Privacy Policy

This privacy policy explains what personal data we collect through this website, the purposes for which we use it, the legal basis for processing, how long we retain it, and the rights you have in relation to your data.

Last updated: [LAWYER: date]

DRAFT FOR LEGAL REVIEW — this text must be reviewed and approved by a lawyer before the site goes live. Items marked [LAWYER: …] must be completed or confirmed.

1. Data controller

The controller of personal data collected through this website is Care Connect, [LAWYER: full legal company name], registered at [LAWYER: address], company registration number [LAWYER: number], tax ID [LAWYER: VAT/PIB].

For any questions regarding data processing you may contact us at info@careconnect.rs or by phone at +381 64 466 8878.

[LAWYER: confirm whether a Data Protection Officer has been appointed. If so, provide contact details.]

2. What data we collect

Through the contact form: your name, email address, phone number, selected service, and the content of the message you send us.

Through the newsletter signup: your email address.

Technical data recorded automatically: IP address, browser type and version, operating system, time of access, and pages visited. This data is used solely for the security and stability of the website.

We do not intentionally collect health data through this website. Please do not enter information about your health, diagnosis, or treatment in the message field. If you nevertheless send us such data, we process it only to the extent necessary to respond to your inquiry, on the basis of your explicit consent.

[LAWYER: confirm whether any health data is processed via the website, and whether PSP programs require a separate, dedicated policy.]

3. Purposes and legal basis

Responding to your inquiry submitted through the contact form — legal basis: your consent, or steps taken at your request prior to entering into a contract.

Sending the newsletter — legal basis: your consent, which you may withdraw at any time.

Security, maintenance, and improvement of the website — legal basis: our legitimate interest in keeping the site functioning correctly and securely.

Compliance with legal obligations where such obligations exist — legal basis: compliance with the controller's legal obligations.

4. Who we share data with

We do not sell your data and do not share it with third parties for marketing purposes.

Your data may be processed by service providers performing technical tasks on our behalf, strictly on our instructions and under appropriate contractual safeguards: our hosting provider [LAWYER: hosting company name] and our form-processing service (Formspree Inc., USA).

[LAWYER: as Formspree processes data in the USA, confirm the transfer mechanism (e.g. standard contractual clauses) or consider replacing it with a local solution.]

We may disclose data to competent authorities where required to do so by law.

5. How long we retain data

Contact form messages are retained for [LAWYER: period, e.g. 12 months] after the end of our correspondence, unless longer retention is required to meet a legal obligation.

Newsletter email addresses are retained until consent is withdrawn or you unsubscribe.

Technical logs are retained for [LAWYER: period, e.g. 6 months].

6. Your rights

You have the right to access your data, to rectify inaccurate data, to erasure, to restriction of processing, to data portability, and to object to processing based on legitimate interest.

Where processing is based on consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

To exercise your rights, write to info@careconnect.rs. We will respond within the period prescribed by law.

If you believe your rights have been infringed, you have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia (www.poverenik.rs).

7. Data security

We apply appropriate technical and organizational safeguards, including an encrypted connection (HTTPS), access controls, and internal data-protection procedures.

8. Children

This website is not intended for children. We do not knowingly collect data relating to persons under [LAWYER: age under applicable law] years of age.

9. Changes to this policy

We may update this policy from time to time. The current version is always available on this page, along with the date it was last updated.