Privacy
policy.

• -We get your data only when you send it to us through a form on this site: an enquiry, a training application or an open job application.
• -The site has no database. A form message is sent at once by email to the Institute's mailbox. Our staff handle it there, and it is kept there for the periods in this policy.
• -We have no user accounts, no newsletter and no marketing. We do not sell data.
• -The site sets no cookies at the moment and uses no analytics.
• -For any question or request, write to us at institut@mdinstitut.co.rs.

The controller of your personal data is MD PROJEKT INSTITUT d.o.o., with its registered office at Trg kralja Aleksandra Ujedinitelja 2/5, 18000 Niš, company registration number (MB) 17009052, tax ID (PIB) 100663046 (“MD PROJEKT INSTITUT”, “the Institute”, “we” or “us”).

This policy explains how we process data when you use mdinstitut.co.rs, send an enquiry or application, and write to us about it. We apply the Law on Personal Data Protection of the Republic of Serbia.

We have not appointed a separate data protection officer. For any question about how we process your data, and to exercise your rights, write to institut@mdinstitut.co.rs, call +381 18 4513 531 or send a letter to our registered office.

We get your data directly from you, through the forms and any later correspondence. Technical data is sent by your browser when you open the site. We do not obtain data about you from other sources.

Enquiry (Contact page)

Full name, email and message (required); company name, phone and area of interest (optional).

Training application

The programme chosen, the contact person's full name and phone (required); company, email, number of participants, city and a note (optional). This form does not ask for a list of participants or for certificate details. If we need them, we ask for them later, outside this site, and tell you then how we process them.

Open job application

Full name, email, at least one area of interest and your CV as a PDF of up to 3 MB (required); phone, level of education, LinkedIn profile address and a message (optional). We also process what you put in your CV, such as your education and work experience. If you give a LinkedIn profile, we may look at what is public on it.

Correspondence

The fact that you gave consent (a form cannot be sent without it), when your message arrived, and the correspondence we need to answer your enquiry or application.

Technical data

• -On every visit: IP address, browser and device type, the page requested and the time. Our hosting (Vercel) and the network that delivers images and documents (Sanity) must process these to show you the site.
• -On pages with a form: Cloudflare Turnstile checks whether the form is being filled in by a person or a program. To do this it processes your IP address and signals from your browser and device. The check is mostly invisible.
• -When you send a form: your IP address is held briefly in the server's working memory to limit how often forms can be sent. The record of the submission holds only the form name, a random submission ID, the result of the checks and the email service's message ID. It does not hold what you entered, your CV or security tokens.

Send only the data your enquiry or application needs. Do not put your personal ID number (JMBG), copies of ID documents, health or religious details, or other sensitive data you do not need into a form or your CV. If you send us another person's data, for example in the note on a training application, send only what you are entitled to share and tell that person about this policy.

We use data only for the purposes in the table.

The consent you give in a form covers only that form's purpose. It does not cover marketing or analytics.

We rely on legitimate interest only where the processing is necessary and your rights do not override it. We do not use that data to learn your habits or for advertising. You can object to this processing.

You can withdraw your consent at any time by writing to institut@mdinstitut.co.rs. We then stop the processing based on it and delete that data, except what the law requires us to keep. Withdrawal does not affect the lawfulness of processing before it.

No. No law requires you to send us data through this site, and you can use the site without sending a form.

A form can only be sent with the fields marked as required, and with your consent. Without them, we cannot accept an enquiry, a training application or a job application. You can leave optional fields empty.

You can always contact us at institut@mdinstitut.co.rs or +381 18 4513 531 instead. This also applies if the security check stops your form by mistake.

We keep data only while we need it for its purpose, or while the law requires. After that we delete it. These periods also apply to messages and attachments in the Institute's mailbox.

• -Enquiries and training applications that did not lead to work together: until the correspondence ends, and no longer than 12 months after the last contact.
• -Enquiries and applications that led to work together: for as long as we work together, and then for as long as accounting, contract and record-keeping rules require.
• -Open job applications: we consider them for positions that open within 12 months of receipt, and then delete them. If we invite you to a selection for a specific position, we keep your application until that selection ends. If you are hired, your data moves to your personnel file. If you withdraw your consent earlier, we delete your application without delay.
• -Requests to exercise your rights, and specific disputes: until they are handled, and evidence of how we handled them for as long as legal action is possible. We keep only what is needed for this.
• -Rate limit (IP address): briefly, only in the server's working memory. It is never written to storage.
• -Hosting server logs: a short time, within the periods Vercel sets.
• -Copy of the message at Resend: a limited time, under that service's own rules. This is separate from the periods for our mailbox.
• -Turnstile check data: as long as Cloudflare sets for that check.
• -Data in your browser: described in the cookies section.

