1. Who processes your data
The controller of personal data is:
Preduzeće za iznajmljivanje automobila i druge usluge Executive Car Service d.o.o. Padinska Skela (short name: Executive Car Service d.o.o., hereinafter: ECS)
Glogonjski rit 12, 11000 Padinska Skela, Belgrade, Republic of Serbia
Tax ID (PIB): 106615979, company registration number: 20645202
Email for data-related questions: info@ecs-serbia.com
Phone: +381 63 282-900
Processing is carried out in accordance with the Personal Data Protection Act of the Republic of Serbia. ECS is not required to appoint a data protection officer, because it does not process data to the extent and in the manner for which the law prescribes that obligation; the contact stated above is responsible for all data-related questions.
2. What data we collect
2.1. Data you provide to us
| Data | Why we ask for it |
|---|---|
| First and last name | identification of the passenger, issuing invoices |
| Phone number | confirmations, reminders, driver contact on the day of the ride |
| Email address | booking confirmation, fiscal receipt, payment confirmation |
| Residential address | mandatory element of the payment confirmation under the bank’s rules |
| Pick-up and destination address | performing the service and calculating the price |
| Date and time of departure | performing the service |
| Flight number | tracking the landing and calculating free waiting time |
| Number of passengers and amount of luggage | choosing a suitable vehicle |
| Company name and tax ID | issuing pro forma invoices and invoices to legal entities |
| Special requests you state | choosing a suitable vehicle and performing the service (for example a child seat, transport of a pet, need for additional space for a wheelchair) |
2.2. Data from communication
Conversation with the assistant on the website. When you use the chat on our website, we keep the content of the conversation, the time, the language and the session identifier. The conversation is kept so that we can perform the service, so that you can continue the conversation later, so that we can resolve any complaint and to improve the quality of answers.
To process conversations we use an artificial intelligence service provided by Anthropic. The content of the conversation is sent to that service to generate answers and is not used to train their models.
Please do not enter payment card data, your personal identification number, health data or other particularly sensitive data in the conversation. We do not need it and do not ask for it. If you do enter it, the assistant will direct you to the bank’s page or to a conversation with an employee.
Special needs related to the ride. If you need something special for the ride (a wheelchair or other aid, additional space, an adapted vehicle, an escort, a child seat), it is sufficient to state the need itself so that we can provide a suitable vehicle. We do not ask for a diagnosis, therapy or medical documentation. We use the information you provide exclusively for choosing the vehicle and organising that ride, we pass it on to the driver who performs the ride, and we keep it with the data on that booking. The same applies to section 8 of the General Terms and Conditions.
WhatsApp. If you write to us or receive our messages via WhatsApp, we keep the content of those messages, the phone number and the time of sending. For sending we use the business service of Meta.
Phone and email. We keep correspondence and notes on calls to the extent necessary to perform the service and resolve complaints.
2.3. Payment data
We do not collect, see or store your payment card data. You enter it exclusively on the bank’s page.
From the bank we receive and keep: the order number, the amount, the transaction status, the authorisation code, the transaction identifier, the date and time of the transaction, the masked card number (only the first six and last four digits) and the card brand. We need this data for accounting, issuing the payment confirmation and any refund.
2.4. Data generated automatically
When you accept the general terms and conditions, we record your IP address, browser information and the exact time. We do this because we are required to prove which version of the terms you accepted and when.
On the payment page we use protection against automated abuse (Google reCAPTCHA), which processes technical data about your browser to check that the request is sent by a person.
The website uses cookies. Details are in section 9.
3. Why we process data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Booking and performing transport | performance of a contract |
| Payment, issuing invoices and pro forma invoices | legal obligation and performance of a contract |
| Fiscalisation and keeping invoices | legal obligation |
| Confirmations, reminders and notices of a change of driver or vehicle | performance of a contract |
| Proof of acceptance of the general terms and conditions | legal obligation and legitimate interest |
| Handling complaints | legal obligation |
| Preventing abuse and payment fraud | legitimate interest |
| Request to rate the service after the ride | legitimate interest |
| Marketing messages about offers | your consent |
For messages that are not necessary to perform the service, we ask for separate consent, which you can withdraw at any time.
