Privacy policy
for Popravka.rs Platform
This Privacy Policy (hereinafter: "Policy") describes how the company operating the Popravka.rs platform (hereinafter: "Controller" or "we") collects, uses, stores, and protects the personal data of platform users (hereinafter: "User" or "You"). This Policy has been prepared in accordance with the Personal Data Protection Act of the Republic of Serbia ("Official Gazette of RS", No. 87/2018), the General Data Protection Regulation (GDPR) of the European Union, and other relevant data protection regulations. By using our Platform, you consent to the collection and processing of your data in accordance with this Policy.
ARTICLE 1. DATA CONTROLLER
1.1. The personal data controller is the company operating the Popravka.rs platform. 1.2. For all questions regarding personal data protection, you may contact us at: Email: info@peliostudio.com Address: Belgrade, Republic of Serbia 1.3. The Controller is responsible for the lawful processing of your personal data in accordance with applicable regulations.
ARTICLE 2. DATA WE COLLECT
2.1. We collect the following categories of personal data: A) Identity data: - First and last name (obtained via Google authentication) - Email address (obtained via Google authentication) B) Usage data: - History of queries submitted on the Platform - Generated recommendations and estimates - Session times and duration - Credit usage data (action type, top-up or deduction amount, date) C) Technical data: - IP address - Browser type and version - Time zone - Device information D) Location data: - Approximate location based on IP address (city, country) 2.2. We DO NOT collect special categories of personal data (sensitive data) such as health data, religious beliefs, political opinions, etc.
ARTICLE 3. LEGAL BASIS FOR PROCESSING
3.1. We process your personal data based on the following legal grounds: A) CONSENT (Article 12(1)(1) PDPA / Article 6(1)(a) GDPR): - Consent is given upon registration on the Platform - You may withdraw consent at any time B) PERFORMANCE OF CONTRACT (Article 12(1)(2) PDPA / Article 6(1)(b) GDPR): - Processing is necessary to provide the services you have requested - Processing is necessary to manage your Account C) LEGITIMATE INTEREST (Article 12(1)(6) PDPA / Article 6(1)(f) GDPR): - Improvement and optimization of our services - Prevention of fraud and abuse - Ensuring Platform security D) LEGAL OBLIGATION (Article 12(1)(3) PDPA / Article 6(1)(c) GDPR): - Compliance with legal obligations (e.g., accounting regulations)
ARTICLE 4. PURPOSES OF PROCESSING
4.1. We process your personal data for the following purposes: A) Service provision: - Creating and managing your user Account - Generating AI recommendations based on your queries - Processing payments and managing credits - Providing customer support B) Service improvement: - Analyzing Platform usage to improve functionality - Developing new features based on user needs - Fixing bugs and technical issues C) Communication: - Sending notifications about changes to terms of service - Responding to your inquiries and requests - Sending information about new features (with your consent) D) Security: - Protection against unauthorized access - Prevention of fraud and abuse - Maintaining Platform integrity
ARTICLE 5. DATA RETENTION PERIOD
5.1. We retain your personal data for as long as necessary to fulfill the purposes for which they were collected: A) Account data: - Retained while your Account is active - After Account closure, data is retained for an additional 30 days for possible recovery - After that, data is permanently deleted or anonymized B) Transaction data: - Retained for 5 years in accordance with accounting regulations C) Query and recommendation data: - Retained for 12 months from the date of generation - User may request earlier deletion D) Technical data (logs): - Retained for up to 90 days 5.2. Upon expiration of the retention period, data is permanently deleted or anonymized so that user identification is no longer possible.
ARTICLE 6. SHARING DATA WITH THIRD PARTIES
6.1. We may share your personal data with the following categories of recipients: A) Service providers (processors): - Google (authentication and infrastructure) - Payment service providers - Hosting service providers 6.2. We have contracts with all processors that ensure adequate protection of your data. 6.3. We DO NOT sell, rent, or transfer your personal data to third parties for marketing purposes. 6.4. We may disclose your data to government authorities only if required by law or a final court decision.
ARTICLE 7. INTERNATIONAL DATA TRANSFERS
7.1. Some of our service providers may be located outside the Republic of Serbia and the European Union. 7.2. In case of data transfer outside Serbia/EU, we ensure adequate protection through: - Standard contractual clauses adopted by the European Commission - Adequacy decisions (for countries providing an adequate level of protection) - Other mechanisms provided by law 7.3. For more information about transfer mechanisms, please contact our data protection service.
