HIVE SECURE ID d.o.o.
Website Privacy Policy
Version 1.0 | Effective date: 27 July 2026 | Classification: Public
Karađorđev trg 11, 11080 Belgrade – Zemun, Republic of Serbia
[email protected] | [email protected]
Document Control
| Document title | Hive Secure ID Website Privacy Policy |
| Controller | Hive Secure ID d.o.o. |
| Document owner | Data Protection Officer / data protection function |
| Approved by | Management of Hive Secure ID d.o.o. |
| Version | 1.0 |
| Effective date | 27 July 2026 |
| Classification | Public |
| Privacy contact | [email protected] |
Contents
- Purpose and Scope of this Policy
- Identity and Contact Details of the Controller
- Regulatory and Standards Framework
- Personal Data Processing Principles
- Categories of Individuals and Sources of Data
- Categories of Personal Data We Process
- Purposes of Processing and Legal Bases
- Mandatory and Voluntary Provision of Data
- Cookies and Similar Technologies
- Recipients of Personal Data and Processors
- External Links and Third-Party Services
- Processing in Serbia and International Data Transfers
- Personal Data Retention Periods
- Security and Protection of Personal Data
- Rights of Individuals
- Exercising Rights and Identity Verification
- Direct Marketing and Business Communications
- Automated Decision-Making and Profiling
- Children’s Data
- Personal Data Breaches
- Changes to this Privacy Policy
- Contact and Right to Lodge a Complaint
1. Purpose and Scope of this Policy
This Privacy Policy explains how Hive Secure ID d.o.o. collects, uses, stores, shares and protects the personal data of visitors and other individuals who use the website https://hivesecureid.com, contact Hive through the website form or by email, request information, a demonstration, a quotation or cooperation, or otherwise establish business contact with Hive through the website.
This Policy applies exclusively to processing connected with the website and business communications initiated through the website. Processing of personal data through the Hive IAM platform and the Hive MFA mobile application is governed by separate privacy notices, agreements with customer organisations and applicable data processing documentation.
Using the website or submitting information through the contact form does not automatically create a user account on the Hive IAM platform and does not automatically enrol the visitor in marketing communications.
2. Identity and Contact Details of the Controller
| Legal entity name | Hive Secure ID d.o.o. |
| Address | Karađorđev trg 11, 11080 Belgrade – Zemun, Republic of Serbia |
| Website | https://hivesecureid.com |
| General contact | [email protected] |
| DPO / privacy | [email protected] |
Hive Secure ID d.o.o. is the controller of personal data for the processing described in this Policy, except where, in a specific case, it expressly acts as a processor under the documented instructions of another controller.
For questions about this Policy, to exercise your rights or to raise a privacy concern, you may contact the Data Protection Officer at [email protected].
3. Regulatory and Standards Framework
Processing of personal data through the website is carried out in accordance with the legislation applicable to the specific processing activity, including:
- the Personal Data Protection Act of the Republic of Serbia (Official Gazette of the Republic of Serbia, No. 87/2018);
- Regulation (EU) 2016/679 – the General Data Protection Regulation (GDPR), where applicable to the relevant processing;
- rules on privacy in electronic communications and the use of cookies, including Directive 2002/58/EC and the national laws implementing it, where applicable;
- other applicable legislation concerning electronic commerce, business communications, information security, archiving, accounting and consumer protection.
The content and structure of this Policy have been designed in accordance with the principles of transparency and accountability and with reference to relevant international standards, in particular ISO/IEC 27001:2022 with Amendment 1:2024, ISO/IEC 27701:2025, ISO/IEC 29184:2020 and ISO/IEC TS 27560:2023. Reference to standards does not in itself constitute a claim of certification unless such certification is specifically and verifiably stated.
4. Personal Data Processing Principles
Hive applies the following data processing principles:
- lawfulness, fairness and transparency;
- collection for specified, explicit and legitimate purposes;
- data minimisation and avoidance of collecting data that is not necessary;
- accuracy and updating of data where necessary;
- storage limitation in accordance with the purpose and applicable obligations;
- integrity, confidentiality, availability and resilience of systems;
- data protection by design and by default;
- demonstrable compliance and documented decision-making.
5. Categories of Individuals and Sources of Data
This Policy may apply to:
- website visitors;
- representatives of prospective and existing business customers;
- suppliers, partners, consultants and other business contacts;
- individuals who submit an enquiry or request a demonstration, quotation, meeting or technical information;
- individuals who communicate with Hive by email or through other contact channels published on the website;
- individuals who submit a request to exercise rights relating to personal data.
