Privacy Policy

This Privacy Policy (hereinafter referred to as the "Policy") outlines the procedure for processing and protecting personal data of users provided to VMTech DOO Beograd (Tax ID: 114779614, Registration Number: 22069152), registered in Serbia.

We strictly adhere to the Personal Data Protection Act of the Republic of Serbia and the EU General Data Protection Regulation (GDPR), ensuring the security of information received from users.

1. What data do we collect?

In the course of providing our services, we may collect the following data:

• Identification data: name, surname, email address, phone number.
• Technical data: IP address, browser and device information, cookies.
• Interaction history: data on site visits, page views, and activity.

2. How do we use your data?

The collected information is used for:

• Processing orders and providing services.
• Customer feedback and support.
• Improving service performance and personalizing user experience.
• Analyzing traffic and marketing campaigns.
• Compliance with legal requirements.

3. Data transfer to third parties

We do not transfer personal data to third parties without user consent, except when necessary to fulfill our obligations to the client (e.g., transferring data to logistics or payment partners).

We only work with reliable services that comply with GDPR requirements:

• Payment systems: Stripe, PayPal, AltaBanka, Banca Intesa Beograd, Raiffeisen Bank Serbia.
• Logistics partners: DHL, DPD, Posta Srbije, AKS Express Kurir.
• Analytics systems: Google Analytics, Facebook Pixel, Yandex.Metrica.

4. Data storage and protection

We take all necessary measures to protect information from unauthorized access:

• We use SSL encryption for data transmission.
• We limit access to data for employees working with confidential information.
• We regularly update security systems.

5. User rights

According to GDPR and Serbian legislation, you have the following rights:

• Right of access – request a copy of your personal data.
• Right to rectification – change or update inaccurate data.
• Right to erasure – request data deletion (if no longer needed for processing).
• Right to restrict processing – limit the use of your data.
• Right to data portability – request data transfer to another service.
• Right to withdraw consent – opt-out of personal data processing.

6. Cookies

Our website uses cookies to enhance service performance. Users can change browser settings to disable them, but this may affect site functionality.

7. Changes to the privacy policy

We reserve the right to change the Privacy Policy. All updates will be published on the website.

8. Contact information

If you have questions about data processing, contact us.

Using our website and services implies your consent to this Privacy Policy.

Data processed for an AI callback

For an immediate callback we process the phone number, optional name, locale, public-page context, device class, technical visit identifiers and consent records. If the call takes place, we may process the recording, transcript, summary, call timestamps, tool results and security events. The purposes are mobile-number ownership verification, delivery of the requested call and consultation, abuse prevention and proof of consent.

The legal bases are the user's request and steps before entering into or providing a service, express consent for optional marketing channels, and legitimate interests in security, abuse prevention and legal-claim defence. Marketing consent is not a condition of the callback and is not created by entering an OTP or submitting the callback request.

Processors and international transfers

Processing may involve contracted processors for phone-number verification, telecommunications infrastructure, hosting and technologies required for the voice AI consultation. Data is shared only to the extent necessary and subject to contractual, technical and organisational safeguards. Where processing occurs outside Serbia or the EEA, appropriate transfer safeguards are applied.

Retention, suppression and rights

Data needed for consultation continuity — the recoverable number, optional name, recording, transcript, summary, confirmed business-need facts, opportunity status and an agreed next action — may be retained for no longer than two years from the relevant interaction. At expiry it is deleted or irreversibly anonymised; captcha, OTP and client-code data keep their substantially shorter security periods. A pseudonymised phone identifier, minimal consent and audit records and an active no-contact decision may be retained longer where necessary to prevent a repeat call, maintain security or meet legal obligations. Marketing data is processed until consent is withdrawn.

\n

Irreversibly de-identified parts of successful and unsuccessful consultations may be used to measure quality and improve sales rules and the AI consultant. Call recordings, phone numbers, names, contact details and other direct or indirect identifiers are excluded from the learning set; a candidate undergoes controlled review before activation.

The user may request access, correction, deletion, restriction, objection, withdrawal of marketing consent or manual review of a suppression decision by writing to hello@vmtech.rs. Withdrawal does not affect the lawfulness of earlier processing.

Documentation attached to a project brief

\n

For each selected direction, the user may optionally attach up to five documents, no more than 20 MB per file. We process the file content, safely displayed original name, size, detected type and technical checksums to review the request, assess its scope and prepare a proposal.

\n

A file is uploaded immediately after selection to protected storage outside the public website and undergoes a local malware scan. It can be downloaded only by the authorised owner from the super-admin brief view. Files and download links are not sent by e-mail; confirmations may list only the safely displayed names of successfully stored files.

\n

Files belonging to an unfinished brief are deleted after the 24-hour technical draft expires. Files belonging to a submitted active brief are retained for no more than 180 days, or for 30 days after closure or 7 days after being marked as spam, whichever expires first. The user may request earlier deletion by writing to hello@vmtech.rs.