PRIVACY POLICY AND PERSONAL DATA PROTECTION
Last updated: 12 October 2026
Attorney-at-Law Damir Petrović, practising law under the name Petrović Mojsić & Partners (“Petrović Mojsić”, the “Law Firm”, “we”, “us” or “our”), is committed to protecting the privacy and personal data of its clients, prospective clients, business contacts, website visitors and other natural persons whose personal data are processed.
This Privacy Policy explains which personal data we process, the sources from which we may obtain such data, the purposes and legal bases for processing, the persons to whom such data may be disclosed, how long we retain such data and the rights available to data subjects.
This Policy applies to the processing of personal data through the website www.law-firm.rs, communications with the Law Firm, consideration of prospective engagements, the provision of legal services and other activities related to the legal practice.
We process personal data in accordance with the Law on Personal Data Protection of the Republic of Serbia (“Official Gazette of the Republic of Serbia”, No. 87/2018 – the “Serbian Data Protection Law”), the Law on Electronic Communications (“Official Gazette of the Republic of Serbia”, No. 35/2023), other applicable laws and regulations of the Republic of Serbia and, where applicable, Regulation (EU) 2016/679 – the General Data Protection Regulation (“GDPR”).
The controller of personal data is:
Attorney-at-Law Damir Petrović
Petrović Mojsić & Partners
12 Vlajkovićeva Street
11000 Belgrade
Republic of Serbia
Website: www.law-firm.rs
Email: [email protected]
Telephone: +381 69 605 295
For any questions concerning the processing of personal data or the exercise of your rights, you may contact the controller using the contact details set out above.
We process personal data lawfully, fairly and transparently, for specified, explicit and legitimate purposes.
We process only personal data that are adequate, relevant and limited to what is necessary for the particular purpose. We endeavour to ensure that personal data are accurate and kept up to date and retain them only for as long as necessary or required by law.
We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, loss, destruction, damage or unauthorised disclosure.
As a legal practice, we are additionally bound by statutory and professional duties of attorney-client confidentiality and professional secrecy, in accordance with the laws and professional rules governing the legal profession.
3.1. Website visitors
When you use our website, certain technical data may be processed, including:
Subject to the user’s prior consent, data may also be processed through Google Analytics, as further explained below.
3.2. Contact form and other enquiries
When you contact us through the contact form, by email, telephone or otherwise, we may process:
Please do not provide more personal data through the contact form than is necessary for a preliminary understanding of your legal matter.
Submitting an enquiry, information or documentation to the Law Firm does not, in itself, establish an attorney-client relationship and does not mean that an engagement has been accepted.
3.3. Clients and prospective clients
Depending on the particular matter, we may process:
3.4. Personal data relating to other persons
In the course of providing legal services, we may also process personal data relating to persons who are not our clients, including:
We may obtain such data from the client, the data subject, an opposing party, other participants in proceedings, courts and other authorities, public registers and records, publicly available sources or other lawful sources.
The nature of legal practice may require the processing of special categories of personal data, including data revealing:
We process such data only where, in addition to an appropriate legal basis for processing, one of the specific conditions prescribed by applicable law for the processing of such categories of data is satisfied.
In the context of legal practice, such processing may in particular be necessary for the establishment, exercise or defence of legal claims, in accordance with applicable law.
We process personal data relating to criminal convictions, offences and security measures only under the conditions prescribed by law, under the supervision of a competent authority or, where processing is authorised by law, subject to appropriate specific safeguards for the rights and freedoms of the data subject.
5.1. Operation and security of the website
Technical data necessary for the operation, maintenance and protection of the website may be processed on the basis of the controller’s legitimate interest in ensuring the reliability, integrity and security of the website and information systems.
Where processing is based on legitimate interests, such processing is carried out only where it is necessary for the pursuit of those interests and where such interests are not overridden by the interests or fundamental rights and freedoms of the data subject.
5.2. Responding to enquiries and prospective engagements
We process personal data for the purposes of:
Where a natural person contacts us with a view to potentially entering into an agreement for legal services, the legal basis for processing may be taking steps at the request of that person prior to entering into a contract.
Where an individual contacts us on behalf of a company, organisation or another person, the processing of that individual’s business contact details may be based on our legitimate interest in establishing and managing a professional relationship.
5.3. Provision of legal services
We process personal data for the purposes of:
The applicable legal basis depends on the particular relationship and may include performance of a contract, compliance with a legal obligation, legitimate interests or another legal basis provided for by applicable law.
5.4. Statutory and professional obligations
We may process personal data in order to comply with obligations arising from laws and professional rules governing:
5.5. Establishment, exercise and defence of legal claims
We may process personal data where necessary for the establishment, exercise or defence of legal claims, including in court, arbitration, administrative, enforcement and other proceedings.
5.6. Consent
Where consent is required for a particular processing activity, we process personal data only within the scope of the purpose for which consent has been given.
You may withdraw your consent at any time.
Withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal.
The website www.law-firm.rs uses Google Analytics 4 (“GA4”) for statistical analysis of website use and for improving its content, structure and functionality.
Google Analytics may process information relating to:
According to information provided by Google, GA4 does not log or store users’ IP addresses in its Analytics systems, although the IP address is technically used during communication for the processing of requests and the determination of certain information, such as approximate geographical location.
Google Analytics uses, among others, the following cookies:
_ga – used to distinguish users;
ga<container-id> – used to maintain session state.
Google states that the default duration of these cookies may be up to two years, although web browsers and specific settings may further limit that period.
