1. Data controller
The controller is IVANCO DOO, company registration number 20102519, tax identification number 104148545, registered at Španskih boraca 69, Belgrade – Novi Beograd, Serbia. Business office: Bulevar vojvode Mišića 37, Belgrade.
For questions and rights requests, contact macarnenad@ivancodoo.com or write to the registered address marked “Personal data protection”.
This notice covers visitors to ivancodoo.rs and users of associated contact forms, calculator requests and consultation booking. Processing of client documents for accounting and tax services is covered by separate notices and contracts.
2. Personal data we process
We obtain data directly from you when you write to us, submit a form or request an appointment, and automatically when you access a website, to the extent needed for the particular function:
- Inquiries and quotations: name, email, telephone if provided, company name if provided, inquiry type and message.
- Calculator requests: name, email, selected language, requested tool and whether separate marketing consent was given.
- Bookings: contact details, selected appointment and information you provide to prepare for the consultation.
- Technical data: IP address, access time, visited page, device and browser information, data needed to process form submissions and security records.
- Business correspondence: incoming and outgoing message content, participants, communication times and attachments you provide.
- Evidence of choices: consent or opt-out records and information needed to record and respect your choice.
Fields marked mandatory are needed to handle that request. Without an email address, we cannot email the requested link; without the details necessary for booking, we cannot confirm an appointment. Optional details may be omitted. Do not send national identification numbers, health information, payment card details or employee documents through public forms.
3. Purposes and legal bases
Quotations and consultations requested by an individual. Where you request pre-contractual steps on your own behalf, we process contact details and your request to take those steps under Article 12(1)(2) of Serbia’s Law on Personal Data Protection (the Law).
Business inquiries and communication. Communication with representatives of legal entities and other business inquiries that are not pre-contractual steps with the individual concerned are based on IVANCO DOO’s legitimate interest in receiving, handling and answering business communications, under Article 12(1)(6) of the Law. We use data needed for that discussion and respect your right to object.
Delivery of the free calculator. We use your name and email to handle your request and provide the requested material, based on our legitimate interest in providing information explicitly requested. Delivery is not consent to additional advertising.
Website and communication security. Necessary technical data is processed to detect misuse, prevent unauthorized access and maintain availability, based on our legitimate interest in protecting information systems under Article 12(1)(6).
Marketing through GHL/Automarketar. We do not currently use GHL/Automarketar to send marketing messages. An inquiry, calculator request or appointment does not automatically subscribe you to marketing. Before introducing marketing messages through this system, we will inform you and obtain separate consent under Article 12(1)(1). Consent will not be required to receive an answer, requested material or consultation, and may be withdrawn.
Organization of business correspondence. We associate business messages with CRM contacts to maintain continuity and follow the particular request, based on our legitimate interest in organized business communication. This does not authorize additional advertising without an appropriate legal basis.
Legal obligations and claims. We retain or disclose data where necessary for a specific legal obligation under Article 12(1)(3), or to establish, exercise or defend a specific legal claim based on an appropriate legitimate interest. These bases do not justify indefinite retention of all inquiries.
4. Contact forms and connected services
Contact using an email application. If a button opens your email application, the message is delivered only when you send it from that application. Clicking alone does not confirm receipt by IVANCO DOO.
Connected forms and calculators. Submitting a connected GHL/Automarketar form sends its data to HighLevel/LeadConnector infrastructure for handling the request, CRM records and related communication. Submission time, language, page address, a technical submission identifier and browser information may also be processed.
Bookings and confirmations. We use supplied details to process bookings and messages needed for the requested service. A receipt confirmation, requested material link or appointment notice is distinct from additional promotional messages.
Email and CRM. We use Gmail/Google Workspace and GHL/Automarketar for business communication. When a mailbox is connected to the CRM, associated correspondence may be synchronized and accessible to authorized people in both systems. Receipt in one system does not mean all its archives and copies are covered by the same deletion procedure.
Assistance with replies. Platform AI reply suggestions may involve processing message content to generate the suggestion. A generated suggestion does not itself confirm that a reply was sent. Our procedure calls for human review before using suggestions. Automarketar’s public AI policy describes general conditions; it does not confirm the AI provider, processing locations or retention period for functions active in our account.
