This policy explains how ProEnglish Srbija handles the personal data of visitors to proenglish.rs. It is written to comply with Serbia's Personal Data Protection Act (Zakon o zaštiti podataka o ličnosti, Official Gazette RS 87/2018), which closely follows the GDPR.
In short: you can read this site without leaving any data behind. We only ask for details if you fill in the contact form. Audience measurement is switched on only if you allow it, and you can switch it off again whenever you like.
1. Who the controller is
The data controller is ProEnglish Srbija, based in the Republic of Serbia.
- Email: [email protected]
- Website: proenglish.rs
We do not publish a postal address — email is the official channel for everything, including the rights requests described in section 7.
We have not appointed a data protection officer, because we do not carry out the kind of processing that would require one under article 56 of the Act.
2. The contact form
This is the only place on the site where you give us data. The form asks for your name, email address and a message, and that is all that is sent.
- Purpose: to read your question and answer it.
- Legal basis: steps taken at your request before entering into a contract (article 12(1)(2) of the Act) when you ask about a course, or our legitimate interest in carrying on correspondence you started, otherwise. We do not ask for consent for this — when you write to us, consent would be the wrong basis.
- Retention: at most 2 years from the last message in the thread, unless the correspondence turns into a contract, in which case the periods in section 6 apply.
2.1. Protecting the form from abuse
The form is protected by Cloudflare Turnstile, which tells people apart from
automated programs. Without it the form would fill with spam very quickly. Turnstile may set
the __cf_bm and cf_clearance cookies. These are strictly necessary
and are not subject to consent, because they are required for a service you asked for —
sending a message.
2.2. Where the message actually goes
We spell this out because it is easy to miss: the message does not stop at this site. When you
submit the form, our server first checks the Turnstile response, then forwards the whole
message to a shared mail service at mailer.proenglishpublishing.com, which belongs
to the same publishing house and delivers it to a mailbox from there.
3. Audience measurement
If you allow it, we use Google Analytics 4 to see how many people visit, which countries they come from and which pages they read — so we know which courses and articles to improve. The data is processed on Google servers outside Serbia.
- Legal basis: your consent, which you may withdraw at any time.
- Retention: 14 months at the Google Analytics account level.
Being straight about the past: until August 2026 the course pages loaded Google Analytics without asking for consent — cookies were set the moment you opened a page. That has been fixed: analytics now does not load until you allow it, and any cookies already set are cleared when you withdraw.
4. Server logs
When you open the site, the server records the usual technical details: IP address, time of access, the page requested and browser information. These records are created automatically and are needed to deliver the site and protect it from abuse.
- Legal basis: legitimate interest (article 12(1)(6) of the Act).
- Retention: 1 month.
5. What we do not do
- We do not sell or rent personal data to anyone.
- We use no advertising pixels and do no profiling for marketing.
- We make no automated decisions about you, including profiling.
- We have no user accounts and no newsletter.
- We do not collect special categories of data under article 17 of the Act.
- We do not record how you move around a page — the category exists in the preferences, but it is empty.
6. Who we share data with
| Recipient | Role | What they receive |
|---|---|---|
| Cloudflare, Inc. (USA) | Processor — hosting, content delivery, Turnstile form protection | The server logs in section 4, and form data in transit. |
ProEnglish Publishing (mailer.proenglishpublishing.com service) |
Processor — relaying and delivering contact form messages | Name, email address and message text. |
| Google Ireland Ltd. / Google LLC | Processor — audience measurement, only with your consent | The visit data described in section 3. |
The site links to external pages (LinkedIn, partner sites). Those links do not load by themselves: until you click one, your browser does not contact those sites.
6.1. Transfers outside Serbia
Cloudflare and Google process data outside Serbia, mostly in the United States. The USA is not on the list of countries deemed to provide an adequate level of protection under article 64 of the Act.
Transfers therefore rely on the appropriate safeguards set out in article 65: each of these providers is engaged under a data processing agreement containing standard contractual clauses — those adopted by the European Commission (Decision 2021/914), which match or exceed the requirements of the Serbian Act in substance. You may request a copy by writing to [email protected].
7. Your rights
In relation to the data we process, you have the right to:
- access — to find out whether we process your data and receive a copy;
- rectification of inaccurate or incomplete data;
- erasure when there is no longer a basis for processing;
- restriction of processing in the cases set out in article 31;
- object to processing based on legitimate interest;
- portability of data you provided to us;
- withdraw consent at any time, as easily as you gave it, without affecting the lawfulness of processing before withdrawal;
- complain to the supervisory authority.
Send requests to [email protected]. We reply without delay and within 30 days of receipt at the latest, extendable by a further 60 days with notice. There is no charge.
If you have written to us through the form, we can find you by your email address. For the server logs in section 4 that is usually not possible, because we keep no identifier linking you to a visit; in that case, under article 20 of the Act, we will tell you why we cannot comply.
7.1. Complaining to the supervisory authority
You may complain to the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11120 Belgrade, Serbia, email [email protected], poverenik.rs. Complaining to the Commissioner does not remove your right to go to court.
8. Cookies
The details of every cookie — name, provider, purpose and duration — are in the Cookie policy. You can change your decision at any time using the Cookie preferences button in the footer of every page.
9. Security
The site is served only over an encrypted connection (HTTPS) and is static — there is no database and there are no user accounts. Libraries, icons and the font are hosted locally rather than pulled from external content delivery networks, because such a request would disclose your IP address to a third party before you had agreed to anything.
10. Children
The courses are aimed at working adults. We do not knowingly collect data about children. If you believe we have, write to us and we will delete it.
11. Changes to this policy
If our processing changes, we will update this policy before the change takes effect and update the date at the top. Where a change touches purposes that require consent, we will ask you again.