Privacy Notice

1 Who this notice concerns

This draft covers website enquiries to Milica Vlk, operating under the VLK InfoSec Consulting brand in Belgrade, Serbia. It does not replace a client-specific data processing agreement.

To complete: full registered business name, registered office, registration number, PIB and a direct privacy contact. The current preview offers a contact route; the public business identity and contact details are not yet complete.

2 How the current contact form works

The contact form asks for your name, email address, enquiry topic and message, with optional organization and role. Service enquiries also ask about your goal, timing, approximate employee and system counts, industry, country, organizational footprint, IT environment, available team and documentation. Your role and additional context are optional; most scoping questions offer a “Not sure” answer. Website code holds the entries in the current page and prepares a message in your email application. It does not submit the entries to a website database. You choose whether to send that email. Your browser and email provider may handle information under their own settings and notices.

Once an email is sent, the message and sender details are processed through the receiving mailbox. The current page contains no document upload, newsletter subscription or AI chatbot. Please keep initial enquiries brief and avoid confidential client evidence or sensitive personal information.

3 Intended purposes and legal bases

The proposed purposes are responding to business enquiries, preparing an engagement and maintaining relevant business records. Pre-contract steps apply where the individual is a prospective contracting party; enquiries from company representatives may instead rely on a documented legitimate interest in business communication. Statutory records require the relevant legal obligation. An enquiry is not consent to marketing.

To complete: approve and document the actual purposes, legal bases and any legitimate-interest assessment. No marketing workflow is enabled in this preview.

4 Providers, recipients and transfers

The preview uses the Sites hosting and access service. A visitor’s email service handles the prepared message. Business email is intended to use the existing Google Workspace environment, subject to confirmation of the receiving mailbox. Authorized professional advisers may receive information only where required for an agreed purpose or legal duty.

To complete: confirm hosting and email contracting entities, processor agreements, support access, processing locations, subprocessors and transfer safeguards. No claim is made that all data stays in Serbia or the EU. Google Workspace subscription alone does not establish data residency. Zoho Books or other tools must be added if they receive enquiry or client data.

5 Retention and security

The proposed retention approach is to keep an enquiry only as long as needed for the discussion and any justified follow-up, then delete or anonymize it unless a contract, legal requirement or documented claim requires retention. Client, accounting and backup records require separate schedules.

To complete: approve concrete retention periods or operational criteria, deletion responsibility and backup retention. Verify mailbox access controls, MFA and the handling of client evidence before describing these as implemented controls.

6 Your rights

Depending on the processing and applicable law, you may request access, correction, erasure, restriction or portability, object to processing and withdraw consent where used. Requests can be raised through the contact route. You may complain to Serbia’s Commissioner for Information of Public Importance and Personal Data Protection. Statutory conditions and exceptions apply; the operating procedure should provide a response within the applicable deadline.

7 Automated decisions and changes

The current website code performs no profiling or automated decisions about visitors. Before adding a chatbot, analytics, server-side forms or uploads, VLK must reassess processing and update this notice. The hosting/access service’s own processing is distinct from the static page code.

Legal reference

Serbian Personal Data Protection Law, Official Gazette 87/2018. GDPR requires a separate territorial-scope assessment; an English website or an EU corporate customer alone does not establish all GDPR obligations.