Privacy policy

01
Who processes your data

The controller of personal data collected through this website is CD Agency d.o.o., Cetinjska 26, 11000 Beograd, Serbia, registration number 21587770, tax number 111998876.

For any question about your data, or to exercise the rights described below, write to office@cda.co.rs.

02
What the enquiry form collects

Your name, email address and message, and, if you choose to enter them, your company name, telephone number and building type. The confirmation box on the form records that you want us to answer the enquiry and that you have been informed about this policy.

Name, email address and message are required: without them we cannot answer, so the form will not send the enquiry. The other fields are optional.

03
Why we process it and on what legal basis

To answer your enquiry, prepare a quotation and agree the work. The legal basis is taking steps at your request before entering into a contract (Law on Personal Data Protection of the Republic of Serbia, Article 12(1)(2)) and, where you write on behalf of a company, our legitimate interest in answering business enquiries (Article 12(1)(6)).

We do not use the data for advertising, we do not build profiles and we make no automated decisions.

04
Protection of the form

The form is protected by a check that runs in your browser and on the website server: a short calculation in the background, a time token and a limit on the number of enquiries. It asks nothing of you, sets no cookies and sends nothing to third parties. Your IP address is not stored for it, only a one-way record that changes every day.

An enquiry that the check rejects as automated is discarded and not stored. The legal basis is our legitimate interest in protecting the form and our mailbox from unwanted messages.

05
Who receives your data

Your enquiry is sent by email to office@cda.co.rs, and you receive a confirmation that it arrived at the email address you left. A copy of the enquiry is kept on the website server and deleted automatically 12 months after it was sent. We do not sell, rent or pass your data to third parties for their own purposes. Access is limited to:

CDA staff who answer enquiries; D. Svilenković, who builds and maintains the website and the server; and the provider of the servers in Germany (European Union) on which the website, the enquiry copies, the notification emails and the CDA company email run. Public authorities receive data only where the law requires it.

06
Transfers abroad

The website and email server is in Germany, which provides an adequate level of data protection under Article 64(2) of the Law, so no separate authorisation is needed. We make no other transfers.

07
How long we keep it

Enquiries and the related correspondence are kept while the conversation and the quotation last, and for no longer than 24 months after the last contact. Enquiries that lead to a contract are kept for as long as the law requires for business records. The copy of an enquiry on the website server is deleted automatically 12 months after it was sent. Server logs are deleted after 14 days. On request we delete data earlier, except where the law requires us to keep it.

08
Server logs

On every visit the server records the IP address, time, requested page and browser type. We use these logs only for security and fixing errors, and they are deleted automatically after 14 days. The legal basis is our legitimate interest in keeping the website secure.

09
Analytics with your consent

The website uses no advertising or social media trackers, and fonts and images load from our own server. If you choose “Accept” in the cookie bar, the website uses Google Analytics 4 to count visits and see which pages are read most. The service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and the legal basis is your consent (Article 12(1)(1) of the Law).

Until you choose, and if you choose “Necessary only”, analytics is not loaded (Google Consent Mode: measurement is denied by default). IP addresses are not stored, Google signals and advertising features are off, and event data is kept for 14 months.

Data may be transferred to the United States. Google LLC is certified under the EU–US Data Privacy Framework, for which the European Commission has found an adequate level of protection (Article 64(2) of the Law). Google also applies standard contractual clauses.

10
Cookies

With your consent, analytics sets the cookies _ga and _ga_<ID>, which last up to 2 years. Your choice is stored in the cc_consent cookie for one year. You can change or withdraw it at any time with the “Cookie settings” button in the website footer; analytics cookies are deleted when you withdraw.

11
Your rights

You may request access to your data and a copy of it, correction or completion, erasure, restriction of processing and data portability, and you may object to processing based on legitimate interest (Articles 26 to 37 of the Law). Where processing is based on consent, you may withdraw it at any time without affecting earlier processing.

Write to office@cda.co.rs. We answer without undue delay and within 30 days at the latest; for complex requests the period may be extended by a further 60 days, and we will tell you within the first 30 days. Exercising your rights is free of charge. If we cannot confirm who is asking, we may ask for additional identification.

You also have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11120 Belgrade, Serbia, office@poverenik.rs, poverenik.rs.

12
Security and minors

The website works only over an encrypted connection (HTTPS), the server is kept up to date and access to data is limited to the persons listed above. The form is intended for businesses and adults; if we learn that a child under 15 has sent us data without parental consent, we delete it.

13
Changes

When the way the website or the processing works changes, we update this page and the date below.

Last updated: 2 November 2026.