Privacy Policy

1. Introduction

GMD SOLUTIONS DOO BEOGRAD-NOVI BEOGRAD (“GMD”, “we”, “us”) respects your privacy and is committed to protecting personal data in accordance with applicable data protection laws, including the Law on Personal Data Protection of the Republic of Serbia and, where applicable, the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

This Privacy Policy explains how we collect, use, protect, and otherwise process personal data submitted through the GMD website.

This Privacy Policy applies to personal data processed through this website and does not replace any specific privacy notice or contractual data-processing terms that may apply to particular services, projects, campaigns, or business relationships.

2. Data Controller

The data controller for personal data processed through this website is:

3. Data Protection Officer

GMD has appointed a Data Protection Officer (“DPO”) who may be contacted regarding personal data protection matters and the exercise of data subject rights.

4. Personal Data We Collect

We collect personal data voluntarily provided by users through this website, including, where applicable:

• name and surname;
• email address;
• phone number;
• company name;
• job title or business role, where provided;
• message content and inquiry details;
• meeting scheduling details submitted by the user; and
• newsletter email address, subscription source, confirmation status and confirmation timestamps;
• the GMD page or topic viewed before a contact or newsletter action, where available;
• technical and usage information generated through consented analytics, such as visited page, referral source, device category and approximate location; and
• other information voluntarily provided in connection with a business inquiry or request.

We ask users not to submit personal data that is not necessary for the relevant inquiry.

5. Purpose of Processing

Personal data submitted through this website may be processed for the following purposes:

• responding to contact inquiries and requests;
• scheduling and conducting business meetings;
• communicating with prospective or existing clients, partners, and other business contacts;
• preparing proposals or taking steps requested by the user before entering into a contract;
• sending requested newsletter updates after double opt-in confirmation and managing opt-outs;
• understanding aggregated website use and successful contact-form outcomes where analytics consent has been given;
• maintaining records of business communications where reasonably necessary; and
• preventing abuse, securing the website, administering restricted systems and responding to legal or regulatory requirements.

Personal data submitted through the website is not used for direct marketing purposes without an appropriate legal basis and, where required, the user’s consent.

6. Legal Basis for Processing

Depending on the circumstances, GMD may process personal data on one or more of the following legal bases:

• the data subject’s consent;
• taking steps at the request of the data subject prior to entering into a contract;
• performance of a contract;
• compliance with a legal obligation; or
• GMD’s legitimate interests, where those interests are not overridden by the rights and freedoms of the data subject.

Where GDPR applies, these legal bases correspond, as applicable, to Article 6(1) of the GDPR.

Where processing is based on consent, consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

7. Contact Forms and Newsletter

Contact-form submissions are stored so authorised GMD personnel can assess and respond to the enquiry. The form may include context about the GMD page or topic viewed before submission. Contact notifications are delivered to GMD by its configured email provider. Please do not include credentials, special-category personal data or confidential information that is unnecessary for the initial enquiry.

Newsletter registration uses a double opt-in process. We store the email address, source context, verification status and relevant timestamps. A confirmation link is sent by email and expires after 48 hours. Confirmed subscribers may be synchronised with GMD’s Mailrelay distribution list. Consent can be withdrawn using an unsubscribe mechanism in a communication or by contacting gdpr@gmdhub.com.

8. Analytics, Cookies and Browser Storage

Google Analytics 4 is disabled by default and its script is loaded only after analytics consent. We use it for aggregated page-view information and to record that a contact form was submitted successfully. The analytics event does not contain the name, email, telephone number or free-text message entered in the form. Advertising storage, ad user data, ad personalisation and remarketing are disabled, and admin routes are excluded.

The website also uses necessary local storage to remember the analytics choice and session storage to retain limited page-interest context during a browser session. Details, names and durations are listed in the Cookie Policy.

9. Data Recipients and Service Providers

Personal data may be accessible to authorized GMD personnel who require access for the relevant business purpose.

Depending on the feature used, recipients and processors may include:

• Replit: website hosting, application, database and infrastructure services;
• Mailrelay and the configured business-email provider: contact notifications, subscription confirmation and newsletter distribution;
• Google LLC: consented Google Analytics 4 and, only when requested by the user, Google Maps content;
• Calendly: meeting scheduling when a user follows a Calendly link; and
• professional IT, security, legal or operational advisers where access is necessary and appropriately protected.

