1. Data Controller
This Privacy Policy explains how BazarBalkan ("Platform") collects, processes and protects the personal data of its users.
As data controller, BazarBalkan is committed to complying with the Law on Personal Data Protection (Official Gazette of the Republic of Serbia no. 87/2018, hereinafter LPDP) and Articles 41–42 of the Constitution of the Republic of Serbia.
Contact: info@bazarbalkan.com
2. Personal Data We Collect
- Identity data: Name, surname, username
- Contact data: Email address, phone number
- Location data: City/region provided when posting a listing
- Transaction data: Listings posted, favorites, messages, reviews
- Technical data: IP address, browser type, device information, cookies
- Payment data: Billing information for paid services (card numbers are not stored directly; processed via a payment provider)
3. Legal Basis for Processing
Under Article 12 of the LPDP, your data is processed on the following legal grounds:
- Performance of a contract (art. 12/1/b): Account creation, listing publication, messaging and similar services
- Consent (art. 12/1/a): Marketing emails, analytics cookies and ad personalisation
- Legitimate interests (art. 12/1/f): Platform security, fraud detection and service improvement
- Legal obligation (art. 12/1/c): Statutory retention and reporting requirements
4. Purposes of Processing
- Account management and authentication
- Publication and management of listings
- User-to-user messaging service
- Billing for paid services
- Platform security and fraud prevention
- Fulfilment of legal obligations
- Where consent is given: service update notifications, promotional communications
5. Sharing Data with Third Parties
Your data may be shared with the following third parties:
- Supabase Inc. (database and authentication infrastructure) — US/EU servers
- Google LLC (Google AdSense advertising and Google Analytics) — cookies may be used for ad personalisation
- Vercel Inc. (platform hosting and speed analytics)
- Payment processors (for paid services; the relevant provider's privacy policy applies)
Your data is never sold, rented or transferred to third parties except as required by law, court order or request by competent Serbian authorities.
6. International Data Transfers
Under Articles 64 et seq. of the LPDP: your data may be processed on servers in the European Economic Area (EEA) or the United States via Supabase and Vercel infrastructure. Such transfers are carried out under standard contractual clauses or equivalent protective mechanisms.
7. Cookie Policy
The Platform uses the following cookie categories:
- Essential cookies: Session management and security — may be used without consent
- Analytics cookies: Vercel Speed Insights and Google Analytics — require consent
- Advertising cookies: Google AdSense personalised ads — require consent
You can manage your cookie preferences via the consent banner displayed on your first visit to the Platform.
8. Data Retention Periods
- Account data: While the account remains active + 30 days from a deletion request
- Listing data: 2 years from the closure of a listing (for commercial dispute resolution)
- Message records: 1 year
- Invoice and payment records: 10 years under the Serbian Accounting Law
- Log records (IP, technical): 90 days
9. Rights of Data Subjects
Under Articles 26–36 of the LPDP, you have the following rights:
- Right of access (art. 26): You may request a copy of your processed data
- Right to rectification (art. 29): You may request the correction of inaccurate or incomplete data
- Right to erasure / "right to be forgotten" (art. 30): Under certain conditions you may request the deletion of your data
- Right to restriction of processing (art. 31): Under certain conditions you may request that processing be suspended
- Right to object (art. 37): You may object to processing based on legitimate interests
- Right to data portability (art. 36): You may request your data in a machine-readable format
- Right to object to automated decision-making (art. 38): You may object to automated decisions that affect you
To exercise your rights, write to info@bazarbalkan.com. Requests will be answered within 30 days.
10. Children's Personal Data
Under Article 16 of the LPDP: persons under the age of 15 may only have their data processed with the explicit consent of a parent or legal guardian. The Platform does not knowingly collect data from persons under 15. If we learn that such data has been collected, it will be deleted immediately.
11. Data Security
We apply SSL/TLS encryption, access controls, secure database infrastructure and regular security audits to protect your personal data. We note, however, that no internet transmission is 100% secure.
12. Right to Complain
Under Article 82 of the LPDP, you may lodge a complaint about our data processing activities with the Commissioner for Information of Public Importance and Personal Data Protection:
Website: www.poverenik.rs
Address: Bulevar kralja Aleksandra 15, 11000 Belgrade, Serbia
Phone: +381 11 3408 900
13. Policy Updates
When this policy is significantly amended, registered users will be notified by email and the update date will be shown at the bottom of this page.
Last updated: April 2025
