Legal

Privacy Policy

Last updated: 21 September 2026

This is a working English summary; the authoritative version is the Serbian one. It explains what data undiweb.net collects, why, who we share it with, and your rights. We aim to collect as little as possible.

1. Data controller

The data controller is UndiWeb, Balkanska 11a, 32000 Čačak, Serbia (VAT 111369135). For any privacy question, email info@undiweb.net.

2. What we collect

Only what you send us, plus minimal technical data needed to run the site:

  • Contact form: name, phone number and/or email address, and your message.
  • Chat with our assistant (SmartChatBot): the messages you write in the chat and any contact details you choose to leave there.
  • Technical data: standard logs kept by our server and Cloudflare (e.g. IP address, browser, timestamp) for security and operation.

No user accounts, no payments on the site, no sensitive data requested.

3. Purposes & legal basis

  • Answering your inquiry and preparing a quote — based on your consent and pre-contractual steps (GDPR Art. 6).
  • Security and correct operation of the site, including spam protection of the contact form — based on our legitimate interest.
  • Ad measurement (Meta Pixel, Google Ads, Google Analytics) and showing Google Maps — only with your consent, which you can withdraw at any time (the only exception are the anonymous, cookieless signals on the Serbian-language pages, see sections 4 and 5).

4. Processors & data transfers

We never sell your data. We share it only with vetted providers:

  • Resend (Resend, Inc., USA) — email delivery. Your name, email and message pass through Resend to reach us and to send your confirmation. Transfers outside the EU rely on appropriate safeguards (Standard Contractual Clauses).
  • Hetzner Online GmbH (Germany, EU — Frankfurt) — hosting and server logs, stored in the EU.
  • Cloudflare, Inc. (USA) — content delivery and protection: requests to the site pass through Cloudflare. The contact form also uses Cloudflare Turnstile, an automatic human-vs-bot check that processes your IP address and technical browser data.
  • Umami analytics — self-hosted on our infrastructure (analytics.undiweb.net). Cookieless, no personal data, no profiling — aggregate visit stats only.
  • SmartChatBot — our AI assistant (bot.undiweb.net). Chat messages are processed by our server and passed to an AI model provider to compose answers. Please don’t enter sensitive data in the chat.
  • Meta Pixel (Meta Platforms Ireland Ltd.) — only if you accept cookies: measures how many visitors from our ads send an inquiry. Not loaded without consent.
  • Google Ads and Google Analytics (Google Ireland Limited) — only if you accept cookies on this English version: measure how many visitors from our Google ads send an inquiry or call us. If you then send an inquiry, the email and phone number from the form are hashed before sending and used only for more accurate conversion measurement. On the Serbian-language pages, Google receives only anonymous, cookieless signals without consent (Google Consent Mode).
  • Google Maps (Google Ireland Limited) — the map on the contact page loads only after you click “Show map” or accept cookies; Google then receives your IP address and technical browser data.

Transfers outside the EU (e.g. to the USA) rely on appropriate safeguards — Standard Contractual Clauses or the EU–U.S. Data Privacy Framework.

5. Cookies

The site sets no tracking cookies without your consent, and Umami analytics is cookieless. On your first visit a banner asks for consent: if you accept, Meta Pixel and the Google tag (Google Ads / Google Analytics), which set their own cookies for ad measurement, and Google Maps on the contact page are loaded; if you decline, none of them is. You can also load the map on its own by clicking “Show map”.

Your choice, and what the chat assistant needs to continue a conversation, is kept in your browser’s local storage. You can change your choice at any time via “Cookie settings” at the bottom of every page.

6. Retention

Contact inquiries are kept for as long as needed for communication and cooperation, at most 24 months after the last contact, unless the law requires otherwise.

7. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict or object to processing, data portability, and to withdraw consent at any time.

To exercise any right, email info@undiweb.net. You may also lodge a complaint with your data protection authority.

8. Security

The site runs over HTTPS and access to data is limited. No system is perfectly secure, but we take reasonable technical and organizational measures.

9. Changes

We may update this policy; the current version applies from its publication date on this page.