Privacy policy
This page sets out what data is generated when you visit this website and when you send an enquiry, where it goes and how long it stays. It is short because the processing is short: we run no advertising tracking, build no profiles and currently set no cookies.
Controller
MAYA SOURCING d.o.o.
Mite Ružića 2
21000 Novi Sad
Serbia
Represented by
Director
Register entry
Agencija za privredne registre (APR), Republika Srbija, MB 21839183
Tax number
PIB 113286259
What a plain visit generates
When you open a page, your browser sends technically necessary data to our host: IP address, date and time, the address requested, status code, volume transferred, referrer and browser identification. These server logs serve operation and defence against attacks. The legal basis is our legitimate interest in a functioning service under Article 6(1)(f) GDPR.
Fonts and scripts used by this website are served from our own server. No content is pulled from third-party networks, so your IP address is not passed to anyone else simply because you opened a page.
Cookies and analytics
We currently set no cookies and embed no analytics or advertising services. There is no audience measurement, no retargeting and no profiling.
For the duration of your session, the page stores campaign parameters in your browser if you arrived from an advertisement, that is values such as gclid and utm. This is not a cookie, it leaves your device only if you submit the form, and it is discarded when you close the tab. Its purpose is to connect an enquiry with the advertisement that produced it.
When you start filling in the enquiry form, the page keeps what you have entered so far in your browser local storage, so that an interruption does not send you back to the beginning. It keeps the three answers from the short qualification and, where you have already entered them, your name, telephone number and email address. None of it leaves your device before you submit. The draft is deleted after a successful submission and in any case after seven days, and you can clear it yourself at any time with the button above the form. The consent tick is deliberately not stored. This storage is strictly necessary for the service you asked for and therefore does not require consent.
Your enquiry through the form
When you submit the form we process your name, phone number and email address, together with the answers you gave in the fit check, the address of the page the enquiry came from, the referrer and the campaign parameters described above.
The purpose is solely to handle your enquiry and prepare an offer. The legal basis is Article 6(1)(b) GDPR, because the processing serves steps taken prior to entering into a contract, and, where you have also given consent, Article 6(1)(a) GDPR. You may withdraw consent at any time with effect for the future.
Providing the data is voluntary. Without a name and at least one way to reach you, however, we cannot reply.
Who else processes the data
We do not pass your data to third parties in order to market or sell it. The only recipients are service providers acting on our instructions:
| Provider | Purpose | Established in |
|---|---|---|
| Vercel Inc. | Website hosting and operation of the form endpoint | Third country |
| Telegram FZ-LLC | Delivery of the enquiry to the buyer in charge | Third country |
Hosted by: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA
Transfers to third countries
The controller itself is established in Serbia. There is no adequacy decision of the European Commission for Serbia under Article 45 GDPR. When you submit the form, your entries are therefore transferred to a third country without an adequacy decision. The legal basis for that transfer is Article 49(1)(b) GDPR: it is necessary in order to take steps at your request prior to entering into a contract, namely to prepare a purchase offer for your stock. Without that transfer we cannot deal with your enquiry.
The service providers named above are established outside the European Union or process data there. Such transfers are based on the Standard Contractual Clauses of the European Commission under Article 46(2)(c) GDPR, supplemented, for transfers to the United States, by participation in the EU-US Data Privacy Framework where the provider concerned is certified under it.
Please note that third countries may not offer a level of protection equivalent to the European one in every respect, in particular as regards access by state authorities.
How long the data is kept
Enquiries that do not lead to business are deleted no later than six months after the last contact. Where a purchase contract is concluded, statutory commercial and tax retention periods apply, as a rule six or ten years. Server logs are deleted or truncated after 30 days at the latest.
Your rights
You have the following rights in relation to us:
- Access to the data we hold about you, Article 15 GDPR
- Rectification of inaccurate data, Article 16 GDPR
- Erasure, Article 17 GDPR
- Restriction of processing, Article 18 GDPR
- Data portability, Article 20 GDPR
- Objection to processing based on legitimate interests, Article 21 GDPR
- Withdrawal of consent with effect for the future, Article 7(3) GDPR
- Complaint to a supervisory authority, Article 77 GDPR
Contact on data protection matters
An informal message is enough for access, erasure or objection:
Last updated: 2026-08-25