Home

Privacy policy

Last updated: September 2, 2026
Version 1.0

This Privacy policy explains what personal data we collect, why we collect it, how long we keep it, who we share it with and what rights you have in relation to it.

We describe cookies and similar technologies on our website in detail in a separate document, Cookie policy.

1. Who the controller is

The controller of personal data is:

Company name	EQS INT d.o.o.
Registered office	Mirijevski bulevar 46, 11000 Belgrade, Republic of Serbia
Company registration number	20848430
Tax ID (PIB)	107671238
Email	office@eqsint.com
Phone	+381 64 235 26 28
Website	www.eqsint.com

Former company name. Until September 2026 we operated under the company name Euro Quality Standard INT d.o.o. Beograd. Only the company name has changed — the legal entity remains the same, with the same registration number (20848430) and tax ID (107671238). All consents given under the former name and all obligations assumed under this policy relate to the same controller.

For any questions about the processing of personal data and to exercise your rights, you can write to us at privacy@eqsint.com or at our registered office address.

2. Applicable regulations

We process data in accordance with:

the Law on Personal Data Protection (“Official Gazette of RS”, no. 87/2018) — hereinafter the LPDP;
Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data — hereinafter the GDPR, to the extent it applies to our processing;
the Law on Electronic Communications and Directive 2002/58/EC (ePrivacy), as regards cookies and electronic communications;
the Law on Electronic Commerce, as regards commercial messages;
the Law on Accounting, the Labor Law and other regulations that require us to retain certain documentation.

3. Key terms

Personal data — any information relating to a natural person whose identity is known or can be determined, directly or indirectly (name, email address, phone number, IP address, cookie identifier and the like).
Processing — any operation performed on data: collection, recording, storage, consultation, use, disclosure, erasure.
Controller — the party that determines the purpose and means of processing. In this policy, that is us.
Processor — a party that processes data on our behalf and on our instructions (e.g. a hosting provider).
Data subject — you.

4. What data we collect and where from

We collect data primarily from you — when you write to us, fill in a form, sign a contract or visit our website. To a limited extent, we may also obtain data from publicly available registers (the Serbian Business Registers Agency, LinkedIn business profiles) or from your employer when it is our client or partner.

4.1. Website visitors

On every visit, our server automatically logs technical data: IP address, date and time of access, browser type and version, operating system, the referring page and the pages you visited. We need this data for the security and stability of the website.

If you give consent, we also use analytics and marketing cookies — details in the Cookie policy.

4.2. Contact form and inquiries

When you contact us via the contact form, email or phone, we process: your first and last name, email address, phone number, company name and job title (if you provide them) and the content of your message.

4.3. Clients, suppliers and business partners

To conclude and perform contracts, we process: first and last name, position, business email address and phone number, company details, invoice and payment data, and records of communication during the engagement. For sole proprietors and individuals, we additionally process the address and personal identification number or ID card number when this is necessary to issue an invoice or meet a legal obligation.

4.4. Newsletter sign-up and marketing messages

We process your email address, possibly your name, and data on whether you opened a message and which links you clicked.

4.5. Job candidates

We process data from your CV and cover letter: first and last name, contact details, education, work experience, skills and anything else you send us. Please do not send us information that is not relevant to the job, and in particular no special categories of data (health, ethnic origin, political or religious beliefs, trade union membership).

4.6. What we do not collect

We do not process special categories of personal data (Article 17 LPDP / Article 9 GDPR) or data on criminal convictions, unless expressly required to by law. We do not buy databases from third parties.

