Privacy Policy

Version: 30.10.2026

1. Controller

The controller responsible for processing personal data on this website and in connection with our services is:

NEXOVIA Consult LLC
7901 4th St N, STE 300, St. Petersburg, FL 33702, United States of America
Represented by: Dalibor Smiljanić (Authorized Member)
Telephone: +1 727 405-1212
Email for data protection and general enquiries: info@advokatia.com
Email for contracts, complaints and withdrawal: kontakt@advokatia.com

We handle requests sent to the other of these two addresses in the same way.

No data protection officer has been designated.

2. Overview

We process personal data only to the extent necessary to operate this website and to handle your enquiries and orders.

• On this website we use no analytics or tracking tools, no advertising, no social media plugins and no embedded third-party content. Fonts are loaded from our own server; visiting the website does not transmit any data to Google or other third parties. For open tracking in our emails, see section 7.
• No automated decision-making, including profiling (Art. 22 GDPR), takes place.
• Our company is incorporated and registered in the USA. Details on processing outside the EU are in section 11.

3. Hosting and server log files

This website is hosted by Hostinger on a server in Germany (Frankfurt) (see section 10). On every request, the hosting provider processes technically necessary access data: IP address, date and time, requested address, referrer, browser and operating system information, amount of data transferred and status code.

• Purpose: delivering the website, stability, defence against attacks.
• Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure and functioning operation of the website.
• Retention: Hostinger stores the access logs as the hosting provider. How long they are kept is determined by Hostinger under its own operational rules; Hostinger has not told us a fixed period, and we do not set one of our own. We look at the logs only where necessary for the operation and security of the website, for example to troubleshoot or to investigate an attack. If we need extracts for this, we keep them only as long as this purpose requires and then delete them.
• Runtime logs: the hosting account shows the application's technical messages for the current deployment; a new deployment starts a new log view.

4. Cookies

For visitors to the public pages we set only one cookie:

In the administration area (/admin, only for the authorised person, currently solely the owner), sign-in and security cookies are added (see section 9).

These cookies are technically necessary (§ 25(2) no. 2 TDDDG); no consent is required for them. The related data is processed under Art. 6(1)(f) GDPR.

5. Online enquiry

Data:

• first name, last name, email address and, optionally, company name;
• country of residence, country concerned and service category;
• your description of the matter;
• whether you would like a video appointment, and the selected language.

We assign a reference number and store the processing status with its history, as well as internal processing notes.

Purpose: reviewing and answering your enquiry, preparing a quotation and performing the order.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures or performance of a contract). The information is required to handle your enquiry; there is no statutory obligation to provide it. Without it we cannot handle your enquiry.

Abuse protection: to prevent automated mass enquiries, when the form is submitted and when documents are uploaded we store the IP address together with a counter for a 10-minute window. After the window expires, the entry is no longer taken into account and is deleted at the next automatic clean-up, which normally runs every 6 hours.

• Legal basis: Art. 6(1)(f) GDPR.

6. Uploaded documents

You may voluntarily upload up to 5 documents (PDF, JPG, PNG or DOCX, each up to 10 MB).

• Storage location: documents are transmitted over an encrypted connection (TLS) and stored in a private storage area at Cloudflare R2 that is not publicly accessible. The storage is configured with the data location "EU" (see section 10).
• Checks: before storage we verify the actual file format. Word files with active or embedded content (e.g. macros) are rejected. PDF files are additionally checked automatically for their technical structure. PDF files with prohibited functions (e.g. commands that launch programs or embedded executable files) and PDF files that cannot be checked completely (e.g. encrypted or damaged files) are not accepted; they are not stored. PDF files with active or unusual content (e.g. scripts in forms) are accepted and flagged for particularly careful handling. Only the check result and the type of finding are stored, no content. This check is not a virus scan; no virus scan takes place on the server.
• Access: through the administration area, only one authorised person has access; sign-in requires two-factor authentication. Downloads and deletions are logged.
• Purpose and legal basis: as in section 5.

Special categories of personal data (Art. 9 GDPR): documents and your description may contain specially protected data, e.g. health data in medical reports or religious affiliation in certificates. We process such data only where there is both a legal basis under Art. 6(1) GDPR and an exception under Art. 9(2) GDPR.

