Privacy & Data Protection Policy

The data controller responsible for your personal data is:

OSTROG-LUNA DOO Strumica, registered office: Atanas Mucev no.2, 2400 Strumica, Republic of North Macedonia. Company registration number: 7633521. Tax ID: 4027022536770.

For any privacy-related question or to exercise your rights, contact us at info@ostrogluna.com.

Contact form data: when you submit our contact form, we receive the name and email address you provide (required), and your phone number and message (optional). We also record whether you ticked the consent checkbox for telephone contact.

Email correspondence: if you write to us directly, we receive your email address, your message and any information you choose to include.

Technical and usage data: when you visit the Site, our hosting provider and analytics providers process limited technical signals such as the requested URL, referrer, approximate location derived from IP, device type, browser, language and basic performance timings. These signals are used to generate aggregated, non-identifying statistics and are not combined with your contact details to build a profile of you.

We do not knowingly collect special categories of personal data through the Site, and we do not run advertising or behavioural tracking.

Contact form and direct correspondence: processed on the basis of your request to be contacted (Art. 6(1)(b) GDPR — steps taken at your request prior to entering a contract) and, where you tick the consent box for telephone contact, on the basis of your consent (Art. 6(1)(a) GDPR).

Aggregated, cookieless website analytics and performance monitoring: processed on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in understanding aggregate traffic and keeping the Site secure, fast and functional. Because the analytics tools we use do not set cookies or build personal profiles, the impact on your privacy is minimal.

Compliance with legal obligations: where applicable, we may process data to comply with legal obligations to which we are subject (Art. 6(1)(c) GDPR).

To respond to enquiries you submit through the contact form or by email.

To follow up on commercial discussions, offers and orders that you initiate.

To monitor the Site's traffic and technical performance in aggregate, and to investigate security incidents.

To meet our legal, accounting and regulatory obligations.

We do not sell personal data. We share it only with the service providers that help us operate the Site and our communications, and only to the extent necessary:

Vercel Inc. — hosting of the website and provider of Vercel Web Analytics and Vercel Speed Insights (cookieless, aggregated analytics and performance monitoring).

Resend (Resend.com, Inc.) — transactional email delivery for messages sent through the contact form to our internal inbox.

Google Search Console — off-site webmaster tool that shows us aggregated search-performance data from Google's index. It does not place any script or cookie on the Site.

We may also disclose personal data to competent authorities where required to do so by law.

Contact form submissions and related correspondence: kept for as long as needed to handle your enquiry and any resulting business relationship, and afterwards for a reasonable period for evidentiary and accounting purposes (typically up to 24 months from the last meaningful contact, unless a longer period is required by law).

Server and security logs: kept for short technical periods (typically up to 30 days) and only for as long as needed to operate and secure the Site.

Aggregated analytics statistics: retained without identifying individual visitors.

When we no longer need personal data, we delete or anonymise it.

Subject to the conditions set out in the GDPR and the North Macedonia Law on Personal Data Protection, you have the right to:

access the personal data we hold about you and obtain a copy;

request correction of inaccurate or incomplete data;

request erasure of your data where one of the legal grounds for erasure applies;

request restriction of processing, or object to processing carried out on the basis of legitimate interest;

withdraw any consent you have given, at any time, without affecting the lawfulness of processing carried out beforehand;

request data portability, where applicable;

lodge a complaint with the competent data protection supervisory authority if you believe our processing of your personal data is not in line with applicable law.