ARTICLE 8. YOUR RIGHTS
8.1. Regarding your personal data, you have the following rights: A) RIGHT OF ACCESS (Article 26 PDPA / Article 15 GDPR): - Right to obtain confirmation as to whether your data is being processed - Right to access your personal data and information about processing B) RIGHT TO RECTIFICATION (Article 29 PDPA / Article 16 GDPR): - Right to request correction of inaccurate data - Right to have incomplete data completed C) RIGHT TO ERASURE (Article 30 PDPA / Article 17 GDPR): - Right to request deletion of your personal data - This right is not absolute and is subject to legal limitations D) RIGHT TO RESTRICTION OF PROCESSING (Article 31 PDPA / Article 18 GDPR): - Right to request restriction of processing in certain circumstances E) RIGHT TO DATA PORTABILITY (Article 36 PDPA / Article 20 GDPR): - Right to receive your data in a structured, machine-readable format - Right to request direct transfer of data to another controller F) RIGHT TO OBJECT (Article 37 PDPA / Article 21 GDPR): - Right to object to the processing of your data - Special right to object to processing for direct marketing purposes G) RIGHT TO WITHDRAW CONSENT (Article 15 PDPA / Article 7 GDPR): - Right to withdraw given consent at any time - Withdrawal of consent does not affect the lawfulness of processing before withdrawal 8.2. To exercise your rights, contact us at: info@peliostudio.com 8.3. We will respond to your request within 30 days. In complex cases, the deadline may be extended by an additional 60 days, of which you will be notified.
ARTICLE 9. DATA SECURITY
9.1. We apply appropriate technical and organizational measures to protect your personal data, including: A) Technical measures: - Data encryption in transit (SSL/TLS) - Data encryption at rest - System access protection (authentication, authorization) - Regular system and software updates - Firewall and intrusion detection systems B) Organizational measures: - Limited data access (principle of least privilege) - Employee training on data protection - Data handling policies and procedures - Regular security audits 9.2. Despite our efforts, no system of data transmission over the internet is 100% secure. In case of a data security breach, we will act in accordance with the law, including notifying the competent authority and affected users.
ARTICLE 10. COOKIES AND SIMILAR TECHNOLOGIES
10.1. The Platform uses cookies and similar technologies for: - Enabling Platform functionality (necessary cookies) - Remembering your settings - Analyzing Platform usage 10.2. Optional page analytics are enabled only with your consent. Using the Platform does not itself constitute consent. You can change your choice using the Cookies button in the page footer. 10.3. You can set your browser to refuse cookies, but this may affect Platform functionality.
ARTICLE 11. PROTECTION OF MINORS
11.1. The Platform is not intended for persons under 18 years of age. 11.2. We do not knowingly collect personal data from minors. 11.3. If we learn that we have collected data about a minor, we will delete it without delay. 11.4. If you are a parent or guardian and believe your child has provided personal data, please contact us.
ARTICLE 12. RIGHT TO LODGE A COMPLAINT
12.1. If you believe that the processing of your personal data violates applicable regulations, you have the right to lodge a complaint with: A) The Commissioner for Information of Public Importance and Personal Data Protection: Address: Bulevar kralja Aleksandra 15, 11000 Belgrade Email: office@poverenik.rs Phone: +381 11 3408 900 B) The competent authority in your country (if you are in the EU) 12.2. Before lodging a complaint with the supervisory authority, we recommend that you contact us first so that we can try to resolve the issue.
ARTICLE 13. CHANGES TO THE PRIVACY POLICY
13.1. This Policy may be amended from time to time. 13.2. You will be notified of all significant changes via: - Email notification - Platform notification 13.3. We recommend that you periodically review this Policy. 13.4. Continued use of the Platform after the publication of changes constitutes acceptance of the amended Policy.
ARTICLE 14. FINAL PROVISIONS
14.1. This Policy is an integral part of the General Terms of Service for the Platform. 14.2. In case of inconsistency between this Policy and the Terms of Service, regarding personal data protection, the provisions of this Policy shall apply. 14.3. All matters not regulated by this Policy shall be governed by the provisions of the Personal Data Protection Act of the Republic of Serbia and other relevant regulations.