Through this Privacy Policy, MVM Elektromontaža d.o.o. Kraljevo (hereinafter: the “Controller”) informs visitors of the elektromontaza.rs website, clearly and transparently, which personal data it collects and processes, for what purpose, on what legal basis, how long it keeps the data, and what rights you have in relation to your data.
This Policy complies with the Serbian Personal Data Protection Act (“Official Gazette of the RS”, No. 87/2018, hereinafter: the PDPA) and the General Data Protection Regulation of the European Union (Regulation (EU) 2016/679, GDPR).
1. Data controller
MVM Elektromontaža d.o.o. Kraljevo
Executive office: Aerodromska 7, 36000 Kraljevo, Republic of Serbia
Belgrade branch: GTC 19 Avenue, Vladimira Popovića 38–40, 11000 Belgrade, Serbia
Tax ID (PIB): 103545305 · Company registration number: 17613162
E-mail: office@mvmem.rs · Phone: +381 36 382 300
For any question regarding personal data protection and for exercising the rights described in section 11, write to office@mvmem.rs.
2. Definitions
Personal data — any data relating to a natural person whose identity is determined or determinable (e.g. name, e-mail address, IP address).
Data subject — the natural person whose personal data is processed.
Processing — any operation involving personal data (collection, storage, use, transfer, erasure).
Controller — the legal entity that determines the purpose and means of processing (in this case: MVM Elektromontaža d.o.o. Kraljevo).
Processor — a legal or natural person processing data on behalf of the Controller (e.g. the hosting provider).
Commissioner — the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia.
3. Principles of processing
We process personal data in accordance with Article 5 of the PDPA — lawfully, fairly and transparently. Processing is carried out for clearly defined purposes, data is limited to what is necessary, kept only as long as needed for the stated purpose, and protected by appropriate technical and organisational measures.
4. What data we collect and process
When you visit elektromontaza.rs, we collect the following categories of data:
4.1 Data entered through the form on the Careers page — first and last name, e-mail address, message content and, if you choose to attach it, a document in .pdf, .doc or .docx format (usually a CV, up to 5 MB). You provide this data yourself and voluntarily, together with the explicit consent you confirm in the form.
4.2 Technical access data — IP address, browser data (User-Agent), date and time of the visit, pages visited and the referring URL. This data is recorded automatically by the web server.
4.3 Data on your cookie choice — the choice you make in the cookie banner (accept, reject, or individual categories) and the date of that choice.
4.4 Data transferred to Google when the map is displayed — if you consent to the cookie category covering the Google map, your IP address and browser data are transferred to Google (see section 13).
We do not use website analytics tools, marketing tracking or visitor profiling on this site. Should this change, we will update this Policy and the cookie banner before introducing such tools.
5. Purposes of processing and legal basis
| Purpose | Legal basis |
|---|---|
| Considering an application sent through the form on the Careers page and communicating about that application | Explicit consent of the data subject (consent field in the form) and steps prior to entering into a contract — Article 12(1)(1) and (3) PDPA / Article 6(1)(a) and (b) GDPR |
| Website security and troubleshooting (server logs) | Legitimate interest of the Controller — Article 12(1)(6) PDPA / Article 6(1)(f) GDPR |
| Recording your choice in the cookie banner | Technical necessity for the consent system to function — Article 12(1)(6) PDPA |
| Displaying the Google map with the company location | Consent of the data subject — Article 12(1)(1) PDPA / Article 6(1)(a) GDPR |
6. Recipients of data
We do not sell personal data and do not forward it to third parties for marketing purposes. The following may have access to data:
- Authorised employees of the Controller — persons handling your application or enquiry.
- Hosting provider — provides the infrastructure for the website, as a processor under Article 45 of the PDPA.
- Website maintenance service provider — accesses the website for maintenance purposes, as a processor under Article 45 of the PDPA.
- Google — only when the Google map has been loaded with your consent (see section 13).
- State authorities — where required by law or by a decision of a competent authority.
7. International data transfers
The website is hosted in the Republic of Serbia. Data from the Careers page form, technical logs and consent records are not transferred outside the Republic of Serbia.
The exception is the display of the Google map: if you give consent, Google becomes a recipient of your IP address and technical browser data, including transfer to the United States. The transfer is carried out in accordance with Article 65 of the PDPA, applying the standard contractual clauses that Google uses for transfers outside the EU/EEA.
8. Retention periods
- Data from the Careers page form — for the duration of the application review process and a reasonable period afterwards, for possible future openings and the protection of legal interests, or until you request erasure. You may withdraw your consent at any time.
- Server technical logs — up to 90 days, after which they are deleted or anonymised.
- Cookie choice data — up to one year, or until you change your choice in the banner.
- Data transferred to Google when loading the map — governed by Google’s retention policy.
9. Data security
The Controller applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse:
- HTTPS encryption for all website traffic.
- Web server protection (firewall, regular software updates, security monitoring).
- Access to data limited to authorised persons within the organisation.
- Regular backups with controlled access.
Although we take reasonable protective measures, no system of data transmission over the internet is absolutely secure.
10. Personal data breach procedure
In the event of a personal data breach that may result in a risk to the rights and freedoms of natural persons, the Controller will notify the Commissioner within 72 hours of becoming aware of the breach, in accordance with Article 52 of the PDPA. Data subjects will be notified without undue delay where the breach may result in a high risk to their rights and freedoms.
11. Your rights
In accordance with Articles 26–39 of the PDPA and Articles 15–22 of the GDPR, you have the following rights:
- Right of access (Art. 26 PDPA) — to learn whether we process your data and which data.
- Right to rectification (Art. 29 PDPA) — correction of inaccurate or incomplete data.
- Right to erasure (Art. 30 PDPA) — the “right to be forgotten”, in cases provided by law.
- Right to restriction of processing (Art. 31 PDPA).
- Right to data portability (Art. 36 PDPA).
- Right to object (Art. 37 PDPA) — where processing is based on legitimate interest.
- Right to withdraw consent (Art. 15(3) PDPA) — at any time, without affecting the lawfulness of processing before withdrawal.
- Right to lodge a complaint with the Commissioner (Art. 82 PDPA) — see section 12.
Submit your request to office@mvmem.rs. You will receive a reply within the statutory deadline, no later than 30 days from receipt of the request.
12. Complaint to the Commissioner
If you believe your personal data has been processed contrary to the PDPA, you have the right to lodge a complaint:
Commissioner for Information of Public Importance and Personal Data Protection
Bulevar kralja Aleksandra 15, 11000 Belgrade, Serbia
E-mail: office@poverenik.rs · Phone: +381 11 3408 900 · Web: www.poverenik.rs
13. Google map (third party)
A Google map showing the company location is embedded on the Contact page. The map does not load automatically — until you give consent through the cookie banner, your browser does not connect to Google’s servers.
Once you give consent, Google may collect and process:
- the IP address of your device
- browser and operating system data
- the address of the page from which the map is loaded
- Google cookies already present on your device
Processing by Google is governed by Google’s privacy policy: policies.google.com/privacy.
You may withdraw your consent at any time by changing your choice in the cookie banner.
14. Cookies
The website uses cookies necessary for its operation and for remembering your choices (your cookie banner choice and your language selection), as well as cookies that are only set after your consent, when the Google map is loaded.
A detailed list of cookies, their purpose and duration is available on the Cookie Policy (EU) page. You can change your choice at any time in the cookie banner.
15. Changes to this Privacy Policy
This Policy may be amended or supplemented due to changes in regulations, at the initiative of the Controller or of a competent authority. All changes will be published on this page, with the date of the last amendment.
Last updated: 15 September 2026