Privacy policy

Last updated: 27 October 2026

This is an English translation of the privacy policy. If the two versions differ, the Serbian text prevails.

Who processes the data

The data controller is ARHIFARM d.o.o., Đure Jakšića 19Ž, 11250 Belgrade, Serbia, registration number 07888791, tax ID (PIB) 101016158. For questions about your data and for requests under this policy: e-mail arhifarm@arhifarm.com, phone +381 63 184 31 63 and +381 69 231 88 50.

Inquiries through the form

The “Request a quote” form on the Contact page and on the service and product pages collects the name of the company or institution, the name of the contact person, a phone number or e-mail address and your message. The type of site, floor area or number of sites and the service are entered only if you wish.

We use the data to answer the inquiry, prepare a quote and arrange the service. The legal basis is taking steps at your request before entering into a contract (Serbian Law on Personal Data Protection, Article 12(1)(2)), and, when you send the inquiry on behalf of a company or institution, also our legitimate interest in answering a business inquiry (point 6).

Providing the data is voluntary. The company or institution, the contact person, one contact detail and the message are needed for us to reply; without them the inquiry cannot be sent. You can skip the other fields.

The inquiry is stored in the inquiry log on the website server and a notification about it is sent by e-mail. If you left an e-mail address, a confirmation that the inquiry was received is sent to it. The copy of the inquiry on the website server is deleted automatically 12 months after it was sent. We do not store your IP address with the inquiry.

E-mail, phone, Viber and WhatsApp

When you write to us or call us, we use the data from the conversation only to reply and arrange the work, on the same legal basis as for inquiries. Messages on Viber and WhatsApp pass through the Rakuten Viber and WhatsApp services, whose own privacy rules also apply, including transfers of data outside Serbia.

Site search

The text you type into the search box is used only to show results and is not stored, except as part of the page address in the server logs, which are deleted after 14 days.

Protecting the form from abuse

The form is protected by a check that runs in your browser and on the website server: a hidden field, a short background calculation, a time token and a limit on the number of inquiries from the same network. The check asks nothing of you and sends nothing to third parties. Your IP address is not stored for it, only a one-way record of it that changes every day. An inquiry that the check judges to be automated is rejected and not stored. The legal basis is our legitimate interest in protecting the form and the mailbox from unwanted messages (Article 12(1)(6)).

Server logs

On every visit the server records the IP address, the time, the page address and the type of browser. We use these logs only for security and troubleshooting, and they are deleted automatically after 14 days. The legal basis is our legitimate interest in keeping the website secure (Article 12(1)(6)).

Cookies, analytics, maps and video

The cc_consent cookie remembers your choice on the cookie bar (“Accept” or “Necessary only”) for one year. It is necessary, because without it the website would not know what you chose. A session cookie exists only in the administration area of the website, used by ARHIFARM staff when they sign in. The website does not use advertising tools.

Only if you choose “Accept” does the website load Google Analytics 4, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). It shows us how many visits there were, which pages are read and on what devices, so that we can make the website more useful. Until you choose, and if you choose “Necessary only”, Google’s code is not loaded and nothing is sent to it (Google Consent Mode, consent denied by default). Google Analytics 4 does not store IP addresses, Google signals and ad personalisation are turned off, and visit data is kept for 14 months. Analytics sets the cookies _ga and _ga_H48C96ZJ2Z, which last up to 2 years.

The legal basis for analytics is your consent (Law on Personal Data Protection, Article 12(1)(1), and Law on Electronic Communications, Article 160). You can withdraw consent at any time through the “Cookie settings” link at the bottom of every page, and the analytics cookies are then deleted. Google may also process data in the USA: Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has found an adequate level of protection (Article 64(2) of the Law), and it also applies standard contractual clauses.

The map and YouTube videos are not embedded: they lead to Google Maps and YouTube only when you click the link, and the rules of those services then apply. Videos from our sites load from our own server only when you play them.

Who has access to the data

We do not sell data or give it to others for advertising. Access is limited to:

• ARHIFARM employees who answer inquiries and run the business;
• the website developer D. Svilenković, who maintains the website, the server and the receipt of inquiries;
• server providers in Germany (European Union), where the website, the inquiry log and e-mail notifications run;
• Google Ireland Limited, for visit analytics, only if you accept it;
• the e-mail provider behind the address arhifarm@arhifarm.com;
• public authorities, only when the law requires it.

Transfers abroad

The website server is in Germany, which has an adequate level of data protection under Article 64(2) of the Law, so no separate approval is needed for that transfer. We make no other transfers, apart from those made by Viber and WhatsApp when you write to us through them and by Google when you accept analytics (see the section on cookies).

How long we keep the data

• We keep inquiries and correspondence while the communication and preparation of the quote last, and no longer than 12 months after the last contact. If a contract results from the inquiry, we keep the documents for as long as accounting and tax rules require.
• The copy of the inquiry on the website server is deleted automatically 12 months after it was sent.
• We keep server logs for 14 days.
• Google keeps analytics data for 14 months, and analytics cookies last up to 2 years or until you delete them.

At your request we delete data earlier, except data we are required by law to keep.

Your rights

Regarding your data you have the right to:

• find out whether we process your data and receive a copy (Article 26);
• ask for inaccurate data to be corrected or incomplete data to be completed (Article 29);
• ask for erasure (Article 30) and restriction of processing (Article 31);
• receive the data you gave us or ask us to transfer it to another controller (Article 36);
• object to processing based on legitimate interest (Article 37).

We make no automated decisions without human involvement and do no profiling (Article 38). If any processing is based on consent, you can withdraw consent at any time, without affecting the processing before withdrawal.

How to send a request

Send the request to arhifarm@arhifarm.com or by post to the registered office. We reply without delay and within 30 days at the latest; if the request is complex, the deadline can be extended by another 60 days, of which we inform you within the first 30 days. Exercising your rights is free of charge. Before acting we may ask you to confirm your identity, so that we do not give the data to the wrong person.

If you believe your data is processed contrary to the law, you can lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11120 Belgrade, Serbia, office@poverenik.rs, poverenik.rs.

Data security and minors

The website works only over an encrypted connection (HTTPS), the server is updated regularly, and only authorised persons with an account have access to the inquiry log. The form is intended for companies, institutions and adults. If we learn that a child under 15 has sent us data without parental consent, we delete it.

Changes to this policy

When the way the website works or processes data changes, we update this page and change the date of the last update. The rules for using the website are on the Terms of use page.