Privacy Policy
How we handle your personal data
This privacy policy explains which personal data we collect through the freestate.rs website, the calculator and the customer account, why we process it, who we share it with, how long we keep it and what rights you have. It follows the Serbian Personal Data Protection Act (Official Gazette of the Republic of Serbia 87/2018, the "Act"). Sections 1 to 12 follow the order of the information items in article 23 of the Act.
Right to Object
You have the right to object at any time, on grounds relating to your particular situation, to processing of your data that we base on legitimate interest. We then stop processing that data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims. You may object to processing for direct marketing at any time, without giving reasons. After that we no longer use your data for that purpose. Send your objection to info@freestate.rs or use the unsubscribe link in any of our messages. This right is set out in article 37 of the Act.
1. Data Controller
The controller of your personal data is: ZANSU DOO BEOGRAD Veljka Dugoševića 54, 11060 Beograd (Zvezdara), Republic of Serbia Company number: 22123084 Tax number (PIB): 115172094 Email: info@freestate.rs Phone: +381 66 951 2541 Legal representative: Dejan Arsić, director. The company trades under the Free State brand of the Swiss company Free State AG. Where Free State AG receives your data, this is described in sections 5 and 6.
2. Data Protection Officer
We have not appointed a data protection officer. Please send questions about data processing and requests to exercise your rights to info@freestate.rs, marked "Data protection".
3. Purposes and Legal Bases
The legal bases we rely on are listed in article 12 paragraph 1 of the Act. • Solar calculator. We process the address and coordinates of the building, roof data (type, pitch, orientation, drawn outline and a satellite map image), consumption data (amount and month of the electricity bill, annual consumption, electric heating, approved connection power) and contact details (first and last name, email, phone). The purpose is to produce an estimate and prepare an offer. The basis is taking steps at your request before entering into a contract (item 2). • Customer account. We process your email, your password in encrypted form, project data and documents you upload, for example photos of the roof or the metering point. The account lets you follow the calculation, the offer and the progress of the work. The basis is taking steps before entering into a contract or performing the contract (item 2). • Offer, contract and installation. We process the data needed for the offer, the contract, installation, invoicing and the procedure with EDS and EPS, for example your name, address and details of the metering point and grid connection. The basis is performance of the contract (item 2). We keep invoices and accounting records to comply with legal obligations (item 3). • Contact forms. When you write to us through the contact form, a quote request, a service enquiry, a business enquiry or an investor enquiry, we process the data you enter and any attachments. Where the enquiry concerns an offer or a contract, the basis is taking steps before entering into a contract (item 2). For other enquiries the basis is our legitimate interest in replying to you (item 6). • Newsletter and job alerts. We process your email address. You confirm your subscription through a link we send you. The basis is your consent (item 1). • Marketing messages. We send you marketing messages by email or phone only if you have given separate consent for this (item 1). • Analytics and marketing cookies. The basis is your consent (item 1), in line with article 160 of the Serbian Electronic Communications Act. Details are in section 13. • Audience measurement on our own server. We record which pages are visited, the referring page, campaign parameters from the link and a random session identifier. We do not record your IP address. The purpose is to understand how the website is used and which advertising leads to enquiries. The basis is our legitimate interest (item 6). • Website security. To protect against abuse we process your IP address and technical request data, for example to limit the number of requests from one address. The basis is our legitimate interest (item 6).
4. Legitimate Interest
We rely on legitimate interest for website security, audience measurement on our own server, replies to enquiries that do not concern an offer, and establishing or defending legal claims. We have assessed that these interests do not override your rights, because we process only the data these purposes require, and the audience measurement uses neither your IP address nor cookies. You have the right to object to this processing, as described at the top of this page.
5. Recipients
Only employees who need your data for their work have access to it. Your data is also processed by service providers (processors) acting on our instructions: • Vercel Inc., USA: website hosting. • Railway Corporation, USA: hosting of our servers and the database in which we store accounts, enquiries, calculations and contracts. • Cloudflare, Inc., USA: storage of documents and files, for example offer PDFs and documents you upload. • Resend, Inc., USA: sending emails, for example confirmations, sign-in links and offer notifications. • Google Ireland Limited, Ireland, and Google LLC, USA: Google Maps and Google Places for address entry and the satellite roof map in the calculator and for the map on the Contact page, and, after your consent, Google Tag Manager and Google Analytics. • Meta Platforms Ireland Limited, Ireland: the Meta Pixel and the Conversions API, only after you consent to marketing cookies. When you submit an enquiry, Meta receives your email and phone number only in hashed form (SHA-256), together with your IP address and browser data. • Contentsquare SAS, France: heatmaps and session recordings in the calculator and the customer account, only after you consent to analytics cookies. • An accounting firm, where we entrust it with our bookkeeping: data from invoices and contracts. Free State AG, Stettemerstrasse 40, 8207 Schaffhausen, Switzerland, receives your data when its staff take part in consultations and in preparing offers, and only the data needed for that work. When we handle the prosumer procedure for you, we send Elektrodistribucija Srbije and EPS the data needed for the application. They process it as independent controllers. To estimate production, we send the building's coordinates, roof pitch and orientation to PVGIS, the service of the European Commission's Joint Research Centre. We send no name or contact details with the coordinates. If you book a consultation through Calendly (Calendly LLC, USA), you open their page, and the data you enter there is processed by Calendly. We add your account identifier to the link so we can match the appointment to your project. We disclose data to public authorities only where the law requires it. We do not sell your data.
