Privacy Policy
This Privacy Policy explains how MODULE AGENCY DOO ("Module", "we", "us", or "our") collects, uses, and protects personal data when you visit our website at module.agency or submit information to us through our project brief form.
We are committed to handling your personal data responsibly and in accordance with the EU General Data Protection Regulation (GDPR) and the data protection law of Montenegro.
1. Who we are (Data Controller)
The data controller responsible for your personal data is:
- MODULE AGENCY DOO
- Registration number: 03489051
- Registered address: Njegoseva 1a, Tivat, 85320, Montenegro
- Contact email: in@module.agency
We have not appointed a Data Protection Officer (DPO), as we are not required to do so. For any questions about this policy or your personal data, you can reach us at the email above.
2. Scope
This policy applies to personal data we collect:
- Through the project brief form on our website
- Directly from you when you communicate with us by email or other channels
- Automatically when you visit our website (see Section 9, Cookies and analytics)
3. What personal data we collect
When you complete our project brief form, we collect:
- Your name
- Your email address
- Your company or organization name
- Your phone number
- Your target market(s) (the region(s) you select)
- The type of service you are interested in (the option you select)
- A description of your challenge or project (free-text field)
- Any files you choose to upload (e.g., briefs, documents, presentations)
We do not intentionally collect special categories of personal data (such as data revealing health, religious beliefs, or biometric data). Please do not include such information in your message or uploaded files.
4. How we use your data and our legal basis
We process your personal data for the following purposes:
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Responding to your inquiry and discussing your project | Steps taken at your request prior to entering a contract (Art. 6(1)(b)), and our legitimate interest in responding to potential clients (Art. 6(1)(f)) |
| Preparing proposals, quotes, or scoping documents | Pre-contractual steps (Art. 6(1)(b)) |
| Following up with you about your enquiry | Steps taken at your request prior to entering a contract (Art. 6(1)(b)), and our legitimate interest in communicating with potential clients (Art. 6(1)(f)) |
Where we rely on legitimate interests, you have the right to object to this processing at any time (see Section 7).
5. Who we share your data with (Processors)
We do not sell your personal data. We share it only with service providers ("processors") who help us operate our business, under appropriate data processing agreements:
- Tally (Tally BV, Belgium) — provides our online form. Form data is hosted within the EU and encrypted in transit and at rest.
- Google (Google Workspace / Gmail) — form submissions and related correspondence are received and stored in our Google Workspace email.
- Vercel (Vercel Inc.) — hosts our website (module.agency) and provides built-in, cookieless web analytics.
6. International data transfers
Module is established in Montenegro, which is outside the European Economic Area (EEA). Some of our processors are located in the United States — namely Google and Vercel. When personal data is transferred outside the EEA, including to us in Montenegro or to these providers, we rely on appropriate safeguards to ensure your data continues to receive an adequate level of protection. These safeguards include the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the EU–U.S. Data Privacy Framework.
7. Your rights
If you are in the EEA or the UK, you have the following rights regarding your personal data:
- Access — request a copy of the personal data we hold about you
- Rectification — ask us to correct inaccurate or incomplete data
- Erasure — ask us to delete your data ("right to be forgotten")
- Restriction — ask us to limit how we use your data
- Portability — receive your data in a structured, machine-readable format
- Objection — object to processing based on our legitimate interests
- Withdraw consent — where processing is based on your consent
To exercise any of these rights, contact us at in@module.agency. We will respond within the timeframes required by applicable law.
You also have the right to lodge a complaint with a supervisory authority. If you are in the EEA, you may contact your local data protection authority. In Montenegro, the competent authority is the Agency for Personal Data Protection and Free Access to Information (Agencija za zaštitu ličnih podataka i slobodan pristup informacijama), website: azlp.me.
8. Data retention
We retain your brief submission and related correspondence for as long as necessary to respond to your inquiry and to manage our potential or ongoing business relationship with you. We will delete your data upon your request, or once it is no longer needed for these purposes.
9. Cookies and analytics
Our website does not use tracking or advertising cookies. For website statistics we use Vercel Web Analytics, which is privacy-friendly and does not use cookies: visitors are measured using anonymized, aggregated data only, with no persistent identifiers and no cross-site tracking. We may use only essential cookies strictly necessary for the website to function.
10. Security
We take appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, or misuse. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.
11. Changes to this policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent version. We encourage you to review this page periodically.
12. Contact
If you have any questions about this Privacy Policy or how we handle your data, please contact us at:
MODULE AGENCY DOO Njegoseva 1a, Tivat, 85320, Montenegro in@module.agency
Last updated: 28.05.2026