Privacy notice
1. Date of issue of the personal data processing notice
8 November 2025
2. Purpose of the personal data processing notice
This notice on the processing of users' personal data (the Notice) informs users of the hrexperience.com website (the Service) of all relevant information concerning the processing of their personal data.
In view of legislation on individuals' personal data privacy, primarily the Law on Personal Data Protection (the LPDP), please read this Notice carefully to understand the types of personal data we usually process, the purposes of processing, who has access to your data and, especially, your rights regarding personal data processing.
We care about protecting your personal data and fully support your rights as a user under the LPDP. Personal data means any information relating to an individual whose identity is determined or can be determined, directly or indirectly, especially by an identifier such as a name or identification number, location data, an identifier in electronic communications networks, or one or more features of their physical, physiological, genetic, mental, economic, cultural or social identity.
Questions, complaints, requests and requests for additional information about the Privacy Notice, personal data protection and exercising your rights may be sent to zzpl@infostud.com.
3. About us
The Service is an information society service provided by INFOSTUD REŠENJA D.O.O. SUBOTICA, Matije Korvina 17, 4th floor, 24000 Subotica, Republic of Serbia, company registration number 21159662, tax identification number 109311752 (the Company). References to “we” and “our” in this Notice refer to the Company.
By using the Service, you provide information, some of which is personal data. Depending on the purpose, we process your data as a controller. A controller is an entity that, alone or jointly with others, determines the purposes and means of processing personal data. Before reading this Notice, please also read the Terms of Use.
4. Legal basis for processing
For some purposes, we process your personal data on the basis of your consent, after informing you of all important aspects of processing. You may withdraw consent at any time without giving a reason; this results in the cessation of further processing.
In some situations, the legal basis is the contractual relationship with the data subject, for example where processing is necessary to access and use the Company's Service.
In other situations, we have a legitimate interest in processing your data, for example where processing is necessary to prevent fraud or possible misuse.
We may process your personal data if required by law. We may also process it where necessary to protect your vital interests. We will inform you when we process data because the law requires it or to protect your vital interests.
5. Purposes, retention periods and the data we process
All data requested from you is collected for a specific purpose, which will always be clearly explained. The main purpose of collection and processing is to enable provision of the information society service. Information submitted through the newsletter form is collected so that we can deliver the newsletter to you appropriately.
The basis for processing is a contract: by accepting the terms and rules, you enter into a contractual relationship with us. This covers providing information and improving customer service. In this context, the user consents to the use of their personal data to provide the most relevant information and the best possible customer service relating to the Infostud.com website.
When applying to participate in the Successful HR Stories project, users provide personal data such as the contact person's first and last name, email address and telephone number. The basis for processing is the contractual relationship entered into on application.
We retain personal data for as long as necessary to fulfil the specific purpose, until consent is withdrawn, or until the period for which consent was given expires, after which the data is deleted or rendered unidentifiable. Exceptionally, we may retain data after withdrawal of consent or fulfilment of the purpose where necessary to comply with a legal obligation or to establish, exercise or defend a legal claim.
We process personal data to provide the Service and its features, measure use and improve the Service, protect users and enable uninterrupted website use with customer support. More details on purposes and processing periods follow below.
6. Our legitimate interest
To achieve our business purposes, we process personal data on the basis of legitimate interest, but only where your interests or fundamental rights and freedoms do not override that interest.
We rely on legitimate interest to:
- Diagnose technical problems with the Service;
- Better understand users through their behaviour, interests and preferences;
- Protect our business and support users;
- Test and develop new products to improve existing ones;
- Identify and protect users and the Service from fraud and illegal activities;
- Enable mergers, acquisitions, purchases, sales of shares or other corporate changes involving the Company.
By using the Service, you agree that certain Service employees may contact you using the contact details you provided to alert you to irregularities, diagnose technical problems or investigate suspected fraudulent or illegal activities, such as hacking, inappropriate files or spam, to protect against unwanted consequences.
The basis for processing is our legitimate interest as owner of the Service. To protect the Service, we process data such as website behaviour (pages visited), IP address and information about the device, browser and operating system used to access it.
You may object to this processing at any time by emailing zzpl@infostud.com. For more information, see “Your rights” below.
7. Security of your data
To protect the personal data we process, we always strive to apply necessary data protection standards and all necessary technical, organisational and personnel safeguards required by the applicable LPDP. These include technical safeguards, physical access controls at data storage locations, information security measures in accordance with applicable regulations, and other measures appropriate and necessary to protect the particular personal data.
Third parties processing data must also apply all necessary technical, organisational and personnel safeguards.
