Privacy Policy

The data controller responsible for personal data processed through this website is:

• DS VECTOR ANALYTICS DOO BEOGRAD
• Bulevar JNA 123V
• 11010 Belgrade (Voždovac)
• Republic of Serbia
• Registration Number (MB): 21864609
• Tax Identification Number (PIB): 113424774
• Website: dsvectoranalytics.com
• Email: hello@dsvectoranalytics.com

References in this Privacy Policy to “we”, “us”, “our” or “DS Vector Analytics” mean DS VECTOR ANALYTICS DOO BEOGRAD.

This Privacy Policy applies to the DS Vector Analytics corporate website, published at dsvectoranalytics.com and dsvectoranalytics.rs, including the homepage, dedicated service and information pages, and the contact form. It explains what personal data we collect through the website, why, on what legal basis, how long it is kept, who it may be shared with, and what rights you have.

The website publishes public content in English and Serbian. This Privacy Policy applies to the website regardless of the language or locale URL used to access it.

This Policy does not cover any other DS Vector Analytics service, product, or communication channel outside this website (for example, work carried out under a separate client engagement or contract), which may be governed by separate terms agreed with you directly.

We collect the following categories of personal data through this website:

(a) Contact-form information. When you submit our contact form, we receive:

• your name;
• your company name, if you choose to provide it;
• your email address;
• the project type you select, if any;
• the message/description you write, and any other information you choose to include in it.

(b) Website and device information. Like most websites, our hosting and content-delivery infrastructure, and, once you accept analytics, Google Analytics 4 and Microsoft Clarity, may process technical information generated by your visit, such as your IP address (processed transiently by infrastructure and analytics providers rather than stored by us directly), browser type and version, device type, operating system, referring page, pages viewed, and approximate geographic location derived from your IP address (typically country or city level, not precise location).

(c) Analytics identifiers. Once you accept analytics, Google Analytics 4 and Microsoft Clarity assign pseudonymous identifiers (via cookies and similar technologies) to your browser so that a sequence of page views and interactions can be recognized as belonging to the same visit or visitor over time. See Sections 5 and 6 for detail on each service.

(d) Consent preference stored in localStorage. Regardless of whether you accept or reject analytics, your browser stores your choice locally, under the key dsvector_analytics_consent_v1, as either “accepted” or “rejected”. See Section 7 for detail on this value and how it is used.

We do not require you to create an account, and we do not knowingly collect any special categories of personal data (such as health, religious, or political information) through this website.

We process personal data collected through this website for the following purposes, on the following legal bases:

• Responding to your enquiry and communicating with you about a potential project — based on taking steps at your request prior to entering into a contract, and/or our legitimate interest in responding to business enquiries addressed to us.
• Running the website's optional analytics (Google Analytics 4 and Microsoft Clarity) to understand how visitors use the site and improve it — based on your consent, given through the cookie banner described in Section 7. Analytics never runs before you give this consent.
• Remembering your analytics consent choice (accepted or rejected) so the banner does not reappear on every page — based on our legitimate interest in operating the consent mechanism itself and complying with applicable cookie/consent rules; this narrow, functional use is separate from, and does not depend on, whether you accepted analytics.
• Maintaining the security, integrity and normal technical operation of the website (for example, preventing abuse of the contact form) — based on our legitimate interest in keeping the website secure and functioning correctly.
• Complying with legal, accounting, tax or regulatory obligations that may apply to correspondence or records — based on legal obligation, where applicable.

Where our legal basis is your consent (analytics), you may withdraw that consent at any time, free of charge, as described in Section 7, without affecting the lawfulness of processing carried out before withdrawal.

This website uses Google Analytics 4 (“GA4”), a web analytics service provided by Google LLC / Google Ireland Limited (“Google”). GA4 is enabled only after you actively accept analytics through our cookie banner or Cookie settings control — it is never loaded, and no GA4 request is made, before that choice.

Once enabled, GA4 may process the following information about your visit:

• page views;
• sessions;
• referral and traffic source information (how you arrived at the site);
• website interactions (such as clicks and navigation events);
• approximate geographic information (typically country or city level, derived from IP address);
• browser and device information;
• analytics identifiers (pseudonymous, cookie- or storage-based identifiers used to group events into sessions and visits).

GA4 is not completely anonymous: it relies on pseudonymous identifiers and IP-derived signals that Google's systems process, and we do not represent otherwise. We do not intentionally send your name, email address, contact-form message, or any other directly identifying contact-form data to GA4 — our GA4 configuration does not pass contact-form field values as event parameters (see Section 8 and the audit summary provided alongside this Policy's implementation).

We keep advertising-related consent signals (ad_storage, ad_user_data, ad_personalization) set to denied at all times; only analytics_storage is set to granted, and only once you have accepted. We do not use GA4 for advertising or ad personalization.

User- and event-level data retention in GA4 is configured to 14 months, after which such data is automatically deleted from Google's systems on a rolling basis, in line with GA4's own retention settings. Aggregated, non-identifying reporting data may be retained by Google independently of this setting.