Such providers may process personal data only to the extent necessary for the relevant service and are subject to appropriate confidentiality, security, contractual, and data-protection requirements where applicable.

Personal data is not sold to third parties.

10. International Transfers

Where personal data is transferred or made accessible outside the Republic of Serbia or, where applicable, outside the European Economic Area, GMD applies the safeguards required by applicable data protection law.

Depending on the circumstances, such safeguards may include processing in a jurisdiction recognized as providing an adequate level of protection, appropriate contractual safeguards, or another lawful transfer mechanism.

Where the GDPR applies and a transfer requires additional safeguards, mechanisms such as the European Commission’s Standard Contractual Clauses may be used where appropriate.

GMD applies data minimization and appropriate security measures when personal data is transferred to or accessed by service providers in other jurisdictions.

11. Data Retention

Personal data is retained only for as long as reasonably necessary for the purpose for which it was collected.

For website inquiries and business communications, retention may depend on:

• the duration and nature of the communication;
• whether the inquiry develops into a contractual or business relationship;
• applicable legal, accounting, or regulatory requirements;
• the need to establish, exercise, or defend legal claims; and
• GMD’s applicable internal retention rules.

Where personal data is no longer required for a legitimate purpose, it will be deleted, anonymized, or otherwise handled in accordance with applicable retention requirements.

Unconfirmed newsletter links expire after 48 hours. Expired unconfirmed records are removed by the newsletter cleanup process. Confirmed newsletter details are normally retained until consent is withdrawn or the address is removed, subject to minimal suppression records needed to respect an opt-out. Analytics and browser-storage periods are described in the Cookie Policy. Administrative sessions expire after up to seven days.

12. Data Subject Rights

Subject to the conditions and limitations prescribed by applicable law, individuals may have the right to:

• obtain information about the processing of their personal data;
• request access to their personal data;
• request correction of inaccurate or incomplete personal data;
• request deletion of personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• request data portability where applicable;
• withdraw consent where processing is based on consent; and
• object to direct marketing at any time; and
• lodge a complaint with the competent data protection authority.

Requests relating to personal data protection and the exercise of these rights may be submitted to:

gdpr@gmdhub.com

GMD may request additional information where reasonably necessary to verify the identity of the person making the request and to protect personal data against unauthorized disclosure.

13. Complaints

Individuals have the right to lodge a complaint with the competent supervisory authority if they believe that their personal data has been processed in violation of applicable data protection law.

In the Republic of Serbia, the competent authority is:

Commissioner for Information of Public Importance and Personal Data Protection

Where the GDPR applies, individuals may also have the right to lodge a complaint with the competent supervisory authority in the relevant EU or EEA Member State.

Before submitting a complaint, individuals are welcome to contact GMD’s Data Protection Officer at gdpr@gmdhub.com so that we may review and address the matter.

14. Security

GMD applies appropriate technical and organizational measures designed to protect personal data against unauthorized or unlawful access, disclosure, alteration, loss, destruction, or misuse.

Such measures are selected taking into account the nature of the processing, the type of personal data involved, available technology, and the level of risk.

Access to personal data is limited to authorized persons with a legitimate business need, and GMD applies internal rules concerning confidentiality, access control, information security, incident management, and personal data protection.

Website controls include restricted administrative access, protected session cookies, password hashing, request-rate controls and the avoidance of contact-form content in routine API logs. No internet transmission or storage system can be guaranteed to be completely secure.

15. Third-Party Websites and Services

The GMD website may contain links to external websites or services operated by third parties.

Google Maps is loaded on the Contact page only when the user requests it. Calendly, LinkedIn, Trusty and other external destinations open as third-party websites. GMD is not responsible for privacy practices or content outside its control, and users should review the relevant third-party notices.

16. Children and Automated Decisions

This is a B2B website and is not directed to children. GMD does not knowingly use the public website to collect personal data from children. Website data is not used for solely automated decisions that produce legal or similarly significant effects for visitors.