Privacy Policy & Data Protection

Version: 1.0
Effective date: 1 September 2026

1. General Provisions and Data Controller

This Policy sets forth the procedures for the collection, processing, and storage (hereinafter referred to as "data processing") of users' personal data on the InVero.me platform.

The Data Controller (rukovalac zbirke ličnih podataka) within the meaning of the Law on Personal Data Protection of Montenegro is:

Name	PREDUZETNIK IGOR KARDASHEVSKII KOJI OBAVLJA PRIVREDNU DJELATNOST "MONTECORE SOLUTIONS" PODGORICA
Address	SLOVAČKA 105, STAN 8, PODGORICA, CRNA GORA
Registration Number (CRPS)	1-0061684/001
Tax ID (PIB)	04419812
Email	contact@invero.me

Hereinafter referred to as "InVero" or "we".

By using the platform, registering an account, placing an order, or interacting with InVero, the user acknowledges that they have read and understood this Policy.

InVero processes data in accordance with applicable legislation, including the Law on Personal Data Protection of Montenegro (Zakon o zaštiti podataka o ličnosti) and other laws governing these activities.

2. What Data We Process

Depending on the use of the service, the following data may be processed:

first and last name,
email address,
account data,
information regarding orders, subscriptions, and payments,
billing information, including company details and registration/tax data,
customer support requests,
materials provided by the user when contacting support,
technical data regarding the device and software (IP address, device type, browser, operating system, location, and usage events).

2.1. Mandatory and Voluntary Data

The provision of certain data is a mandatory condition for entering into and performing a contract or fulfilling statutory obligations.The provision of all other data is voluntary.

Data Category	Status	Consequences of Failure to Provide
Email	Mandatory	Inability to create an account and grant access to the service
Password / authentication data	Mandatory	Inability to create an account and ensure its security
Billing data (first and last name or company name, address, registration/tax data)	Mandatory when placing a paid order	Inability to issue an invoice and process a paid order; accounting and VAT legislation strictly prohibit issuing a document without this data
Payment data transmitted to the payment provider	Mandatory when placing a paid order	Inability to process the payment
Technical and log data (IP, device type, browser, OS, usage events)	Collected automatically when using the service	Using the service without collecting this data is technically impossible; refusal is executed by ceasing the use of the service
First and last name in the profile (if not required for billing)	Voluntary	Limitation of personalization; does not affect access to the service
Content of support requests and attached materials	Voluntary	Inability to review the request or provide the requested assistance
Consent to marketing communications	Voluntary	The user will not receive marketing communications; does not affect access to the service
Non-essential cookies (analytics, etc.)	Voluntary	No impact on access to the main functionalities of the service

3. Purposes of Processing

Data is used for creating and maintaining an account, providing services, processing orders and payments, issuing and storing invoices, managing subscriptions, providing support, ensuring security, preventing fraud, improving the service, fulfilling legal and contractual obligations, and sending marketing communications where a legal basis exists.

4. Legal Basis for Processing

Processing may be based on the necessity for the performance of a contract, compliance with a legal obligation, consent, the legitimate interests pursued by InVero, or another legal basis provided by law.

Consent, if relied upon as the legal basis for processing, may be withdrawn at any time.The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

5. Third-Party Service Providers

InVero may engage third-party service providers for payment processing, hosting, email distribution, analytics, authentication, and other technical tasks and business processes.They are provided only with the data strictly necessary within the limits of applicable law and contractual obligations.

The delegation of personal data processing to a data processor is formalized by a written contract.

Full bank card details are processed directly by the payment provider via a secure channel and are never stored by InVero.

6. International Data Transfers and Processing

Data may be processed outside of Montenegro if necessary for the operation of the service and provided there is a legal basis, particularly when the transfer is necessary for the performance of a contract with the user or the implementation of pre-contractual measures, is mandated by law or an international treaty binding upon Montenegro, or is carried out on the basis of the user's prior consent, having been informed of the potential consequences of such a transfer.In all other cases, the transfer is carried out solely on the basis of prior consent obtained from the supervisory authority.

InVero implements legally mandated security measures during international transfers within the scope of its obligations and in compliance with the law.

7. Data Retention Period

Data is retained for as long as necessary to fulfill the respective purpose, unless a longer retention period is required by law or is necessary to protect the rights and legitimate interests of InVero.Data relating to orders, payments, and invoices may be retained for mandatory accounting, tax, and other statutory retention periods.

8. User Rights and Timeframes for Their Exercise

The user has the right to request access to their personal data, its rectification and supplementation, erasure, restriction of processing, the right to object to processing, the right to withdraw previously given consent, as well as to exercise other rights provided by applicable law.

Procedure and timeframes:

A request must be submitted in writing to contact@invero.me or via other contact methods specified in Section 1.Identity verification of the applicant is required to fulfill the request; if the request is submitted by a legal representative or an authorized person, a document proving their authority must be provided.
InVero shall provide a notification as to whether personal data relating to the user is being processed, no later than 15 days from the date the request is submitted.
Upon a request for the rectification, supplementation, or erasure of data, InVero shall take the appropriate actions within up to 15 days from the date the request is submitted.
InVero shall notify the user of the actions taken or the reasons for refusal within up to 8 days.

The user has the right to lodge a complaint with the supervisory authority — the Agency for Personal Data Protection and Free Access to Information of Montenegro (Agencija za zaštitu ličnih podataka i slobodan pristup informacijama, AZLP), as well as to seek judicial remedies provided by law.

9. Security

InVero implements technical, personnel, and organizational measures to protect personal data against loss, destruction, unauthorized access, alteration, disclosure, and misuse.However, the absolute security of data transmission or storage cannot be guaranteed.

10. Cookies

InVero may use cookies and similar technologies for website functionality, authentication, preferences, analytics, and security.Where required by law, consent is obtained separately.Consent for non-essential cookies may be withdrawn at any time through the website or browser settings.

11. Marketing Communications

Marketing communications are sent where the appropriate consent and/or legal basis exists, subject to applicable regulatory requirements.The user may opt out of receiving them at any time — via the unsubscribe link provided in the communication or by contacting us using the details specified in Section 1.

12. AI and Automated Processing

Certain features may utilize automated processing, including the use of AI models, to process user queries and generate results.

Decisions affecting the rights, obligations, and interests of the user, as well as the evaluation of their personal characteristics and capabilities, are not made solely on the basis of automated data processing.If otherwise provided in a specific case, the user shall be informed of this explicitly and in advance.

13. Children's Data

The service is not intended for individuals who have not reached the age of majority required to independently enter into respective contracts under applicable law.For a minor or a person deprived of legal capacity, consent to data processing shall be provided by their parents, adoptive parents, or a legal guardian in accordance with the procedure established by law.

14. Amendments

InVero reserves the right to amend this Policy due to changes in the service, legislation, or data processing practices.The current version is published on the website along with its effective date.If notification or consent is legally required, it shall be executed accordingly.

15. Contact Information

For any inquiries regarding data processing, the user may contact us via email at contact@invero.me or by mail at the Data Controller's postal address specified in Section 1.

Supervisory Authority: Agency for Personal Data Protection and Free Access to Information of Montenegro (Agencija za zaštitu ličnih podataka i slobodan pristup informacijama).