the page for exercising rights, without sending unnecessary confidential data. When purposes or other material conditions of processing change, the notice is updated before such change to the extent the law requires. New consent is obtained if required. Publishing new text alone cannot retroactively legitimise processing without a legal basis.