Book a call
Book a call

Privacy policy

Last updated:

NEMANJA MILJKOVIĆ PR AGENCIJA ZA KONSALTING U OBLASTI UPRAVLJANJA POSLOVANJEM HEROSA PARAĆIN, with its registered office in Paraćin (hereinafter: HEROSA or we), provides professional services in the fields of information security, data privacy and artificial intelligence strategy, as well as consultancy services related to compliance. Our goal is to support you in protecting and accelerating your business by becoming compliant with industry standards and regulatory requirements, including ISO 27001, ISO 22301, the EU GDPR, NIS2 and DORA.

This Privacy Policy applies to the website https://herosa.consulting/, including its subpages and language versions (hereinafter: the Website), including all available functionalities, as well as to the consultancy services provided by HEROSA (hereinafter: HEROSA Services).

The topics covered in this Privacy Policy are listed below:

1. How we collect information about you, for what purpose and on what legal basis, and our role in the processing

We may collect your personal data directly from you or from third parties, for example your employer or a colleague who provides us with your contact details in order to establish cooperation. Our role in the processing depends on whether we determine the purpose and means of the processing, in which case we act as the data controller, or process the data on behalf of and according to the instructions of a client, in which case we act as a data processor for the client. The typical processing activities in which HEROSA acts as the controller of personal data are described below.

1.1 HEROSA as data controller

When we collect certain personal data directly from you and determine the purpose and means of processing that data, we act as a data controller. Here you can see how, for what purposes and which personal data we collect from you: when you fill in our contact form, contact us directly or request a call. In the section on The security of your data you can find out where we store your data and how we protect it. In each of these situations, we are committed to ensuring that your data is used in the manner defined in this Privacy Policy and that appropriate technical and organisational measures are applied to keep it secure.

Contact form

When you fill in the contact form on the Website, whether you are asking us about our products or requesting a call back or a quote, you provide us with your personal data, namely: email address, first name, last name, LinkedIn profile (optional) and any other relevant personal data you choose to share in the free-text field. We will use this data only to give you appropriate answers and adequate information about our products. Depending on the subject of your request, we may ask you to provide some additional information, such as your company name, to make sure that you are a legitimate potential client. The legal basis for the processing is taking steps at the request of the data subject prior to entering into a contract, where the contract would be concluded with you as a natural person, or our legitimate interest in contacting potential customers and presenting our services, where you contact us with a view to concluding a contract with your employer or company as a legal entity.

Communication with client contact persons

When we communicate with you as a contact person or representative of an existing or potential client, we process your first and last name, business contact details, information about your position and the organisation you represent, as well as the content of our correspondence and other information we exchange. We use this data to arrange and organise our cooperation, prepare offers, monitor agreed activities and maintain the business relationship with the client. The legal basis for this processing is our legitimate interest in establishing and maintaining business communication and cooperation with clients. If you as a natural person are a party to the contract, we process the data in order to perform the contract with you or to take steps, at your request, prior to entering into a contract.

Technical data about visits to the Website

When you visit the Website, data such as your IP address, browser type and version, operating system, date and time of access, pages visited and information about technical errors may be processed automatically through the technical infrastructure of our service providers. We use this data to the extent necessary to display content, maintain the availability and security of the Website, fix errors and prevent misuse. The legal basis for this processing is our legitimate interest in ensuring the reliable and secure operation of the Website.

1.2 HEROSA as data processor

As a rule, our consultancy services do not require us to process personal data on behalf of a client. If such processing is nevertheless necessary for a specific engagement and we act as a processor in it, we process the data according to the client’s documented instructions and in accordance with the contract governing the processing and the data protection measures. The types of data and the purpose, scope and duration of such processing are determined for each engagement. For information about that processing and to exercise your rights, you may contact the client who is the controller, and we provide the client with the necessary assistance in handling such requests.

This Privacy Policy governs the way we process data and the protection measures we apply when we act as a data controller.

2. How we share information

In some cases, we may share personal data and information that we have collected or received from our clients, as described in the previous parts of this Policy. In this section we explain in which cases and to whom we provide personal data, and what we do to preserve the privacy of the data we share.

Our service providers and international data transfers

For the purposes of our business and the operation of the website, we use the services of third parties, including hosting providers and providers of email and cloud file storage services. When they process personal data on our behalf, these service providers act as processors, or as sub-processors where they are engaged by our processors.

HEROSA engages processors that provide sufficient guarantees for the protection of personal data and sets out in a contract their obligations regarding confidentiality, security and the lawfulness of processing, including the conditions for engaging sub-processors.

The use of these services may involve the transfer of personal data to other countries, in which case we ensure an appropriate legal basis for the transfer and the application of the necessary safeguards in accordance with the applicable regulations. For more detailed information about the service providers that process your data, their roles and the safeguards applied to international transfers, you can contact us at letstalk@herosa.consulting.

