Privacy policy

1. Controller and applicable framework

The controller is Fenjer Bestattung d.o.o., Trg cara Lazara 6, 25101 Sombor, Serbia. Questions and rights requests may be sent to direktor@fenjerbestattung.com or raised by telephone on +381 61 409 39 59. The controller determines the purposes and means of the processing described here.

The Serbian Law on Personal Data Protection applies to the business, and the General Data Protection Regulation applies where its territorial scope is engaged. This notice describes the present website configuration. It does not replace statutory wording or remove any right that the applicable law gives an individual.

2. What information is used and why?

The form asks where the deceased is currently located, the intended destination, a telephone number and an optional note. Later communication may add a name, email address, message content and facts necessary to prepare a quotation. Any additional case documentation must remain proportionate to the purpose for which it is needed.

Purposes include returning the call, assessing the enquiry, preparing an offer, carrying out an agreed service, accounting, mandatory record keeping and protecting the website from abuse. Detailed health information should not be placed in the first message. If sensitive information later becomes necessary, its legal ground, recipients and transmission method must be considered for that case.

3. Which legal grounds are used?

An enquiry is processed to take steps requested before a possible contract. If an appointment follows, necessary handling supports contract performance. Tax and accounting records may be required by law. Protecting the form, investigating faults and defending a specific legal claim can rely on a balanced legitimate interest where the relevant conditions are satisfied.

Google Analytics is separated from necessary operation. Its tag is loaded only after an express analytics choice. Declining does not restrict page content, telephone links or the enquiry form. A granted choice may be changed for the future through the privacy settings control.

4. Which service providers receive technical data?

Vercel hosts the website and handles the technical requests needed to deliver it. A separate service, Vercel Web Analytics, records aggregate visit statistics before any Google Analytics choice. It uses no analytics cookies and distinguishes visits through a short-lived request hash rather than a permanent identity across websites. Form-field values are not included in our analytics events.

Interacting with the form starts Cloudflare Turnstile. Browser, device, network and interaction signals support that security check; Cloudflare states that Turnstile does not access messages or other field entries. Once the server has validated the token, Resend delivers the enquiry by email. The message also records its submission time and, when available, the page address without query parameters or a fragment.

Resend identifies the United States as its primary processing location in its published Data Processing Addendum. That agreement describes standard contractual clauses where applicable to international transfers. The delivery provider and the receiving mailbox are separate storage locations. Optional Google Analytics activates only after your express agreement, which is distinct from the requested email delivery.

For an instructed repatriation, necessary details may also go to civil registries, health bodies, consulates, cemetery administrations, investigative authorities or contracted providers involved in the case. Each recipient should receive only what its task requires. Transfers across borders must meet the applicable requirements and safeguards for the processing concerned.

5. How long is information retained?

Retention depends on the purpose and any applicable legal duty. An initial enquiry concerns the requested assessment and response; an appointed service can also require contractual records and legally required documentation. A specific dispute may justify preserving relevant evidence. Once neither the purpose nor a lawful retention requirement remains, identifiable information must not be kept indefinitely.

The analytics preference is stored in your browser for 180 days. This is the duration of the local choice record, not a common deadline for enquiry emails or every analytics record. Mailbox copies, delivery-provider data and infrastructure logs are subject to their respective storage conditions. The form acknowledgement does not trigger automatic deletion from all those systems.

You can ask the privacy contact above about retention of a particular record or request its erasure. Any continuing duty has to be assessed for that record. Keeping information merely because storage space is available is not a sufficient retention purpose.

6. What rights may an individual exercise?

Subject to the statutory conditions, a person may request access, correction, erasure, restriction and portability, or object to processing based on legitimate interests. Consent can be withdrawn for future processing at any time. Reasonable identity evidence may be requested before disclosure so that information is not sent to an unauthorised person.

A complaint may be submitted to the Serbian Commissioner for Information of Public Importance and Personal Data Protection. Where the GDPR applies, an individual in the European Economic Area may also approach the competent authority for their habitual residence or workplace. Company requests should use the privacy email stated above.

7. Data minimisation, security and revisions

Data protection by default requires access to personal information to be limited to those who need it for the relevant purpose. The optional field should not contain extensive medical information or document identifiers that are unnecessary for an initial response. A hidden honeypot accompanies Turnstile to reduce automated submissions without adding an advertising purpose.

Changes to processing purposes, providers or website functions may require this notice to be updated. The date shown above identifies the current version. Your statutory rights continue to depend on the law applicable to the processing concerned.

Sources and review date