Privacy policy

Who we are

This site and the client portal are operated by Uros Sumic, based in Belgrade, Serbia ("we", "us"). For any question about your data, write to uros@sumicodata.com.

A full postal address is available on request.

Two roles: controller and processor

For website visitors and leads, we are the controller: we decide why and how your enquiry and contact details are used, as described below.

For any data a client uploads into the portal, such as an accounting or POS export, we are a processor. We process that data only on the client's documented instructions, for the purpose agreed in a separate data processing agreement, and never for our own purposes.

What we collect

• Name, email address, company name and phone number, when you give them to us through a form.
• The message you write and any file you attach, including a data export sent for a diagnostic.
• Cookieless analytics: which page was viewed, the referring site, country and device type. No cookie is set for this and nothing is linked across sites or across visits.

Why we process it, and on what legal basis

• Responding to an enquiry or diagnostic request: our legitimate interest in running the business and answering the people who contact us.
• Delivering a signed engagement, including the client portal: performance of the contract with the client.
• Issuing invoices and keeping accounting records: a legal obligation under Serbian tax and accounting law.

How long we keep it

• Enquiries and leads that do not turn into a client: 24 months from the last contact, then deleted.
• Files uploaded for a diagnostic or as part of an engagement: deleted 30 days after they are no longer needed for that purpose.
• Invoices and accounting records: kept for as long as Serbian law requires.

Who else handles this data

We use a small number of processors to run the site and portal. Some are located outside Serbia; where that is the case, the transfer relies on the European Commission's standard contractual clauses.

• Hosting: Vercel.
• Database and file storage: Supabase.
• Scheduling: Cal.com, for booking a call.
• Email delivery: Resend, to send us a copy of your enquiry.

Your rights

• Access the personal data we hold about you.
• Have it corrected if it is inaccurate.
• Have it deleted, subject to what we must keep by law.
• Restrict or object to certain processing.
• Receive a copy in a portable format.

How to complain

We aim to respond to any rights request within 30 days. If you believe we have not handled your data properly, you can also complain to the Poverenik za informacije od javnog znacaja i zastitu podataka o licnosti (the Serbian data protection authority).

No automated decisions, no selling data, no ad profiling

We do not use your data to make automated decisions that affect you, we do not sell personal data, and we do not build advertising profiles. The cookieless analytics described above cannot identify you and is never combined with anything that could.

How we protect it

Access to client data is limited to what a role needs, enforced through row-level security in our database, and administrative actions are logged. See SECURITY.md in the project's source repository for the technical summary.

Changes to this policy

We will update this page if what we collect, or why, changes, and update the date above.