GHL/Automarketar is not currently used for marketing messages. If a form offers a separate marketing option, an unchecked option is not consent and submitting the request does not automatically subscribe you. Recording a form choice is distinct from sending marketing messages. Read the short notice beside the particular form before submitting it.
5. Recipients and processors
Access is available to authorized IVANCO DOO personnel and service providers requiring access for a specific function:
- Hosting: UNITED INTERNET DOO BEOGRAD, trading as unlimited.rs, hosts the website and associated server functions under the OPTIMUM+ Web hosting package. Support confirmed in writing that production infrastructure is in Belgrade and encrypted backups are in Germany.
- Forms, CRM and bookings: biz koncept LLC, 75E 3rd St, Sheridan, Wyoming 82801, United States, provider of Automarketar; HighLevel and LeadConnector infrastructure within the services used.
- Email and message delivery: Google for Gmail/Google Workspace business email and GHL/HighLevel/LeadConnector infrastructure for connected forms and automation messages. Connecting a business mailbox enables associated correspondence to be processed in the CRM too.
- External resources: Google for Google Fonts and an embedded map when loaded; Cloudflare and other CDN providers when a particular page uses their security or distribution services.
Controller, processor and subprocessor roles depend on the processing involved. IVANCO DOO is controller for inquiry data processed for our business purposes; infrastructure providers may process data on our behalf. Providers may act as independent controllers for their separate purposes, such as managing their own accounts and legal obligations.
Data is disclosed to competent authorities where required by law. We do not sell user data to advertisers. An external link does not automatically send the content of your inquiry to the destination website. See section 10 for embedded resources.
6. Processing outside Serbia
International infrastructure may involve storing data or remote access outside Serbia.
- Automarketar: the contractual provider, biz koncept LLC, is established in the United States. Using the platform may involve US transfers even without marketing messages. Public information about HighLevel/LeadConnector includes processing in the US and support from India; specific subprocessors depend on the service used.
- Hosting: UNLIMITED.RS confirmed for our OPTIMUM+ package that website files and databases used on that hosting are in Belgrade, Serbia. Backups are transferred to encrypted remote storage in Germany, which is not the website’s regular execution location. The confirmation covers email only if hosted in its cPanel system; it does not determine the location of our Google Workspace or GHL email.
- Google: business email and data needed to deliver external resources may be processed within the provider’s international infrastructure.
- Cloudflare: technical data may be processed outside Serbia on connected pages using its security or resource delivery services.
Transfers are subject to the Law’s requirements: an adequate level of protection where applicable, or appropriate safeguards for the particular transfer. You may request information about recipients, processing countries and available safeguard documentation through our privacy contact. Automarketar’s public DPA mentions standard contractual clauses and other lawful mechanisms where required, but that statement alone does not identify the instrument applicable to every transfer from Serbia. An account-specific confirmation of countries, subprocessors and contractual instruments, including AI processing, has not yet been provided.
Public service notices are available from Automarketar, HighLevel and unlimited.rs. General notices do not replace information about the specific transfer of your data.
7. Retention periods
Retention depends on the data and purpose. Completion of one purpose does not authorize use for another.
- Inquiries that do not lead to a contract: up to 3 calendar months from the last substantive communication about that inquiry, unless longer retention is necessary for a legal obligation or specific legal claim. Substantive communication means an actual inquiry, response or discussion about it. An automatic receipt, email opening or promotional message does not extend the period. If the corresponding day does not exist in the target month, the period ends on that month’s last day.
- Calculator and appointment requests: during handling, delivery and related communication; if they remain only an unsuccessful business inquiry, the preceding period applies.
- Marketing choices in forms: where provided, retained only to the extent and for the period necessary to evidence and respect your choice. We do not currently use GHL/Automarketar for marketing. After withdrawal, only a minimal record necessary to respect the choice and, where needed, demonstrate lawfulness of previous processing is retained.
- Consent evidence and legal claims: only while needed to demonstrate lawfulness or address a specific legal claim within applicable time limits.
- Technical records: for the time necessary to detect and analyze incidents and protect systems; records needed for a specific incident are separated from routine records. Hosting records include access, error, security, system and authentication logs. Some are accessible through cPanel; authorized technical staff access system and security records. Rotation differs by category. Specific periods for our server have not yet been confirmed, so we do not state a single number of days.
