In brief
We collect data needed to respond to inquiries, prepare possible offers and operate the site securely. Optional first-party analytics runs only with consent, without form data or marketing profiles.
1. Data we collect
When you send an inquiry, we may process the company name, contact person's name and role, business email, telephone, country and location, together with product, volume, packaging, delivery point and timing information and the message content.
Server and security systems may automatically record technical data such as IP address, device and browser type, access time and the requested page. Data sent by email or telephone is processed as part of the same business communication.
2. Purposes and legal bases
We use inquiry data to respond, assess a commercial requirement, prepare a possible offer and communicate before entering into a contract. The legal bases are steps taken at your request before a contract and BFC's legitimate interest in responding to business inquiries and protecting its systems.
Where processing relies on consent, you may withdraw it at any time. Withdrawal does not affect processing carried out before it. We may also process data to meet legal obligations or establish, exercise and defend legal claims.
3. Recipients and processors
Only authorised BFC personnel who need the data to respond and handle the request have access. The contact form is currently delivered through Formspree, which processes form content on BFC's behalf. Hosting, IT and security providers, professional advisers and competent authorities may also process data where legally required.
If a provider processes data outside the Republic of Serbia, BFC applies an appropriate legal mechanism and safeguards required by applicable law. We do not sell personal data or provide it for independent advertising.
4. How long we keep data
Inquiry data is kept for no longer than 24 months after the last meaningful communication, unless a shorter period is sufficient or longer retention is required for a contract, legal obligation or legal claim. Spam and security-related messages may be retained for up to 90 days to protect the form and systems.
Basic server logs are retained only as long as needed for security, diagnostics and abuse prevention, normally for up to 30 days unless an incident requires longer retention.
6. Your rights
Subject to applicable law, you may request access, correction, deletion, restriction and portability, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it.
Send a request to office@bfcltd.rs. We may ask for reasonable identity verification. You also have the right to complain to the Commissioner for Information of Public Importance and Personal Data Protection in Serbia.
7. Security, children and changes
We apply organisational and technical safeguards appropriate to the nature of the data and processing risk. No transmission or storage system can, however, be guaranteed absolutely secure.
This business-to-business site is not directed to persons under 18. We may update this policy when services, technology or law change; the latest revision date will be shown here.
8. Contact and supervisory authority
For questions and requests, contact office@bfcltd.rs.
Commissioner for Information of Public Importance and Personal Data Protection