We primarily obtain personal data directly from individuals through the contact form, email or other communications. Certain technical data is generated automatically when the website is accessed. We may also obtain business contact details from the organisation for which the individual works, a business partner or legitimately available professional sources, subject to the applicable information obligations.
6. Categories of Personal Data We Process
6.1. Contact Form Data
The website includes a contact form that may contain the following fields: full name, company name, business email address, selected topic and message content. We may also process the date and time of submission, enquiry status and internal notes necessary to respond to and follow up the communication.
Do not submit passwords, authentication secrets, private keys, one-time codes, special categories of personal data, confidential customer data or other information that is not necessary for the specific enquiry through the contact form.
6.2. Direct Business Communications
If you contact us by email or through another business channel, we may process your name, contact details, position, organisation, communication content, attachments, meeting records, agreed actions and other information you voluntarily provide.
6.3. Technical, Network and Security Data
When the website is accessed, servers and network and security systems may automatically record:
- IP address and approximate network location derived from the IP address;
- date and time of access;
- requested page, URL, request method and response status;
- browser type and version, operating system and device type;
- referring page and basic session data;
- identifiers necessary for security, session management and protection against abuse;
- error, performance, suspicious request and attempted attack data.
6.4. Cookie and Privacy Preference Data
Where applicable, we process cookie identifiers, cookie-category selections, the time consent was given or withdrawn, the version of the notice and technical data necessary to demonstrate and respect your choices.
6.5. Business and Contractual Data
Where a website enquiry develops into a business relationship, we may process information about contact persons, organisation, position, authority, project requirements, quotations, contracts, billing and business correspondence. The processing of such information may be further governed by a contract, a Data Processing Agreement and other notices.
7. Purposes of Processing and Legal Bases
| Purpose of processing | Categories of data | Legal basis |
|---|---|---|
| Responding to enquiries and arranging a meeting or demonstration | Contact and communication data; enquiry content | Taking steps at the request of the individual before entering into a contract; legitimate interests in business communications |
| Preparing a quotation and establishing a business relationship | Contact details, organisation, requirements and correspondence | Pre-contractual steps; performance of a contract; legitimate interests |
| Operation, maintenance and delivery of the website | Technical data, necessary cookies and server logs | Legitimate interests in operating a functional and reliable website; performance of the visitor’s request |
| Information and cyber security | IP address, logs, abuse indicators and incident data | Legitimate interests in protecting systems, data, users and business operations; legal obligation where applicable |
| Cookie consent management | Privacy choices, consent log and technical identifier | Legal obligation; legitimate interests in demonstrating compliance |
| Optional measurement of website use | Pseudonymous visit and interaction data | Consent where non-essential cookies or access to terminal equipment require consent |
| Direct marketing and updates | Name, business email, organisation and consent/unsubscribe record | Consent or legitimate interests only where permitted and subject to the right to object |
| Management of rights and complaints | Identity data, request, identity evidence and correspondence | Legal obligation; legitimate interests in preventing unauthorised disclosure |
| Compliance, audit and legal protection | Relevant business, technical and communication records | Legal obligation; legitimate interests in establishing, exercising or defending legal claims |
Where processing is based on legitimate interests, Hive assesses the necessity and proportionality of the processing and considers the expectations, risks and rights of the individual. Information about the relevant legitimate interest assessment may be requested at [email protected], subject to the protection of confidential and security-sensitive information.
8. Mandatory and Voluntary Provision of Data
Providing data through the contact form is voluntary. However, without at least valid contact information and sufficient details about the enquiry, we may be unable to respond, prepare a quotation or organise the requested activity.
Fields marked as mandatory should be limited to data that is genuinely necessary to provide a response. Data not required for the specific purpose should not be requested as a condition for submitting the form.
9. Cookies and Similar Technologies
Cookies are small text files or similar identifiers that may be stored on a visitor’s device. Hive distinguishes the following categories:
| Category | Purpose | Legal basis and activation rule |
|---|---|---|
| Strictly necessary | Security, network delivery, session management, storage of privacy choices and core functionality | Activated without separate consent only where technically necessary for the service requested |
| Functional | Remembering options that are not necessary for delivery of the website itself | Activated after consent where required by applicable law |
| Analytics | Measuring website visits, performance and use | Not activated before consent unless the specific technology is lawfully exempt |
| Marketing and tracking | Profiling, advertising or tracking across websites and services | Hive does not use these technologies without prior, specific and withdrawable consent; any use must be separately disclosed |
The cookie banner and the Cookie Settings control should provide a genuine choice. Rejecting non-essential cookies should be as easy as accepting them, consent must not be preselected, and consent must be capable of being withdrawn at any time without adverse consequences for basic use of the website.
