Privacy policy

The controller is Društvo za grafički dizajn, proizvodnju, trgovinu i usluge, White Rook DOO Kovačica, JNA 25, 26210 Kovačica, Serbia. Company number: 21339393. Tax ID: 110339214.

Privacy questions and requests can be sent to info@elegantrender.com. This is our privacy contact; we have not appointed a data protection officer because our present processing does not require one.

We receive personal data:

• directly from you in forms, checkout, the portal, uploads, email, and support messages;
• automatically from your browser, device, and our security and analytics tools;
• from services you choose, including Google sign-in and PayPal;
• from a customer, colleague, architect, agent, or company that includes you in a project; and
• from public or official sources used to verify company, tax, VAT, sanctions, or payment information.

If we receive your data from someone else, we provide this notice at the first appropriate contact or within the period required by applicable law, unless an exception applies.

The entries below connect each activity with its data, purpose, legal basis, recipients, and retention rule. More than one legal basis can apply when an activity serves distinct purposes.

Identity, contact, billing, order, payment, and usable project information marked as required are necessary to enter into or perform a contract. If you do not provide them, we may be unable to prepare an estimate, accept payment, create an invoice, or deliver the service. Optional fields, optional cookies, and marketing choices can be refused without losing access to the core service.

Plans, photographs, property files, and correspondence can contain personal data about occupants, owners, employees, or other people. Please share only what the project needs, remove unnecessary personal details, and make sure you have authority to provide the material. Unless it is essential and agreed with us first, do not upload identity documents, financial credentials, medical data, or other sensitive information.

We do not use private customer project files to train our own general-purpose AI models. When you choose an AI Studio engine, the selected inputs and prompt are sent to that provider to produce the requested result under the provider terms and business settings in force for our account.

We disclose personal data only as needed for the purposes above: to contracted service providers, authorised staff and production partners, accountants and professional advisers, payment and identity providers, and public authorities where law requires it. Providers that process data for us must be bound by appropriate confidentiality, security, and data-protection terms.

PayPal, Google sign-in, advertising networks, tax authorities, and some professional advisers may act as independent controllers for their own purposes. Their privacy notices apply to that separate processing. If the business is reorganised, financed, sold, or merged, relevant data may be disclosed under confidentiality and transferred with the affected business, subject to applicable law.

We are established in Serbia and use providers in Serbia, the European Economic Area, the United Kingdom, the United States, and other countries. Your data may therefore be processed outside your country. Serbia is not currently covered by an EU adequacy decision.

Where EEA, UK, Swiss, Serbian, or other transfer rules require a mechanism, we use the mechanism appropriate to the transfer, such as an adequacy decision, approved Standard Contractual Clauses, contractual safeguards, and supplementary technical or organisational measures. You can ask our privacy contact for information about the safeguard relevant to your data.

Necessary storage supports sign-in, security, checkout, and your privacy choices. Optional browser analytics, marketing measurement, and session replay are disabled until the relevant consent is given where consent is required. See the cookie policy or open Cookie settings.

We do not sell personal information for money. Optional disclosures to advertising providers can be treated as “sharing”, targeted advertising, or cross-context behavioural advertising under some US privacy laws. You can opt out by keeping the Marketing category off or withdrawing it in cookie settings.

We use access controls, role-based permissions, encrypted transport, password hashing, malware scanning, logging, backups, supplier controls, and incident procedures designed to protect data. Our management systems include ISO/IEC 27001:2022 certification. No online system is risk-free, so please use a strong password and contact us promptly if you suspect unauthorised account access.

Depending on your location and the processing, you may have rights to know or access data, receive a copy, correct it, delete it, restrict or object to processing, portability, withdraw consent, opt out of sale, sharing, or targeted advertising, limit certain sensitive-data uses, appeal a refusal, and complain to a regulator. These rights are not absolute; for example, we can retain invoice data that law requires us to keep.

Email info@elegantrender.com with “Privacy request” in the subject. Account holders can also export account data or request deletion from the portal profile. We may verify your identity, authority, and jurisdiction before acting. You may use an authorised agent where the law permits it. We do not discriminate against anyone for exercising a privacy right.

• Serbia: rights arise under the Serbian Law on Personal Data Protection. You may complain to the Commissioner for Information of Public Importance and Personal Data Protection.
• EEA: the GDPR rights described above apply when the GDPR covers our processing. You may complain to the authority where you live, work, or believe an infringement occurred. The EDPB lists national supervisory authorities.
• United Kingdom: UK GDPR rights apply when UK law covers our processing. Complaints can be made to the Information Commissioner's Office.
• United States: residents of states with comprehensive privacy laws may make the access, correction, deletion, portability, opt-out, limitation, or appeal requests provided by their law. Our privacy contact is the designated request method. We do not knowingly sell or share data of people under 16.
• Other regions: if privacy law in your country gives you an additional right, contact us and identify your country. We will apply the right where that law governs our processing.

The service is intended for adults and business users, not children. We do not knowingly create accounts for or collect data directly from anyone under 16. A parent or guardian who believes a child has provided data should contact us so we can investigate and delete it where appropriate.

AI tools generate images from the instructions and files you choose, and security tools can flag suspicious requests or files. We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you. PayPal and other independent providers may make their own fraud, identity, or payment decisions under their notices.

We update this policy when our services, providers, or legal duties change. The date at the top shows the latest revision. If a change materially affects how we use existing data, we will provide a prominent notice or contact affected users where required.