Privacy policy

This policy describes what data we collect when you visit xolus.rs or contact us, why we collect it, how long we keep it, and what rights you have over it.

Who we are

Xolus is a software studio based in Serbia. You can contact us at [email protected] for any questions regarding your data.

What data we collect

Contact form submissions. When you send us a message through the site form, we collect: your name, email address, optionally phone number and company name, message content, optionally a selected budget range and source (how you found us). In addition, we automatically log your IP address, referrer (the site you came from, if any), and any UTM parameters from the URL.

Technical logs. Our server keeps standard access logs (IP address, time, path, response status) for security reasons and error detection.

Analytics. We use Umami, a self-hosted analytics solution that doesn't use cookies and doesn't track individual users across sites. Anonymized statistical data about visits is recorded: path, source, device type, country.

We don't use Google Analytics, we have no advertising cookies, we don't sell your data to third parties, and we don't profile you for third-party marketing.

Why we collect this data

• To respond to your inquiry — the contact form exists only for that.
• To analyze site traffic — which pages get read, where people come from, so we can improve content.
• For security reasons — IP addresses in logs help us detect and prevent abuse.

Legal basis for processing

We process data on the basis of:

• Your consent (when you send us an inquiry through the form),
• Legitimate interest (for site security and anonymized analytics),
• Legal obligation when it exists (e.g. retention of certain logs).

Processing complies with the Serbian Personal Data Protection Act (ZZPL) and the EU General Data Protection Regulation (GDPR), when applicable.

Who we share data with

We forward contact form data to our transactional email provider (ZeptoMail / Zoho), exclusively for delivering your message to our inbox. We don't share your data with other third parties.

We self-host the analytics — data from Umami doesn't leave our infrastructure.

How long we keep data

• Contact form inquiries: up to 24 months after the last communication, then we delete them (unless the inquiry leads to a contractual relationship, in which case the contract's retention period applies).
• Technical logs: up to 90 days.
• Anonymized analytics: aggregated, kept indefinitely, but contains no personal data.

Your rights

At any time you have the right to:

• Get confirmation of what data we process about you and a copy of that data,
• Request correction of inaccurate data,
• Request deletion of data ("right to be forgotten"),
• Restrict processing or raise an objection,
• Transfer your data to another controller,
• Withdraw consent at any time.

To exercise any of these rights, send us an email at [email protected].

You also have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia.

Cookies

The site doesn't set tracking cookies. Your browser may use technical cookies necessary for the site to function (e.g. for remembering language choice) — these carry no personal data.

Changes to this policy

When we change something significant, we'll update the date at the top of the page. Material changes are announced through a notice on the site.

Contact

For any questions: [email protected].

---