Details of specific cookies, their provider, purpose and duration are published in a separate Cookie Policy or in the active cookie settings panel. The information must correspond to the website’s actual technical configuration.
10. Recipients of Personal Data and Processors
Personal data may be accessed only by authorised persons who require it for a specific task. Depending on the configuration and purpose, personal data may be disclosed to the following categories of recipients:
- providers of hosting, cloud infrastructure, DNS/CDN and security services;
- providers of email, contact-form, business communication and CRM services;
- providers of cookie-consent platforms, analytics and performance monitoring, only within the approved scope;
- providers of IT support, backup, monitoring and incident-response services;
- legal, accounting, audit and other professional advisers;
- competent authorities, courts and regulators where disclosure is required by law or a valid binding request;
- affiliated or transaction parties in the event of a reorganisation, investment, merger or transfer of business, subject to appropriate safeguards.
Processors are engaged under agreements governing personal data processing, confidentiality, security, sub-processors, data breaches, assistance with individual rights, deletion or return of data and audits. Hive applies supplier due diligence proportionate to the processing risk.
11. External Links and Third-Party Services
The website may contain links to independent services, including a location map, status page, app stores, documentation or other external websites. When you select such a link, you leave the Hive website and the third party may independently process personal data in accordance with its own privacy rules.
Hive does not control processing independently performed by third parties and recommends that you read the relevant privacy notices before using their services. External content should not be loaded in a manner that enables visitor tracking before consent, unless such loading is technically necessary and lawful.
12. Processing in Serbia and International Data Transfers
Hive Secure ID d.o.o. is established in the Republic of Serbia. Data submitted through the website may be processed in Serbia, including access by authorised employees and contractors for the purposes of responding to enquiries, maintaining security and managing business relationships.
The Republic of Serbia is not currently covered by an adequacy decision of the European Commission. Where a specific disclosure or making available of data constitutes a regulated international transfer from the EU/EEA to another recipient in Serbia or another third country, Hive and the relevant party apply an appropriate mechanism, such as the European Commission Standard Contractual Clauses, together with a transfer impact assessment and supplementary technical, contractual and organisational measures where required.
Service providers may process personal data in other countries. Before engaging such a provider, Hive reviews processing locations, roles, onward transfers and the applicable legal mechanism. A copy or description of the relevant safeguards may be requested at [email protected], subject to redactions necessary to protect trade secrets and security.
If Hive is required to appoint a representative in the European Union under Article 27 GDPR, the representative’s details will be published on the website and in this Policy before the processing to which the obligation applies begins.
13. Personal Data Retention Periods
| Category | Standard period | Notes |
|---|---|---|
| Contact form submissions and general business enquiries that do not result in a contract | Up to 24 months from the last relevant communication | May be deleted earlier when no longer required; may be retained longer for a specific legal claim |
| Enquiries, quotations and negotiations that result in a contract | For the duration of the relationship and thereafter in accordance with the contract and statutory periods | Relevant business and evidentiary records may be retained until applicable limitation periods expire |
| Marketing contact details and consent | Until unsubscribe or withdrawal of consent; evidence of consent/unsubscribe for up to 5 years | After an objection, the contact detail may be retained on a suppression list to prevent further communications |
| Server, network and security logs | Normally up to 12 months | Longer only for an active incident investigation, evidence preservation or legal obligation |
| Cookie consent records | Up to 5 years, or less where no longer required | To demonstrate choices and respect withdrawal of consent |
| Analytics data | No longer than 14 months, where activated | Shorter periods, aggregation and pseudonymisation are preferred |
| Requests to exercise rights and complaints | Up to 5 years after the matter is closed | To demonstrate compliance and support legal protection |
| Accounting, tax and other mandatory documentation | In accordance with applicable statutory retention periods | The period depends on the type of record; access is restricted to authorised functions |
| Backup copies | In accordance with the controlled backup cycle, normally up to 90 days after deletion from active systems | Data is not restored to active use except for system recovery or incident investigation |
The stated periods are standard limits and may be shortened or extended where necessary due to law, an authority order, an active investigation, dispute resolution, evidence of consent or the establishment, exercise or defence of legal claims. At the end of the applicable period, data is deleted, anonymised or placed in a restricted archive with controlled access.