- Backups: support states that our OPTIMUM+ package has automatic daily backups with declared retention of up to 50 days. Deleted files, databases and cPanel-hosted email may remain in earlier copies until rotation. After hosting ends, account backups may be kept for up to one further month for recovery, without guaranteed availability throughout that period and subject to hosting conditions. These periods do not automatically apply to Google or GHL/Automarketar copies, whose specific periods have not been confirmed. Data retained only for recovery is not intended for routine business use or re-enrollment in marketing.
Where data becomes part of documentation subject to statutory retention, the period prescribed for that document applies. Extended retention is limited to data needed for that obligation or specific claim. You may request the period applicable to your data.
The unsuccessful-inquiry period covers its data in routine business use, including CRM and business email. Where another justified purpose applies, data scope and access are limited. Deleting one inquiry does not mean deleting all existing-client data lawfully retained for other purposes.
8. Your rights
Subject to the Law, you have rights to information, access, a copy, rectification, erasure, restriction and portability where applicable. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
Objection. Where processing relies on legitimate interest, you may object on grounds relating to your particular situation. We then stop unless we demonstrate overriding grounds provided by law or a need relating to legal claims. You may object to direct marketing at any time; we will cease processing for that purpose.
Send a request in any format to macarnenad@ivancodoo.com or by post to our registered address. We respond without undue delay, within 30 days at the latest. Complexity or volume may justify an additional 60 days; we will explain the extension within the first 30 days.
If there are reasonable doubts about identity, we may request proportionate information needed to verify it. Rights requests are normally free, subject to statutory exceptions for manifestly unfounded or excessive requests.
You may complain to Serbia’s Commissioner for Information of Public Importance and Personal Data Protection and use other remedies provided by law.
9. Cookies, local storage and analytics
Website technologies. Cookies and similar device storage may operate or secure a particular function or remember a choice. Separate optional technologies are used for visitor statistics and campaign attribution. Calling a technology “functional” does not itself make it necessary.
Google Analytics. This notice is neither consent to Google Analytics nor confirmation that it is active on every connected page. Optional analytics on a particular page requires separate information about its purpose, provider, data, duration and how consent is given and withdrawn.
Hosting security. UNLIMITED.RS confirmed that our package does not automatically include Cloudflare CDN. It applies server WAF protection and does not inject analytics scripts, marketing cookies or visitor tracking into website content as part of standard hosting. This does not confirm the absence of technologies separately included in the main website, embedded calculator or funnel platform.
Cloudflare security. Connected pages using Cloudflare protection may set the security cookie __cf_bm. Provider documentation states it expires after 30 minutes of inactivity and detects bots. It is distinct from Google Analytics or marketing tracking; its presence depends on the page and configuration.
Form data. Sending contact details, request content and technical data needed for CRM form receipt is processing even without an analytics cookie. Sections 2–6 describe this processing.
Your choice. Where consent is required for device storage or access, it must precede that use, with refusal and later withdrawal available. Browsing further or submitting an inquiry is not consent. Browser settings allow you to view and delete cookies and local data; they do not replace required prior consent or remove inquiries already sent to business systems.
10. External content and links
The main website loads fonts through Google Fonts. Google may receive the IP address and technical data needed to deliver the font. The same principle applies to images or libraries loaded from external servers.
An embedded map, video or other external content may initiate processing when loaded, before a click. Where consent is required, it should be obtained before loading; processing technical data to deliver a requested resource is assessed separately.
Embedded calculator. The calculator page currently loads an external application from manus.space. Loading it connects your browser to that provider’s infrastructure and supplies technical data needed for display. It is not covered by the confirmation of Unlimited hosting server location.
Following an ordinary link away from our website subjects processing determined by the destination operator to its privacy notice. Our responsibility for selecting and embedding external resources remains as provided by law.
11. Security
We organize protection according to data type and risk through restricted access, appropriate authentication, protection of transfers, system maintenance and backup controls. Inquiry content is intended for people who need it to answer or support the service.
No information system is risk-free. Report suspected misuse or misdirected messages to our privacy contact. Do not submit confidential documents through public forms before agreeing an appropriate channel.
12. Updates and contact
We update this notice when processing, services or relevant rules change. Content version: 5 November 2026. Continuing to use the website does not constitute consent to new purposes.
For questions, recipient and retention information, withdrawal and rights requests: macarnenad@ivancodoo.com.