User-level and event-level data in a standard GA4 configuration are retained in accordance with the configuration of the relevant Google Analytics account.
Prior consent
Google Analytics is not necessary for the operation of the website.
Google Analytics tags are not activated before the user gives consent to analytics cookies.
If the user rejects analytics cookies, Google Analytics tags remain blocked and no data are sent to Google Analytics through those tags.
The legal basis for such analytics processing is the user’s consent.
Users may accept or reject analytics cookies and may subsequently change or withdraw their choice through the cookie management mechanism available on the website.
Rejecting analytics cookies does not affect the ability to use the essential functions of the website.
In connection with the use of Google Analytics, certain data may be processed by Google and its affiliated companies. Where the use of this service involves transfers of data to other countries, such transfers are subject to the rules governing international transfers of personal data set out in this Policy.
The website may use cookies or similar technologies that are technically necessary for:
Consent is not required for technical storage or access to information where such storage or access is strictly necessary to enable communication or to provide a service expressly requested by the user, to the extent permitted by applicable law.
Personal data may be accessed only by persons who require such access for a specific legitimate purpose.
Depending on the particular circumstances, recipients may include:
When Google Analytics is used, and subject to the user’s prior consent, certain data may be made available to Google as the provider of the analytics service.
Where a third party processes personal data on behalf of and for the account of the controller, the relationship with such processor is governed in accordance with applicable data protection requirements.
Any disclosure of data relating to client matters is additionally subject to the rules governing attorney-client confidentiality and professional secrecy.
Due to the international nature of our legal practice and the use of certain IT and cloud services, personal data may be transferred or made available to recipients outside the Republic of Serbia.
This may include transfers to:
Transfers are carried out only in accordance with the requirements of the Serbian Data Protection Law, including transfers to countries or organisations ensuring an adequate level of protection, transfers subject to appropriate safeguards or, where the statutory conditions are satisfied, on the basis of an applicable derogation for a specific situation.
In the context of legal matters, a transfer may in particular be carried out where it is necessary for the establishment, exercise or defence of legal claims, in accordance with applicable law.
Where the GDPR applies, international transfers of personal data are also carried out in accordance with its requirements.
We retain personal data only for as long as necessary to fulfil the purpose of the processing, or for any additional period required by law or justified by legitimate legal and professional interests.
When determining retention periods, we take into account in particular:
Information submitted through an enquiry which does not result in an engagement is retained only for the period reasonably necessary to process and document the enquiry, conduct conflict-of-interest checks and protect potential legal interests.
Data collected through Google Analytics are retained in accordance with the settings of the Google Analytics account and the rules applicable to the relevant category of data.
Upon expiry of the applicable retention period, personal data are deleted, securely destroyed, anonymised or retained further only where an appropriate legal basis exists.
We implement appropriate technical and organisational measures designed to protect personal data against:
Access to personal data is restricted to persons who require such access for the performance of relevant professional or operational duties and who are subject to confidentiality obligations.
No electronic system can guarantee absolute security; however, we adapt our security measures to the nature of the personal data, the manner of processing and the assessed level of risk.
In certain circumstances, the provision of personal data may be required by law or contract or may be necessary in order to take steps prior to entering into a contract or to provide legal services.
If you do not provide personal data necessary for a particular purpose, we may be unable to accept an engagement, respond to a particular request or provide the requested legal services.
Subject to the conditions prescribed by the Serbian Data Protection Law and other applicable legislation, you may have the right to:
These rights are not absolute.
Their exercise may be restricted where processing is necessary for:
Requests for the exercise of data subject rights may be submitted to [email protected].
For the purpose of protecting personal data, we may request additional information reasonably necessary to verify the identity of the person making the request.
We will respond to a request without undue delay and no later than within the period prescribed by law. Under the Serbian Data Protection Law, that period is generally 30 days from receipt of the request, and may be extended by a further 60 days where necessary due to the complexity or number of requests, in which case the data subject will be informed accordingly within the applicable statutory period.
Where processing is based on legitimate interests, the data subject has the right to object at any time to such processing on grounds relating to his or her particular situation.
In such circumstances, we will cease processing unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights or freedoms of the data subject, or where the processing is necessary for the establishment, exercise or defence of legal claims.
We do not make decisions producing legal effects concerning a natural person, or similarly significantly affecting that person, based solely on automated processing of personal data, including profiling.
Google Analytics is used solely for statistical analysis of website use and not for making decisions concerning individual visitors which produce legal or similarly significant effects.
Our website may contain links to third-party websites.
We do not control how such third parties process personal data, and this Policy does not apply to their websites.
We recommend reviewing the applicable privacy policy before using any third-party website accessed through a link on our website.
If you believe that your personal data have been processed in breach of applicable data protection legislation, you have the right to lodge a complaint with:
Commissioner for Information of Public Importance and Personal Data Protection
15 Bulevar kralja Aleksandra
11120 Belgrade
Republic of Serbia
Telephone: +381 11 3408 900
Email: [email protected]
Website: www.poverenik.rs
Lodging a complaint with the Commissioner does not affect any other administrative or judicial remedies available to you under applicable law.
We may amend this Policy from time to time in order to reflect changes in applicable legislation, our processing activities, the website, technologies used or service providers.
The current version of this Policy will always be available at www.law-firm.rs, together with the date of the latest update.
Attorney-at-Law Damir Petrović
Petrović Mojsić & Partners
12 Vlajkovićeva Street
11000 Belgrade
Republic of Serbia
[email protected]
www.law-firm.rs
+381 69 605 295
