Privacy policy

This policy explains how ISLTech ("ISLTech", "we", "us") handles personal data collected through isltech.ai and in the course of delivering our services: building custom AI systems, training and fine-tuning models, and running AI model evaluations for clients in fintech, healthcare and related regulated industries.

1. Who we are

ISLTech is an applied AI agency based in Belgrade, Serbia. We work with clients in the UK, EU & North America. For personal data you submit through this website, for example when you email us or book a call, we act as the data controller. For personal data we handle inside a client engagement (we call this engagement data), we act as a data processor on the client's behalf under our Data Processing Agreement. Section 2.3 below explains what that means for you if your data is included in a client's dataset.

2. What we collect

2.1 Website analytics. We use Google Analytics 4 (GA4), loaded through Google Tag Manager (GTM), to understand which pages are visited and which actions are taken on the site. Both are gated by Google Consent Mode v2. If you are in the European Economic Area, the United Kingdom or Switzerland, analytics storage is denied by default and is only enabled after you choose "Accept" in our consent banner. Choosing "Essential only" keeps it denied. Your choice is stored in your browser so we do not ask again. See our Cookie policy for details.

2.2 Contact data. When you email us, or book a call through our scheduling tool (Cal.eu), we collect what you give us: typically your name, email address, company, role, the time you booked and the content of your message. If you later become a client, we also hold the contract, invoicing and correspondence records needed to run the engagement.

2.3 Engagement data. During an engagement a client may give us access to data that contains personal information, for example documents, transaction records, support conversations, clinical notes or evaluation transcripts. We process this data only on the client's documented instructions and only for the purposes set out in the engagement's scope document and the Data Processing Agreement. The client remains the controller; if you want to exercise your rights over data held in a client's dataset, contact that client, and we will support them in responding.

3. How we use it

We use contact data to answer your enquiry, schedule and run meetings, prepare proposals, deliver and invoice engagements, and keep a record of our business relationship. We use analytics data, where you have allowed it, to understand how the site is used and to improve it. We do not use personal data collected through this website to train AI models, and we do not send marketing email unless you have asked for it.

4. Legal basis

We process personal data under the EU General Data Protection Regulation (GDPR), the UK GDPR and Serbia's Law on Personal Data Protection. Our legal bases are: performance of a contract or steps taken at your request before entering one (Article 6(1)(b)); our legitimate interest in business correspondence, running our services and keeping our systems secure (Article 6(1)(f)); consent where we ask for it, such as for analytics (Article 6(1)(a)); and legal obligations such as accounting and tax record-keeping (Article 6(1)(c)).

5. Sharing and sub-processors

We do not sell personal data. We share it only with service providers who help us operate: web hosting, our scheduling tool, email and document tooling, invoicing and accounting, analytics, and the cloud and AI model providers used in a specific engagement. Each provider is bound by a data processing agreement. Sub-processors used for engagement data are listed in each engagement's addendum, and we give clients advance notice before adding a new one.

Providers we currently use to run this website and our business operations:

• Vercel: website hosting and content delivery.
• Google (Google Analytics 4 and Google Tag Manager): website analytics, loaded only with your consent where consent is required.
• Cal.com (cal.eu): scheduling of calls, hosted in the European Union.
• Our email, document, invoicing and accounting providers, used to communicate with you and to keep the records the law requires.

Sub-processors used for engagement data (cloud infrastructure, AI model providers and, where agreed, annotation services) are specific to each engagement and are listed in its addendum.

6. Where your data is stored and international transfers

Our website, scheduling and business tooling are hosted mainly within the European Union. Some providers process data outside the European Economic Area, including in the United States and the United Kingdom. Where that happens, we rely on an adequacy decision, the European Commission's Standard Contractual Clauses, or the UK International Data Transfer Addendum, as applicable. ISLTech itself is based in Serbia, which the European Commission has not recognised as adequate; transfers to us are covered by the same mechanisms. For engagement data, we prefer to work inside the client's own cloud environment so that data does not leave it; where that is not possible, the processing locations are set out in the engagement's addendum.

7. Retention

Enquiry and correspondence data is kept for 24 months after our last contact, unless you ask us to delete it sooner or we are required to keep it longer, for example for accounting records. Analytics data is retained by Google under the retention period configured in our GA4 property (currently 14 months). Engagement data is retained and deleted according to the Data Processing Agreement: by default it is returned or deleted when the engagement ends.

8. Your rights

You have the right to access, correct, delete, restrict or port your personal data, to object to processing, and to withdraw consent at any time. To exercise any of these rights, email privacy@isltech.ai. We respond within 30 days. To withdraw analytics consent, clear this site's data in your browser and choose "Essential only" when the banner reappears.

9. Security

We protect personal data with encryption in transit and at rest, access limited to the people who need it for the engagement, multi-factor authentication on our accounts, and logging of access to engagement data. We review these measures regularly. We do not hold any security certification and do not claim one; the measures that apply to a specific engagement are described in its Data Processing Agreement.

10. Changes to this policy

We may update this policy from time to time. The "last updated" date above reflects the current version, and material changes will be posted on this page.

11. Contact

Questions about this policy or your data: privacy@isltech.ai. If you believe we have not handled your data properly, you may complain to Serbia's Commissioner for Information of Public Importance and Personal Data Protection, to the UK Information Commissioner's Office, or to the data protection authority in your EU country of residence.