Privacy Policy

Last updated: November 4, 2026.

1. Data Controller

Sinfon d.o.o., Tax ID: 105917999, MB: 20490829, Tadije Sondermajera 5, 11070 Belgrade, Serbia. Contact: office@sinfon.rs, +381 11 785 4545.

Sinfon processes personal data in accordance with the Serbian Personal Data Protection Act ("Official Gazette RS" No. 87/2018, hereinafter: PDPA).

2. Data We Collect and Purposes

2.1 Contact Form

The contact form collects: name, email address, phone (optional), and message text. Messages are sent to office@sinfon.rs via SMTP (sender: gonzales@rezidual.rs). Email content is retained for 90 days and then automatically deleted.

Legal basis: legitimate interest (Art. 12(1)(6) PDPA) — responding to visitor inquiries.

2.2 Session Cookie

The website uses a cookie named "session" with a 30-day expiry. This cookie is necessary for website functionality (CSRF protection) and cannot be declined. It holds only a session identifier, with none of your name or anything else you have given us; the identifier itself is personal data and is processed as described in this policy. The security token is derived from the session on each request and is stored nowhere.

2.3 Rate Limiting

IP addresses are temporarily stored in server memory (60-second window), solely to protect forms from abuse.

Legal basis: legitimate interest (Art. 12(1)(6) PDPA) — system security.

2.4 Website analytics

If you accept analytics cookies, we measure traffic with Matomo, installed on our own server (analitika.rezidual.rs). Matomo records which pages you visit, where you arrived from, an approximate location derived from your IP address, and basic browser and device details. The data stays on our server, is not passed to any third party, and is not used for advertising or profiling. If you decline analytics, Matomo does not measure your visit and sets no cookies.

If you accept analytics, Matomo sets the cookies "_pk_id" (13 months) and "_pk_ses" (30 minutes). The "consent" cookie (12 months) stores your choice itself and is strictly necessary. You can change your choice at any time from the link in the page footer.

Legal basis: consent (Art. 12(1)(1) PDPA).

3. Third Parties and Data Transfers

3.1 Cloudflare Turnstile

The contact form uses Cloudflare Turnstile for bot protection. Cloudflare, Inc. (USA) processes the visitor's IP address and browser data. The transfer to the USA relies on standard contractual clauses (Art. 65 PDPA). More information: Cloudflare Privacy Policy.

3.2 Fonts

The website uses the Inter font hosted on its own server. Fonts are not loaded from external services and the visitor's IP address is not sent to third parties for font loading.

3.3 Google Maps

The contact page displays a Google Maps embed. Google LLC (USA) receives the visitor's IP address when the map loads. The transfer to the USA relies on standard contractual clauses (Art. 65 PDPA). The map loads only on the contact page.

4. Data Retention

• Contact messages (sent-mail record): the body of the message is deleted 90 days after sending. The recipient address, the subject and the time of sending remain in the record as a log of mail sent. The message itself also stays in the recipient’s mailbox under our internal mail retention practice.
• Session data: until session expiry (30 days of inactivity).
• Rate limiting data: 60 seconds, in server memory only.
• Cookie consent record: when you accept or decline analytics in the banner, we record the choice itself, your IP address, your browser’s user agent and the time of the choice, and keep that for 3 years so that we can show consent was given or refused. Legal basis: the legal obligation to keep a record of consent (Art. 12(1)(3) PDPA).

5. Your Rights

Under the PDPA, you have the right to:

• request access to your personal data (Art. 26 PDPA);
• request correction of inaccurate data (Art. 29 PDPA);
• request deletion of your data (Art. 30 PDPA);
• restrict processing (Art. 31 PDPA);
• receive your data in a structured, machine-readable format (Art. 36 PDPA);
• object to processing based on legitimate interest (Art. 37 PDPA);
• withdraw your consent at any time where processing is based on consent (Art. 15(3) PDPA). You withdraw consent for analytics from the "Cookie settings" link in the page footer; withdrawal does not affect the lawfulness of processing carried out beforehand.

Send requests to: office@sinfon.rs. We will respond within 30 days.

6. Right to Complain

If you believe your data is being processed unlawfully, you have the right to file a complaint with the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11120 Belgrade, www.poverenik.rs.

7. Data Security

We implement appropriate technical and organizational measures to protect your data. All communication with the website is encrypted via HTTPS. Access to the database is restricted to the application layer.

8. Automated Decision-Making

We do not take decisions about you by automated processing alone and we do not carry out profiling within the meaning of Art. 38 PDPA. Traffic measurement produces aggregate figures and is not used to evaluate individuals.

9. Changes to This Policy

We reserve the right to amend this policy. Any changes will be published on this page with an updated date.