Privacy policy.

What we collect, why, and what you can ask us to do with it. Plain English, no tricks.

Last updated: 8 November 2026

1. Who we are

VR Tactic ("VR Tactic", "we", "us", "our") is a social media marketing agency run by its two founders, based in Belgrade, Serbia. We run the website vrtactic.com (the "Site") and provide social media marketing, content strategy, scriptwriting, video editing and related services (the "Services").

For the personal data described in this policy, VR Tactic is the "controller", meaning we decide why and how it is used. You can reach us about anything in this policy at [email protected].

2. What this policy covers

This policy explains how we collect, use, share, protect and keep personal data when you:

  • visit or use the Site;
  • book a call, email us or send us a message;
  • become a client, or act on behalf of a client;
  • apply for a role or send us a portfolio or test task;
  • appear in, or are mentioned in, content a client gives us to work on.

When we work on a client's content, the client is often the controller of the personal data inside that content (for example, footage of their customers or guests) and we process it on their behalf. In those cases the client's own privacy notice also applies, and our written agreement with the client sets out each side's responsibilities.

3. What we collect

3.1 Information you give us

  • Contact details: your name, email address, social media handles and anything else you include when you email us or use a form on the Site. Our forms open your own email app, so the message is sent from your email account to ours.
  • Booking details: when you book a call, our booking provider Calendly collects your name, email, chosen time, time zone and any answers you give to its questions.
  • Business information: details about your offer, pricing, audience, goals and current results that you share with us on calls or in writing.
  • Client content: raw footage, audio, photos, scripts, logos, brand assets and other material you send us to work on. This content may show your face, voice and likeness, and those of anyone else who appears in it.
  • Account access details: if you ask us to post for you or pull performance data, the access you grant us to your social media accounts (preferably through each platform's team or partner access features, or otherwise login details you choose to share).
  • Billing details: your name or company name, billing address, tax details and payment records. We do not store full card numbers; payments are handled by the bank or payment provider you use.
  • Job applications: your name, email, location or time zone, portfolio links, work samples, test tasks, and anything you tell us about yourself.
  • Communications: the content of emails, messages, call notes and feedback between us.

3.2 Information collected automatically

  • Server logs: our hosting provider automatically records technical data such as IP address, browser type, device type, pages requested, referring page and time of visit. This is used for security and to keep the Site running.
  • Cookies and similar technologies: see section 7.
  • Analytics data: if analytics tools are active on the Site, information about how you use it, such as pages viewed, time spent, clicks, approximate location (city or country level) and the device you use. See section 7.

3.3 Information from other sources

  • Public profiles: information that is publicly visible on your social media accounts or website, which we may look at before or after a call to understand your business.
  • Platform data: if you are a client, performance data from your social media accounts (such as views, reach, watch time, followers and engagement) that we access with your permission.
  • Service providers: confirmation and scheduling information from Calendly, and delivery information from file-transfer services.

We do not intentionally collect sensitive data (such as health information, religious beliefs or political opinions). Please do not send it to us unless it is necessary for the content you want us to make. If your content naturally includes such information (for example, a health coach discussing their own story), you are choosing to share it with us for the purpose of producing that content.

4. How we use your data and our legal reasons

Where laws such as the EU or UK GDPR or the Serbian Law on Personal Data Protection apply, we must have a legal reason ("legal basis") for each use. Here is what we do and why:

  • Replying to you and running booked calls. Legal basis: steps you asked us to take before entering a contract, and our legitimate interest in answering enquiries.
  • Providing the Services (research, scripts, editing, packaging, posting, reporting). Legal basis: performance of our contract with you.
  • Accessing your social media accounts to post content or pull performance data, only when you ask us to. Legal basis: performance of our contract with you.
  • Invoicing, payments and record-keeping. Legal basis: performance of a contract and compliance with legal obligations (for example, tax and accounting rules).
  • Reviewing job applications and test tasks. Legal basis: steps you asked us to take before entering a contract, and our legitimate interest in hiring.
  • Showing work in our portfolio (on the Site and our social media). Legal basis: your consent or the permission set out in our agreement with you. You can withdraw it at any time (see section 6).
  • Improving the Site and our Services, including analytics. Legal basis: your consent where the law requires it (for example, non-essential cookies), otherwise our legitimate interest.
  • Keeping the Site and our systems secure, preventing fraud and abuse. Legal basis: our legitimate interest.
  • Sending occasional updates about our Services to clients or people who asked for them. Legal basis: consent or legitimate interest, as the law allows. Every such message lets you unsubscribe.
  • Handling legal claims and complying with the law. Legal basis: legal obligation and our legitimate interest in protecting our rights.

