Terms of Purchase

Scope and processing principles

This Policy explains how Mensa Serbia processes personal data when you use its public website, Members Portal, and related digital services. Data is processed lawfully, fairly, and transparently, only for specified purposes and to the extent necessary to achieve them.

Data we may process

The data categories depend on the feature you use. We do not collect every category listed below from every visitor.

• Identity and contact data such as name, email, phone, address, date of birth, membership number and, where necessary for reliable record matching, a national identification number or its protected derived value.
• Account data, email confirmation, membership status, roles, permissions, and security events.
• Data from registrations for testing, events, calls, communities, mailing lists, and other Mensa Serbia activities.
• Payment and order metadata such as amount, currency, time, status, card brand, OTP Order ID, authorisation number, Transaction ID, and Shop ID. Mensa does not receive or store the card number, expiry date, or CVC.
• Messages, requests, proposals, photographs, or documents that you choose to submit.
• Technical data such as IP address, browser type, access time, session identifiers, error logs, and security records.

Purposes and legal basis

We use data to provide requested services, manage memberships and accounts, organize testing and events, process registrations and payments, communicate, secure the system, prevent abuse, maintain required records, and improve the website. Each activity relies on an appropriate legal basis, including consent, performance of a contract or steps requested by the user, legal obligations, and legitimate interests that do not override individual rights.

AI assistant

When you voluntarily use the AI assistant, your question and necessary context may be sent to an AI service provider to generate a response. Do not submit national identification numbers, passwords, one-time codes, card details, health data, or other sensitive information. The AI assistant does not make decisions about membership, test results, user rights, or obligations.

Recipients and service providers

Access is limited to authorized persons who need it for a specific task, such as administrators, organizers, the finance team, and authorized psychologists. We may use trusted providers for hosting, databases, authentication, storage, email, SMS or push delivery, AI features, and other technical services. They process data under our instructions and contractual obligations.

• Card payments involve OTP banka Srbija as acquirer and SIA/Nexi infrastructure as processor. Their secure Redirect page handles card data; Mensa receives only the result and safe transaction identifiers required for confirmation, reconciliation, and complaints.
• Data is not sold or disclosed for third parties' independent marketing.
• Data may be disclosed to a competent authority where required by law or a valid order.

Transfers outside Serbia

Some digital infrastructure providers may process data outside the Republic of Serbia. Where such transfers apply, legally permitted mechanisms and appropriate contractual, organizational, and technical safeguards are used.

Retention periods

We retain data only for as long as needed for the purpose of collection, the duration of a membership or account, handling requests and disputes, system security, and legal obligations. Financial, membership, and other official records are retained for periods required by applicable law and internal rules. When the applicable period expires, data is deleted, anonymized, or securely archived where required.

Cookies and local storage

Necessary cookies and local storage support sign-in, security, language, session persistence, and privacy choices. Optional preferences, analytics, and marketing remain disabled until you accept them. You can change your choice through the cookie icon shown on the website. Blocking necessary technologies in your browser may prevent sign-in or other features from working.

Data security

We apply reasonable technical and organizational safeguards, including role-based access controls, protected communications, access logging, limits on public visibility, and backups where needed. No system is entirely risk-free; report suspected unauthorized access or misuse without delay.

Your rights

Subject to applicable law, you may request information and access, correction, completion, deletion, restriction, and portability, and you may object to processing. You may withdraw consent for future processing without affecting prior lawful processing. A request may be limited where retention is legally required or necessary to protect the rights of others.

• To protect personal data, we may request reasonable identity verification before handling a request.
• If you believe processing is unlawful, you may lodge a complaint with the Serbian Commissioner for Information of Public Importance and Personal Data Protection.

Minors' data

Where a service is available to minors, we collect only the data needed for the relevant registration or activity and obtain consent from a parent or legal guardian where required by law. A parent or guardian may contact us to exercise the minor's rights.

Changes and contact

This Policy may change to reflect legal requirements, functionality, or processing practices. The current version and effective date are published on this page. For privacy questions and requests, email predsednistvo@mensa.rs or write to Mensa Serbia at its postal address.