Privacy Policy

NorthPeak Digital is a trading brand of WebRešenje PR, established at Karađorđeva 58, 26000 Pančevo, Serbia.

VAT number (PIB): 115803024 · Company registration number (MB): 68647509.

Controller: WebRešenje PR. Privacy contact: hello@northpeakdigital.eu, phone +31 6 860 300 11.

No data protection officer has been appointed; this is not mandatory for an organisation of this size and processing activity.

EU representative (GDPR Art. 27): because we deliberately and ongoingly offer services to businesses in the EU from Serbia, designation of an EU representative is likely required. No representative has been designated yet; once one is, their details will be published here. We do not publish a representative that does not exist.

Form data you enter yourself: name, company name, website URL, email address, optional phone number, your description of the challenge and your main objective.

Correspondence: the content of emails or messages you send us and our replies.

Technical data generated by every website visit: IP address, time, requested URL, user agent and error messages in server logs.

Cookie and consent data: your selected categories, the cookie policy version and the time of your choice, stored locally in your browser.

Analytics data, only after your consent: page views, event names and aggregated usage. We never attach form content to it.

We do not buy data, do not enrich profiles and do not collect special categories of personal data.

Responding to your question or contact request.

Performing the free website review you requested.

Preparing a quotation or proposal and communicating in the run-up to an agreement.

Performing an agreement and the related client communication.

Securing the website and preventing abuse and spam.

Website usage statistics, only to the extent you have consented.

Commercial updates only where you have separately asked for them.

Performance of a contract or steps prior to entering into one (Art. 6(1)(b) GDPR): handling your enquiry, performing a review and preparing a proposal. We do not ask for separate consent for this — the processing is necessary to do what you asked for.

Legitimate interests (Art. 6(1)(f) GDPR): website security, abuse prevention and limited administration of client contact, balanced against your interests.

Consent (Art. 6(1)(a) GDPR): analytics cookies and, where applicable, receiving commercial updates. You can withdraw this consent at any time without affecting the lawfulness of earlier processing.

Legal obligation (Art. 6(1)(c) GDPR): retaining invoicing and accounting data where required.

Enquiries that do not lead to an engagement: no longer than 6 months after the enquiry process ends, unless a longer period is needed to establish, exercise or defend legal claims, or a statutory obligation requires it. This is confirmed business policy.

Client and project records: for as long as statutory bookkeeping obligations require.

Technical server logs: no longer than 30 days.

Record of your cookie choice: 12 months, after which consent is requested again.

We do not keep data longer than necessary for the purpose it was collected for.

Vercel Inc. (hosting, server functions and delivery of the website, including edge network/CDN): processes technical logs and IP addresses to deliver and secure the site.

Google Ireland Ltd. for Google Analytics 4: active only after your consent to analytics.

Supabase, Inc.: stores the data submitted through the Contact and Free Website Review forms in a database that NorthPeak/WebRešenje also uses as its internal management system (shared with WebRešenje and NaručiPortal, same owner).

Resend: sends the internal lead-notification email to the NorthPeak team on a new enquiry, triggered through a Supabase database function.

There is currently no separate email-marketing platform and no CAPTCHA service in use. If that changes it will be stated here before the service is deployed.

Data Processing Agreements are concluded with processors; these are verified before production launch.

Our organisation is established in Serbia, outside the European Economic Area. Data you send through this website is therefore accessed and processed by personnel in Serbia.

We do not claim an adequacy decision for this transfer. The applicable transfer mechanism is under legal review and will be published here once established.

Until then we limit the transfer to what is needed to handle your enquiry and make no further transfers for other purposes.

Google Analytics is loaded only after your consent; data may then be transferred to the United States under the safeguards operated by Google.

Depending on the situation and the applicable legal basis, you have the right of access, rectification, erasure, restriction of processing, objection and data portability.

Where you gave consent you can withdraw it at any time. For cookies, use “Cookie preferences” at the bottom of every page.

Not every right applies in every situation: portability only applies to processing based on consent or contract, and statutory retention duties may prevent erasure. We always explain why a request cannot be met, or only partly.

Requests can be sent to hello@northpeakdigital.eu. We respond within one month.

You may also lodge a complaint with a competent supervisory authority, for example the Dutch Autoriteit Persoonsgegevens or the Belgian Gegevensbeschermingsautoriteit / Autorité de protection des données.

We do not take decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you. Website reviews are carried out by a human.

The website is served over HTTPS only and uses security headers, CSRF protection, server-side form validation and rate limiting against abuse.

Our forms only ask for data needed to handle your enquiry, and form content is never sent to analytics services.

This policy is version 2026-01. On material changes to purposes or providers we bump the version and ask for your cookie consent again where required.