Privacy notice

Who is responsible for your data

The controller of your data is:

• RNDM DOO
• Tadeuša Košćuška 78, 11000 Belgrade, Serbia
• PIB (tax number): 112729694
• MB (registration number): 21727938
• Email: desk@rndm.rs

EU representative (GDPR Art. 27): Antun Franetović, attorney at law, Mažuranićevo šetalište 1A, 21000 Split, Croatia, odvj.antunfranetovic@gmail.com

Write to desk@rndm.rs with any question about your data, and to use your rights.

What we process, why, and on which legal basis

When you visit the site

Data. We count each page view by the page, the language, the site that sent you, the source, the medium and the name of the campaign tags of the address (not their term or their content), the country, the type of your device and the browser language. The count keeps no IP address and no identifier, and it puts nothing on your device. To protect the count against abuse, we also use your IP address for a short limit on the number of page views from one address: the limit lasts about a minute and is stored nowhere. To deliver each page, our hosting provider receives the data that your browser sends, such as your IP address and the type of your browser. When a browser opens a deletion link that is wrong, we keep a one-way coded form of its IP address for at most 3 days, to slow down anyone who guesses links.

Purpose. To deliver the site, to keep it secure, and to count how often each page is read.

Legal basis. Our legitimate interest in delivering the site and keeping it secure (ZZPL Art. 12(1)(6); GDPR Art. 6(1)(f)).

When you send a form

Data. Your name, your email address and your question. The contact form also asks for your plan in Serbia, and you can add details about your company and the services you need. With the form, we store the page and its language, and the site, the campaign tags or the AI assistant that sent you, when the link or your answer names one. The form sends the source only from the link that opened the page of the form: the site that sent you to that page and the campaign tags of that page.

Purpose. To answer your enquiry and, when you ask for it, to prepare an offer. We use the page and the source of your visit only in totals for each source, to learn which sources bring enquiries, and never for a profile of you.

Legal basis. Our legitimate interest in answering business enquiries and in knowing which sources bring them (ZZPL Art. 12(1)(6); GDPR Art. 6(1)(f)).

The security check. The form runs a security check of our hosting provider, which tells a person from an automated program.

Legal basis of the check. Our legitimate interest in protecting the form from spam and abuse (ZZPL Art. 12(1)(6); GDPR Art. 6(1)(f)).

When you agree to receive marketing email

Data. Your name, your email address, the time of your consent and the version of this notice.

Purpose. To send you new guides, changes to the Serbian rules for companies and news about our services by email, at most once a month.

Legal basis. Your consent (ZZPL Art. 12(1)(1); GDPR Art. 6(1)(a)). Serbian law allows marketing email only with prior consent (Zakon o elektronskim komunikacijama, ZEK, Art. 148; Zakon o elektronskoj trgovini, Art. 8). Every marketing email carries a free link to stop further mail.

When you accept statistics

Data, our own statistics. A cookie of our own site holds a random visitor ID. It links your visits, the first page and the campaign tags that brought you to the site and, if you send a form, your enquiry. It holds no IP address and no advertising ID.

Data, Google Analytics 4. The Google tag sends data on your visit to Google: the pages that you open, the site that sent you, how you use the pages (scrolls, clicks on links to other sites, file downloads, video views, searches on the site and the use of a form), your device, your browser and your approximate location. Its cookies hold a random ID that links your visits.

Purpose. To see which pages, sources and campaigns bring visitors and enquiries.

Legal basis. Your consent (ZZPL Art. 12(1)(1); GDPR Art. 6(1)(a); ZEK Art. 160).

When you accept marketing

Data, ad tags. The ad tags of Google, Meta, LinkedIn and X load only after you accept marketing. They set the cookies and keep the other items in your browser that the cookie settings page lists.

Data, LinkedIn Insight Tag. The tag sends LinkedIn the address and the title of each page, the time that you spend on it, the buttons and the links that you click, your IP address, your browser and your device, and the click ID of a LinkedIn ad that brought you. LinkedIn links the data to your LinkedIn account, when you have one.

Data, X pixel. The pixel sends X the address of each page, the time that you spend on it and when you leave it, the buttons that you click, your IP address, your browser, your device and its screen, and the click ID of an X ad that brought you. When you type your email address or your name into a form on this site, the pixel also sends them to X in a one-way coded form, also before you send the form. X links the data to your X account, when you have one.

Data, Meta Pixel. The pixel sends Meta the address of each page, the page that sent you, the buttons that you click and their text, your IP address, your browser, your device and its screen, a random ID of your browser, and the click ID of a Meta ad that brought you. When you type your email address or your name into a form on this site, the pixel also sends them to Meta in a one-way coded form with its next event, also before you send the form. With them it sends a pattern of each value: the number of its characters and the place of its capital letters and punctuation, but no letter. Meta links the data to your Facebook or Instagram account, when you have one.

Data, Google Ads tag. The tag sends Google the address and the title of each page, when you start and when you send a form, your IP address, your browser and your device, a random ID of your browser, and the click ID of a Google ad that brought you. When you type into a form on this site, the tag also sends Google a one-way coded form of the email address in it, also before you send the form. Google links the data to your Google account, when you have one.

Data, Google Analytics 4 with marketing. When you accept statistics and marketing, Google Analytics 4 also runs Google signals and ads personalization. Google signals links your visits to your Google account, when you are signed in and your account allows personalized ads. Google then counts your visits across your devices, and gives us totals by age, gender and interests. Ads personalization lets Google use your visits to show you our ads in Google's services and on other sites. For Google signals and ads personalization, Google also uses the data for its own purposes, under its own privacy policy.

Data, click IDs. A link from an ad carries a click ID. We keep it with your enquiry only when you accept statistics and marketing. We delete it when you withdraw either consent, and at the latest 90 days after the enquiry. Our site keeps no copy of the click ID in your browser.

