Privacy Policy

Article 1.General provisions and scope

This Privacy Policy (hereinafter: the Policy) describes the processing of personal data performed by the Controller through the limark.rs website, the client area (portal), the LimaChat conversational agent, the free diagnostic tools and the ordering process for LimaCloud, LimaMail and LimaChat services.

Processing is governed primarily by the Personal Data Protection Act of the Republic of Serbia ("Official Gazette of RS", no. 87/2018 - hereinafter: PDPA) and other applicable regulations.

Our services are intended for legal entities. However, data of contact persons, legal representatives and employees of our clients (name, business e-mail, phone) constitute personal data and are processed in accordance with this Policy.

Article 2.Data controller and contact

For all questions regarding personal data protection, exercising your rights or this Policy, you can contact us at:

• E-mail: [email protected]
• Phone: +381 11 441 4580
• Mail: LIMARK DOO, Knicaninova 14, 26101 Pancevo, Serbia

The Controller has not appointed a data protection officer, as the statutory conditions requiring one are not met; requests are handled directly by the Controller.

Article 3.Data we process and when

When you send an inquiry via the contact form we process: name and surname, e-mail address, phone number (optional), the content of your message, IP address, time of submission and page language. The IP address is used solely for abuse protection (Cloudflare Turnstile verification).

When ordering LimaCloud or LimaMail we process: company name, company tax ID (PIB), registration number (MB), contact person's name, business e-mail, phone, migration details you provide, an optional note, and the IP address and timestamp of accepting the Terms of Service (proof of contract formation).

Within the client portal we process login data (e-mail), support tickets you open, their content and attachments, and technical access records.

When you talk to the LimaChat agent on our site we process the content of the conversation and, if you choose to leave them, contact details (name, e-mail, phone). Article 6 describes this processing in detail.

The diagnostic tools process the domain, URL or IP address you enter, solely to run the requested check, and the visitor's IP address for rate limiting. Entered values are not linked to your identity.

For issued proforma invoices and invoices we process the data required by accounting and e-invoicing regulations (company data, PIB, MB, amounts, payment references).

Web servers record standard access logs (IP address, time, requested page, browser type) for security, error diagnostics and abuse prevention.

Article 4.Purposes and legal bases

• Responding to inquiries and pre-contractual steps (contact form, LimaChat, order processing) - Art. 12(1)(2) PDPA: processing necessary for the performance of a contract or actions preceding its conclusion.
• Providing contracted services (client area, support, provisioning, migration) - performance of a contract.
• Issuing proforma invoices and invoices, e-invoicing (SEF), bookkeeping - Art. 12(1)(3) PDPA: compliance with legal obligations.
• Security, abuse prevention, rate limiting, technical logs - Art. 12(1)(6) PDPA: legitimate interest of the Controller in protecting its infrastructure and services.
• Site usage statistics (Google Analytics) - legitimate interest in understanding site usage; data is used in aggregate form.
• Service notifications (proforma delivery, payment confirmation, renewal notices) - performance of a contract.

Article 5.Cookies and similar technologies

The site uses the minimum necessary cookies and similar technologies:

• Essential - client area session (login) and language preference. Without them the portal cannot function.
• Statistics - Google Analytics (_ga cookies), used to measure visits in aggregate. IP addresses are processed by Google on our behalf.
• Security - Cloudflare Turnstile sets technical tokens during bot verification on forms.
• LimaChat - the chat widget keeps local technical state (e.g. conversation continuity) in your browser.

You can delete or block cookies in your browser settings at any time; the site remains usable, except for portal login which requires the session cookie. We do not use advertising cookies.

Article 6.LimaChat and AI processing

LimaChat is our own conversational agent. Conversations are processed on LIMARK's own infrastructure - they are not forwarded to third-party AI providers, are not used to train third-party models and are not sold.

