Privacy policy

1. Applicable rules and contact

We operate from Belgrade. We apply Serbia’s Law on Personal Data Protection (Official Gazette RS 87/2018). The EU General Data Protection Regulation (GDPR) also applies where its territorial conditions are met, including relevant offers of services to people in the EU/EEA or monitoring of their behaviour there. A visit to this site alone does not determine GDPR applicability.

Send privacy questions or rights requests to office@bkk.rs, or write to our registered address. This is our privacy contact; it is not a statement that a statutory data protection officer has been appointed.

2. Data, purposes and legal grounds

• Enquiries: name, email, phone, subject, message and any organisation details you supply. We use these to reply, assess your request and discuss an engagement. The basis is taking steps at your request before a contract with you, or our legitimate interest in responding to business contacts when you represent an organisation. Organisation details are optional; the other marked fields are needed by the form. You may instead contact us by email.
• Security and delivery: for website security, availability and fault diagnosis, our application records requests to website pages and form endpoints. Records include the client and directly connected network peer IP addresses, a server timestamp in UTC with microsecond resolution, the page path without query parameters, HTTP method and status, processing duration, browser-supplied user agent and language preferences, referring website origin without its path or query, page language, request content length and, for form submissions, the outcome and selected topic/language. These logs exclude message contents, contact details, cookies and credentials. For approximate location and network information, our hosting server sends the visitor’s public IP address over HTTPS to IPWhois at ipwho.is. The lookup does not send the visitor’s user agent, website paths, form data or cookies to that provider. Where available, the result adds country, region, city, postal code, approximate coordinates, time zone, autonomous system number (ASN), internet service provider (ISP) and network organisation. IP geolocation is approximate and does not establish a person’s exact location. We do not collect clicks, scrolling or keystrokes through JavaScript, or create tracking cookies or persistent visitor identifiers. The form separately uses a session and CSRF token, and a hashed IP address with attempt times for abuse prevention. Our legal basis is our legitimate interest in protecting the website, keeping it available and diagnosing faults. IP addresses and associated records may be personal data; hashing is pseudonymisation, not anonymisation. The application does not put the IP address or browser user agent in enquiry emails.
• Optional map: only after your consent, your browser requests OpenStreetMap images and sends its IP address and technical request data to the provider. Refusing has no effect on enquiries. See Cookie & telemetry policy.
• Legal duties and disputes: where necessary, we retain or disclose relevant records to meet applicable legal obligations or establish, exercise or defend legal claims. We identify the relevant obligation or legitimate interest for the particular processing.
• We do not sell personal data, run advertising or behavioural analytics, or use website enquiries to make solely automated decisions with legal or similarly significant effects. Sending an enquiry does not subscribe you to marketing.

3. Recipients and international processing

Access is limited to personnel who need it for the enquiry, administration or security, and providers of hosting, email and technical support acting under appropriate confidentiality and processing terms. Professional advisers or competent authorities may receive relevant data when required or justified by law.

BKK processes enquiries in Serbia. Supplier infrastructure may involve other countries. A transfer requiring safeguards must use a valid mechanism under Serbian law and, where applicable, GDPR Chapter V, such as a recognised adequacy decision or approved contractual safeguards with supplementary measures where needed. Cookie consent does not replace a transfer mechanism. You may ask office@bkk.rs for the recipients, processing locations and applicable safeguards for your data, including a copy or explanation of the safeguards.

IPWhois (ipwho.is) receives visitors’ public IP addresses from our hosting server for location and network lookups. The request excludes the visitor’s user agent, website paths, form data and cookies. The provider and its delivery infrastructure may process these requests outside Serbia. Its own processing is described in its IPWhois - Privacy Policy. The international-transfer requirements described above apply where relevant; this notice does not itself establish a transfer mechanism.

If you enable the map, the OpenStreetMap Foundation and its delivery infrastructure receive the map requests. Tiles are delivered through a global network of cache servers, whose location is determined at request time. The provider’s own processing is described in its OpenStreetMap Privacy Notice.

4. Retention

We keep enquiry correspondence for as long as needed to handle the request and any reasonably expected follow-up. If it leads to an engagement, the relevant contract, accounting and legal retention requirements apply. We retain records longer only where necessary for a specific legal obligation or dispute; otherwise they are deleted or anonymised. You can request the applicable retention criteria for your matter.

Application request and security logs use a rolling window of 30 UTC calendar days, including the current day. Cleanup runs automatically during subsequent website traffic, at most once per hour. If the site receives no requests, deletion waits until a later request triggers cleanup. An aggregate storage limit of 128 MiB may remove the oldest logs sooner. Successful IP lookup results are cached locally for seven days, with at most 1,000 entries; expired entries are removed during subsequent request-triggered cleanup, so inactivity can also delay their deletion. Location and network information copied into request logs follows the logs’ retention window. Downloaded or exported copies, hosting logs and backups have separate retention arrangements; deleting a live application record does not remove those copies.

Form values awaiting a response are kept in the server session and removed when the contact page next displays them; remaining session data is subject to the server’s session expiry and cleanup. Rate-limit entries are valid for 15 minutes and expired entries are removed on the next validated form submission. Diagnostic mail-failure logs contain a timestamp and failure status only; on the next failure, entries older than 30 days are removed and the log is capped at 1,000 entries. Hosting logs and backups follow the applicable provider and operational retention schedules. Cookie lifetimes appear in Cookie & telemetry policy.

5. Your rights and complaints

Subject to the conditions in the applicable law, you may request access and a copy, correction, erasure, restriction and portability. You may object to processing based on legitimate interests for reasons relating to your situation, and object to direct marketing at any time. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. Map consent can be withdrawn through Cookie settings on every page.

We may request proportionate information to verify your identity. Under Serbian law we respond without undue delay, within 30 days; a necessary extension of up to 60 further days is explained within the original 30 days. Where GDPR applies, the corresponding period is one month, extendable by two further months with notice and reasons within the first month. Requests are normally free; any lawful exception will be explained.

You may complain directly to Serbia’s Commissioner for Information of Public Importance and Personal Data Protection: poverenik.rs, Bulevar kralja Aleksandra 15, 11120 Belgrade, office@poverenik.rs. Where GDPR applies, you may also complain to the competent EU/EEA supervisory authority, including where you habitually live, work or consider an infringement occurred. You retain the right to a judicial remedy; contacting us first is not a condition.

6. Security, sensitive material and changes

We use proportionate technical and organisational safeguards, including TLS in transit, access restrictions and form protection. No system is risk-free. Do not send passwords, private keys, special-category data, criminal-offence data or incident evidence through the public form. We can arrange a suitable channel and the necessary terms. The site is intended for adult private clients and professional contacts, not services directed at children.

This notice applies from the date shown above. Material changes will be highlighted here; new optional processing will not begin on the basis of an old, incompatible consent. The four language versions are intended to convey the same rights and practices.