We do not sell your data or pass it on to others for their marketing. Inside the Institute, only staff who need the data for their work can see it: to reply, arrange training or select candidates.

Messages from all three forms, including CVs, arrive in the Institute's mailbox, institut@mdinstitut.co.rs. If you gave your email address, our reply goes to it.

The following service providers process data on our behalf, under contract and only for the contracted services:

We may also give data to public authorities, but only when the law requires it.

Some providers in the previous section process data outside Serbia.

• -Germany (Vercel, Frankfurt) and Norway (Sanity) are considered to provide an adequate level of personal data protection.
• -The USA has no such status under Serbian law. For transfers to the USA (Vercel, Resend, Cloudflare) and to servers in global networks, we rely on a basis the Law on Personal Data Protection allows, mainly standard contractual clauses in our contracts with these providers.

You can ask at institut@mdinstitut.co.rs for more information about where your data is processed and how it is protected when transferred.

• -The connection between your browser and the site is always encrypted (HTTPS).
• -The site has no database. Your message and CV are sent as one email to the Institute's address.
• -Server logs do not contain what you entered, or your CV.
• -We protect the forms with input checks, the Turnstile check, a hidden field against automated programs and a limit on how often forms can be sent.
• -Only authorised staff can access the Institute's mailbox.

No system is completely secure. If a data breach occurs, we will act as the law requires. Where the legal conditions are met, we will inform the Commissioner and you.

Under the Law on Personal Data Protection, you have the right to:

• -find out whether we process your data, and get information about the processing and a copy of the data (right of access);
• -have inaccurate data corrected and incomplete data completed;
• -have your data erased, for example when it is no longer needed or you have withdrawn consent and we have no other basis to keep it;
• -have processing restricted, for example while we check whether the data is accurate;
• -receive the data you gave us in a common electronic format and pass it to another controller, where processing is based on consent or a contract (right to data portability);
• -object to processing based on legitimate interest;
• -withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal.

How to exercise your rights. Send your request to institut@mdinstitut.co.rs or by letter to our registered office. Say what the request is about and give details that help us find your message or application. If we have good reason to doubt who is sending the request, we will ask only for the information we need to check it.

Time limits. We reply without delay, and at the latest within 30 days of receiving the request. We may extend this by a further 60 days if the request is complex or there are many requests. If so, we tell you within the first 30 days, with the reasons. If you write by email, we reply by email unless you ask otherwise. If we refuse a request, we tell you why within the same 30 days, and how you can seek protection.

Costs. Exercising your rights is free. For a clearly unfounded or excessive request, the law allows us to charge the necessary administrative costs or to refuse to act.

Complaints and court protection. If you believe that the processing does not comply with the law, you can lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection. You do not have to contact us first. You also have the right to protection before a court.

The site does not set any cookies at the moment. We use no analytics or advertising tools.

The site keeps only the following in your browser:

• -Your analytics choice (the browser's local storage): only if you save a choice in the settings below. It holds your choice, its time and the settings version. The choice is valid for 180 days, or less if we change the settings; after that we no longer rely on it. The entry itself stays in your browser until you change it or clear the site's data.
• -A note that you have seen the intro animation (session storage), so that it does not repeat. It is normally deleted when you close the tab.
• -The Turnstile check (Cloudflare) on pages with a form may use its own technical storage to tell people from programs. This is not analytics and does not depend on your analytics choice.

This is needed for the site to work and to protect the forms, so we do not ask for consent for it.

Analytics. We use analytics cookies only if you allow them. We do not use them at the moment. Before we switch them on, we will name here the tool, the provider, the cookies, how long they are kept and any data transfers. Without your consent, analytics does not run, and saying no does not affect your use of the site or your ability to send forms. You can save or change your choice here at any time. Changing it does not by itself switch on a tool we do not use.

Your choice applies to the browser and device where you save it. The switch covers analytics only. To withdraw consent for a message or application, write to us at institut@mdinstitut.co.rs. You can also delete stored data and cookies in your browser's settings.

We do not make decisions based solely on automated processing, and we do not profile anyone. People decide on enquiries and applications, including every job application. The security check may stop a suspicious form submission; if this happens, contact us by email or phone.

The site is not aimed at children. We do not knowingly collect data from anyone under 15. If you learn that a child has sent us data, write to institut@mdinstitut.co.rs and we will delete it.

The site has plain links to other sites, such as LinkedIn, Infostud and a map service (“Open in maps”). It has no embedded maps and no social media buttons, and our fonts load from our own site, not from Google Fonts. These sites receive no data from you until you click a link. Once you go to them, their own privacy rules apply.

We update this policy when we change how we process data, for example when we add a new tool or service provider, or when the law changes. The current version is always on this page, with the date from which it applies. If a change needs your new consent, we will ask for it before the new processing starts.