Where we rely on legitimate interest, we have weighed our interest against your rights and only rely on it where we believe your rights are not overridden. You can object to it (see section 11).

We do not use your data for automated decision-making that has legal or similarly significant effects on you.

5. Access to your social media accounts

If you are a client and ask us to post for you or report on performance, these extra rules apply:

  • We prefer access through each platform's official team, partner or business tools (such as Meta Business Suite, YouTube channel permissions or TikTok business features), so you never have to share your password. If you choose to share login details instead, you do so at your own decision.
  • Any login details you share are stored in a password manager or other secure method, are only available to team members who need them for your account, and are never shared outside VR Tactic.
  • We only use access to do what you asked: uploading approved content, scheduling posts, writing captions, replying where agreed, and reading analytics. We do not change account settings, passwords, payment details, profile information or ad spend without your written instruction.
  • You can remove our access at any time. When our work ends, we will stop using your accounts and ask you to remove our access and change any passwords you shared.
  • You stay responsible for your accounts and for following each platform's rules. Please tell us immediately if you notice anything unusual.

6. Client content, footage and our portfolio

  • We use footage and material you send us only to produce your content and for the other purposes in this policy.
  • If other people appear in your footage (clients, guests, employees, members of the public), you are responsible for having their permission for the content to be filmed, edited and published.
  • We may show finished work in our portfolio, on the Site and on our social media, as set out in our agreement with you. If you don't want a piece shown, or you want it taken down later, email [email protected] and we will remove it from the Site and our own accounts within a reasonable time. We cannot remove copies other people have already saved or shared.
  • Raw footage and project files are deleted or archived as described in section 10.

7. Cookies, analytics and tracking

Cookies are small files stored on your device. Similar technologies include pixels, tags and local storage. We use:

  • Strictly necessary technologies that make the Site work and keep it secure. These don't need your consent.
  • Embedded content: the booking calendar is loaded from Calendly, which may set its own cookies when it loads. See Calendly's privacy notice.
  • Analytics and marketing tools (for example, Google Analytics or social media pixels), if and when they are active on the Site, to understand how visitors use the Site and to measure our own marketing. Where the law requires it (including in the EU, UK and Serbia), these only run after you agree, and you can change your choice at any time.

You can also block or delete cookies in your browser settings. Blocking some cookies may stop parts of the Site, such as the booking calendar, from working. Where required by law, we treat browser privacy signals such as Global Privacy Control as a request to opt out of "sale" or "sharing" of personal data.

8. Who we share your data with

We do not sell your personal data. We do not rent it or trade it. We only share it with:

  • Service providers who help us run our business and process data on our behalf under their own terms and security measures, including:
    • Calendly (call booking);
    • Google Workspace, including Gmail and Google Drive (email, documents and file storage);
    • file transfer and storage services we use to send and receive footage and project files (such as Google Drive, Dropbox, WeTransfer or Frame.io);
    • analytics providers, when active on the Site;
    • our website hosting provider;
    • password managers and the software we use to edit and manage projects.
  • Team members and freelancers (editors, scriptwriters, motion designers, researchers) who work on your project. They only receive what they need for their task and must keep it confidential.
  • Social media platforms (Instagram, TikTok, YouTube, X / Twitter and others) when we publish content to your accounts at your request. Those platforms handle that content under their own policies.
  • Professional advisers such as accountants or lawyers, where needed.
  • Authorities, if we are required to by law, court order or to protect our rights, safety or property, or those of others.
  • A future business owner, if VR Tactic is reorganised, merged or sold. We would tell you before your data becomes subject to a different policy.

