1. Data controller

The controller of your personal data is:

Stefan Bojić PR Grafički Dizajn Priboj (SB Grafix), 29. oktobra 53, 31330 Priboj, Serbia · Registration no.: 67604415 · Tax ID: 114474137 · Email: sbgrafix.mail@gmail.com

For any privacy questions or to exercise your rights, write to the email address above.

2. What data we collect

  • Contact form inquiries: full name, email address, company name (optional), services you are interested in, estimated budget and timeline, message, site language and the page the inquiry was sent from.
  • Newsletter sign-ups: email address, site language and the page you signed up from.
  • Email communication: any data you share with us in correspondence.
  • Booking a call: when you book through Calendly, you enter data directly on Calendly and it is processed under their privacy policy.
  • Analytics and marketing data, only with your consent: visit and usage data collected by Google Analytics and Meta Pixel (see the Cookie Policy).
  • Technical data: IP address and browser information in the hosting provider's server logs, used for security and to prevent form abuse.

We do not collect special categories of personal data (such as health data) and ask you not to include them in messages.

3. Purposes and legal basis

  • Replying to inquiries, preparing proposals and pre-contract communication: steps taken at your request before entering into a contract.
  • Delivering agreed services: performance of a contract.
  • Sending the newsletter: your consent, which you can withdraw at any time.
  • Visit analytics and ad measurement: your consent given through the cookie banner.
  • Site security and preventing form abuse: our legitimate interest.
  • Meeting legal obligations (e.g. accounting and tax rules): legal obligation.

4. How long we keep data

  • Inquiries that do not lead to a project: up to 24 months after the last communication.
  • Client data and contract documents: for the duration of the collaboration and the periods required by law.
  • Newsletter: until you unsubscribe or ask for deletion.
  • Cookies: the periods listed in the Cookie Policy.

When the period expires, we delete the data or permanently anonymize it.

5. Who else has access

We do not sell your data or share it with third parties for their marketing. We use trusted service providers (processors) who process data only on our instructions:

  • Supabase: database for inquiries and newsletter sign-ups, with servers in the European Union (Ireland).
  • Netlify: website hosting (USA).
  • Google: Google Tag Manager, Google Analytics and Google Ads for ad measurement (with consent) and Gmail for email communication.
  • Meta Platforms: Meta Pixel for ad measurement (with consent).
  • Calendly: call scheduling.

We may also disclose data to public authorities when required by law.

6. International transfers

Some providers are located in the European Union and the United States. Transfers to the EU go to countries considered to provide an adequate level of protection. For transfers to the US we rely on standard contractual clauses and, where applicable, the EU–US Data Privacy Framework those providers have joined.

7. Your rights

Regarding your data, you have the right to:

  • know whether we process your data and receive a copy of it;
  • request correction of inaccurate or incomplete data;
  • request deletion;
  • request restriction of processing;
  • receive your data in a structured, machine-readable format (portability);
  • object to processing based on legitimate interest;
  • withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

Send requests to sbgrafix.mail@gmail.com. We will reply without undue delay and within 30 days at the latest. If you believe your rights have been violated, you can lodge a complaint with the Serbian Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, Belgrade (www.poverenik.rs), or with the supervisory authority in your EU country of residence.

8. Data security

The site uses an encrypted HTTPS connection. Only an authorized person can access the inquiry database, with sign-in and database-level access control. Forms are protected against automated abuse. No system is completely secure, but we apply reasonable technical and organizational measures.

9. Children

The site and our services are not intended for people under 15, and we do not knowingly collect their data.

10. Changes to this policy

We may update this policy from time to time. The date of the last change is shown at the top of the page, and we will announce significant changes on the site.