Privacy policy

Who we are

The controller is Roman Krasheninnikov PR Novi Sad (“vebsajt”, “we”), seat: Mite Ružića 2, 21101 Novi Sad, MB 67418263, PIB 114231685. Contact for anything about your data: madshuhov@gmail.com, +381 63 723 9009.

We build and run websites with online booking for small businesses. This policy covers vebsajt.net, the demo sites we make and the admin (cabinet) of our clients' sites.

Two roles

•For visitors of vebsajt.net, people who request a demo and our clients (business owners and staff) we are the controller.

•For our clients' customers (who booked a haircut, left a request at a restaurant, bought a gift voucher) the business is the controller and we are its processor: we keep and process the data only on its instructions, under a data processing agreement. Please ask the business; we will help it answer.

What we collect and why

•A demo request (the form on vebsajt.net): the link to your business, its name and city, the contact you leave (phone, Viber, Telegram or email) and the page's language. Purpose: to make the demo and get back to you. Basis: steps before a contract at your request (ZZPL art. 12(1)(2)).

•An admin account: email, name, password (we keep only its cryptographic hash), sign-in sessions with the IP address and browser details. Purpose: signing in and account security. Basis: contract.

•Billing details of clients: business name, address, tax and registry numbers, amounts and payments. Basis: contract and legal duties (accounting, taxes).

•Demo sites: we make a demo from public information about the business (Google Maps, its website and social networks) — name, address, hours, phone, photos and sometimes public reviews with their authors' names as published. A demo is private and opens only by the link we send to the owner. Basis: legitimate interest in showing the business what its site could look like (art. 12(1)(6)). On request we delete the demo or anything in it at once.

•Visits to demo sites: when a demo is opened we record the page, the time, the kind of device (phone or computer), the browser's language and a random visitor id from a cookie — to know whether the demo was seen and when to get in touch. We do not keep the IP address. Basis: legitimate interest.

•Site statistics (vebsajt.net and our clients' sites): pages, where the visit came from (domain and utm tags only), kind of device, language, which parts of a page were seen and what was clicked. No cookies and no stored IP address: a visitor is recognised only within one day through a hash made with a random daily value, and that value is deleted after the day — after that the record is no longer tied to a person. We also honour Do Not Track and GPC: such visits are not counted.

•Telegram notifications: if you connect Telegram yourself (a customer after booking, a business's staff, the owner), we keep your Telegram chat id to send confirmations and reminders. You can disconnect at any time.

Cookies

We use no advertising or cross-site tracking cookies. Only:

•the admin sign-in (session) — necessary;

•the chosen language (vs_lang, 1 year) — so you don't pick it again;

•the key of a private demo (vd_…, 1 year) — so the demo opens without the link again;

•a random demo visitor id (vebsajt_v, 1 year) — to count visits to demo sites (see above).

Who else sees the data

We do not sell data or share it for advertising. Access have only:

•our server in Belgrade (Republic of Serbia), which holds all data and backups;

•Telegram (Telegram Messenger Inc. / Telegram FZ-LLC), only for notifications you turned on yourself — a transfer abroad based on the consent you give by connecting;

•Google (Places API), when we make a demo from public data about a business;

•Cloudflare, as the DNS service of our domains;

•the bank, for payments by invoice, and the accountant, for the books the law requires;

•public authorities, only when the law requires it.

How long we keep it

•Demo requests — while we talk about working together, at most 24 months after the last contact.

•A demo site — until the owner takes it or declines, or until you ask us to delete it.

•Client accounts and data — while we work together; invoices and books — as long as the law requires.

•Our clients' customers' data — as long as the business decides; after the work ends we delete it or hand it to the business.

•Detailed statistics records — 90 days; totals (with no personal data) for good.

•Database backups — 14 days.

Security

Connections are encrypted (HTTPS), passwords are kept only as hashes, the server is reachable by key only, and in the admin each team member sees only what their role allows. We use the data for no automated decisions or profiling.

Your rights

You have the right to access your data, to have it corrected or erased, to restrict processing, to data portability and to object to processing based on legitimate interest; you may withdraw consent at any time (ZZPL arts. 26–38). Write to madshuhov@gmail.com — we answer within 30 days at the latest.

If you think the processing breaks the law, you can complain to the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11000 Belgrade, www.poverenik.rs.

Changes

If we change this policy, the new version is published here with its date; clients hear of important changes in advance.