CG EN

Privacy Policy

Last updated: 16 September 2026

This policy explains what personal data we collect when you visit www.northlight.me, send us an inquiry or subscribe to our newsletter, why we use it, how long we keep it and what rights you have.

We process personal data in accordance with the data protection laws of Montenegro and, to the extent it applies, the EU General Data Protection Regulation (GDPR).

1. Who processes your data

The controller of your personal data is:

[NAZIV FIRME]
[ADRESA SJEDIŠTA], Montenegro
Tax ID (PIB): [PIB]
E-mail: [E-MAIL]

You can send any question about data processing, or a request to exercise your rights under this policy, to this address.

2. What data we collect

Data you give us

  • Contact form and product inquiry: your name, e-mail address, phone number (if provided), the text of your message and the product your inquiry is about.
  • Newsletter: your e-mail address, the time you subscribed and the time you confirmed the subscription.
  • Correspondence: any data you share when you write to us or call us.

Data recorded automatically

  • With a submitted form: IP address, browser and device information, site language and time of submission.
  • Cookie consent record: the cookie categories you chose, the time of your choice, IP address and browser information.
  • Server logs: IP address, time of visit, page requested and browser information, recorded by the server on every visit.
  • Cookies and browser storage: described in our Cookie Policy.

The site has no user accounts and no online payments, so we do not collect passwords or payment card details. We do not use visitor analytics tools or advertising cookies.

3. Why we use your data and on what legal basis

  • Answering your inquiry and preparing a quote (form data and correspondence). Legal basis: steps taken at your request before entering into a contract, or our legitimate interest in answering questions you send us.
  • Sending the newsletter (e-mail address). Legal basis: your consent, which you confirm by clicking the link in the e-mail we send after you subscribe.
  • Site security and abuse prevention, such as automated form submissions (IP address, browser information, server logs). Legal basis: our legitimate interest in protecting the site and data.
  • Proof of cookie consent (consent record). Legal basis: our legal obligation to be able to demonstrate consent.
  • Legal obligations, such as accounting and tax rules, when an inquiry leads to a purchase. Legal basis: legal obligation.

We do not use your data for automated decision-making or profiling.

4. Who can access your data

Only employees who need your data for their work can access it. We do not sell your data or share it with others for their marketing.

The following service providers may process data on our behalf, bound by confidentiality:

  • our hosting provider, whose server runs the site;
  • our e-mail service provider, which delivers inquiry notifications and the newsletter;
  • the company that maintains the site, when needed for technical support.

We disclose data to public authorities only when required by law. If a service provider processes data outside Montenegro, this happens only with the safeguards required by law.

5. Content from other services

  • Google Maps. The Contact and About us pages show a map. When the map loads, your browser connects to Google servers, so Google receives your IP address and may set its own cookies. The legal basis is our legitimate interest in showing you where we are.
  • YouTube. Videos load only when you start them, in privacy-enhanced mode (youtube-nocookie.com). Your browser then connects to Google servers and to cdn.plyr.io, which provides the video player.
  • Social networks. The Instagram, Facebook and other icons are plain links. Nothing is sent to these networks unless you click a link.

Google processes data under its own rules (policies.google.com/privacy) and may do so outside Montenegro and the European Union, including in the United States.

6. How long we keep your data

  • Inquiries and correspondence: until we reply and, if the inquiry leads to cooperation, for as long as it lasts; after that, no longer than two years from our last contact.
  • Newsletter: until you unsubscribe. After that we keep your address only as a record that we must not send you messages, unless you ask us to delete it.
  • Cookie consent record: no longer than three years from when you gave or changed your consent.
  • Server logs and abuse-prevention data: for a short period set by the server configuration, unless needed to investigate a security incident.
  • Purchase records: as long as accounting and tax rules require.

When the period ends, we delete the data or anonymise it permanently.

7. Your rights

You have the right to:

  • find out whether we process your data and get a copy of it;
  • ask us to correct inaccurate data or complete incomplete data;
  • ask us to delete your data when there is no longer a basis for processing it;
  • ask us to restrict processing;
  • object to processing based on our legitimate interest;
  • receive the data you gave us in a common, machine-readable format;
  • withdraw your consent at any time, without affecting processing carried out before the withdrawal. You can unsubscribe from the newsletter using the unsubscribe link in our e-mail or by writing to us.

Send your request to [E-MAIL]. We will reply without undue delay and within the time limit set by law. Before replying, we may ask you to confirm your identity so that we do not disclose data to the wrong person.

If you believe your right to personal data protection has been violated, you can file a request for protection of rights with the Agency for Personal Data Protection and Free Access to Information of Montenegro (www.azlp.me). You can always contact us first, so we can try to resolve the issue.

8. How we protect your data

We protect data with technical and organisational measures: an encrypted connection (HTTPS), access to the site administration limited to authorised persons with a password, and protection of forms against automated abuse. No system is completely secure. If an incident puts your data at risk, we will notify the competent authority and you, where the law requires it.

9. Children

The site is not intended for children under 16, and we do not knowingly collect their data. If we learn that we have received such data without the consent of a parent or guardian, we will delete it.

10. Changes to this policy

We update this policy when the law or the way the site works changes. The current version is always on this page, with the date of the last update at the top.