Legal requirements and protection of our rights

We may provide personal data to the competent authorities where we are required to do so by law or on the basis of their binding request. We may also provide data to other recipients where this is necessary for the establishment, exercise or defence of a legal claim, with an appropriate legal basis and only to the extent necessary for that purpose.

Change of ownership or control

HEROSA reserves the right to disclose and transfer information about users, including personal information, in connection with a corporate merger, consolidation, restructuring or other corporate change, including, without limitation, during any due diligence process.

3. The security of your data

We take appropriate measures to protect your information. When you submit personal information through the website, your information is protected both online and offline. While we use encryption to protect sensitive information transmitted online, we also protect your information offline. Only employees and associates who need the information to perform a specific job (for example, invoicing or customer support) are granted access to personally identifiable information. The computers/servers on which we store personally identifiable information are kept in a secure environment.

We have implemented technical and organisational security measures to protect personal data before processing any personal data, and additional security measures as agreed with our clients in Data Processing Agreements where we act as a data processor. HEROSA has adopted security measures including encryption, pseudonymisation, resilience of processing systems and backup of personal data, so that we are able to restore the system.

The security and privacy of our information, including personal data as important information, are based on best practices and a holistic approach to information protection and data protection. All our organisational and technical measures are applied taking into account high information security standards (e.g. ISO 27001) and the requirements of the GDPR and the Serbian Law on Personal Data Protection.

4. Your rights in relation to your data

You may exercise the rights described below under the conditions laid down in the Law on Personal Data Protection by sending a request to letstalk@herosa.consulting.

Right of access

You have the right to obtain confirmation as to whether we process your personal data, access to that data and a copy of it, as well as information about the purpose of the processing, the recipients, the retention periods and other circumstances of the processing.

Right to rectification and completion

You may ask us to correct inaccurate data about you and to complete incomplete data, taking into account the purpose of the processing.

Right to erasure

You may request the erasure of your data where the legal conditions are met, for example where the data is no longer necessary for the purpose for which it was collected. This right is not absolute, in particular where keeping the data is necessary to comply with legal obligations or for the establishment, exercise or defence of a legal claim.

Right to restriction of processing

You may request restriction of processing in the cases provided for by law, for example while we verify the accuracy of data you have contested or whether your objection to the processing is justified.

Right to object

Where we process data on the basis of legitimate interest, you may object on grounds relating to your particular situation. Following an objection, we will no longer process the data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms or that relate to the establishment, exercise or defence of a legal claim. While this assessment is under way, you may request restriction of processing.

Right to withdraw consent

Where the processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before its withdrawal.

Right to data portability

Where the processing is carried out by automated means and is based on consent or a contract, you may request to receive the data you have provided to us in a structured, commonly used and machine-readable format and to transmit it to another controller. You may also request that the data be transmitted directly to another controller, where technically feasible.

Right in relation to automated decision-making

You have the right not to be subject to a decision based solely on automated processing, including profiling, if such a decision produces legal effects concerning you or significantly affects your position, except in the cases provided for by law. HEROSA does not carry out such automated decision-making.

Right to lodge a complaint with the Commissioner

If you believe that we process your data in breach of the law, you have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection, at Bulevar kralja Aleksandra 15, 11120 Belgrade, or by email: office@poverenik.rs.

Data we process on behalf of a client

If a request concerns data that we process on behalf of a client as the controller, we will forward the request to the client and provide the necessary assistance in handling it.

5. Data retention

The processing of data we have received from our clients or directly from users of the Website is limited to the time needed to fulfil our obligations in connection with the requested service, unless a legal retention obligation applies, the limitation period for recovering the relevant claim is running, or the relevant proceedings or dispute are ongoing. Our obligations regarding the processing of data will always continue until the data is properly deleted or returned at the request of our customer. In order to fulfil our legal obligations, we will retain financial, accounting and payment data for the period required by law, and until the expiry of the limitation period for recovering our claims in respect of the relevant obligations, or for the duration of the relevant proceedings or dispute.

6. Our policy towards children

HEROSA Services are not directed at persons under the age of 18. We do not knowingly collect personal information from children under the age of 15. If we become aware that a child under the age of 15 has provided us with personal information, we will take steps to delete such information without delay. If you become aware that a child has provided personal information, please contact us at the following email address: letstalk@herosa.consulting.

7. Changes to our Privacy Policy

HEROSA may update this policy from time to time, and any changes will take effect on the date they are posted. We will notify you of significant changes in the way we treat personal information by posting a prominent notice on our website.

8. How to contact us

Please contact us with any questions or comments about this Policy, your personal data or your consent choices. If you have any issues to resolve, questions or complaints regarding this Policy or your personal data, you can contact us by email at letstalk@herosa.consulting.