14. Security and Protection of Personal Data
Hive applies risk-based technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures may include:
- TLS encryption of communications and protection of network traffic;
- access controls based on business need and the principle of least privilege;
- multi-factor authentication for administrative and other high-risk access;
- security logging, monitoring, anomaly detection and incident response;
- vulnerability, patch, change and secure development management;
- segregation of environments, backups and controlled recovery;
- supplier due diligence, contractual requirements and sub-processor oversight;
- employee training, confidentiality obligations and periodic review of access rights;
- data minimisation, pseudonymisation and deletion when data is no longer required.
No system is completely secure. If you suspect that communications with Hive have been compromised or identify a security issue on the website, do not send confidential information and immediately contact [email protected] or [email protected].
15. Rights of Individuals
Depending on the applicable law, you have the right to:
- obtain confirmation as to whether we process your personal data and obtain access to that data;
- request correction of inaccurate data or completion of incomplete data;
- request erasure where there is no valid reason for continued retention;
- request restriction of processing;
- object to processing based on legitimate interests;
- object to direct marketing at any time;
- receive certain data in a structured, commonly used and machine-readable format and request its transfer, where the applicable conditions are met;
- withdraw consent without affecting the lawfulness of processing carried out before withdrawal;
- obtain information about appropriate safeguards used for international data transfers;
- lodge a complaint with the competent data protection authority.
These rights are not absolute. Hive may refuse or restrict a request where there is a lawful basis for doing so, for example to protect the rights of others, trade secrets, system security, legal claims or mandatory retention obligations. You will be informed of the reasons and available remedies in accordance with applicable law.
16. Exercising Rights and Identity Verification
You may submit a request to [email protected] or by post to Hive Secure ID d.o.o., Karađorđev trg 11, 11080 Belgrade – Zemun, marked “For the attention of the DPO / Privacy”.
A request should contain sufficient information to enable us to identify the relevant processing and understand what you are requesting. Hive may request additional information reasonably necessary to verify identity and authority, particularly where the response could disclose data to another person. You should not send a copy of an identity document unless this measure is genuinely necessary and is expressly requested with appropriate safeguards.
We respond without undue delay and within the periods prescribed by applicable law. Requests are generally free of charge, except where the law permits a reasonable fee for manifestly unfounded, excessive or repetitive requests.
17. Direct Marketing and Business Communications
Submitting the contact form does not constitute automatic consent to receive newsletters or marketing messages. Hive may send the information requested, respond to the enquiry and engage in reasonable communications directly related to your request.
Marketing communications are sent only where an appropriate legal basis exists and the individual’s right to refuse or withdraw the communication is respected. Every electronic marketing communication should provide a simple method of unsubscribing. You may also object or unsubscribe by contacting [email protected].
After you unsubscribe, we may retain minimal information on a suppression list to prevent further messages. This processing is based on our legitimate interest and is necessary to respect your request.
18. Automated Decision-Making and Profiling
The website does not make solely automated decisions that produce legal effects or similarly significantly affect a visitor. Security systems may automatically assess network requests and temporarily block or restrict suspicious traffic to protect the website and infrastructure.
If Hive introduces profiling or automated decision-making that requires additional information or rights in the future, this Policy and the relevant interface will be updated before such processing begins.
19. Children’s Data
The website is intended for a business audience and is not directed at children. Hive does not knowingly request children to submit personal data through the website. If we become aware that a child’s data has been provided without an appropriate legal basis or authority, we will take reasonable steps to delete the data or restrict its processing.
20. Personal Data Breaches
Hive maintains a process for identifying, reporting, assessing and resolving incidents that may involve personal data. Where required, Hive will notify the competent authority and affected individuals within the applicable time limits and provide information about the nature of the breach, its possible consequences and the measures taken to mitigate risk.
You may report suspected unauthorised access, loss or misdelivery of personal data to [email protected] or [email protected].
21. Changes to this Privacy Policy
Hive may amend this Policy due to changes to the website, technology, service providers, processing purposes, regulatory requirements or safeguards. The current version will be published on the website with its effective date and last-updated date.
If an amendment materially affects individual rights or introduces new processing that requires consent, Hive will provide an appropriate notice and, where necessary, obtain new consent before the processing begins.
22. Contact and Right to Lodge a Complaint
| Controller | Hive Secure ID d.o.o. |
| Address | Karađorđev trg 11, 11080 Belgrade – Zemun, Republic of Serbia |
| General contact | [email protected] |
| DPO / privacy | [email protected] |
| Website | https://hivesecureid.com |
Individuals in the Republic of Serbia may lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection. Individuals to whom the GDPR applies may lodge a complaint with the competent supervisory authority in the Member State of their habitual residence, place of work or the place of the alleged infringement.
Before lodging a complaint, you may contact us so that we can attempt to clarify and resolve the matter, without limiting your right to contact the competent authority directly.