Privacy & data protection

Version 1.0 · 22 October 2026 · Draft for formal adoption. Scope: MENSCH and relevant related legal entities, in accordance with contracts and applicable law.

1. Purpose of the document

This document describes privacy principles for business contacts, website visitors, service users, and persons whose data are processed through projects. For a public privacy notice, specific categories, purposes, periods, and providers must be added. Detailed notices for the site and services are published in the Privacy policy.

2. Who processes data

The relevant controller is the legal entity stated in the contract or specific notice. MENSCH may be controller for its own business processes and processor when it processes data on behalf of a client. Roles are not determined by platform name alone.

3. Principles

Lawfulness, fairness, transparency, purpose limitation, minimisation, accuracy, limited retention, integrity, confidentiality, and accountability.

4. Categories of data

Depending on the service, name, business contact, correspondence, contractual data, user identifiers, IP address, technical logs, account content, and other data the client enters may be processed. Special categories of data require an additional legal basis and protection.

5. Purposes and legal bases

Processing may serve responding to inquiries, performing a contract, invoicing, security, support, and legal obligations. The legal basis is determined per purpose: contract, legal obligation, legitimate interest, consent, or other applicable basis. Consent is not used as a universal basis.

6. Cookies and analytics

Necessary cookies may support basic functions, while optional cookies and similar technologies are used in line with consent rules where applicable. The public notice must list actually used tools and periods. See the Cookie policy.

7. Client data in MenschOS

The client defines purposes and categories of data it enters in its tenant when acting as controller. MENSCH processes data according to documented instructions, the contract, and applicable law. One client's data are not used for another's needs without a valid basis.

8. Access and recipients

Access is limited to authorised persons. Data may be disclosed to contractual processors, infrastructure providers, or competent authorities when there is a legal basis. A list of relevant processors must be maintained for specific services.

9. International transfers

Transfer outside the country of origin requires an appropriate mechanism and safeguards when required by law, including assessment of destination, contractual clauses, or other permitted mechanisms.

10. Individual rights

Under law, rights may include information, access, rectification, erasure, restriction, portability, objection, and protection from certain automated decision-making. Requests are sent to the controller; MENSCH as processor assists the client within the contract.

11. Retention periods

Periods are set per data category, purpose, legal obligation, and contract. There is no single universal period for all data. After expiry, deletion or anonymisation is applied where possible.

12. Security and incidents

Technical and organisational measures appropriate to risk are applied. Suspected personal data breaches are reported without delay; notification of supervisory authorities and individuals is carried out according to applicable legal criteria and deadlines.

13. Privacy by design

New features are assessed from the perspective of purpose, minimisation, access, retention, and impact on individual rights. Data protection impact assessment is carried out when required by law.

14. Automation and AI

Automated processing and AI features must have a clearly defined purpose, appropriate basis, access control, and risk review. Data are not used to train external models without an appropriate basis and contractual authorisation.

15. Contact and complaints

For general inquiries: hi@mensch.rs. For formal requests, the appropriate controller and identity verification procedure must be established. Persons have the right to contact the competent data protection authority where applicable.

16. Before publication

Enter accurate legal names, registered offices, contacts, actual purposes and bases, list of processors, international transfers, cookies, retention periods, and any DPO if appointed. Without that information the text is not a complete public notice.

Document management

Responsible party: management of the relevant legal entity. Review: at least once a year. Effective date: date of formal adoption. Contact: hi@mensch.rs.