Privacy Notice

Vaultum Capital d.o.o. Beograd is the controller of the personal data described in this notice. The firm is registered in the Republic of Serbia under registration number (MB) 22068873 and tax identification number (PIB) 114777477, with its registered office at Bulevar Kralja Aleksandra 18, Beograd (Vračar), Serbia.

This notice is given under the Law on Personal Data Protection (Official Gazette of RS No. 87/2018), which governs how we handle personal data.

Any question about this notice, and any request to exercise the rights set out in it, can be sent to office@vaultum.io.

Nothing. This website sets no cookies, runs no analytics, embeds no tracking pixels, and loads no fonts, scripts, or other resources from third-party servers. Every file the site needs is served from this domain.

There is no profiling, no advertising, and no measurement of what you read or how long you stay. Reading this site does not require you to accept anything, and there is no consent banner because there is nothing to consent to.

As with any web server, a request to this site is recorded in technical logs. These typically contain the IP address the request came from, the time it was made, the page requested, the response status, the referring page, and the browser's user-agent string.

We do not use these logs to identify individual visitors and do not combine them with anything else. They exist so the site can be delivered, so faults can be diagnosed, and so abuse of the infrastructure can be detected. The company that operates the servers on our behalf is named in section 8.

This is worth stating plainly, because most contact forms work the other way. The form on our contact page does not transmit your details to us and does not store them anywhere.

When you press “Continue to email”, your browser assembles what you typed into a draft message in your own email programme, addressed to office@vaultum.io. Nothing leaves your device at that point. We receive your data only if you then press send in your own email programme, and only in the form of an ordinary email. If you close the draft instead, we never see it and have nothing to delete.

If you do send it, we receive what you chose to put in it: your name and email address, the type of enquiry you selected, and — where you filled them in — your organisation, your country, and the text of your message. You can of course also email office@vaultum.io directly, with the same effect.

Enquiry correspondence is processed for one purpose: to read your enquiry, answer it, and carry on whatever correspondence follows from it. That includes telling you when we think a structure is not viable, which is frequently the answer.

Server logs are processed to deliver the website, keep it available, and investigate faults and abuse.

Where a correspondence becomes a business record — because it leads to an engagement — it may also be processed to meet the record-keeping obligations that apply to us as a company registered in the Republic of Serbia.

The Law on Personal Data Protection (Official Gazette of RS No. 87/2018) permits processing only on one of the grounds it sets out. We rely on the following.

Where your enquiry concerns a possible engagement, we process your correspondence in order to take steps at your own request before a contract is concluded.

Where your enquiry is a general or press question rather than a prospective engagement, we rely on our legitimate interest in reading and answering correspondence that has been addressed to us. We consider that interest balanced by the fact that you chose to write to us and can ask us to erase the exchange at any time.

Server logs are processed on the basis of our legitimate interest in operating a website that stays available and is not abused.

Where Serbian company or accounting law requires us to retain a record, the basis is compliance with a legal obligation of the controller.

Enquiry correspondence that does not lead to an engagement is deleted 24 months after the last message in the exchange.

Correspondence that becomes part of an engagement is retained for the period required by the Serbian statutory record-keeping rules that apply to the engagement, and deleted once that period ends.

Server logs are retained for the period our hosting provider keeps them, which is short and measured in weeks rather than years. We do not export them or keep our own copy.

We use two service providers, each of which processes personal data only on our instructions and only for the purpose described. Neither is permitted to use it for its own purposes.

The Law on Personal Data Protection (Official Gazette of RS No. 87/2018) allows personal data to be transferred out of the Republic of Serbia without further authorisation where the receiving state appears on the list adopted by the Government of the Republic of Serbia of states considered to provide an adequate level of protection (Official Gazette of RS No. 55/2019).

Germany, where our domain, DNS, and mailbox are operated, appears on that list. Correspondence you send us is therefore transferred to a state the Republic of Serbia already recognises as providing adequate protection, and no separate authorisation or additional instrument is required for it.

The United States, where this website is hosted, does not appear on that list. What reaches it is limited to the server-log data described in section 3.

Correspondence you send us is not part of that transfer. Email addressed to us is delivered to the mailbox described above and stays there — it does not pass through the website or its host at any point. If you would like to know the basis on which the server-log transfer is made, write to us and we will tell you.

There is none. We make no decisions about you by automated means and carry out no profiling.

In relation to personal data we hold about you, the Law on Personal Data Protection (Official Gazette of RS No. 87/2018) gives you the following rights. To exercise any of them, email office@vaultum.io. We will respond within 30 days, and will tell you if we need longer and why.

No. You are under no statutory or contractual obligation to contact us, and there is no consequence of not doing so other than that we cannot answer a question you have not asked. The name, email address, and message fields on the contact form are marked as required only because an enquiry without them cannot be replied to.