5. Purposes of processing and legal basis

We carry out each processing operation for a clearly defined purpose and on one of the legal bases set out in Article 12 LPDP and Article 6 GDPR:

Purpose	Data	Legal basis
Responding to your inquiry and preparing a quote	Contact details, message content, employer details	Taking steps at your request prior to entering into a contract; our legitimate interest in responding to a business inquiry
Concluding and performing contracts, client support	Identification and contact details, contract data, payment data	Performance of a contract to which you are a party; for legal entities — our legitimate interest in communicating with the client's contact persons
Invoicing, bookkeeping, tax obligations	Identification data, invoice data	Compliance with a legal obligation of the controller
Establishing, exercising and defending legal claims	Contract and communication data	Our legitimate interest in protecting our legal interests
Sending newsletters and information about our services	Email address, name, open statistics	Your consent; for existing clients regarding similar services — our legitimate interest in direct marketing, with the option to object in every message
Website security, abuse prevention and troubleshooting	IP address, log records, strictly necessary cookies	Our legitimate interest in system security
Measuring traffic and improving the website	Analytics cookies and identifiers	Your consent
Advertising and remarketing	Marketing cookies and identifiers	Your consent
Selecting job candidates	CV data	Taking steps at the data subject's request prior to entering into an employment contract; for retention after the hiring process ends — your consent

When we rely on legitimate interest, we first weigh that interest against your rights and freedoms. On request, we can provide you with a summary of that assessment.

Providing data is voluntary. However, if you do not give us data that is necessary to conclude and perform a contract or that we are required to collect by law, we will not be able to enter into a business relationship with you.

6. How long we keep data

We keep data only as long as needed for the purpose for which it was collected, or as long as the law requires:

Type of data	Retention period
Inquiries that did not lead to an engagement	Up to 1 year from the last communication
Quotes and pre-contract communication	Up to 2 years from the last activity
Contract documentation and correspondence with clients	For the term of the contract and 10 years after it ends, in line with the general statute of limitations
Accounting documents, invoices and business books	For the periods prescribed by the Law on Accounting
Newsletter data	Until consent is withdrawn, and no longer than 3 years from the last interaction
Server logs	12 months
Data collected through cookies	According to the periods set out in the Cookie policy
Records of cookie consent	Up to 2 years, to demonstrate the lawfulness of processing
Candidates' CVs	6 months after the hiring process ends; longer only with your consent

If court, administrative or other proceedings have been initiated in connection with the data, we keep it until the proceedings are finally concluded. When the period expires, we delete the data or permanently anonymize it.

7. Who we share data with

We do not sell data or pass it on to third parties for their own marketing purposes. Data may be accessible to the following categories of recipients, and only to the extent necessary:

IT service providers — hosting, website maintenance, email, cloud storage, backup;
Analytics and advertising tools — if you have given consent (listed in the Cookie policy);
Newsletter platform — Salesforce Account Engagement (Pardot);
Accounting firm, auditors, lawyers and other advisors — within their legal authority and professional duty of confidentiality;
Banks and payment service providers — to process payments;
Public authorities — when required by law or by a decision of a competent authority (Tax Administration, courts, Ministry of Interior and others).

With all processors we conclude a data processing agreement in accordance with Article 45 LPDP and Article 28 GDPR, which binds them to confidentiality and appropriate safeguards. An up-to-date list of processors is available on request.

8. Transfers of data outside the Republic of Serbia

Some of the tools we use (for example for analytics, email or cloud storage) may involve transferring data outside the Republic of Serbia, including to the United States of America.

We carry out such transfers only when one of the conditions in Articles 64–69 LPDP or Articles 44–49 GDPR is met:

transfer to a country on the List of countries and international organizations deemed to provide an adequate level of protection, or to a country covered by a European Commission adequacy decision;
transfer using standard contractual clauses established by the Commissioner or adopted by the European Commission;
transfer to recipients in the US certified under the EU–U.S. Data Privacy Framework;
with your explicit consent, after we inform you of the possible risks.

On request, we can tell you the specific basis for a transfer and provide a copy of the safeguards applied.

9. Automated decision-making and profiling

We do not make decisions that produce legal effects concerning you or similarly significantly affect you based solely on automated processing, including profiling.