• Ordinary information about you in your documents is processed to handle your enquiry and perform the order (Art. 6(1)(b) GDPR); no consent is required for this.
• Your own specially protected data is processed only with your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR), and only to handle your enquiry and perform the order. You give it through a separate, unticked checkbox in the form. It covers only data about yourself and only to the extent that your documents or your description contain such data. At present this checkbox is a requirement for uploading documents, because we cannot tell in advance whether a document contains such data. Without consent you can send an enquiry without documents. We store the time and the version of your consent.
• Data received without consent: if your description or an email to us contains specially protected data about you without your consent, we ask for your consent before processing further.
• Withdrawal: you can withdraw your consent at any time with effect for the future, e.g. by email to info@advokatia.com or kontakt@advokatia.com. From the withdrawal onwards we no longer use the data concerned for the work, accept no further documents and delete the documents concerned manually without undue delay, unless another legal basis (e.g. defence of legal claims) or a statutory retention obligation applies. We continue to process ordinary information to perform the order; if the order cannot be performed without the documents, we will inform you. Processing carried out before the withdrawal remains lawful.
• Data minimisation: please upload only documents that are necessary for your matter, and black out or remove beforehand any information we do not need.

Information about other people: your documents or your description may contain information about other people, e.g. family members, children, landlords or employers. We accept only information about other people that is necessary for the service you request. Please black out or remove all other information about other people before uploading.

• Your consent does not cover other people: your consent in the form does not allow us to process data of other people. A separate legal basis is required for that in each case.
• Ordinary information about other people is processed, to the extent necessary for your matter, on the basis of legitimate interests (Art. 6(1)(f) GDPR): your interest in having your matter dealt with and our interest in performing the order. We protect the interests of the person concerned by using only the necessary information, using it only for your matter, and protecting and deleting it like your other data. In the case of children we give particular weight to their interests.
• Specially protected data of other people (e.g. health data of a family member) is processed only if it is necessary for your matter and, for the person concerned, there is both a legal basis under Art. 6(1) GDPR and an exception under Art. 9(2) GDPR. As a rule this is the explicit consent of the person concerned. Consent given by someone else is sufficient only if that person is legally authorised to act for the person concerned, e.g. as a parent with parental responsibility acting within it, or as a court-appointed guardian whose scope of duties covers the matter. We check in each case whether such authority exists and ask you to provide the consent in text form and, where appropriate, proof of the authority. If there is no sufficient basis, we do not use this information and black it out or delete it manually.
• Children: information about children is processed only to the extent necessary for the matter; for specially protected data of a child, the previous point applies.
• Source of the information (Art. 14 GDPR): we do not receive this information from the person concerned, but from our customer. The categories are the information in the documents and descriptions provided; otherwise the information in this privacy policy on purpose, legal basis, recipients, retention and rights applies accordingly.
• Informing the people concerned: whether we inform a person concerned individually is assessed case by case. We refrain from doing so only where a statutory exception under Art. 14(5) GDPR applies. In that case we document the reasons and take appropriate measures to protect the legitimate interests of the person concerned, including making this information publicly available.

7. Email communication

Confirmation to you: after receiving your enquiry we send you a confirmation with your reference number. The sender is kontakt@advokatia.com. Sending is handled by the service provider Brevo (see section 10). For this, Brevo processes your email address, your name and the content of the confirmation. Brevo also stores sending and delivery events (e.g. "delivered", "bounced") so that we can detect delivery problems. Brevo deletes these logs after one month; Brevo does not store previews of the email content.

Open tracking by Brevo: Brevo delivers the confirmation as an HTML email and inserts an invisible tracking pixel, even when we hand over the message as plain text only. If your email program loads this image, Brevo records an open. Since 29.10.2026 our Brevo account is set to anonymised recording: opens and clicks are counted but not attributed to any specific person; information that could identify you, such as your email address and IP address, is anonymised. Our confirmation itself contains no links. If your email program does not load images automatically, no open is recorded.

Internal notification: we notify ourselves of every new enquiry by email to our mailbox info@advokatia.com. It is sent through Hostinger's mail server and contains:

• reference number, name and email address;
• country of residence, country concerned, language and service category;
• whether documents were provided.

Your description and your documents are not included.

