Privacy policy

Effective from 24 September 2026.

This policy explains what data fulfilment.rs collects about you, why, who receives it, how long we keep it and what rights you have. It is issued under the Serbian Law on Personal Data Protection (Official Gazette of the Republic of Serbia, No. 87/2018).

Who processes your data

The controller, the company that decides why and how your data is used, is PAKUM DOO NIŠ, Toplički partizanski odred 150A, 18000 Niš, Serbia, Company ID 22332040, Tax ID (PIB) 115952498. For any question about your data, write to info@pakum.rs.

What data we collect

The website has three forms in Serbian (a quote request on the home page, a four-step questionnaire and a partner programme application) and one in English. You enter the data yourself:

• Contact: first and last name, phone number and email.
• Company: company name and tax ID, if you enter them (on the English form, country and tax ID).
• Your sales: brand name, website or social profile, what you sell, approximate number of parcels per month, services you are interested in, where your goods are now, when you would like to start, how you heard about us and your note.
• Partner programme: name and link of your website or profile, promotion channel, approximate reach, type of cooperation and the products you are interested in.

If you write to info@pakum.rs, we receive your email and the address you write from. The same applies when a form fails to send and the website offers to send the data from your own mail program.

If we call you about your request, we also record in the internal database what you tell us during the call (for example how many products you have, who or which courier you have shipped with so far and which platform your shop runs on), our notes on the call, who spoke with you and the status of the quote.

When you submit a form, the servers that receive it, like any server on the internet, receive your device’s IP address. We also record where you came to the website from, and the Google tag collects visit data for ad measurement (see “Browser storage and cookies”).

Why we use your data and on what legal basis

• Answering your request, preparing a quote and contacting you – to call or email you, prepare a quote and agree on cooperation or a partnership. Legal basis: if you contact us on behalf of a company, our legitimate interest in answering the company you represent and agreeing on cooperation with it (Article 12(1)(6) of the Law). A legitimate interest is a justified business reason that must not override your rights. If you enter into the contract yourself, for example as a sole trader, the basis is steps taken at your request before entering into a contract (Article 12(1)(2) of the Law).
• Visit source – to know which ad or website brought the request and where advertising pays off. Legal basis: our legitimate interest.
• Google ad measurement and remarketing – to measure how many requests our ads bring and to show ads to people who have already visited the website. Legal basis: our legitimate interest. You can opt out at any time (see “Remarketing and how to opt out”).
• Abuse prevention – the request intake system uses the sender’s IP address to accept no more than five requests from the same address within 10 minutes. Legal basis: our legitimate interest.

We do not make decisions about you by automated means only. People decide on quotes and cooperation.

Do you have to provide your data

No. Providing data is not a legal or contractual obligation. Without the fields marked with an asterisk (for example name, phone and email) we cannot process your request or get back to you. The other fields are optional and help us make the quote more accurate.

Who receives your data

When you submit a form, the data is sent encrypted (HTTPS) to two places: the request intake system at sus.rs and the internal client database. Both run on a Hetzner server in Germany. The intake system does not store the request in a database; it forwards it as a message to an internal Slack channel. The internal database stores the request and sends the team a short notification in Slack. Access to requests, in the internal database and in the Slack channels that receive request notifications, is limited to the people who run the business and handle enquiries.

In addition, the data is processed by the service providers we use:

• Google – Google tag and Google Ads, for ad measurement and remarketing;
• GitHub – hosts the website and, like any server, sees your device’s IP address when delivering a page;
• Hetzner – the server in Germany that runs the intake system and the internal database;
• Slack – our team’s internal communication about requests;
• Resend – receiving mail sent to @pakum.rs addresses and sending our emails and quotes;
• OpenAI – when a team member asks for a suggested reply to your email. The subject and text of your email, your name and email address, and the company name and contact person from our records are then sent to that service. A person reviews the suggestion, and replies are never sent automatically.
• Anthropic, with OpenAI and Google (Gemini) as backup – request notifications from the intake system reach a Slack channel where our AI assistant works. When a team member replies in the conversation about your request, the request text, including name, phone and email, is sent to one of these services so the assistant can prepare a response. The assistant replies to the team, not to you.

We do not pass your name, phone or email from the form to the Google tag or Google Ads. We may disclose data to public authorities when the law requires it.

Transfers outside Serbia

The server with the internal database and the intake system is in Germany, which under Article 64 of the Law is considered to provide an adequate level of personal data protection.

Google, GitHub, Slack, Resend, OpenAI and Anthropic are international companies and may process data outside Serbia, including in the United States, under the data processing terms they have published. On request sent to info@pakum.rs, we will tell you which safeguards each transfer to these companies relies on and how you can obtain a copy of them. How Google uses data from websites that use its services is explained at policies.google.com/technologies/partner-sites.

Browser storage and cookies

Our own code does not set cookies. Cookies are set by the Google tag, the only external service that loads on our pages. Fonts and images load from our own domain.

When you arrive through an ad or a link with a campaign tag again, the pakum_izvor record is usually replaced with a new one. If your browser does not allow local storage, nothing is saved and only data about your visit to the page you submit the form from is sent with your request.

Remarketing and how to opt out

We use Google Ads remarketing to show our ads to people who have visited fulfilment.rs while they browse other websites. Third-party vendors, including Google, show our ads on sites across the internet and use cookies to serve ads based on your past visits to our website.

You can turn off personalised ads in Google’s ad settings and, for networks that take part in the opt-out programme, at optout.aboutads.info. You can also delete or block cookies in your browser settings; the forms on the website work without them.

How long we keep data

• Requests, call notes, correspondence and messages about requests – if you become a client, they become part of our business records and we keep them for the duration of the cooperation and afterwards for as long as the law requires. If cooperation does not start, we keep them in case the conversation about cooperation continues. At your request we delete them from the internal database, Slack, our mailbox and our AI assistant’s conversation records, except for what we must keep by law.
• Backups of the internal database – deleted data may remain in daily backups for up to 7 days.
• IP address – the intake system keeps it in working memory for abuse prevention, at most until the server restarts, and does not write it to a database. The servers that run the website and our systems may also record IP addresses in technical logs for security and operation.
• pakum_izvor record – valid for 90 days and kept in your browser.
• Remarketing lists – 180 days after your last visit.

Your rights

At any time you can ask for:

• access – to be told what data we hold about you and to receive a copy;
• correction or completion of inaccurate data;
• erasure of your data;
• restriction of processing – that for a while we only store your data and do not use it, for example while we check whether it is accurate;
• portability – the data you gave us, in a common electronic format;
• objection to processing based on legitimate interest, including ad measurement and remarketing;
• withdrawal of consent, where processing is based on consent; withdrawal does not affect processing before it.

Send your request to info@pakum.rs. We reply without undue delay and within 30 days of receiving the request at the latest. If the request is complex or there are several requests, we may extend this by up to 60 more days, and we will inform you of this, with reasons, within the first 30 days. We may ask you to confirm your identity, for example by writing from the address you entered in the form.

If you believe we process your data unlawfully, you can lodge a complaint with the Serbian Commissioner for Information of Public Importance and Personal Data Protection (www.poverenik.rs).

Changes to this policy

If we change how we process data, we publish the new version on this page with the date from which it applies.