6. Transfers Outside Serbia
We transfer some data outside the Republic of Serbia: • To Switzerland, to Free State AG. Switzerland is on the Serbian list of countries with an adequate level of protection (Official Gazette 55/2019). • To Ireland and France, to Google, Meta and Contentsquare. Both are parties to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, so under article 64 paragraph 2 of the Act they are deemed to provide an adequate level of protection. • To the USA, to Vercel, Railway, Cloudflare, Resend, Google, Meta and Calendly. The USA is not on the list of countries with an adequate level of protection. We base these transfers on the standard contractual clauses adopted by the Commissioner (Official Gazette of the Republic of Serbia 5/2020), in line with article 65 of the Act. You can request a copy of the safeguards applied at info@freestate.rs.
7. Retention Periods
• Contact form messages, quote requests, service enquiries and investor enquiries: 24 months from receipt, after which we delete them. • Business enquiries and their attachments: 24 months from the last update to the enquiry, after which we delete them. • Audience measurement and calculator usage records: 24 months, after which we delete them. • Customer account data, including calculations and projects: for as long as the account exists. You can request deletion of your account at info@freestate.rs. • Contracts, invoices and accounting records: for the periods set by accounting and tax regulations. • The cost estimate and your approval before work starts: one year after the service is completed, as the Serbian Consumer Protection Act requires. • The complaints register: at least two years from the date of the complaint. • Newsletter and job alert subscriptions: until you unsubscribe. • Google Analytics data, Contentsquare session recordings and server logs: for the period set with the provider of each service. We tell you the exact period if you ask at info@freestate.rs. Once the period ends, we delete the data or anonymise it permanently. Cookie lifetimes are listed in section 13.
8. Your Rights
Regarding the processing of your data, you have the right: • of access to the data we process about you (article 26 of the Act) • to rectification of inaccurate data and completion of incomplete data (article 29) • to erasure (article 30) • to restriction of processing (article 31) • to data portability, meaning to receive the data you gave us in a structured, commonly used and machine-readable format (article 36) • to object (article 37), as described at the top of this page • not to be subject to a decision based solely on automated processing (article 38) Send your request to info@freestate.rs. We reply without delay and at the latest within 30 days of receiving it. For complex or numerous requests we may extend this by a further 60 days, and we tell you about the extension within the first 30 days. We may verify your identity before replying.
9. Withdrawing Consent
You can withdraw your consent at any time, as easily as you gave it. You change your cookie consent through the cookie settings link in the footer of every page. You unsubscribe from the newsletter through the link in every message or by email to info@freestate.rs. Withdrawal does not affect the lawfulness of processing based on consent before the withdrawal.
10. Complaint to the Commissioner
If you believe that we process your data in breach of the Act, you can lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik), Bulevar kralja Aleksandra 15, Belgrade, www.poverenik.rs. A complaint to the Commissioner does not affect your right to go to court.
11. Do You Have to Provide Your Data?
No law requires you to provide your data. Without your address, consumption data and contact details we cannot produce an estimate or an offer. Without an email address we cannot open an account. There are no other consequences. If we conclude a contract, the data needed for invoicing and for the application to EDS and EPS becomes a contractual obligation, and partly a statutory one.
12. Automated Decision-Making and Profiling
We do not take decisions that produce legal effects concerning you or significantly affect you based solely on automated processing, including profiling. The calculator automatically computes an estimate of production, savings and an indicative price. That result is neither a decision nor an offer. The offer is prepared by a member of our staff after checking the data.
13. Cookies and Similar Technologies
Cookies and similar technologies (browser local storage and session storage) keep small records on your device. We always use the necessary ones, and the analytics and marketing ones only after you accept them in the cookie banner. Rejecting is as easy as accepting, and you can change your choice through the cookie settings link in the footer of every page. Necessary: • cc_cookie: remembers your cookie choice, 182 days. • refreshToken: keeps you signed in to your customer account, 7 days. • auth-storage (local storage): sign-in data, until you sign out. • Session storage: remembers your calculator progress, until you close the tab. Audience measurement on our own server: • mkt_session_key (session storage): random session identifier, until you close the tab. • utm (session storage): campaign parameters and landing page, until you close the tab. • utm_first (local storage): source of your first visit, 30 days. Website display: • fs-consultation-advisor (local storage): which advisor the consultation box shows you, 24 hours. Analytics, only with your consent: • Google Analytics (_ga, _ga_*), loaded through Google Tag Manager. • Contentsquare (_cs_*), only in the calculator and the customer account. Marketing, only with your consent: • Meta Pixel (_fbp, _fbc). • Google Ads (_gcl_*). Google Tag Manager loads immediately, but with consent denied by default (Google Consent Mode). Until you consent, Google Analytics and Google Ads set no cookies and the Meta Pixel sends no events. When you withdraw consent, we delete the analytics and marketing cookies.
14. Changes to This Policy
We update this policy when our processing, the law or our service providers change. The date of the last change is shown at the bottom of this page. If a change materially affects processing based on your consent, we will ask for your consent again.
Last updated: 11 September 2026