Direct emails: if you write to us directly, we process your message, attachments and contact details in order to reply. Our mailboxes are operated by Hostinger. Hostinger logs sign-ins to the mailboxes (access logs) as well as sending and receiving of emails (delivery logs with sender, recipient and delivery status); these logs are available for 30 days. If your attachments contain specially protected data (e.g. health data), we ask for your explicit consent before processing (see section 6).

Legal basis: Art. 6(1)(b) GDPR, for general enquiries point (f) (answering enquiries).

Short-term sending copy: for reliable sending, we first place every email in a sending queue in our database. Our system deletes this copy automatically 30 days after it was created, once the email has been sent or sending has finally failed. This applies independently of Brevo's periods.

8. Video appointments

On request and by prior arrangement we offer video appointments, e.g. via Microsoft Teams, Zoom or another suitable platform. We tell you which platform we use with the invitation.

• Data processed: name or display name, email address, image and sound during the call, time and duration, and technical connection data (e.g. IP address).
• Purpose and legal basis: discussing your enquiry or performing the order (Art. 6(1)(b) GDPR). Participation is voluntary; you can communicate with us by email or telephone instead.
• Platform providers: depending on the platform, providers process the data on our behalf or also for their own purposes under their own privacy notices. They may also process data in countries outside the EU, in particular in the USA (see section 11).
• No recording: as a rule we do not record calls. A recording is made only exceptionally, after prior information and with the separate explicit consent of all participants.
• Data minimisation: please share in the call only what is necessary for your matter.

9. Administration area and security logs

This section mainly concerns the person who uses the administration area, but it also describes how your data is protected. Currently only the owner has access to the administration area and to your documents; other staff have no access.

• Sign-in: sign-in requires a password and two-factor authentication (Auth.js software).
• Sessions: a session is valid for at most 8 hours and can be ended server-side at any time. For this the administration area sets session and security cookies (authjs.*).
• Limiting sign-in attempts (temporary): to limit attacks, we count sign-in attempts in a 10-minute window, separately by IP address and by a check value of the email address entered. After the window expires, these entries are deleted at the next automatic clean-up, normally within 6 hours.
• Audit log: an audit log records who viewed, changed or deleted an enquiry and who downloaded or deleted a document, and when. It also contains successful and failed sign-ins with time and reason (e.g. wrong password). Failed sign-ins are stored with the internal account ID or, if the email address entered does not belong to any account, only with a truncated check value of that address computed with a secret key (HMAC), never with the address itself, a password or a code. The audit log contains no IP addresses, no content of your enquiry and no documents.
• Purpose: protecting your data against unauthorised access (Art. 32 GDPR) and demonstrating proper processing (Art. 5(2) GDPR).
• Legal basis: Art. 6(1)(f) GDPR, where necessary point (c).
• Retention of the audit log: we keep audit log entries for up to 12 months and then delete them manually. We keep individual entries longer only where they are needed in the individual case, for example to investigate a security incident or to establish, exercise or defend legal claims; we document such exceptions. After an enquiry is deleted, the log contains only internal IDs that cannot readily be linked to you.

10. Recipients and processors

We use the following service providers. They process data on our behalf.

The terms of all four providers include a data processing agreement under Art. 28 GDPR, which applies on acceptance of the terms of use. The customer accounts with these providers are currently registered in the name of the owner, Dalibor Smiljanić; processing is carried out for NEXOVIA Consult LLC as the controller. The providers may in turn engage sub-processors; they publish information on this in their contractual or data protection documentation.

Other recipients:

• Payments through a US business account: our business account is held with a bank in the United States. For payments by bank transfer, the data required to process the payment, in particular name, account details, amount and payment reference, is transmitted to and processed by the banks involved. Processing is carried out to perform the contract (Art. 6(1)(b) GDPR). For the transfer to the USA, see section 11.
• Other payment methods: if in an individual case we offer another payment method (e.g. PayPal or card payment via Stripe), we name it in the quotation or payment request; the provider concerned then processes the payment data under its own privacy notice. We receive from it only the information we need to match the payment.
• External collaborators (e.g. translators): currently no external collaborators receive customer documents. Only one authorised person has access to the administration area and your documents.
• AI tools: we do not pass your data or documents to AI services. Neither the website nor the administration area transmits data to AI services.

We pass data to other third parties only if

• this is necessary to perform your order and you wish it (e.g. a letter to an authority that you send yourself or instruct us to send),
• you have consented, or
• we are legally obliged to do so.

