Privacy notice

Who is responsible for your data

The controller of your data is:

• RNDM DOO
• Tadeuša Košćuška 78, 11000 Belgrade, Serbia
• PIB (tax number): 112729694
• MB (registration number): 21727938
• Email: hello@rndm.rs

Write to this address with any question about your data, and to use your rights.

What we process, why, and on which legal basis

We process only the data that each purpose needs. Each part below names the data, the purpose and the legal basis.

When you visit the site

Data. Our server counts each page view. It records the page, the language, the host of the site that sent you, the UTM tags of the link, the country, the device class and the browser language. The count stores no IP address and no identifier, and it puts nothing on your device. So the page view totals identify nobody, and they are not personal data. Our server finds the country from your IP address while it answers the request. To deliver each page, Cloudflare, our hosting provider, receives the technical data of the request, such as your IP address and your browser.

Purpose. To deliver the site, to keep it secure, and to count how often each page is read.

Legal basis. Our legitimate interest in delivering the site and keeping it secure (ZZPL Art. 12(1)(6); GDPR Art. 6(1)(f)). This processing needs no consent, because it stores nothing in your browser and reads nothing from it.

When you send a form

Data. The short form asks for your name, your email address and your question. The contact form also asks for your plan in Serbia, and it lets you add your company, your current structure, the team size, the timeline and the services you are interested in. The question "How did you find us?" is optional. With the form, we store the page you sent it from, its language, the first site that sent you to us, the UTM tags of the link and the AI assistant that sent you, when the link or your answer names one. When you have not accepted statistics, the site that sent you and the UTM tags come only from the visit in which you send the form.

Purpose. To answer your enquiry and, when you ask for it, to prepare an offer. We also keep the page, the first site that sent you, the UTM tags and the AI assistant, to learn which sources bring enquiries. We use these fields only in totals for each source, never for a profile of you, and we delete them together with the enquiry. We send you a confirmation email in the language of the form, with a link to delete your data. The RNDM team gets a short notice of each new enquiry by email.

Legal basis. Our legitimate interest in answering business enquiries and in knowing which sources bring them (ZZPL Art. 12(1)(6); GDPR Art. 6(1)(f)).

The security check. The form runs the Turnstile check of Cloudflare, which tells a person from an automated program.

Legal basis of the check. Our legitimate interest in protecting the form from spam and abuse (ZZPL Art. 12(1)(6); GDPR Art. 6(1)(f)). The check is strictly necessary to send the form you asked to send, so it needs no consent.

When you agree to receive marketing email

Data. Your name, your email address, the time of your consent and the version of this notice. The marketing box under each form is separate from the other fields, and it is not ticked.

Purpose. To send you news and offers of RNDM by email. The email brings new guides, changes to the Serbian rules for companies, and news about our services, at most once a month.

Legal basis. Your consent (ZZPL Art. 12(1)(1); GDPR Art. 6(1)(a)). Serbian law allows marketing email only with prior consent (Zakon o elektronskim komunikacijama, ZEK, Art. 148; Zakon o elektronskoj trgovini, Art. 8). Every marketing email carries a free link to stop further mail.

When you accept statistics

Data, our own statistics. We set a first-party cookie with a random visitor ID. It links your visits, the first page that brought you to the site and, if you send a form, your enquiry. It keeps the UTM tags of your first visit across later visits. The cookie holds no IP address and no advertising ID.

Data, Google Analytics 4. The Google tag loads only after you accept statistics. It sets the cookie _ga, which lasts 2 years, and it sends data on your visit to Google. The tag loads through our own domain. When you reject statistics, our code loads no Google tag, and nothing goes to Google.

Purpose. To see which pages, sources and campaigns bring visitors and enquiries.

Legal basis. Your consent (ZZPL Art. 12(1)(1); GDPR Art. 6(1)(a)). ZEK Art. 160 allows storage on your device, and access to it, only with your consent.

When you accept heatmaps

Data. A small script records which marked elements of the page you click and how far you scroll. It sends this data when you leave the page. It sets no cookie, stores nothing in your browser, and sends no text, no form input and no IP address.

Purpose. To improve the design of the pages.

Legal basis. Your consent (ZZPL Art. 12(1)(1); GDPR Art. 6(1)(a)). The law asks for consent for such a script even without a cookie, because the script reads data in your browser and sends it to us.

When you accept marketing

Data, ad tags. The Google tag for Google Ads, the Meta Pixel, the LinkedIn Insight Tag and the X pixel load only after you accept marketing. They set the cookies that the cookie settings page lists.

Data, click IDs. A link from an ad carries a click ID: gclid (Google), fbclid (Meta), li_fat_id (LinkedIn) or twclid (X). We keep the click ID with your enquiry only after you accept marketing. When you withdraw that consent, we delete the click ID from your browser and from your enquiry.

Data, conversions. When you have accepted marketing and you send a form, our server tells the ad platform that brought you that an ad led to an enquiry. It sends a SHA-256 hash of your email address. To Meta it also sends the IP address and the user agent of your browser. The hash is personal data: the platforms match the hash with the accounts of their users. When no ad brought you, our server tells no platform.

