Privacy Policy

Who is responsible for your data

The controller of the personal data covered by this policy is Network Solutions d.o.o. Beograd, Bulevar JNA 123V, 11090 Belgrade (Voždovac), Serbia, company registration number 21832189, tax identification number 113251633. For privacy questions and requests to exercise your rights, contact info@nsolutions.rs or write to the postal address above.

This policy covers website visitors and individuals who contact us on behalf of customers, prospective customers, suppliers and other business partners. We operate in Serbia and apply the Serbian Law on Personal Data Protection (Official Gazette of the Republic of Serbia, No. 87/2018).

What data we process and where it comes from

We process data you provide in business communications: your name, company and business role, email address, telephone number if supplied, inquiry content and attachments. Depending on the inquiry, this may also include the requested product or service, quantity, delivery location and project requirements.

We usually receive data directly from you. Your company or another participant in a particular transaction may provide your business contact details so that we can communicate about that transaction. In that case, we provide information about the processing, including the data source, within the statutory period, normally at our first contact.

Accessing the website involves processing technical data needed to display and protect it, such as the IP address, requested page, request time and information your browser sends to the server. A form inquiry may also include the page and product from which it was started. In the demonstration version of the website, forms show the process and do not send the entered data or attachments. Please use email for an actual inquiry.

Please provide only the data needed for your inquiry. Do not send passwords, payment card details, health information or other sensitive data. If you provide another person’s data, you must have appropriate authorisation or another lawful basis to do so.

Why we process data and our legal bases

• Responding to inquiries and working with business partners: we process company representatives’ business contact details on the basis of our legitimate interest in responding to requests, preparing quotes, arranging demonstrations and organising agreed deliveries or support. We use this basis only where your rights and freedoms do not override that interest.
• Legal obligations: we process data needed for accounting, tax documentation, mandatory business records and lawful requests from competent authorities on the basis of the relevant legal obligation.
• Security and protection of rights: necessary processing to prevent misuse of the website and communications, and to establish, exercise or defend legal claims, is based on legitimate interests, with an assessment of the effect on your rights, or on a legal obligation where prescribed.
• Website analytics: measuring visits and content use through optional analytics services is based on your prior consent. Refusing analytics does not prevent you from using the website or making an inquiry.
• Consent: if we request consent for a particular additional purpose, we explain that purpose separately. You may withdraw consent at any time without affecting the lawfulness of earlier processing. Sending a business inquiry does not constitute consent to promotional messages.

Visiting the website does not require you to submit an inquiry. Fields marked as mandatory are needed to handle the relevant request. Without adequate contact information or a description, we may be unable to respond or prepare a quote. We do not require consent as a general condition for processing that relies on another legal basis.

Who may receive the data

Access is limited to people who need the data for the relevant work. Depending on the specific request, recipients may include appointed hosting, email and IT support providers, accounting and legal advisers, and delivery, licence activation or service partners where their involvement is necessary. We disclose data to competent authorities where there is a lawful basis.

Where a provider processes data on our behalf, the relationship must comply with Article 45 of the Law, including appropriate instructions, confidentiality and safeguards. Each recipient is given only the data needed for the specific purpose.

Transfers to other countries

If a particular service or business relationship requires a transfer of data outside Serbia, a condition under the Law must be met before the transfer: an adequate level of protection under Article 64, appropriate safeguards under Article 65, or another permitted basis for the specific circumstances. Contractual safeguards must take a form recognised by Serbian law.

We inform you about intended transfers, the relevant country and the basis for protection as required by the Law. You may contact us to request information about recipients and how to obtain details of the safeguards applied.

How long we retain data

Retention depends on the purpose and type of record. We keep inquiry data while it is needed to respond and for reasonably related business communications. If an inquiry leads to a business relationship, relevant data is retained while obligations are being fulfilled and for the periods applicable to the corresponding contractual, accounting or tax records.

Longer retention may be necessary for a specific legal obligation or legal claim, taking applicable limitation periods into account. Technical records are retained only as long as justified by the operation and protection of the systems. Once the basis for retention ends, data is deleted or anonymised. You may request an explanation of the period or criteria applied to your data.

Cookies and your choice

Essential website functions are separate from optional analytics. Analytics is currently inactive, we do not set analytics cookies and we do not request advance consent. A control for changing analytics consent is not currently available.