Data, enquiry reports. When you have accepted marketing and you send a form, the ad tags of Google, Meta and X each tell their platform that you sent an enquiry. With it they send a one-way coded form of your email address, and Meta and X also of your name. The coded address is personal data: the platforms match it with the accounts of their users, to learn which ad led to the enquiry.

Purpose. To measure which ads bring enquiries, to show our ads again to visitors of the site, and to find similar audiences: people whom a platform finds similar to our visitors. Google, Meta, LinkedIn and X also use the data for their own purposes, under their own privacy policies.

Legal basis. Your consent (ZZPL Art. 12(1)(1); GDPR Art. 6(1)(a); ZEK Art. 160).

When you delete your data or object to our emails

Data. Your email address on our do-not-email list.

Purpose. To stop every email from us to you, also after the deletion, with one exception: if our form receives your address again, we send you one email to ask whether it was you, and we answer the form only after you confirm it. If you do not confirm within 14 days, we delete the data of that form.

Legal basis. Our legitimate interest in respecting your deletion or objection, in never emailing you again except the one email described above, and in not answering a form that someone else sent with your address (ZZPL Art. 12(1)(6); GDPR Art. 6(1)(f)).

Do you have to give us your data?

No law and no contract obliges you to give us your data. To answer you, we need your name, your email address and your question. Without them, we cannot reply. Every other field is optional.

Who receives your data

These recipients process data for us, as our processors:

After you accept marketing, Google, Meta, LinkedIn and X also receive data from their ad tags, and Google, Meta and X the report of each enquiry. Google also receives the data of Google Analytics 4 for Google signals and ads personalization. For this data they are not our processors. Each platform and RNDM are joint controllers for the collection of the data through the tag and for the enquiry report. For its own use of the data after that, each platform is a separate controller, under its own privacy policy.

Transfers outside Serbia

Our databases. We keep the enquiries in databases in the EU. The EU member states are on the Serbian list of states with an adequate level of protection (ZZPL Art. 64(7); Sl. glasnik RS 55/2019).

Our hosting provider in the United States. Our hosting provider is a company in the United States, and it states that it complies with the EU-U.S. Data Privacy Framework. The transfer relies on the EU adequacy decision for this framework, which applies in Serbia under ZZPL Art. 64(2) (GDPR Art. 45).

Google Analytics 4. Google keeps the data of Google Analytics 4 also in the United States, at Google LLC, which is certified under the EU-U.S. Data Privacy Framework, so the same adequacy decision applies (ZZPL Art. 64(2); GDPR Art. 45).

Google, Meta, LinkedIn and X. The four companies that receive the data are in Ireland, which is on the Serbian list of states with an adequate level of protection (ZZPL Art. 64). They send the data on to the companies of their groups in the United States: Google LLC, Meta Platforms, Inc., LinkedIn Corporation and X Corp. Each of these companies is certified under the EU-U.S. Data Privacy Framework, so the same adequacy decision applies (ZZPL Art. 64(2); GDPR Art. 45).

The Data Privacy Framework list shows the certification of each company: https://www.dataprivacyframework.gov/list

How long we keep your data

When the period of an enquiry ends, we delete every copy of it.

Your rights

You have these rights:

• Access. You can ask which data we hold about you, and get a copy (ZZPL Art. 26).
• Correction. You can ask us to correct or complete your data (Art. 29).
• Deletion. You can ask us to delete your data (Art. 30). We then delete your personal data without undue delay. We keep only what the law requires us to keep and what we need to establish, exercise or defend legal claims (ZZPL Art. 30(5); GDPR Art. 17(3)). This applies to our records of our work with you only while you are our client and for 5 years after our contract ends. We also keep a short record that you asked for deletion and when we did it.
• Restriction. You can ask us to restrict the processing of your data (Art. 31).
• Portability. You can ask for your data in a structured, common, machine-readable form (Art. 36).
• Objection. You can object to the processing of your data, as the next part explains (Art. 37).
• Withdrawal of consent. You can withdraw a consent at any time, as easily as you gave it: on the cookie settings page, with the link in each marketing email, or by email to the address above (Art. 15(3)). The withdrawal does not change the lawfulness of the processing before it.

How to use your rights. Write to us at the email address above. You need no form. Every email that we send you also carries a link to delete your data.

When we answer. We answer within 30 days of your request. When a request needs more time, we can extend this period by 60 days, and we tell you so within the first 30 days. We ask for proof of your identity only when we have a reasonable doubt about it.

Your right to object

You can object at any time to the processing of your data on the basis of our legitimate interest, and to marketing. When you object to marketing, we stop it at once.

To object to the profiling for marketing, withdraw your marketing consent in the cookie settings. For the data that a platform already has, also use the ad settings of your account with that platform.

To object, write to the email address above, or use the link in any of our emails.

Automated decisions and profiling

We make no decision about you that rests only on automated processing and has legal or similarly significant effects on you (ZZPL Art. 38; GDPR Art. 22).

When you accept statistics, we link your visits to learn which sources bring enquiries. When you accept marketing, Google, Meta, LinkedIn and X may also use the data from their tags and from our enquiry reports, and Google also the data of Google Analytics 4, to build profiles for their own advertising.

Complaint to a supervisory authority

You can file a complaint with the Poverenik, the Commissioner for Information of Public Importance and Personal Data Protection (ZZPL Art. 82):

• Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti
• Bulevar kralja Aleksandra 15, 11120 Belgrade, Serbia
• office@poverenik.rs
• https://www.poverenik.rs

If you live or work in the EU, you can also file a complaint with the data protection authority of the member state where you live or work (GDPR Art. 77).