9. International transfers

We are based in Serbia, and some of our service providers (including Google and Calendly) are based in, or store data in, the United States and other countries. These countries may have different data-protection laws from yours. Where the law requires it, we rely on recognised safeguards for these transfers, such as the European Commission's Standard Contractual Clauses, the EU-US Data Privacy Framework or similar mechanisms offered by our providers. Contact us if you want more information.

10. How long we keep your data

  • Enquiries and booking details from people who don't become clients: up to 24 months after our last contact.
  • Client records, contracts and communications: for as long as we work together, then for as long as needed to handle possible claims, and for as long as tax or accounting laws require.
  • Raw footage and project files: for as long as we work together, then up to 90 days after the work ends so you can request copies, after which we delete them unless we agree otherwise in writing. Finished videos shown in our portfolio are kept until you ask us to remove them.
  • Account access details: deleted as soon as our work ends or you remove our access.
  • Job applications and test tasks: up to 12 months, unless you ask us to delete them sooner or you join the team.
  • Server logs and analytics data: according to our hosting and analytics providers' standard retention periods, generally not more than 26 months.

When we no longer need data, we delete it or make it anonymous.

11. Your rights

Depending on where you live, you may have the right to:

  • access the personal data we hold about you and get a copy;
  • correct data that is wrong or incomplete;
  • delete your data;
  • restrict how we use it;
  • object to uses based on legitimate interest, and to direct marketing at any time;
  • receive your data in a portable format;
  • withdraw consent at any time, without affecting anything we did before;
  • complain to a data-protection authority, such as the Commissioner for Information of Public Importance and Personal Data Protection in Serbia, or the authority in the country where you live or work.

To use any of these rights, email [email protected]. We may need to confirm your identity before acting. We will reply within 30 days, and we will tell you if we need more time as the law allows. These requests are free unless they are clearly unfounded or excessive.

12. Extra information for United States residents

Some US state privacy laws (such as California's CCPA/CPRA and similar laws in other states) give residents specific rights. To the extent those laws apply to us:

  • Categories we collect: identifiers (name, email, handles, IP address); commercial information (services discussed or bought); internet activity (Site usage); audio and visual information (footage and recordings you send); professional information (job applications); and inferences about your content needs. Sources and purposes are described in sections 3 and 4.
  • No sale or targeted-advertising sharing: we do not sell personal data and do not share it for cross-context behavioural advertising. If we ever use advertising pixels that count as "sharing", we will offer an opt-out and honour Global Privacy Control signals.
  • Your rights: to know what we collect and how we use it, to access, correct and delete it, to opt out of sale or sharing, and to appeal if we refuse a request. You can use an authorised agent, and we will confirm the agent's authority.
  • No discrimination: we will not treat you differently for using your rights.
  • Sensitive information: we do not use sensitive personal information to infer characteristics about you.

To make a request or appeal a decision, email [email protected] with "Privacy request" in the subject line.

13. How we protect your data

We use reasonable technical and organisational measures to protect personal data, such as secure (HTTPS) connections, limiting access to people who need it, two-factor authentication and password managers where available, and using reputable service providers. No method of storage or transfer is 100% secure, so we cannot guarantee absolute security. If a data breach is likely to put your rights at risk, we will notify you and the relevant authority as the law requires.

14. Children

The Site and our Services are meant for adults and businesses. We do not knowingly collect personal data from anyone under 16 (or under 13 in the United States) without a parent's or guardian's permission. If you believe a child has sent us personal data, contact us and we will delete it. If a client's content includes minors, the client is responsible for getting permission from their parent or guardian.

15. Links to other websites

The Site links to other websites and platforms, including Calendly, Instagram, TikTok, YouTube and X / Twitter. We are not responsible for how they handle your data. Please read their privacy policies.

16. Changes to this policy

We may update this policy as our business, tools or the law change. We will change the date at the top of this page, and if the changes are significant we will tell clients by email or show a notice on the Site.

17. Contact

Questions, requests or complaints about privacy: [email protected]. We aim to answer every message within a few working days.