11. Processing outside the EU

Company seat: NEXOVIA Consult LLC is a company incorporated under the laws of the State of Florida with a registered address in the USA (see section 1).

Processing and access: your enquiry is handled exclusively by the owner in person. Access to the administration area and your documents takes place from Germany, from Serbia and, when travelling, from other countries. Your data remains at the storage locations listed in section 10. Access takes place over encrypted connections; signing in to the administration area requires two-factor authentication.

Service providers: for some providers, access from outside the EU cannot be ruled out. As far as we have verified:

• Cloudflare, Inc. (USA): Cloudflare is certified under the EU-US Data Privacy Framework; the basis is the European Commission's adequacy decision (Art. 45 GDPR).
• Supabase Pte. Ltd. (Singapore): the data processing agreement contains the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).
• Brevo SAS: according to its data processing agreement, Brevo also uses sub-processors in the USA and relies for this on standard contractual clauses or the EU-US Data Privacy Framework.
• Hostinger International Ltd. (Cyprus): for transfers to sub-processors outside the EEA in countries without an adequacy decision, the data processing agreement provides for the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

Payments through our US bank: for payments by bank transfer to our business account, payment data is transmitted to a bank in the USA (see section 10). Where we transfer personal data to a third country, we assess the applicable requirements under Chapter V GDPR, including, where relevant, Art. 49(1)(b) GDPR.

Video appointments: we tell you which platform we use with the invitation, and inform you then about transfers by the platform provider.

12. Retention and deletion

We delete personal data as soon as it is no longer needed for its purpose and no statutory retention obligation applies.

We delete enquiries and documents manually, not automatically:

• uploaded documents are deleted as soon as they are no longer needed for the work;
• enquiries that did not lead to an order are deleted once they are closed and no longer needed;
• we review closed matters for this every month;
• after you withdraw your consent regarding specially protected data, we delete the documents concerned without undue delay (see section 6);
• at your request we delete earlier (see section 13).

Contract records (quotation, acceptance, contract confirmation, the applicable version of the general terms and conditions and the withdrawal notice, any request for early performance, invoices and proof of payment, business correspondence) are kept separately from working documents, in the business mailbox and in an organised internal archive. Uploaded documents are not part of them; they are not kept longer because contract records must be kept.

Statutory retention: where statutory retention obligations apply to us, we keep records relating to quotations and orders for the prescribed period. Under German law this is in particular six years for commercial and business letters and eight years for invoices and accounting vouchers, each counted from the end of the calendar year (§ 257 HGB, § 147 AO, § 14b UStG). During this period we restrict processing to storage.

Our system deletes the following data automatically:

Emails in our mailboxes are also deleted manually, on the same principles as enquiries. At Brevo the following applies to all senders of our account: sending and delivery logs are deleted after one month; previews of email content are not stored.

Backups: we distinguish between our own backups and backups or operational copies that service providers keep under their own responsibility.

• Our own backups: we make no backups or copies of our own of our database (Supabase) or our document storage (Cloudflare R2). We do not store enquiries or uploaded documents on the web server. A temporary internal copy of document metadata in our database was deleted on 30.10.2026.
• Supabase: in our plan, Supabase provides us with no database backups. Whether Supabase also keeps internal copies for its operations is not known to us.
• Cloudflare R2: whether and for how long Cloudflare still keeps deleted documents internally for operational reasons is not known to us.
• Hostinger: Hostinger backs up the website daily; the backups are stored in France. Whether Hostinger also backs up the mailboxes and how long backups are kept is determined by Hostinger; Hostinger has not told us a fixed period.
• Consequence: we cannot rule out that deleted data remains for some time in backups or operational copies of the service providers until it is routinely deleted or overwritten there.

13. Your rights

You have the right to

• access the data we hold about you and obtain a copy (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR), unless a statutory retention obligation applies,
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdraw consent you have given at any time with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation.

How to make a request:

• An email to info@advokatia.com is sufficient; we handle requests sent to kontakt@advokatia.com in the same way. Please state your reference number, if you have one.
• We respond within one month (Art. 12(3) GDPR).
• To avoid disclosing data to unauthorised persons, we may ask you to confirm your identity, for example by replying from the email address given in the enquiry.

Right to lodge a complaint: you may lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR).

14. Changes

We update this privacy policy when our processing or the legal situation changes. The version published on this page applies.