Purpose. To measure which ads bring enquiries, to show our ads again to visitors of the site, and to find similar audiences. A similar audience is a group of people that a platform finds similar to our visitors. Google, Meta, LinkedIn and X also use the data for their own purposes, under their own privacy policies.

Legal basis. Your consent (ZZPL Art. 12(1)(1); GDPR Art. 6(1)(a); ZEK Art. 160).

When you delete your data or object to our emails

Data. A SHA-256 hash of your email address on a suppression list. We keep no readable copy of the address.

Purpose. To stop every email from us to you, also after the deletion.

Legal basis. Our legitimate interest in respecting your deletion or objection and in never emailing you again (ZZPL Art. 12(1)(6); GDPR Art. 6(1)(f)).

Do you have to give us your data?

No law and no contract obliges you to give us your data. To answer you, we need your name, your email address and your question. Without them, we cannot reply. Every other field is optional.

Who receives your data

Only the RNDM team reads the enquiries. These recipients process data for us, as our processors:

Google, Meta, LinkedIn and X also receive data from their ad tags and from our conversion reports. For this data they are not our processors. Each platform and RNDM are joint controllers for the collection of the data through the tag and for the conversion report. For its own use of the data after that, each platform is a separate controller, under its own privacy policy.

Transfers outside Serbia

Our database. We keep the enquiries in a Cloudflare D1 database in the EU jurisdiction. The member states of the EU are on the Serbian list of states with an adequate level of protection, which the Government adopted under ZZPL Art. 64(7) (Sl. glasnik RS 55/2019).

Cloudflare in the United States. Cloudflare, Inc. is a company in the United States. Cloudflare states that it complies with the EU-U.S. Data Privacy Framework. The transfer relies on the EU adequacy decision for the EU-U.S. Data Privacy Framework, which applies in Serbia under ZZPL Art. 64(2) (GDPR Art. 45).

Google, Meta, LinkedIn and X. The four companies that receive the data are in Ireland, which is on the Serbian list of states with an adequate level of protection (ZZPL Art. 64). They send the data on to the companies of their groups in the United States: Google LLC, Meta Platforms, Inc., LinkedIn Corporation and X Corp. Each of these companies is certified under the EU-U.S. Data Privacy Framework, so the same adequacy decision applies (ZZPL Art. 64(2); GDPR Art. 45).

The Data Privacy Framework list shows the certification of each company: https://www.dataprivacyframework.gov/list

How long we keep your data

When the period of an enquiry ends, a scheduled job deletes it from our database, from the exports and from the notice inbox.

Your rights

You have these rights:

• Access. You can ask which data we hold about you, and get a copy (ZZPL Art. 26).
• Correction. You can ask us to correct or complete your data (Art. 29).
• Deletion. You can ask us to delete your data (Art. 30). We delete it without undue delay, unless a legal exception applies, such as a legal duty to keep it or a legal claim (Art. 30(5)).
• Restriction. You can ask us to restrict the processing of your data (Art. 31).
• Portability. You can ask for your data in a structured, common, machine-readable form (Art. 36).
• Objection. You can object to the processing of your data, as the next part explains (Art. 37).
• Withdrawal of consent. You can withdraw a consent at any time, as easily as you gave it: on the cookie settings page, with the link in each marketing email, or by email to the address above (Art. 15(3)). The withdrawal does not change the lawfulness of the processing before it.

How to use your rights. Write to us at the email address above. You need no form. Every email that we send you also carries a link to delete your data. The link opens a page where you confirm the deletion.

When we answer. We answer within 30 days of your request. When a request needs more time, we can extend this period by 60 days, and we tell you so within the first 30 days. We ask for proof of your identity only when we have a reasonable doubt about it.

Your right to object

You can object at any time to the processing of your data on the basis of our legitimate interest. You can also object at any time to marketing. When you object to marketing, we stop it at once.

You can also object to the profiling for marketing. Withdraw your marketing consent in the cookie settings. For the data that a platform already has, also use the ad settings of your account with that platform.

To object, write to the email address above, or use the link in any of our emails.

Automated decisions and profiling

We make no decision about you that rests only on automated processing and has legal or similarly significant effects on you (ZZPL Art. 38; GDPR Art. 22).

When you accept statistics, we link your visits to learn which sources bring enquiries. When you accept marketing, Google, Meta, LinkedIn and X may also use the data from their tags and from our conversion reports to build profiles for their own advertising, under their own privacy policies. You can withdraw these consents at any time in the cookie settings.

Complaint to a supervisory authority

You can file a complaint with the Poverenik, the Commissioner for Information of Public Importance and Personal Data Protection (ZZPL Art. 82):

• Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti
• Bulevar kralja Aleksandra 15, 11120 Belgrade, Serbia
• office@poverenik.rs
• https://www.poverenik.rs

If you live or work in the EU, you can also file a complaint with the data protection authority of the member state where you live or work (GDPR Art. 77).