Privacy Policy
Effective date: June 10, 2026
This Privacy Policy explains how Pyramind, a sole proprietorship (preduzetnik) registered in the Republic of Serbia (the “Operator”, “we”, “us”), processes personal data of visitors and prospective clients of the website https://pyramind.tech (the “Site”) and of users of products developed by Pyramind under separate subscription agreements.
This document is drafted to comply with the Serbian Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti, “ZZPL”) and to align with Regulation (EU) 2016/679 (GDPR), the UK GDPR and DPA 2018, the Brazilian LGPD (Law No. 13.709/2018), the Swiss revised FADP, and the California CPRA to the extent applicable to our processing.
A separate Russian-language policy (/legal/politika-obrabotki-pd.md) governs processing performed by our Russian affiliate (Sole Proprietor Dmitrii Litvinenko, RU) for Russian-resident clients under a separate contractual setup.
1. Controller and contact
- Operator (controller): Pyramind, sole proprietorship (preduzetnik) registered in the Business Registers Agency of the Republic of Serbia (APR).
- Registered name: [REGISTERED NAME — to insert]
- PIB (tax ID) / matični broj (registration number): [to insert]
- Registered seat: [address], Republic of Serbia
- Email for privacy enquiries:
dev@pyramind.tech - EU/UK Article 27 representative: to be appointed in writing before active marketing in the EU/UK and listed here. Until appointment, please direct all enquiries to
dev@pyramind.tech. - Data Protection Officer: not appointed; under GDPR Art. 37 / ZZPL Art. 56 not strictly required at the current scale of processing. We will reassess this if processing volume or sensitivity changes.
2. Personal data we process
We process the following categories of personal data:
- Contact data you submit through forms or by emailing us: name, business email, phone number, company name, company URL, preferred contact method (call / Telegram / WhatsApp), free-form message.
- Technical data automatically collected when you browse the Site: IP address, user-agent, referrer, time-zone, language, device and browser characteristics, pages viewed, events triggered. This data is collected only after analytics consent for non-essential cookies (see Section 6).
- Communication data: emails, messages, transcripts of voice or video calls if you initiate them. We record calls only with your prior explicit consent.
- Account / contractual data for clients under a Subscription Agreement: legal entity details, signatory names, billing data, invoice records.
We do not intentionally collect special categories of data (Art. 9 GDPR / Art. 17 ZZPL), data of children under 16 (Art. 8 GDPR), or biometric data via the Site. If you submit such data voluntarily through a free-form field, we will minimise and erase it.
3. Purposes and lawful bases
| Purpose | Lawful basis (GDPR Art. 6 / ZZPL Art. 12) |
|---|
| Responding to enquiries, sending proposals, conducting pre-contractual negotiations | (b) steps prior to entering into a contract; (f) legitimate interest in B2B outreach |
| Performance of a Subscription Agreement and related services | (b) |
| Site analytics, performance monitoring, A/B testing | (a) consent (granular, withdrawable); (f) for strictly necessary security telemetry |
| Marketing newsletters and re-engagement | (a) opt-in consent (no soft opt-in for non-customers) |
| Compliance with tax, accounting, AML, sanctions screening, court orders | (c) legal obligation; (f) legitimate interest in fraud and sanctions risk control |
| Defending legal claims | (f); (e) under Serbian public-interest grounds where applicable |
For California residents, the corresponding business purposes under the CPRA are: providing services, performing contracts, security and integrity, debugging, internal research, and limited marketing.
4. Recipients and processors
We share personal data with the following categories of recipients:
- Hosting and infrastructure providers — by default within the European Economic Area or the Republic of Serbia. For products delivered to clients in other regions, we may, with the client's prior agreement, use a regional cloud (UAE, Singapore, etc.).
- Email and messaging providers for replying to your enquiries (transactional email, Telegram, WhatsApp Business).
- Analytics providers — Yandex LLC (Yandex Metrica), only if you have given analytics consent. Yandex Metrica processes data in the Russian Federation; see Section 5.
- Payment, banking, and accounting service providers in the Republic of Serbia and, where applicable, in the recipient's country.
- Professional advisors — lawyers, auditors, tax advisors — under written confidentiality.
- Authorities — when required by Serbian law, EU/EEA law applicable through SCCs, court order, or to protect our rights.
A current list of our sub-processors for product clients is published as a separate document; see `/legal/en/sub-processors.md`.
5. International data transfers
The Operator is established in the Republic of Serbia. Serbia is not an EU member state and is not subject to a current adequacy decision under GDPR Art. 45. However, the Serbian Commissioner for Personal Data Protection has confirmed Serbian DP law as substantially aligned with the GDPR, and Serbia is on the Council of Europe Convention 108+.
For transfers from the EEA, UK, or Switzerland to Serbia we rely on:
- Standard Contractual Clauses (SCCs) under Commission Implementing Decision (EU) 2021/914 with supplementary measures (encryption in transit and at rest, access controls, audit logging) for ongoing engagements;
- Your explicit, informed consent under Art. 49(1)(a) GDPR for one-off interactions where appropriate;
- Contractual necessity under Art. 49(1)(b) where the transfer is necessary for the performance of, or the conclusion of, a contract you requested.
