This policy explains which personal data M Lab Studio collects through this website, why, on what legal basis, how long we keep it and what rights you have. It applies to visitors of mlab-studio.com and to people who contact us, book a call or apply for a job.
Who is responsible for your data
The controller is M Lab Studio, a sole proprietorship registered in Serbia, Jovana Krajišnika 14/5, 11300 Smederevo, registration number 66129853, tax ID 112478179. Full details are in the Impressum. For any question about your data, write to hello@mlab-studio.com.
Which laws apply
We process personal data in line with the Serbian Law on Personal Data Protection (Official Gazette of RS, No. 87/2018). Where we offer services to people in the European Union, we also follow the EU General Data Protection Regulation (GDPR).
What we collect and why
Visiting the website
When you open a page, our server and our content delivery and security provider, Cloudflare, process technical data: your IP address, the date and time, the requested address, the referring page and information about your browser. We use it to deliver the site, protect it from abuse and fix errors. Legal basis: our legitimate interest in a secure, working website. Addresses that return a "page not found" error are logged without your IP address and deleted after 90 days.
Contact form
When you send an inquiry, we collect your name, email address, company (optional), the services and plan you select, your preferred start and billing period, your website address (optional), your message, the page you sent it from and the language of that page. We use this data to reply and to prepare an offer, and we send you a confirmation email. Legal basis: steps taken at your request before entering into a contract, and our legitimate interest in replying to you. To protect the form from spam, your IP address is held for up to one hour to limit the number of messages; it is not stored with your inquiry.
Booking a call
Calls are booked through Calendly (Calendly LLC, USA). Calendly processes the data you enter on its page on our behalf: your name, email address, the time you choose and any notes you add. We use it to hold the call and follow up. Legal basis: steps taken at your request before entering into a contract. Calendly's own privacy policy also applies.
Job applications
When you apply for a position or send an open application, we collect your name, email address, phone number (optional), a link to your profile or portfolio (optional), your message and your CV. We use them only for recruitment. Legal basis: steps taken at your request before an employment or engagement contract, and your consent, which you give in the application form. CVs are stored privately and are available only to the people who decide on hiring.
Analytics, only with your consent
If you allow it, we use Google Analytics 4 (Google Ireland Limited and Google LLC) to understand how the site is used: pages viewed, time spent, approximate location derived from your IP address, device and browser type, and actions such as sending the form or clicking "Book a call". Google Analytics 4 does not store IP addresses. Legal basis: your consent, which you can withdraw at any time in Cookie settings. Without your consent, Google Analytics is not loaded.
Email and client relationships
When you write to us or become a client, we process your contact details and our correspondence to carry out the contract, issue invoices and meet our legal obligations. Legal basis: performance of the contract and our legal obligations.
Who receives your data
We do not sell your data. We share it only with providers who work on our behalf, under contracts that oblige them to protect it:
- UNITED INTERNET DOO, hosting of the website and its database;
- Cloudflare, Inc., content delivery and protection against attacks;
- Google Ireland Limited and Google LLC, analytics, only with your consent;
- Calendly LLC, booking calls.
We may disclose data to public authorities when the law requires it.
Transfers outside Serbia and the EU
Some providers, such as Cloudflare, Google and Calendly, may process data in the United States or in other countries. These transfers rely on an adequacy decision, such as the EU–U.S. Data Privacy Framework for certified companies, or on standard contractual clauses, with additional safeguards where needed.
How long we keep data
- Inquiries and booked calls: 24 months after our last contact, or longer if a contract follows.
- Job applications: 12 months after they are received, then deleted automatically.
- "Page not found" log: 90 days.
- Analytics data: 14 months.
- Backups: up to 6 months, deleted in rotation.
- Contracts and invoices: for the periods required by Serbian accounting and tax regulations.
How we protect data
All traffic to the site is encrypted (HTTPS). Access to the administration is limited to authorized people with personal accounts, CVs and documents are not publicly accessible, and backups are encrypted and stored outside the hosting account.
Your rights
You have the right to:
- access the data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict processing;
- receive your data in a structured, machine-readable format;
- object to processing based on our legitimate interest;
- withdraw your consent at any time, without affecting processing carried out before the withdrawal.
Send your request to hello@mlab-studio.com. We reply within 30 days. In complex cases we may extend this period as the law allows, and we will tell you why. You can also lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, Belgrade (www.poverenik.rs), or, if you live in the EU, with your local data protection authority.
Children
This website is not intended for children under 15, and we do not knowingly collect their data.
Automated decisions
We do not make decisions based solely on automated processing, including profiling.
Changes to this policy
We may update this policy when our services or the law change. The date of the last change is shown at the top of this page.