Privacy notice

Who processes your data

Medić Law Office is the data controller. For questions about processing and to exercise your rights, use the office contact details on the Contact page.

Enquiries through the contact form

When it is switched on on the Contact page, the form collects your name, telephone number and/or email, chosen attorney and contact channel and, if you provide them, practice area, consultation format and a brief message. We use these details to reply to your enquiry and, if needed, arrange a consultation. The legal basis is taking steps at your request before entering into a contract (Article 12(1)(2) of the Serbian Law on Personal Data Protection).

You are not legally required to provide this information. Without a name and suitable contact details, the form cannot send an enquiry. The message, practice area and consultation format are optional. No attachments are collected. If you provide an email address, we may send you a confirmation with pre-set text, without your name or the content of your message.

An enquiry to your chosen attorney is sent to their address, with a copy to the office. If you do not choose an attorney, it is sent to the office, with a copy to both attorneys.

Booking an appointment

For booking, we collect your name, email and telephone number, chosen attorney, consultation format, practice area, appointment time, an optional note and the version of the site you book on. This data is used to book and hold the consultation, on the same legal basis.

When you book, this data is entered as an appointment in the office calendar, in the office’s Google Workspace account. Google sends you an invitation from the office’s email address and, for a video consultation, also provides Google Meet. The note is in the appointment description, so you also see it in your invitation.

For every new booking, the site sends an email to the chosen attorney, with a copy to the office, containing the booking details and a link to the appointment in the office calendar. Scaleway SAS sends this email.

The site keeps no booking database, and White City Labs keeps no copy. The invitation stays in your mailbox and calendar, and your replies to it go to the office mailbox.

Without the required details and selections, you cannot book an appointment through the site. You can contact the attorney directly. A booked appointment does not mean that your matter has been taken on: the attorney decides whether to accept the engagement.

Sensitive data

Do not enter health information, information about criminal proceedings, personal identification numbers or other sensitive details in your message or note. If you nevertheless provide them, processing for legal claims is subject to the conditions in Articles 17 and 19 of the Law. We discuss how to send documents after first contact.

Security checks

To prevent misuse, we use Cloudflare Turnstile and request limits, based on the legitimate interest in operating the site securely (Article 12(1)(6) of the Law). The check involves the IP address and technical browser, device and connection signals. Our code does not store the IP address.

The check may prevent a request from being submitted, but it does not decide whether an attorney takes on a matter and is not used for profiling. If the check is unavailable, use the direct contact details. We do not use automated decision-making to accept matters.

Recipients and technical service providers

Enquiries and bookings are intended for the chosen attorney and the office, according to your selections. White City Labs maintains the site and its functions as a processor. Cloudflare, Inc. provides hosting, function execution and abuse checks; booking data passes through it to Google, and our code does not store it at Cloudflare. Through its Transactional Email service in the EU, Scaleway SAS sends the attorney the email about each new booking and, when the form is switched on, the contact form emails. Scaleway does not receive the invitation or your replies to it.

Google processes booked appointments as the office’s processor, within the office’s Google Workspace service: Google Calendar holds the appointment, Gmail sends the invitation and receives your replies, and Google Meet is used for video consultations. Processing is governed by the office’s contract and the Cloud Data Processing Addendum. To offer appointment times, the site reads only the start and end of busy periods from the attorneys’ calendars, without titles or contents.

Video consultations take place on Google Meet, as part of the office’s Google Workspace service. The call link is in the invitation.

For Turnstile verification, Cloudflare acts as a processor when checking requests and as a separate controller when improving abuse detection. Further information is available in the Cloudflare privacy notice and the Turnstile terms.

GitHub holds the site’s code and texts. We do not put form or booking data into the repository.

Processing locations and data transfers

Cloudflare is a US company and may process data outside Serbia and the EU. Google may process data about booked appointments outside Serbia and the EU, with the safeguards set out in the office’s agreement with Google.

Contact the office for information about the legal basis for international transfers, safeguards and a copy of the relevant contractual provisions. Information about technical providers is available in the Cloudflare DPA, the Scaleway privacy notice and the Google privacy notice.

Retention periods

Data entered in the form remains in the page’s memory until you close the page. The enquiry function processes data in memory while verifying the enquiry and sending the email; it does not create a database or backup of the enquiry.

The site does not keep booking data and deletes nothing. The appointment in the office calendar is the office’s record of the consultation and stays there until the office deletes it, as does the attorney’s email about the booking in the office mailbox. You can ask for the appointment and that email to be deleted at any time.

We keep enquiries that do not lead to an engagement in the office mailbox for up to 12 months. If you engage us, the necessary information becomes part of the case file and is retained in accordance with the obligations applicable to that matter. Messages and invitations in your mailbox and calendar remain under your control.

Our system’s technical logs contain only permitted data about the outcome and processing duration and, for bookings, also the attorney and the number of calendar calls. They contain no name, contact details, message, note, IP address or calendar event title. They are retained for three days and accessible to authorised White City Labs personnel. Cloudflare and Turnstile operational data and Scaleway sending data are subject to those providers’ terms.

Search, themes and device data

Search runs in your browser against an index from our site. We do not send the query to a server or third party, log it or store it. You can open search with a keyboard shortcut. Search stores nothing on your device.

The initial theme follows your device setting. Only when you choose the light or dark theme yourself is your choice saved in the theme key in persistent browser storage. The key remains on your device until you change the choice or clear site data. We do not use it for tracking or send it to a server.

Our code does not set cookies. Turnstile loads only when you start filling in the contact form or the details step when booking. The check uses technical signals and device storage to protect the request. We do not use the cf_clearance cookie.

Fonts and images load from the site itself, and the map is not an embedded service. Following a link to Google Maps, Viber or WhatsApp opens a service with its own terms. The site does not use visitor analytics.

Your rights

You may request access to your data and a copy, rectification of inaccurate data and, where the statutory conditions are met, erasure, restriction of processing and portability. You may object to processing based on legitimate interest. Use the office contact details to make a request; a proportionate identity check may be required.

We respond within the statutory period, generally within 30 days. If you consider processing unlawful, you may complain to the Serbian Commissioner for Information of Public Importance and Personal Data Protection.

Consultations are held in Serbian and English only.