Conversation content is used to answer your questions, improve the agent's knowledge base and, where you request an offer or leave contact details, to follow up on your inquiry. Contact details are never guessed or generated - only the values you explicitly provide in the conversation are recorded.

The agent responds automatically, but no decision producing legal effects concerning you is made by automated means (Article 13 of this Policy).

Article 7.Recipients and processors

Personal data may be disclosed to the following categories of recipients, strictly to the extent necessary:

• Cloudflare, Inc. - Turnstile bot protection on forms (IP address, technical browser data);
• Google LLC - site statistics (Google Analytics);
• Banks and payment operators - processing of payments against proforma invoices;
• SEF (system of electronic invoices) and competent state authorities - where required by law;
• Professional advisers (accounting) - to the extent required for bookkeeping.

Hosting of the site, e-mail, LimaChat and client data takes place on the Controller's own infrastructure. Where a processor is engaged, the relationship is regulated by a data processing agreement pursuant to Art. 45 PDPA.

Article 8.Transfers out of Serbia

Data is primarily processed on infrastructure in the Republic of Serbia and the European Union. Parts of the infrastructure (network points and probe locations) may be located in EU countries; EU member states are on the Government of Serbia's list of countries providing an adequate level of protection, so such transfer is permitted under Art. 64 PDPA.

Providers such as Cloudflare and Google may process limited technical data outside Serbia; transfers rely on adequacy decisions or appropriate safeguards (standard contractual clauses) pursuant to Art. 65 PDPA.

Article 9.Retention periods

• Contact form inquiries - up to 12 months after the last communication, unless the inquiry results in a contract;
• LimaChat conversations - up to 12 months, after which they are deleted or anonymized;
• Order and contract documentation - for the duration of the business relationship and afterwards for the statutory limitation periods;
• Proforma invoices, invoices and accounting records - within the periods prescribed by accounting, tax and e-invoicing regulations (as a rule 10 years);
• Client area and tickets - for the duration of the business relationship, then to the extent needed for evidencing;
• Technical logs - up to 90 days, longer only where needed to investigate a security incident;
• Statistics - in aggregate form per Google Analytics settings.

Upon expiry of the retention period data is deleted or irreversibly anonymized.

Article 10.Data security

The Controller applies technical and organizational measures appropriate to the risk: encrypted transport (TLS/HTTPS) on all pages and services, access control on the least-privilege principle, its own monitored infrastructure, regular backups (RapidBackup), attack protection (RapidProtect), access logging and network isolation of internal systems.

In the event of a personal data breach likely to produce a risk to the rights and freedoms of individuals, the Controller shall notify the Commissioner within 72 hours, and the data subjects where the risk is high, pursuant to Arts. 52 and 53 PDPA.

Article 11.Your rights

With respect to your personal data you have the right to: access, rectification and supplementation, erasure, restriction of processing, data portability, objection to processing based on legitimate interest, and withdrawal of consent at any time where processing is based on consent (withdrawal does not affect processing before withdrawal).

Requests are submitted to [email protected]. We respond without undue delay, and at the latest within 30 days of receipt; the deadline may be extended in accordance with the PDPA for complex requests. Exercising rights is free of charge.

Article 12.Complaint to the Commissioner

If you believe that processing of your data is unlawful, you have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection: Bulevar kralja Aleksandra 15, 11120 Belgrade, Republic of Serbia, www.poverenik.rs.

Article 13.Minors and automated decision-making

Our services are intended for legal entities and are not directed at minors. We do not knowingly collect data of persons under 15 years of age; should we learn of such collection, the data will be deleted.

The Controller does not make decisions based solely on automated processing, including profiling, that would produce legal effects concerning data subjects.

Article 14.Changes and final provisions

The Controller may amend this Policy; the applicable version with its effective date is always published on this page. For material changes, active clients will be notified by e-mail or through the client area.

This Policy complements the LimaCloud Terms of Service and the LimaMail Terms of Service. In case of discrepancy between language versions, the Serbian version prevails.