Before activating an analytics service, we will provide a way to accept, reject and subsequently change or withdraw consent, together with an updated notice. The service will be able to load and start collecting data only after you consent. The planned storage period for your choice in the browser is limited to 182 days. Withdrawal will stop future collection and remove this website’s analytics cookies that the website can access. It does not affect the lawfulness of earlier processing or automatically erase data already collected by the service provider.

You can also remove your saved choice and cookies by clearing this website’s data in your browser settings. When analytics is available, we ask again once the choice is deleted or expires. While no analytics service is connected, its activation option is unavailable and we do not request advance consent. Once a service is connected, we request fresh, explicit consent. Consent to analytics does not cover advertising or unnamed future services.

Google Analytics and other analytics services

We plan to use Google Analytics, provided by Google Ireland Limited, Ireland, to analyse visits and improve content. The service has not yet been activated in this demonstration version. Before activation, we confirm the account settings, retention periods and data transfer arrangements, and update this notice to reflect them.

The initial setup is intended to measure page views, without additional interaction tracking. When enabled with your consent, the service may process pseudonymous cookie identifiers, pages visited, referral source, device and browser information, and approximate location. Google also processes IP addresses to operate the service, including for abuse prevention and approximate location. We remove query parameters and the part after the # sign from page and referral addresses before sending them. We do not send form contents, contact details or attachments to analytics.

Google Analytics uses cookies such as _ga , and the _ga_… to distinguish visitors and sessions. Their planned lifetime on this website is limited to 182 days, without automatic renewal on subsequent visits. Your browser may impose a shorter period. If the service is activated, cookie removal through withdrawal of consent will be available. You can also clear website data in your browser settings. We separately confirm and state the analytics account’s data retention period before activating the service. Data may also be processed outside Serbia, including in the United States, so the international transfer requirements described above apply. Consent to analytics does not replace the necessary lawful basis for such a transfer.

Further details are available in Google’s explanation of analytics data processing, explanation of IP address use outside the specified European regions , and the international transfer information. Before adding any other analytics service, we will identify its provider, purpose, data, retention and transfer arrangements, update the settings and obtain appropriate consent before collection begins.

Your rights

Subject to the conditions set out in the Law, you have the right to:

• obtain confirmation of processing, access your data and receive a copy.
• request correction of inaccurate data and completion of incomplete data.
• request erasure or restriction of processing where the legal conditions are met.
• object to processing based on legitimate interests on grounds relating to your particular situation.
• receive data in a portable format where processing is automated, is based on consent or a contract, and the other legal conditions are met.
• withdraw consent for processing based on that consent.

If data is processed for direct marketing, you may object to that processing at any time. An erasure request does not override a legal retention obligation or other statutory exceptions. Through this website, we do not make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you.

How to exercise your rights

Send your request to info@nsolutions.rs or our postal address. No special form is required. Please provide enough information for us to understand your request and locate the data. If we have reasonable doubts about the applicant’s identity, we may request only the additional information needed to confirm it.

We will inform you of the action taken without delay and no later than 30 days after receipt. This period may be extended by a further 60 days where necessary because of the complexity and number of requests. We will explain the extension and its reasons within the initial 30 days. Exercising your rights is generally free, subject to the statutory exceptions for manifestly unfounded or excessive requests.

If you believe your rights have been infringed, you may complain to the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, Belgrade, at office@poverenik.rs, and seek a judicial remedy. You do not have to contact us first to lodge a complaint.

Security and data in customer systems

Safeguards are determined according to the nature of the data and the processing risk, including restricted access and confidentiality requirements. No method of transmission or storage provides absolute security. Where a personal data breach requires notification to the Commissioner or affected individuals, the statutory conditions and deadlines apply.

Where we process data on a customer’s behalf as part of an agreed IT service, the customer determines the purpose as controller, and our work and access are governed by an appropriate agreement and the customer’s instructions. This policy for visitors and business contacts does not replace the notices and agreements for those services.

Changes and legal sources

We revise this policy to reflect changes to the website, business processes and legislation. The update date appears at the top of this page. We provide further information for any new processing purpose and obtain prior consent where required.

Official sources: the Serbian Law on Personal Data Protection, controller obligations and the Commissioner’s guidance , and the Law on Electronic Communications, Article 160.