For more information about how Google processes data, see Google's own Privacy Policy and the Google Analytics terms of service.

This website uses Microsoft Clarity (“Clarity”), a behavioural analytics service provided by Microsoft Corporation. Like GA4, Clarity is enabled only after you accept analytics — it is never loaded, and no Clarity request is made, before that choice.

Once enabled, Clarity may process the following information about your visit:

• click heatmaps;
• scroll behaviour;
• behavioural metrics (for example engagement and rage-click signals);
• navigation patterns;
• session information;
• session replay (a reconstruction of on-page interactions during a visit).

Clarity must not, and is configured not to, intentionally collect the contents of our contact form. The contact form's input fields (name, company, email, project type and message) are explicitly marked with Clarity's element-level masking attribute, so their content is masked in click, heatmap and session-replay data regardless of Clarity's project-wide masking mode. We do not display submitted contact-form data back to visitors anywhere on the site, so there is no other on-page area containing your contact-form input for Clarity to capture.

Current Clarity data retention, per Microsoft's documented defaults, is approximately:

• standard session playback: approximately 30 days;
• click and heatmap data: approximately 9 months;
• labelled or favourited sessions: approximately 9 months.

These figures reflect Microsoft's published retention behaviour and may be updated by Microsoft from time to time; see Microsoft's own documentation and Privacy Statement for the current position.

Analytics on this website (GA4 and Clarity) is optional and off by default. On your first visit, a banner asks you to Accept analytics or Reject analytics; neither choice is pre-selected, and both options are clearly available in the same consent banner. Nothing from GA4 or Clarity loads, and no analytics cookie or storage value is set, until you actively choose Accept analytics.

If you accept, GA4 and Clarity may set cookies and use browser storage to recognize your browser across page views (for example, cookies such as _ga, _ga_*, _gid used by GA4, and _clck, _clsk used by Clarity). If you reject, or have not yet made a choice, none of these are set.

You can change your mind at any time. A permanent “Cookie settings” control in the website's footer reopens the same panel so you can review or change your choice, whether that means accepting after previously rejecting, or withdrawing consent after previously accepting. If you withdraw consent after having accepted, we update GA4's consent signal to denied, clear GA4's and Clarity's cookies from your browser, and stop sending further analytics events.

Rejecting analytics, or not making a choice at all, never prevents normal use of the website or the contact form — every page, and the contact form, work identically regardless of your analytics choice.

Separately from analytics, your browser stores your consent choice itself (the word “accepted” or “rejected”) in local storage, under the key dsvector_analytics_consent_v1. This value exists solely so the website can remember and respect your privacy choice and avoid asking again on every visit; it is not read by, or shared with, GA4, Clarity, or any other third party, and it is not used for behavioural tracking, profiling, or any purpose beyond remembering your preference. It stays in your browser until you clear your browser's site data or change your choice through Cookie settings.

We do not use a third-party cookie-consent management platform; the consent banner is built and operated directly by us.

When you submit our contact form, the information you provide is sent as an email notification to our inbox using Resend, an email-delivery service operated by Plus Five Five, Inc. (“Resend”). Resend acts as our processor for this purpose.

In delivering that email, Resend may process:

• the message content (the fields and text you submitted);
• sender and recipient information;
• email metadata (such as subject line and headers);
• delivery logs;
• technical delivery and security information (for example information used for spam and abuse prevention).

Resend is a United States-based service, and certain Resend data may accordingly be processed in the United States; see Section 10 for more on international transfers.

Consistent with Resend's own published documentation, relevant email and log data is generally retained by Resend for approximately 30 days on standard plans. This is a general description of Resend's standard practice, not a guarantee we can make on Resend's behalf — Resend's own documentation and Privacy Policy govern the current, authoritative position, and Resend's retention practices are outside our direct control.

The contact form itself does not use GA4 or Clarity to read or transmit its field values (see Sections 5 and 6): submitting the form does not send its content to Google or Microsoft, and its input fields are masked from Clarity session recordings.

We share personal data collected through this website with the following categories of service providers, each acting on our instructions and only for the purposes described in this Policy:

• Resend (Plus Five Five, Inc.) — contact-form email delivery (Section 8).
• Google LLC / Google Ireland Limited — Google Analytics 4, once you accept analytics (Section 5).
• Microsoft Corporation — Microsoft Clarity, once you accept analytics (Section 6).
• Our website hosting and content-delivery infrastructure provider(s) — technical hosting and delivery of the website itself.

We do not sell personal data, and we do not share it with third parties for their own independent marketing purposes.

We may also disclose personal data where required to do so by law, regulation, legal process, or a competent public authority.

DS Vector Analytics is established in the Republic of Serbia. Some of the service providers described in Section 9 — including Google (Google Analytics 4), Microsoft (Clarity), and Resend / Plus Five Five, Inc. — are based in, or process data in, the United States, meaning your personal data may be transferred outside Serbia and, where applicable, outside the European Economic Area.