8. Transfers of personal data to other countries
Some processors with access to personal data are based abroad, primarily in EU member states or states party to Council of Europe Convention 108. Transfers to these countries rely on their presumed adequate level of personal data protection, in accordance with the law. If processors are based outside that group of countries, transfers are possible only in accordance with Article 65 of the LPDP, which governs transfers subject to appropriate safeguards.
9. Your rights regarding the personal data we process
- Transparency: When you provide personal data, we will transparently inform you of the purposes, who uses it and all other relevant information about processing. This right is fulfilled by making this Notice available.
- Access: You have the right to be informed whether we process your personal data. If we do, you may, based on access to it, request rectification, completion, updating or erasure, as well as cessation or temporary suspension of processing. As we process your data as controller, you have the right to obtain all information about that processing from us.
- Rectification, completion and updating: Data processed should be accurate and complete. You have the right to have inaccurate data rectified and incomplete data completed without undue delay.
- Erasure: You have the right to have personal data erased in accordance with the LPDP. If continued processing is necessary to meet legal obligations, such as accounting requirements, or to establish, exercise or defend a legal claim, we will erase only the data we no longer need.
- Portability: You may request to receive the personal data you supplied on registration in a structured, commonly used and machine-readable format, or to have the data you supplied to us as controller transferred to another controller, provided processing is based on consent or a contract and is automated.
- Restriction of processing: You may request restriction of processing in certain circumstances.
- Objection: You may object to processing based on legitimate interest.
- Complaint to the competent authority: You may lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11120 Belgrade, telephone +381 11 3408 900, email office@poverenik.rs.
- All other statutory rights: Data subjects may exercise their rights by sending a request to zzpl@infostud.com.
The Company will provide necessary additional information and assistance with these requests under the conditions and procedures set out in the applicable LPDP. Send requests to zzpl@infostud.com. We will respond as soon as possible and no later than 30 days after receipt. Complex requests or a large number of requests may require additional time; the period cannot exceed 90 days and we will notify you separately. We may refuse a manifestly unfounded or frequently repeated request, or charge the costs of fulfilling it. A request is considered frequently repeated if you ask to exercise a right more than once in a year. If you contact us twice or more in one year about the same right, we will fulfil your request only if you have a justified reason.
10. Who has access to your data — recipients
Depending on the specific purpose, access to certain users' personal data may be granted to:
- Company employees and freelance or similar associates bound by confidentiality, only to the extent necessary for processing;
- Affiliated companies within the Company's corporate group, where necessary and always within our legitimate interest and the defined purpose;
- Newly established entities or an entity acquiring ownership of the Company in a merger, acquisition, purchase, sale of shares or other corporate change;
- Partners acting as processors for the Company, such as external service providers and software companies developing and maintaining software in which data is stored;
- Exceptionally, competent public authorities where this is a legal obligation of the controller, only to the extent necessary to fulfil that obligation;
- Any other recipient where reasonably necessary, for example in a life-threatening situation.
All recipients must take appropriate technical, organisational and personnel measures to protect personal data. Where we act as controller and a third-party legal entity processes data on our instructions, we regulate the relationship contractually, covering all important aspects of processing and safeguards.
List of processors:
- Google Ireland Ltd (Ireland)
- Facebook Ireland Limited (Malta)
- Zoho (USA)
11. Consent and withdrawal of consent
If you have given consent to processing, you may withdraw it at any time. We then cease further processing and delete that personal data within a maximum of 90 days after you send the withdrawal. Withdrawal is free of charge and may be sent to zzpl@infostud.com.
Under Article 24 of the LPDP, consent may be obtained from an affiliated entity of the Company, with appropriate information about the manner, scope and purpose of processing. This includes, but is not limited to, corporate changes such as mergers, acquisitions or transfers of ownership of the Service, where consent was previously given to the former Service owner, an affiliated entity of the Company. In such cases, the Company continues processing solely for the same purposes, to the same extent and in a manner consistent with what you could reasonably expect from your earlier consent. This applies only if no new purposes or forms of processing are introduced without your consent. New processing activities relying on consent will require new consent. Your right to withdraw consent at any time remains guaranteed, whether consent was obtained by the Company or a third party.
12. Website policy
We use various technologies on our website. Some are controlled by us (first-party technologies) and others by other organisations (third-party technologies).
These technologies include, but are not limited to, cookies and scripts. Some are necessary for the website to function and for us to understand your use of it. We also use them for marketing and other purposes described below.
Cookies enable certain website features and improve your experience. To improve customer service, the website uses certain external scripts, such as Google Analytics, Firebase, Facebook Pixel, Google Ads and similar tools, which may collect some personal data.
13. Final provisions
This is the latest version of the Notice (8 December 2025).
This Notice is subject to change. If it is amended or supplemented, we will specify the date of the latest version.