Privacy policy

1. Who we are

The data controller for this website is NSB INVICTUS, a company established in the Republic of Serbia.

Contact for all privacy matters: nikola.bera@gmail.com, +353 87 443 3160 (Ireland), +387 64 191 4707 (Serbia).

2. Scope

This policy applies to personal data processed through this website and through inquiries you send us. We process personal data in line with the Law on Personal Data Protection of the Republic of Serbia (Zakon o zaštiti podataka o ličnosti, Official Gazette RS No. 87/2018, "ZZPL"). Where we offer services to or monitor individuals in the European Union, we also comply with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR").

3. What data we process and why

3.1 Project inquiries and consultation requests

When you submit the contact form we process: your name, email address, company or organisation (optional), the topic you select, indicative budget and timeline (optional), the content of your message and your confirmation that you agree to this processing. We use this to respond to your inquiry, prepare proposals and, if we work together, to manage the business relationship.

3.2 Direct emails and phone calls

If you email or call us, we process your contact details and the content of the communication for the same purposes.

3.3 Spam and abuse prevention

To protect the contact form against automated abuse, our server derives a one-way cryptographic hash from your IP address and counts submissions per hour. The IP address itself is not stored by the form, and the hash is overwritten within one hour. If Cloudflare Turnstile is enabled on the form, Cloudflare processes limited technical information (such as IP address and browser characteristics) to distinguish people from bots.

3.4 Free website tools

When you use our free tools, we process the web address or domain you enter in order to fetch and analyse that public page or its DNS records. Results are shown to you and are not stored. As with the contact form, a one-way hash of your IP address is used for rate limiting and overwritten within one hour. If you request a full report, the results are sent to our team together with your name and email address (see 3.1).

3.4a Technical server logs

Like every website, our hosting provider automatically records technical data when pages are requested — such as IP address, date and time, requested URL, referrer and browser type — to deliver the website securely and to detect and resolve faults or attacks.

3.5 Website analytics (only with your consent)

If you accept analytics cookies, we use Google Analytics 4, loaded through Google Tag Manager, to understand how visitors use the website — for example which pages are viewed, how long visits last, the approximate region and the type of device. IP addresses are not stored in Google Analytics 4. We use this information only in aggregated form to improve the website. If you do not consent, Google Tag Manager and Google Analytics are not loaded at all.

3.6 What we do not do

We do not use advertising cookies without consent, do not sell personal data and do not make decisions based solely on automated processing that produce legal or similarly significant effects for you. We do not send newsletters unless you separately ask to receive them.

4. Legal bases

• Steps prior to entering into a contract / performance of a contract (ZZPL Art. 12(1)(2); GDPR Art. 6(1)(b)) — responding to inquiries about our services and delivering agreed work.
• Consent (ZZPL Art. 12(1)(1); GDPR Art. 6(1)(a)) — the processing you agree to when submitting the contact form, and analytics cookies. You can withdraw consent at any time without affecting earlier processing.
• Legitimate interests (ZZPL Art. 12(1)(6); GDPR Art. 6(1)(f)) — website security, spam prevention, server logs and handling general correspondence.
• Legal obligations (ZZPL Art. 12(1)(3); GDPR Art. 6(1)(c)) — keeping business and accounting records where the law requires it.

5. Service providers and recipients

We share personal data only with providers that help us run the website and communicate with you, under agreements that require them to protect it:

• Hostinger — website hosting, server logs and email delivery (processing primarily in the European Union).
• Google (Gmail / Google Workspace) — receipt and storage of inquiry emails.
• Google (Google Tag Manager, Google Analytics 4) — website analytics, only if you consent to analytics cookies.
• Cloudflare — bot protection on the contact form, only if Turnstile is enabled.
• GitHub — source code hosting; contains no visitor data.

We may disclose data to public authorities where required by law. We never sell personal data.

6. International transfers

Some providers (such as Google and Cloudflare) may process data outside Serbia and the European Economic Area, including in the United States. Where this happens, transfers rely on appropriate safeguards recognised under ZZPL and GDPR, such as adequacy decisions (including the EU–U.S. Data Privacy Framework for certified companies) or standard contractual clauses.

7. How long we keep data

• Inquiries that do not lead to a project: up to 24 months after our last contact, then deleted.
• Client correspondence and contract records: for the duration of the relationship and afterwards as long as required by accounting, tax and other legal retention obligations.
• Spam-prevention hashes: overwritten within one hour.
• Server logs: according to the hosting provider's retention period, typically a few weeks.
• Analytics data: event data in Google Analytics is retained for 14 months; analytics cookies expire after up to 2 years. Your consent choice is stored for 12 months.

8. Cookies and similar technologies

When you first visit, a banner asks for your choice. Optional cookies are only set after you agree, and nothing optional is loaded if you reject them. We use Google Consent Mode v2, so Google tags respect your choice.

No marketing or advertising cookies are currently in use. If we add them, they will only be set with your separate consent. Fonts and all other site resources are served from our own server. If Cloudflare Turnstile is enabled on the contact form, it may use strictly necessary technical storage for security purposes.

You can change or withdraw your consent at any time: open cookie settings. You can also delete cookies in your browser settings.

9. Security

The website is served exclusively over encrypted HTTPS connections with modern security headers. Form submissions are validated on the server, configuration secrets are stored outside the public web directory, and access to inquiry data is limited to the people who need it to respond.

10. Your rights

Under ZZPL (Articles 26–41) and, where applicable, GDPR (Articles 15–22), you have the right to:

• be informed about and access the personal data we hold about you;
• have inaccurate data corrected and incomplete data completed;
• have your data erased ("right to be forgotten");
• restrict processing;
• receive your data in a portable format;
• object to processing based on legitimate interests;
• withdraw consent at any time.

To exercise any of these rights, contact us at nikola.bera@gmail.com. We respond within 30 days and may ask you to verify your identity.

11. Complaints

You have the right to lodge a complaint with the supervisory authority in Serbia: the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti), Bulevar kralja Aleksandra 15, 11120 Belgrade, www.poverenik.rs. If you live in the European Union, you may also complain to the data protection authority in your country of residence — in Ireland, the Data Protection Commission (www.dataprotection.ie). We would appreciate the chance to address your concerns first.

12. Other information

Providing data is voluntary. Without the required form fields we cannot respond to an inquiry, but you can always email or call us instead.

Children. This website is intended for businesses and is not directed at children under 16.

Changes. We may update this policy when our services or legal requirements change. The effective date at the top always shows the current version.