Where such transfers occur, we rely on the safeguards those providers make available, such as Standard Contractual Clauses and/or participation in applicable cross-border data transfer frameworks (for example the EU-U.S. Data Privacy Framework, where a given provider participates in it). Each provider's own privacy and data-processing documentation reflects its current, authoritative transfer mechanisms and certifications, which we do not control and cannot independently guarantee; we encourage you to consult Google's, Microsoft's, and Resend's own privacy documentation for the latest detail.

We retain personal data only for as long as necessary for the purposes described in this Policy:

• Contact-form submissions and related correspondence are generally retained for up to 12 months after the last substantive communication with you, unless: the enquiry develops into a contractual or client relationship (in which case relevant records are kept for the duration of that relationship and any applicable post-relationship period); a longer period is required by law; records must be kept for accounting or contractual purposes; or retention is necessary to establish, exercise or defend legal claims.
• Google Analytics 4 user- and event-level data is configured to a 14-month retention period in GA4 itself (Section 5).
• Microsoft Clarity data is retained per Microsoft's documented defaults described in Section 6 (approximately 30 days for session playback; approximately 9 months for click/heatmap data and for labelled or favourited sessions).
• Resend's email and delivery-log data is retained per Resend's own standard practice described in Section 8 (approximately 30 days on standard plans).
• Your consent preference in localStorage persists in your browser until you clear your browser's site data or change your choice through Cookie settings — it has no separate server-side retention period, because it is never transmitted to or stored by us on a server.

We take reasonable technical and organizational measures to protect personal data processed through this website, including transmitting the website and contact form over encrypted (HTTPS/TLS) connections, restricting access to our email and analytics accounts to authorized personnel, and collecting only the data reasonably needed for the purposes described in this Policy.

This website does not process payment card or financial account information; no such data is collected here.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you become aware of a security concern involving this website, please contact us using the details in Section 19.

Depending on your location and applicable law (including the Serbian Law on Personal Data Protection and, where applicable, the GDPR), you may have the following rights regarding your personal data:

• Access — to obtain confirmation of, and access to, the personal data we hold about you.
• Rectification — to have inaccurate or incomplete personal data corrected.
• Erasure — to request deletion of your personal data, subject to applicable legal exceptions.
• Restriction of processing — to request that we limit how we use your personal data in certain circumstances.
• Data portability — to receive certain personal data you provided to us in a structured, commonly used format, where technically feasible.
• Objection — to object to processing based on our legitimate interest, on grounds relating to your particular situation.
• Withdrawal of consent — to withdraw analytics consent at any time, as described in Section 7, without affecting processing carried out before withdrawal.
• Not to be subject to solely automated decisions — see Section 15; we do not, in any event, use this website's data for automated decisions with legal or similarly significant effects on you.

To exercise any of these rights, contact us at hello@dsvectoranalytics.com. We may need to verify your identity before acting on a request, and we will respond within the timeframes required by applicable law.

If you believe we have not handled your personal data in accordance with applicable law, we encourage you to contact us first at hello@dsvectoranalytics.com so we can try to resolve the matter directly.

You also have the right to lodge a complaint with the competent supervisory authority in Serbia:

• Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia
• (Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti)
• Bulevar kralja Aleksandra 15
• 11120 Belgrade
• Republic of Serbia
• Email: office@poverenik.rs

If GDPR applies to your personal data (for example because you are located in the European Union or European Economic Area), you may instead, or in addition, lodge a complaint with the data protection supervisory authority in your own country of residence, work, or the place of the alleged infringement.

We do not use personal data collected through this website to make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. Google Analytics 4 and Microsoft Clarity are used for aggregate and behavioural website analytics (understanding how the site as a whole is used), not to make automated decisions about individual visitors.

This website is a business-to-business corporate website and is not directed at, or intended for use by, children. We do not knowingly collect personal data from children under the age of 16 through this website. If you believe a child has provided us with personal data, please contact us at hello@dsvectoranalytics.com and we will take appropriate steps to delete it.

This website may contain links to third-party websites or services that are not operated by us. This Privacy Policy applies only to this website; we are not responsible for the privacy practices or content of any third-party site, and we encourage you to review the privacy policy of any third-party site you visit.

We may update this Privacy Policy from time to time, for example to reflect changes in our practices, the services we use, or applicable law. The “Last updated” date at the top of this page reflects the date of the most recent revision. Where a change is material, we will take reasonable steps to make it apparent, such as updating that date. Your continued use of the website after a revised Privacy Policy is published constitutes acknowledgement of the update.

If you have any questions about this Privacy Policy or how we handle your personal data, please contact:

• DS VECTOR ANALYTICS DOO BEOGRAD
• Bulevar JNA 123V
• 11010 Belgrade (Voždovac)
• Republic of Serbia
• Email: hello@dsvectoranalytics.com
• Website: dsvectoranalytics.com