Privacy Policy

1. Who We Are (Data Controller)

The data controller responsible for your personal data is:

Pagus — Industrija kartona d.o.o.
Patrijarha Dimitrija 1a
11090 Belgrade, Serbia
Email: gdpr@pagus.co.rs

For any questions regarding the processing of your personal data, please contact us at the email address above.

2. What Data We Collect and Why

2.1 Contact Form and Quote Request Form

When you fill in our contact or quote request form, we collect the following data: first and last name, company name, email address, phone number, inquiry type, and message content.

Purpose: processing your inquiry and providing a response or quotation.
Legal basis: legitimate interest (Art. 6(1)(f) GDPR) — B2B communication for the purpose of entering into or performing a business relationship.
Retention period: up to 2 years from the last communication, after which the data is deleted from our email archive.

Data is transmitted via EmailJS directly to our email inbox. EmailJS acts as a data processor on our behalf and is bound by data protection obligations under applicable law.

2.2 Google Analytics 4 (with your consent only)

With your prior consent, we use Google Analytics 4 (GA4) to collect anonymous analytics data: number of visits, pages viewed, device type, and country. IP addresses are anonymised. Data is not used for personalised advertising.

Legal basis: consent (Art. 6(1)(a) GDPR).
Recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Retention in GA4: 14 months.
International transfers: Google is covered by the EU–US Data Privacy Framework.

You may withdraw your consent at any time by clicking "Manage cookies" in the site footer.

2.3 Google Maps (with your consent only)

On the contact page we display an interactive map using the Google Maps API. The map loads only if you consent to map cookies. Without consent, a static placeholder is shown with no communication to Google's servers.

Legal basis: consent (Art. 6(1)(a) GDPR).
Recipient: Google Ireland Limited, Dublin 4, Ireland.
International transfers: covered by the EU–US Data Privacy Framework.

2.4 Fonts (self-hosted)

Fonts used on this website (Open Sans) are served from our own servers. No data is sent to third parties for font loading.

3. Cookies

We use the following categories of cookies:

Category	Name	Purpose	Duration
Necessary	pagus_cookie_consent	Stores your cookie preferences (localStorage)	No expiry
Analytics (with consent)	_ga, _ga_*	Google Analytics — traffic analysis	Up to 2 years
Maps (with consent)	Google cookies	Display of Google Maps map	Variable

You can manage your cookie preferences at any time by clicking "Manage cookies" in the site footer.

4. Recipients of Data

We share your data only with the following recipients and only for the stated purposes:

• EmailJS — technical processor that forwards contact form messages to our email
• Google Ireland Limited — GA4 analytics and Maps, with your consent only
• Pauk Hosting d.o.o. — production website hosting; processes HTTP request metadata (IP addresses) in accordance with Serbian data protection law
• Netlify Inc. — development preview (staging) platform only; does not process data from real visitors to the production site

We do not sell, rent or exchange your personal data with third parties.

5. Your Rights

Under the GDPR and the Serbian Law on Personal Data Protection (ZZPL), you have the following rights:

• Right of access — you may request to see the data we hold about you
• Right to rectification — you may request correction of inaccurate data
• Right to erasure — you may request deletion of your data ("right to be forgotten")
• Right to object — you may object to processing based on legitimate interest
• Right to portability — you may request your data in a structured, machine-readable format
• Right to withdraw consent — you may withdraw consent at any time without consequence

To exercise any of these rights, please write to us at: gdpr@pagus.co.rs. We will respond within 30 days.

6. Complaint to the Supervisory Authority

If you believe that the processing of your data does not comply with applicable law, you have the right to lodge a complaint with the competent supervisory authority:

Commissioner for Information of Public Importance and Personal Data Protection
Bulevar kralja Aleksandra 15, 11000 Belgrade, Serbia
Tel: +381 11 3408 900
Web: www.poverenik.rs

7. Data Security

This website is served exclusively over HTTPS. Contact form data is transmitted encrypted. We do not store form data on our own servers — messages are forwarded directly to our email via EmailJS.

8. Changes to This Policy

We may update this policy from time to time. The date of the last update is shown at the top of this page. We recommend checking this page periodically.