Privacy notice for the Moesys website

1. Introduction and scope

1.1. This privacy notice (the “Notice”) explains how personal data is processed when you visit the website at moesys.net and its subdomains used for the website (the “Website”).

1.2. This Notice is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”) and Articles 23 and 24 of the Serbian Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti, Official Gazette of the Republic of Serbia, No. 87/2018, the “ZZPL”).

1.3. This Notice does not apply to the Moesys application at tool.moesys.net (the “Application”). The Application has its own privacy notice, which is made available to you when you sign in or create an account.

2. Controller

2.1. The controller of the personal data described in this Notice is Nikola Zgonjanin, a natural person resident in the Republic of Serbia, trading under the name “Moesys” (the “Controller”, “we”, “us”).

2.2. You may contact the Controller about any matter concerning your personal data at privacy@moesys.net.

2.3. The Controller has not appointed a data protection officer, as the conditions of Article 37 GDPR and Article 56 ZZPL are not met.

3. Definitions

3.1. Terms such as “personal data”, “processing”, “controller”, “processor” and “data subject” have the meanings given to them in Article 4 GDPR and Article 4 ZZPL.

4. Principles of the Website

4.1. The Website does not set cookies.

4.2. The Website does not use analytics, advertising, profiling or tracking technologies.

4.3. The Website does not load resources (such as fonts, scripts or images) from third-party servers, except Cloudflare Turnstile on the contact page, as described in clause 5.4.

4.4. The Website does not contain forms and does not request your name, email address or password.

5. Personal data processed, purposes and legal bases

5.1. Technical data of website requests.

Item	Description
Categories of data	IP address; date and time of the request; requested address (URL); browser and operating system information (user agent); technical status data
Purpose	Delivering the Website to your device; protecting the Website against attacks and misuse
Legal basis	Our legitimate interest in providing a functioning and secure website (Article 6(1)(f) GDPR; Article 12(1)(6) ZZPL)
Source	Your browser, automatically when you visit the Website

5.2. Correspondence.

Item	Description
Categories of data	Your email address; your name, if you provide it; your organisation and the topic you choose, if you use the contact form; the content of your message and of our reply
Purpose	Answering your enquiry and any follow-up
Legal basis	Steps taken at your request before entering into a contract (Article 6(1)(b) GDPR; Article 12(1)(2) ZZPL), or our legitimate interest in answering enquiries (Article 6(1)(f) GDPR; Article 12(1)(6) ZZPL)
Source	You, when you write to an @moesys.net address or send the contact form on the Website

5.3. Legitimate interests. Where we rely on legitimate interests, we have balanced those interests against your interests and fundamental rights. You may obtain information about this balancing on request (clause 2.2).

5.4. Spam protection on the contact form.

Item	Description
Categories of data	IP address; technical characteristics of your browser and device
Purpose	Checking that the contact form is used by a person and not by an automated program
Legal basis	Our legitimate interest in protecting the contact form and our mailboxes against spam and abuse (Article 6(1)(f) GDPR; Article 12(1)(6) ZZPL)
Source	Your browser, when you open the contact page (/contact)

6. Recipients and processors

6.1. We disclose personal data only to the following processors, which act on our documented instructions under a data processing agreement in accordance with Article 28 GDPR and Article 45 ZZPL:

Processor	Service	Location of processing
Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA	Hosting and delivery of the Website; protection against attacks; spam protection on the contact form (Cloudflare Turnstile); delivery of contact form messages to us; forwarding of email sent to @moesys.net addresses	Global network; see clause 7

6.2. We do not sell personal data and do not disclose it to third parties for their own purposes, except where we are required to do so by law.

7. Transfers outside the EEA and Serbia

7.1. Requests to the Website may be processed in Cloudflare data centres outside the European Economic Area and the Republic of Serbia, including in the United States.

7.2. Such transfers are based on the Standard Contractual Clauses adopted by the European Commission (Article 46(2)(c) GDPR), incorporated in Cloudflare’s data processing agreement, and, where applicable, on the certification of Cloudflare, Inc. under the EU–U.S. Data Privacy Framework (Article 45 GDPR). Transfers from the Republic of Serbia are made under Articles 64 and 65 ZZPL. You may request a copy of the relevant safeguards (clause 2.2).

8. Retention

8.1. Technical data of website requests (clause 5.1) is not stored by us. Cloudflare processes it for the time needed to deliver the request and may keep security logs for a limited period under its data processing agreement.

8.2. Spam protection data (clause 5.4) is not stored by us. Cloudflare processes it to check the form and may keep it for a limited period under its data processing agreement.

8.3. Correspondence (clause 5.2) is kept for as long as necessary to deal with your enquiry and any follow-up, and is deleted no later than 12 months after the last message, unless a longer period is required by law or for the establishment, exercise or defence of legal claims.

9. Your rights

9.1. Subject to the conditions set out in the GDPR and the ZZPL, you have the right:

1. to obtain confirmation of whether we process your personal data, and access to it (Article 15 GDPR; Article 26 ZZPL);
2. to have inaccurate personal data rectified (Article 16 GDPR; Article 29 ZZPL);
3. to have your personal data erased (Article 17 GDPR; Article 30 ZZPL);
4. to have processing restricted (Article 18 GDPR; Article 31 ZZPL);
5. to receive your personal data in a structured, commonly used and machine-readable format and to transmit it to another controller (Article 20 GDPR; Article 36 ZZPL);
6. not to be subject to a decision based solely on automated processing (Article 22 GDPR; Article 38 ZZPL). We make no such decisions.

9.2. Right to object. Where we process your personal data on the basis of legitimate interests (clauses 5.1 and 5.2), you have the right to object at any time, on grounds relating to your particular situation (Article 21 GDPR; Article 37 ZZPL).

9.3. To exercise your rights, write to privacy@moesys.net. We may ask you for information to confirm your identity. We respond without undue delay and in any event within one month of receipt. This period may be extended by two further months where necessary, in which case we will inform you (Article 12(3) GDPR; Article 21 ZZPL).

9.4. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.

10. Storage on your device

10.1. The Website does not store information on your device and does not read information from it, other than what your browser needs to display the pages. Details are in the cookies policy.

11. Obligation to provide data

11.1. You are not obliged to provide personal data to visit the Website. The technical data in clause 5.1 is necessary to deliver the Website to your device; without it, the Website cannot be displayed.

12. Security

12.1. We take appropriate technical and organisational measures to protect personal data, including encryption of all connections (HTTPS with HTTP Strict Transport Security), a restrictive content security policy, and access to systems limited to the Controller with multi-factor authentication.

13. Right to lodge a complaint

13.1. You have the right to lodge a complaint with a supervisory authority, in particular:

1. in the Republic of Serbia: the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti), Bulevar kralja Aleksandra 15, 11120 Belgrade, poverenik.rs (Article 82 ZZPL);
2. in the European Union or the European Economic Area: the supervisory authority of the Member State of your habitual residence, place of work or place of the alleged infringement (Article 77 GDPR).

14. Changes to this Notice

14.1. We may amend this Notice to reflect changes in the Website or in the law. The version number and the date of the last update are stated at the top of this Notice. We will give notice of material changes on the Website before they take effect.