Draft for legal review. Not yet in force.
This policy explains what personal data we handle when you use bigital.agency, why we do it, who we share it with, and what rights you have. We keep it short and plain on purpose.
1. Who we are
The controller of your personal data is:
- Legal name: [Legal name]
- Address: [Registered address], Belgrade, Serbia
- Registration number (MB): [MB]
- Tax ID (PIB): [PIB]
- Email: hello@bigital.agency
- Phone: [Phone]
We are a consulting company. We help businesses with consulting, standard operating procedures (SOPs), automation and software, and we are a Shopify Partner. Our clients are businesses in the EU, the UK and the US.
EU representative (GDPR Art. 27): [EU representative, if required — confirm with lawyer]
2. Which laws apply
- The Serbian Law on Personal Data Protection (ZZPL, Official Gazette RS 87/2018), because we are established in Serbia.
- The EU GDPR, where Article 3(2) applies, that is, where we offer our services to people in the EU.
- The UK GDPR, where we offer our services to people in the UK.
3. What data we collect, why, and on what legal basis
| Situation | Data | Purpose | Legal basis |
|---|---|---|---|
| Visiting the website | Technical data such as IP address, browser, device type, pages viewed, approximate country | Delivering the site, keeping it secure, measuring traffic in aggregate | Legitimate interest (running and securing our site) |
| Free audit form | Name, work email, company website (optional), areas of interest, free-text message | Replying to you and preparing the audit | Steps prior to entering into a contract at your request; legitimate interest in answering business enquiries |
| Booking a call | Name, email, chosen time slot and anything you enter in the booking form | Scheduling and holding the call | Steps prior to entering into a contract; legitimate interest |
| Newsletter | Email address (and name if you give it) | Sending our newsletter | Your consent |
| Business email | Email content and contact details when you write to us | Communicating with you | Legitimate interest; contract where a client relationship exists |
| Legal and accounting duties | Invoices, contracts and related records for clients | Meeting tax, accounting and legal obligations | Legal obligation |
We do not ask for sensitive personal data. Please do not put it in the free-text field.
4. Who we share data with
We use a small number of service providers (processors) who handle data on our behalf under written agreements:
| Provider | What for | Data involved |
|---|---|---|
| Cloudflare | Hosting (Cloudflare Pages), content delivery, security, Turnstile anti-spam on forms, cookieless Web Analytics | Technical data, IP address, form-protection signals |
| Resend | Delivering form submissions to us by email | Contents of the audit form |
| HubSpot (CRM) | Storing and managing contacts and enquiries | Audit form data, correspondence |
| [Booking provider: Calendly or Cal.com] | Scheduling calls. It has its own privacy policy, which applies when you use its booking page. | Name, email, time slot |
| Google Workspace | Business email, calendar and documents | Email correspondence, files |
| Brevo | Sending the newsletter | Email address, subscription status |
We may also share data where the law requires it, or with professional advisers (lawyers, accountants) bound by confidentiality.
We do not sell your data and we do not share it for advertising.
5. How long we keep data
| Data | Retention |
|---|---|
| Audit form and booking enquiries | [24 months] after our last contact with you, unless a client relationship follows |
| Client records | For the duration of the contract, then as long as tax, accounting and limitation rules require |
| Newsletter subscription | Until you unsubscribe, then only a minimal suppression record so we do not email you again |
| Website technical logs | Kept by Cloudflare for the periods stated in its documentation [confirm] |
After these periods we delete or anonymise the data.
6. International transfers
We are based in Serbia, which is outside the EU/EEA and the UK. Several of our providers are in the United States or other countries. When personal data is transferred outside the EU/EEA or UK, we rely on appropriate safeguards, such as Standard Contractual Clauses or the EU-US Data Privacy Framework where the provider is certified.
[confirm transfer mechanism per provider]
You can ask us for a copy of the safeguards at hello@bigital.agency.
7. Cookies and similar technologies
Our site does not use advertising or tracking cookies. Analytics are cookieless and no personal profiles are built. The site stores two small items in your browser that are needed for it to work as you expect. Details are in our Cookies page.
8. Your rights
You have the right to:
- Access the personal data we hold about you.
- Rectify data that is wrong or incomplete.
- Erase your data, in the cases the law provides.
- Restrict how we use your data.
- Data portability: receive your data in a common format.
- Object to processing based on our legitimate interests.
- Withdraw consent at any time, for example by using the unsubscribe link in any newsletter. Withdrawal does not affect what we did before.
To use a right, email hello@bigital.agency. We may ask you to confirm your identity. We reply within 30 days. If a request is complex we may extend this as the law allows, and we will tell you why.
9. Complaints
You can complain to the Serbian Commissioner for Information of Public Importance and Personal Data Protection (Poverenik, poverenik.rs). If you are in the EU or the UK, you can also complain to your local data protection authority. We would appreciate the chance to fix the problem first, so please write to us.
10. Automated decisions, selling and ad tracking
- We do not make decisions about you based solely on automated processing, and we do not profile you.
- We do not sell personal data.
- We do not use advertising trackers.
11. Security
We use reasonable technical and organisational measures: encrypted connections (HTTPS), access controls and a limited set of trusted providers. No system is perfectly secure. If a breach puts your rights at serious risk we will notify you and the authority as the law requires.
12. Children
Our services are for businesses. The site is not directed at children and we do not knowingly collect data from them.
13. Changes to this policy
We may update this policy. The date at the top shows when it last changed. For significant changes we will say so on the site.