If you have consented to analytics and marketing cookies, third-party tools may carry out profiling for marketing purposes (for example, showing more relevant ads). You can withdraw that consent at any time, with no effect on your use of the website.

10. Data security

We apply technical, organizational and personnel measures appropriate to the risk, including:

encrypted communication with the website (HTTPS/TLS) and password-protected access;
multi-factor authentication for access to key systems;
access control on the principle of least privilege — data is accessed only by employees who need it for their work;
regular backups and recovery testing;
regular software updates and monitoring of security advisories;
confidentiality obligations for employees and contractors;
physical security of premises and keeping paper documents under lock and key.

In the event of a personal data breach likely to result in a risk to the rights and freedoms of natural persons, we will notify the Commissioner within 72 hours of becoming aware of it, and notify you without delay if the risk is high.

11. Your rights

With regard to your data, you have the following rights:

Right of access — to find out whether we process your data, which data, for what purpose, who we share it with and how long we keep it, and to obtain a copy.
Right to rectification and completion — to request that inaccurate data be corrected and incomplete data be completed.
Right to erasure — when the data is no longer needed for its purpose, when you withdraw consent, when you lodge a justified objection or when the processing is unlawful.
Right to restriction of processing — in the cases set out in Article 31 LPDP and Article 18 GDPR.
Right to data portability — to receive the data you have given us in a structured, commonly used and machine-readable format, or to have us transfer it to another controller where technically feasible.
Right to object — you can object to processing based on legitimate interest. Where direct marketing is concerned, we stop the processing immediately and without further justification.
Right to withdraw consent — at any time, as easily as you gave it. Withdrawal does not affect the lawfulness of processing carried out before it.
Right to lodge a complaint with a supervisory authority — see section 13.

How to exercise your rights

Send your request to privacy@eqsint.com or by post to our registered office address. We will respond without undue delay and no later than 30 days from receiving the request. We may extend that period by a further 60 days if the request is complex or there are several requests, in which case we will inform you within the first 30 days and explain why.

Handling your request is free of charge. If a request is manifestly unfounded or excessive, in particular because it is repetitive, we may charge reasonable administrative costs or refuse to act on it, giving our reasons.

If we have reasonable doubts about the identity of the person making the request, we may ask for additional information to confirm their identity.

12. Minors

Our services and website are not intended for children. We do not knowingly collect data from minors. In relation to information society services, processing based on consent is permitted if the minor is at least 15 years old; for younger children, the consent of a parent or guardian is required. In European Union countries the age is 16, or lower where national law so provides.

If we learn that we have collected a child's data without an appropriate legal basis, we will delete it without delay. If you believe your child has provided us with data, contact us at privacy@eqsint.com.

13. Complaint to the supervisory authority

If you believe we are processing your data in breach of the regulations, you have the right to lodge a complaint with the:

Commissioner for Information of Public Importance and Personal Data Protection
Bulevar kralja Aleksandra 15, 11120 Belgrade, Republic of Serbia
Email: office@poverenik.rs
Phone: +381 11 3408 900
Web: www.poverenik.rs

If you reside in the European Union, you may also lodge a complaint with the supervisory authority of the member state where you reside, work or where the alleged infringement took place. Your right to judicial remedy remains unaffected.

We would appreciate it if you contacted us directly first — we can resolve most concerns quickly.

14. Links to other websites

Our website may contain links to third-party websites. We have no control over how they operate and are not responsible for their privacy policies. We recommend reading them before you leave your data on those websites.

15. Changes to this policy

We may change this policy from time to time, for example when we introduce a new service or tool, or when regulations change. The current version is always published on this page, with the date of the last update at the top.

We will inform you of significant changes affecting your rights in an appropriate way — through a notice on the website or by email, if we have your address.

16. Contact

EQS INT d.o.o. Beograd
Mirijevski bulevar 46, 11000 Belgrade
Company registration number: 20848430
Tax ID (PIB): 107671238
Email: privacy@eqsint.com
Phone: +381 64 235 26 28