Data protection

Privacy policy

Who processes your data, what we collect and why, who we pass it on to, how long we keep it and what rights you have. This is also the notice on the processing of personal data required by Article 23 of the Serbian Personal Data Protection Act, written to be read.

1. Who processes your data

Controller: RDB Insurance Brokerage Ltd. Belgrade
Company number: 22097288
Tax ID (PIB): 114964953
Registered office: Belgrade, Republic of Serbia
Data protection contact: posrednik@rdb.rs

The controller is whoever decides why and how data is processed. For everything described on this page, that is us. For any question or request arising from this text, write to posrednik@rdb.rs.

2. What data we collect

When you send an enquiry

Your name, email address, phone number if you leave one, company name if you are writing on its behalf, the type of insurance you are interested in and the content of your message. You enter all of it yourself and you decide how much to write.

When you become a client

The data needed to obtain offers and to conclude and perform the insurance contract. Exactly which data depends on the type of insurance, and we ask only for what the insurer cannot prepare an offer without.

When you are just reading the site

If you accept visit measurement, we record which pages you view, how long you stay, what kind of device you use and which country you come from. None of it tells us who you are and we do not link it to your name.

We ask for health data only where it is necessary for the specific type of insurance, for example voluntary health insurance, and always with your explicit consent. We never ask for it through the forms on this site.

3. Why we process it and on what basis

Every processing operation needs a legal basis under Article 12 of the Personal Data Protection Act. Ours are the following:

To answer your enquiry and obtain offers: Steps taken before entering a contract, at your request
To conclude and perform the contract and help with claims: Performance of a contract
To meet obligations imposed on us by law: Legal obligation
To measure visits to the site: Your consent, which you can withdraw at any time

4. Do you have to give us your data

Giving us your data is voluntary, no regulation obliges you to do it. But without some of it we cannot do the very thing you came to us for:

When you send an enquiry: Your name and email address are what we need in order to reply at all. Without them the enquiry cannot be processed. Phone, company name and description are optional.
When we obtain quotes: The details of the risk are asked for by the insurer. Without them it cannot prepare a quote, so neither can we obtain one for you.
When a policy is concluded: The data the insurance contract requires is a condition for concluding it. Without it the contract can be neither drawn up nor performed.
Visit measurement: Entirely voluntary. If you decline, the site works exactly the same and you lose nothing.

5. Who we pass data on to

Insurance companies we have an agreement with, and only those covering the risk you are asking about, in order to obtain an offer. The list is on the Regulatory information page.
Service providers who process data on our instruction and only for what we entrusted to them: Web3Forms delivers the message from the form, Google Workspace carries our mail, Google Analytics measures visits.
State authorities where the law requires it, primarily the National Bank of Serbia as the supervisory authority.

We do not sell or trade data and we do not use it for advertising, and we pass on to service providers only what is necessary for the contact form and visit measurement to work at all. Part of the processing takes place outside the Republic of Serbia. Google Ireland Limited is based in Ireland, a member state of the European Union, which is on the list of countries considered to provide an adequate level of protection, and for transfers outside the European Union Google applies standard contractual clauses. Web3Forms is operated by Web3Creative from India, with server infrastructure in Germany and Finland and some sub-processors in the United States; a data processing agreement incorporating standard contractual clauses applies to them. When you send us an enquiry, that transfer is also necessary in order to take steps at your request before entering into a contract, which is a specific case of transfer provided for by Article 69 of the Serbian Personal Data Protection Act.

6. How long we keep it

An enquiry that does not lead to a contract: While the correspondence lasts and at most one year from the last contact, then deleted
Once a contract is concluded: For as long as the insurance and accounting regulations require, counted from the end of the contractual relationship
The message on the form provider server: Web3Forms deletes it at the latest three years after submission under its own terms, regardless of when we delete it on our side
Visit measurement: Fourteen months, as configured in Google Analytics

7. Cookies and visit measurement

The site uses Google Analytics (Google Ireland Limited) so we can see how many visitors arrive, where they come from and which pages they read. Measurement is switched on only after you accept it in the bar shown on your first visit. Until you do, the site does not load the Google script at all: no request is sent to Google and no cookie is set. If you decline, nothing is sent later either, and the site works exactly the same.

We do not use cookies for advertising or for tracking you across other sites. Besides page views we measure three actions that tell us the site is useful: sending an enquiry, clicking the phone number and clicking the email address. The content of your message and your personal data are never sent along.

8. Your rights

Access, to learn whether we process your data and to receive a copy
Rectification and completion, if something is inaccurate or incomplete
Erasure, once there is no longer a basis for keeping it
Restriction of processing, until a disputed question is resolved
Portability, to receive your data in a common electronic format
Objection to processing, where it is based on a legitimate or public interest
Withdrawal of consent at any time, without effect on processing before the withdrawal

Send your request to posrednik@rdb.rs. We reply within 30 days of receipt at the latest. In more complex cases that period may be extended, and we will tell you before it expires.

We do not make decisions about you automatically, without human involvement, and we do not build profiles based on your behaviour on the site.

9. Complaints

If you believe we process your data contrary to the regulations, you may lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11120 Belgrade, or electronically via poverenik.rs.

Before that, feel free to write to us directly. It is faster, and most misunderstandings get resolved that way.

We update this policy when the way we work changes. If a change is significant, we will publish it on this page before it takes effect.

The way we protect data internally is governed by an internal act of the company, which we publish in full (in Serbian): Rulebook on personal data protection

Last updated: 27 August 2026. · Regulatory information