# Privacy Policy
*17.04.2026 • v1.0*
## 1. General Provisions
This Privacy Policy defines the order of processing and protection of personal data of users of the website and service SerbiaHub.com. It applies to the data we receive when using the Service, including registration, submitting applications, publishing ads, correspondence with support, and other Service functions. Contact address: info@serbiahub.com.
The document is prepared in accordance with the Law of the Republic of Serbia on Personal Data Protection and applies to the extent that personal data processing is carried out in connection with the operation of the Service in Serbia.
## 2. What Data We Process
We process the following data:
- Identification and contact data: name, email address, phone number (if you provide it).
- Account and profile data: login, password in hashed form (bcrypt algorithm), profile picture, interface language, notification settings, Telegram ID and username (when logging in via Telegram).
- Data about your requests and actions in the Service: published ads, reviews, messages in chats between users, support inquiries, attachments and documents.
- Geolocation: used only at the moment for searching nearby objects and is not stored in the database.
- Payment data: fact and amount of payment. We do not store bank card numbers - they are processed by the payment partner.
- Technical data: IP address, device type, browser, operating system, login date and time, cookie identifiers, event logs.
- Marketing preferences and consents, if you give consent to receive notifications.
## 3. Purposes of Processing and Legal Grounds
We process personal data only when there is a corresponding legal basis and to the extent necessary for a specific purpose. Grounds for data processing include:
- Performance of a contract or taking measures prior to its conclusion: creation and maintenance of an account, publishing and processing applications, providing Service functions.
- Compliance with legal obligations: responding to lawful requests from state authorities, complying with accounting, tax and other mandatory regulations.
- User consent: sending notifications about new ads via subscriptions, optional cookies.
- Legitimate interest of the Operator: ensuring Service security, preventing abuse, maintaining event logs, protecting rights in claims and disputes, improving Service quality.
## 4. Data Sources
Generally, we receive data directly from you. In some cases, data may come from other users with whom you interact through the Service (e.g., reviews or chat messages), as well as from authorization tool providers (Telegram, Google) if you use login through them.
## 5. Cookies and Analytics
The Service uses cookies and similar technologies to enable login, preserve language and settings, protect against abuse, analyze traffic, and improve user experience. Mandatory cookies are used for the Service operation (session, interface language). Analytical cookies are used via Google Analytics to calculate anonymous visit statistics. You can disable cookies in your browser settings, but some Service functions will stop working.
## 6. Who We May Share Data With
We do not sell your personal data. Data may be transferred only to the extent necessary to achieve the stated purposes, to the following categories of recipients:
- Brevo (SaaS for email newsletters) - email and recipient name when sending transactional emails.
- Zoho Mail (email hosting for incoming and outgoing mail on the domain serbiahub.com).
- Google (Google Analytics for anonymous statistics, Google Translate API for translating ads without linking to a user, Google OAuth for login via Google account).
- Telegram (when interacting with the @SerbiaHub_bot bot, when logging in via Telegram Login Widget, when sending notifications).
- Payment systems (we do not see card data - it is processed by the payment partner).
- Hosting provider of the server infrastructure.
- Government bodies, courts, law-enforcement agencies - upon a lawful request.
- Other Service users - only to the extent that follows from the Service functionality and your own actions (public profile, ads, reviews, chat messages).
## 7. Cross-Border Data Transfers
Some service providers are located outside the Republic of Serbia. Data may be transferred to the following jurisdictions:
- European Union (France, Ireland, Netherlands) - Brevo, Zoho, Telegram, main Google servers.
- United States - Google for certain services, when necessary (transfer is based on the EU-US Data Privacy Framework).
All listed providers comply with applicable personal data protection legislation (GDPR and Serbian national law).
## 8. Retention Periods
We store data for the following periods:
- Account data - while the account exists. After account deletion - 30 days for possible restoration, then irreversible deletion.
- Support inquiries and correspondence - up to 24 months.
- Security logs (login and activity logs) - up to 12 months.
- Financial documents related to payments - 5 years (tax legislation requirement).
- User-deleted ads - 30 days in the trash, then erased.
- Anonymized visit statistics - indefinitely.
## 9. Security Measures
We take reasonable technical, organizational and personnel measures to protect data from unauthorized access, disclosure, alteration, loss and destruction:
- Passwords are hashed with bcrypt and are not stored in plain text.
- Connections are protected by TLS/HTTPS.
- Database access is restricted and logged.
- Regular backups are created.
- Contractual restrictions for processors (DPA) and internal incident-response procedures.
## 10. User Rights
You have the right to:
- Access your data (including within the Service profile).
- Request correction, addition or deletion of data.
- Request restriction of processing.
- Receive data in a machine-readable format (data portability).
- Object to processing based on legitimate interest.
- Withdraw previously given consent - e.g., unsubscribe from notifications with one click in the subscription settings.
- Not be subject to a decision based solely on automated processing.
To exercise your rights, send a request to info@serbiahub.com. We respond within 30 days. We may request additional information to verify your identity.
## 11. Children's Data
The Service is not intended for persons under 15 years of age. If processing is based on consent in connection with information-society services, a person who has reached 15 years may give consent themselves; for a person under 15, such consent must be provided by a parent or other legal representative.
If you believe a child has provided us with data without proper consent, please contact us: info@serbiahub.com. We will delete such data.
## 12. Third-Party Websites and Services
The Service may contain links to third-party websites and services. We do not control their content or data-processing rules and recommend that you review their privacy policies independently.
## 13. Policy Changes
We may periodically update this Policy. The current version is posted on SerbiaHub.com with the update date. In case of significant changes we will additionally notify users through the Service interface or by email at least 14 days before the changes take effect.
## 14. Contacts and Complaints
For questions regarding personal data processing you can contact us at: info@serbiahub.com.
If you believe that the processing of your personal data violates the law, you have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia (Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti, poverenik.rs).