NEXT

Legal

Privacy policy

What data the site collects, why, where it goes and how to have it deleted. Written from what the site actually does.

Last updated:

Who processes your data

The data controller is NEXT Holding, Save Kovačevića 296, 36300 Novi Pazar, Serbia. For anything to do with personal data, write to info@next.rs or call +381 20 630 000.

Processing is governed by the Serbian Personal Data Protection Act. For visitors from the European Union the General Data Protection Regulation also applies, as the group operates in Germany through NEXT Glasfaser GmbH.

The contact form

When you send a message through the form, we keep your name, email address, phone number if you entered one, and the text of the message.

We use this only to reply to you. The basis for processing is taking steps at your request: without these details there is nobody to reply to.

The message arrives in the site's admin area, where it is seen by the staff who answer it, and a copy is also sent as a notification to our own email address.

The assistant on this site

The site has an assistant that answers questions about the group. You should know this before you type anything into it.

Conversations are stored on our server and staff in the admin area can read them. We read them to see what visitors ask for most often and what the site is missing.

The site has no user accounts, so a conversation is not tied to your name but to a random string your browser keeps locally. That string does not say who you are, but it links conversations from the same device.

The assistant sends nothing outside our own server and uses no external service. Even so, do not type into it anything you would not put in an ordinary message: an identity card number, a password, or payment details.

You can delete your conversation history in the assistant itself. Clearing what your browser stores locally also cuts the link to your conversations.

What the site itself records

This site has no analytics at all. No Google Analytics, no social network pixels, no behaviour tracking tools. We do not build visitor profiles and we do not follow you across other websites.

The server the site runs on records technical details about requests, such as the IP address, the time and the address requested. This is an ordinary server log, kept for security and fault finding, and it is not used to identify anyone.

Job applications

Applications to job adverts go through a Google form, at the client's express request, so that all applications arrive in one place.

When you open that form, whatever you enter is processed by Google under its own terms, and it reaches us in a responses spreadsheet. If you would rather apply another way, write to info@next.rs.

Who we share data with

We do not sell data and we do not give it to third parties for their own purposes. It is shared only with the services the site cannot run without:

  • Supabase, the database that holds messages and conversations. Its servers are in Frankfurt, in the European Union.
  • Vercel, the company that hosts the site.
  • Resend, the service that delivers the notification when a new message arrives.
  • Google, when you choose to load the map on the contact page, and when you open the job application form.

Data leaving the country

The database is in the European Union, whose level of protection is recognised in Serbia, so its transfer needs no separate approval.

Vercel and Resend are companies based in the United States. Their data processing terms apply, and those provide for standard contractual clauses.

How long we keep data

We keep a message from the form for as long as the exchange lasts, and for a while afterwards, so we can recall what it was about if you get in touch again.

Assistant conversations are kept for a shorter time, as they serve only to show us what visitors ask.

We delete data sooner than that as soon as you ask us to, unless a regulation requires us to keep it.

Your rights

In relation to your own data you have the right to:

  • ask for access, that is, to learn what data we hold about you,
  • have inaccurate data corrected and incomplete data completed,
  • ask for erasure,
  • ask for processing to be restricted,
  • object to processing,
  • ask us to hand over your data in a form you can take elsewhere.

How to exercise your rights

Write to info@next.rs. We reply within thirty days of receiving the request at the latest, and usually well before that.

If you believe your rights have been infringed, you may complain to the Serbian Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, Belgrade. A visitor from the European Union may also turn to the supervisory authority in their own country.

Security

The site runs over an encrypted connection. Only a signed-in account can reach the admin area, and rules inside the database itself limit who can read what, so a flaw in the site's code does not open other people's data.

No measure is complete. If a breach does occur that carries a risk to your rights, we will act as the law requires and tell you.

Changes to this policy

We change this policy when what the site does changes. The date of the last change is at the top of this page.

If a change is significant we will say so somewhere visible, rather than quietly moving the date.