The Company and the Provider process personal data in accordance with applicable law (including the GDPR where it applies). Read how, why, and for how long.
Version effective: 1 May 2026
This version is effective from 1 May 2026.
“GM Soultech ao”, with its registered office in Estonia, at Harju maakond, Tallinn, Kesklinna linnaosa, Tornimäe tn 5, 10145, registration no. 17469333 (hereinafter the “Company”), and the company that provides certain ancillary administrative services “GM SOULTECH DOO IRIG”, Stevana Gudurića Street No. 30, 22406 Irig, Republic of Serbia, company registration no.: 22185632, tax ID (PIB): 115631427 (hereinafter: the “Provider”), as data controllers, take the protection of personal data seriously and recognise that your personal data is important to you.
As a controller, the Company has prepared this Personal Data Processing Notice (hereinafter: “Notice”) so that processing is transparent and understandable. In this Notice we explain the legal concept of personal data, how we collect, share, and use your data, and how you can exercise privacy rights.
Personal data means any information relating to an identified or identifiable natural person; an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.
Please read the General Terms of Use before relying on this Notice. Cookie information is contained in Article 11 of this document. Together, these materials set out how we treat your data when you use the Platform.
Terms defined in the General Terms of Use have the same meaning in this Notice.
Questions about this Notice: privacy.data@workserbianow.com.
This Notice applies to users of the Platform.
There are three user categories:
Data you provide:
Clients must provide complete and accurate registration data: first and last name, e-mail address, mobile phone number, résumé/CV.
Employers and Agencies must provide complete and accurate registration data: a) companies: business name, company registration number, tax identification number, decision/permit of the competent ministry where applicable, e-mail address, registered office address, telephone number, mobile phone of the legal representative, and first and last name of the responsible person; b) entrepreneurs: business name, company registration number, tax identification number, permit/decision of the competent ministry where applicable, e-mail, mobile phone number.
Users may be asked by the Company or the Provider to submit additional data to deliver the selected service or job process, such as an ID card, passport image, diploma of education, and similar.
Data collected automatically:
When you visit the Platform, certain technical data from your device may be processed automatically, such as your IP address, device type, browser/device identifiers where available, browser type, and approximate geographic location (e.g. city/country from the IP address).
We may collect information about how your device uses our site, including pages visited and links clicked—primarily when you enable optional analytics (Article 11).
See Article 11 for cookies and analytics.
We collect and process your data to deliver the service of quickly and efficiently connecting foreign nationals interested in employment in the Republic of Serbia with Employers and Agencies—the core purpose of the Platform.
Registration data is processed to approve accounts and enable use of services offered by the Company and the Provider.
We collect only what we need for clearly stated purposes and inform you accordingly.
Some data is used to send communications about the operation of the Platform, news, and promotions—where permitted, including separate consent for direct marketing where the law requires it.
We process necessary data where you have given consent, for clearly defined purposes, in a lawful and proportionate manner.
For certain processing we rely on your consent, after informing you of the key aspects. You may withdraw consent at any time without a fee; this may end processing that is solely consent-based (e.g. marketing, optional analytics), subject to retention where the law requires it.
Processing connected with operating the Platform also rests on contract when you register and accept the General Terms of Use, under those terms.
For legal and operational security we may rely on legitimate interests where processing is necessary to prevent fraud or abuse, strictly as needed.
We may also process data where necessary to protect vital or other essential interests, or where law requires it.
Where we rely on legal obligation or other bases outside pure contract/consent, we inform you as required.
The Company and the Provider devote attention to protecting your personal data.
We do not sell personal data and do not share it with unspecified third parties for their independent use, except:
Where you consent or sharing is necessary for the Platform’s purpose—including sharing with the Employer/Agency you choose for employment-related steps: identity, work experience, phone, e-mail, facial photo, passport page, diplomas, etc., as needed for hiring and visa procedures under the General Terms.
Where we are legally required (e.g. public authorities); additional consent is not always required.
Where we engage trusted processors who process data on our behalf and under our instructions, with contractual safeguards under applicable law—typically hosting, database, e-mail delivery, payments, document storage, and, if you consent, analytics (see Article 12).
Safeguards
We retain data no longer than necessary for the purpose for which it was collected, and no longer than consent lasts where processing is consent-based, except where law requires longer storage.
Registration data is kept until your user account is deleted (unless law requires archiving or there are pending requests/disputes within a reasonable period).
Photos, passport pages, diplomas, and related data are kept in accordance with applicable law and the employment/visa purpose.
Subject to applicable law, you may have the right to:
information about collection and processing;
access your data;
rectify incomplete or inaccurate data;
erase data (“right to be forgotten”) where conditions are met;
withdraw consent where consent is the basis;
restrict processing and object where the law allows;
lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia—in particular if you receive no response within 30 days or are dissatisfied with the response.
Where the GDPR applies, you may also lodge a complaint with an EU supervisory authority in your habitual residence, place of work, or the place of the alleged infringement, in line with Article 77 GDPR.
In complex cases we may extend the response by up to 90 additional days and will inform you.
To exercise rights, e-mail privacy.data@workserbianow.com.
If you gave consent, you may withdraw it at any time.
Where processing is consent-only, we stop that processing and delete those data within 90 days of receiving withdrawal, except where law requires retention.
Withdrawal is free; send it to privacy.data@workserbianow.com.
We may amend this Notice. We will publish the last-updated date and notify you of material changes as required by law and Platform practice (e.g. e-mail or on-site notice).
This section describes cookies and similar technologies as implemented today.
Strictly necessary
Analytics consent
The wis_cookie_consent cookie stores your choices regarding optional analytics and marketing (retention: about 180 days).
Umami analytics is loaded from https://analytic.workvisaserbia.com only if you accept optional analytics in the cookie banner or enable it in preferences. Umami is used for aggregated traffic insight (pages, clicks) according to your choice.
If you reject optional cookies, the analytics script does not load.
Marketing consent
Google Tag Manager may load on the site with Google Consent Mode defaulted to denied. Advertising and measurement tags inside GTM (including Meta Pixel, when configured) fire only if you accept marketing cookies in the banner.
Marketing tags may set cookies and share usage data with third parties (e.g. Meta, Google) for campaign measurement and advertising, subject to your choice.
Use the cookie banner at the bottom of the page to manage preferences.
To operate the Platform we use processors who handle data on our instructions, with contractual and technical measures:
International transfers: the Company is in Estonia, the Provider in Serbia; subprocessors may use infrastructure in the EU, United States, and elsewhere. Where the GDPR applies, we use appropriate mechanisms (e.g. standard contractual clauses) or other lawful tools, with risk assessment as required.
We do not sell your data to subprocessors; they use it only to provide services to us.