4. Who we share data with
We do not sell data. We share it only when necessary to perform the service or when required to do so by law:
| Recipient | What it receives | Why |
|---|---|---|
| Banca Intesa ad Beograd | order and amount data | processing card payments |
| IT Creator (electronic fiscalisation service provider, WEB ESIR) | invoice data and email address | issuing and sending the fiscal receipt |
| Meta Platforms | phone number and message content | sending WhatsApp messages |
| Anthropic | content of the conversation with the assistant | generating the assistant’s answers |
| pick-up and destination address | calculating the route and duration of the ride | |
| Limo Anywhere | booking data | assigning vehicles and drivers |
| Andrić Digital (Belgrade) | access to the booking system | processor that maintains the booking system, the chatbot and the payment page for ECS, under a data processing agreement |
| Andrić Digital (server in the European Union) | technical data when visiting the payment page | hosting the payment page |
| Google Ireland Limited | technical browser data when visiting the payment page | protection against automated abuse (reCAPTCHA) |
| The driver performing the ride | name, phone, pick-up and destination address, time | performing the service |
| Accounting agency | invoice data | bookkeeping |
| Competent state authorities | on request | legal obligation |
Some of these service providers are located outside the Republic of Serbia, including the United States of America. Transfers are made with the appropriate safeguards provided by law, including standard contractual clauses.
5. How long we keep data
| Type of data | Retention period |
|---|---|
| Data on completed bookings and invoices | 10 years, in accordance with VAT and accounting regulations |
| Payment transaction data | same as invoices |
| Proof of acceptance of the general terms and conditions | while a dispute regarding that booking is possible, no longer than the invoice |
| Conversations with the assistant on the website | 24 months from the last message |
| WhatsApp correspondence | 24 months from the last message |
| Data for marketing messages | until you withdraw consent |
| Unfinished bookings without payment | 12 months |
When the period expires, the data is deleted or permanently anonymised.
6. Your rights
You have the right to:
- request access to your data and a copy
- correct inaccurate data
- request erasure, when there is no basis for further processing
- restrict processing
- object to processing based on legitimate interest, including requests to rate the service
- transfer your data to another controller
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal
Send your request to info@ecs-serbia.com. We reply within 30 days at the latest.
If you believe your rights have been violated, you may lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11120 Belgrade, www.poverenik.rs.
7. Data security
Data is kept in a database with restricted access, on a server in the European Union. Access is granted only to persons who need it to do their work. Data transfer between your browser and our systems is protected by SSL encryption. Access keys for the payment and fiscalisation systems are kept separately from the application and are changed regularly.
8. Automated decision-making
The price of the service is calculated automatically, based on the published price list, the route and the duration of the ride. This is the application of rules published in advance, not an assessment of your person.
We do not make decisions based solely on automated processing that would produce legal effects for you. At any time you can ask for your booking to be taken over by an employee.
9. Cookies
The website uses:
- necessary cookies and the browser’s local storage for the operation of the website, the contact form and remembering the chat session and the assistant’s chosen language; these are set without consent because they are required for operation
- analytics cookies of the Google Analytics service, to measure website traffic
- marketing cookies of the Meta Pixel (Facebook) service, to measure ad performance
We set analytics and marketing cookies only with your consent, which you give or refuse in the banner on your first visit and can change at any time in the cookie settings at the bottom of the page.
The chat session with the assistant is stored in your browser’s local storage so that you can continue the conversation. Clearing your browser data also deletes it.
10. Children
The service is not intended to be ordered independently by persons under 16 years of age. Minors may travel as passengers, and the booking is made by an adult. The rules for transporting children are in the General Terms and Conditions, section 8.
11. Changes to this policy
We may change this policy. The current version is always published on this page.
Version: 2026-09-v2. Effective date: the date of publication on the website.