Privacy and Cookie Policy

HSE Training DOO, Braće Radovanović 17/5, Lamela C, 11000 Belgrade, Serbia (company registration number 20952288; tax identification number (PIB) 108205616) is the controller. Privacy questions and requests may be sent to info@hsetraining.rs or made by telephone on +381 61 5335 010.

Depending on the interaction, we process contact and enquiry data; billing, company and tax-identification data; selected course, price and currency; order, payment, refund and fiscalisation status; provider references and timestamps; the checkout language; the version and time of legal consents; account-creation and course-delivery evidence; and proportionate technical and security logs such as IP address, browser, requested URL and time.

Required checkout data is necessary to conclude and perform the contract, process payment, issue required records and deliver course access. Without it we cannot complete the order. Card numbers, security codes and 3-D Secure credentials are entered on the hosted bank page and are not received or stored by HSE Training.

Enquiries and checkout preparation are processed to take requested pre-contract steps. Orders, payment reconciliation, refunds, account-creation instructions and course access are processed to perform the contract. Fiscal, accounting and complaint records are processed to comply with legal duties. Service security, fraud prevention, delivery evidence and legal claims are processed for the legitimate interests of operating and protecting the service and demonstrating compliance, subject to the required balancing assessment. Optional external media is loaded only with consent.

We do not use checkout data for automated decision-making or profiling that produces legal or similarly significant effects.

Necessary data may be processed by our hosting and authenticated email providers; WooCommerce for order administration; Raiffeisen Bank/RaiAccept for hosted card payment; BokaPOS for fiscalisation and electronic fiscal receipts; professional advisers; public authorities where legally required; and the HSE e-learning platform on which the purchaser creates an account and accesses the paid course.

Only the data required for each purpose is shared. If a provider processes data outside Serbia, HSE Training will use an applicable legal transfer mechanism and make information about the relevant safeguards available. We do not sell personal data.

Transaction and electronic-delivery evidence is retained for at least 120 days and longer while a payment dispute, complaint or legal claim may be pursued. Complaint records are kept for at least two years. Order, payment, fiscal, tax, accounting and contractual records are retained for the periods required by applicable law. Enquiries, security logs and consent records are kept only for as long as necessary for their stated purpose, security investigation or proof of compliance, after which they are deleted, anonymised or securely archived.

Necessary storage includes hse_cookie_consent (your choice for 180 days), hse_checkout_locale (checkout language for up to one month) and WooCommerce session/cart cookies such as woocommerce_cart_hash, woocommerce_items_in_cart and wp_woocommerce_session_*. They support language, consent choice, cart, checkout, security and fraud prevention and cannot be disabled where required for the requested service.

Google Maps is optional and loads only after consent; loading it may disclose IP address and browser data to Google. Cookie Settings in the website footer lets you change or withdraw that choice at any time. RaiAccept or another external service may set its own necessary cookies on its domain under its own notice.

Subject to applicable law, you may request access, correction, deletion, restriction or portability, object to processing, or withdraw consent without affecting earlier lawful processing. We may verify identity before acting and normally respond within 30 days. You may complain to the Serbian Commissioner for Information of Public Importance and Personal Data Protection at poverenik.rs.

We update this policy when the website, providers or legal requirements change and publish the effective date here.