Where analytics consent is granted, technical data may be transmitted to Yandex (Russian Federation). Russia is not subject to an adequacy decision; we rely on your explicit consent (GDPR Art. 49(1)(a)) for this transfer, with the disclosure that Russian law may grant authorities access to data without remedies equivalent to EU standards.
6. Cookies and similar technologies
The Site uses cookies and similar technologies in three categories: strictly necessary, analytics, and marketing. Analytics and marketing cookies do not load until you give consent through our cookie banner (all non-essential storage defaults to denied). Detailed information on each cookie, retention periods, and opt-out controls is set out in our Cookie Policy.
You can withdraw or change cookie consent at any time via the “Manage cookies” link in the footer or on this page.
7. Retention
We retain personal data only for as long as necessary for the purpose of processing, then delete or anonymise it.
- Enquiry contacts (no contract concluded): up to 12 months from last contact, then deleted.
- Client contractual records: for the duration of the Subscription Agreement and 3 years after termination, plus the longer of (i) the statutory accounting and tax retention period under Serbian law (5 years for primary accounting books, 10 years for invoicing records, per the Serbian Accounting Law) and (ii) any retention required under your local law.
- Analytics data: as configured in the analytics provider (default 25 months for Yandex Metrica, unless you withdraw consent earlier).
- Marketing consents: until you withdraw consent or for 3 years from last engagement, whichever is earlier.
8. Your rights
Subject to applicable law, you have the right to:
- Access the personal data we hold about you (GDPR Art. 15 / ZZPL Art. 26 / UK GDPR / LGPD Art. 18 / CPRA §1798.110);
- Rectify inaccurate or incomplete data (Art. 16 / ZZPL Art. 29);
- Erase data (“right to be forgotten”) (Art. 17 / ZZPL Art. 30);
- Restrict processing (Art. 18 / ZZPL Art. 31);
- Data portability in a structured, commonly used, machine-readable format (Art. 20 / ZZPL Art. 36);
- Object to processing based on legitimate interests, including profiling (Art. 21 / ZZPL Art. 37), and, in particular, to direct marketing at any time;
- Withdraw consent at any time, without affecting prior lawful processing (Art. 7(3) / ZZPL Art. 15);
- Not be subject to a decision based solely on automated processing producing legal effects (Art. 22 / ZZPL Art. 38). We do not use such processing.
- For California residents: the right to know, delete, correct, opt out of sale or sharing, and limit the use of sensitive personal information (we do not “sell” personal data within the meaning of CPRA §1798.140(ad), but we will honour Global Privacy Control (GPC) signals).
- For Brazilian data subjects: the rights enumerated in LGPD Art. 18.
To exercise rights, email dev@pyramind.tech. We will respond within 30 days (GDPR/UK/LGPD/ZZPL) or 45 days (CPRA), with one possible extension as permitted by law. We may need to verify your identity before disclosing or modifying data.
You also have the right to lodge a complaint with a supervisory authority — the Serbian Commissioner for Information of Public Importance and Personal Data Protection (Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti) for matters under our remit; your local data protection authority in the EEA / UK; the ANPD in Brazil; or the California Attorney General / CPPA.
9. Security
We implement organisational and technical measures appropriate to the risk under Art. 32 GDPR / Art. 42 ZZPL, including encryption of data in transit, access controls, audit logging, regular backups with restoration testing, vulnerability management, and incident response procedures. In the event of a personal data breach affecting your data, we will notify the Serbian Commissioner within 72 hours where required, and notify you without undue delay where required by law.
10. Automated decision-making and profiling
We do not engage in automated decision-making producing legal or similarly significant effects on you (GDPR Art. 22 / ZZPL Art. 38). Where products we develop for clients embed AI/ML features, the client (controller) is responsible for compliance with Art. 22, the EU AI Act (Regulation (EU) 2024/1689), and equivalent provisions; we act as processor under a separate Data Processing Agreement.
11. Children
The Site is not directed to children under 16. We do not knowingly collect personal data from children. If you believe we have collected such data, please contact us and we will delete it.
12. Changes to this Policy
We will publish updates to this Policy on this page with a new effective date. Material changes will be highlighted at the top of the page for at least 30 days, and we will notify clients with a current Subscription Agreement by email.
13. Contact
For all privacy-related enquiries, requests, or complaints:
- Email:
dev@pyramind.tech - Postal address: [address], Republic of Serbia (available on request from the email above for service of formal legal correspondence).
This Privacy Policy is provided for information only and does not, by itself, replace contractual or statutory protections. In case of conflict between this English text and any local-language version, the English text governs for all data subjects outside the Russian Federation; for Russian-resident data subjects whose data is processed by our Russian affiliate, the Russian-language /legal/politika-obrabotki-pd.md prevails.