Privacy and cookies

Who is responsible for your data

DirectBalkan is a product and service operated by WebResenje PR. WebResenje PR is the controller of the personal data described in this notice.

• WebResenje PR
• Karađorđeva 58, 26000 Pančevo, Serbia
• MB: 68647509
• PIB: 115803024
• Email: info@directbalkan.com

For any privacy question or request, write to info@directbalkan.com.

What we collect

When you register for Early Access, we collect what you enter in the form:

• Step 1: your name, email address and, if you give it, your phone number; your accommodation’s name, type, country and city or region.
• Step 2, if you continue: the number of units, how you take bookings today, your current website, your preferred website address and any notes.

We also record:

• your language, the form version, the time of each step and your registration reference;
• that you ticked the confirmation box, with the time and the version of this notice you saw;
• how you reached the form: campaign tags in the link (UTM parameters), the page you landed on and the referring page (its address without query details);
• whether and when we sent your confirmation email;
• status changes and notes our team adds while handling your registration.

We do not store your IP address with your registration. To protect the form against abuse, we keep short-lived counters based on a keyed one-way code derived from your IP address and email address, never the addresses themselves. Our web server’s access logs record IP addresses for security purposes.

Required fields are needed to process your registration; without them we cannot register you. Optional fields are up to you.

Why we use your data and on what legal basis

• Handling your Early Access registration, sending the confirmation you asked for, and contacting you about Early Access and possible onboarding. Legal basis: steps taken at your request before entering into a possible contract.
• Managing Early Access: recording status changes and internal notes, and learning which pages and campaigns bring registrations from the attribution details above. Legal basis: our legitimate interest in running and improving Early Access.
• Protecting the site and the form against abuse, spam and security incidents, using the counters and access logs described above. Legal basis: our legitimate interest in keeping the service secure.
• Analytics: none at present. If we add analytics, it will run only with your consent (see Cookies).

The box you tick in the form confirms that you have read this notice and asks us to contact you about Early Access. It is a condition of registering, not a separate consent; we record it to show what you were told and when.

We do not sell your data and do not use it for advertising.

Who receives your data

Only authorised WebResenje PR staff can see registrations, in a protected admin system that requires two-step sign-in. These service providers process data on our behalf and on our instructions:

• Contabo GmbH (Germany): hosting of our servers and database, in a data centre in the European Union.
• Namecheap, Inc.: sending our emails, including your confirmation, and hosting our mailbox info@directbalkan.com, on servers in the Netherlands.
• Scaleway SAS (France): storage of our database backups in Amsterdam, the Netherlands. Backups are encrypted on our server before they are sent, so Scaleway cannot read them.

We disclose data to public authorities only where the law requires it.

Transfers outside Serbia

Our servers, backups and email servers are in the European Union. Serbian law treats EU member states as providing an adequate level of data protection.

Namecheap, Inc. is based in the United States, and its staff may access data from there, for example for support or security. Such transfers rely on the safeguards in Namecheap’s data processing terms, such as Standard Contractual Clauses.

How long we keep your data

Early Access registrations are retained while the Early Access relationship is active and for up to 12 months after our last meaningful contact with you. If you become a customer, the data needed for the customer relationship is retained under the applicable customer retention rules. You may request deletion earlier where applicable. After deletion from the active systems, residual copies may remain in encrypted backups until those backups expire, normally within approximately 35 days.

Abuse-prevention counters are deleted after about a day. Web server access logs are rotated automatically and overwritten as new entries are written. Our application logs contain neither your IP address nor your form answers.

Your rights

Where applicable under data protection law, you have the right to:

• access your data and receive a copy;
• have inaccurate data corrected;
• have your data deleted;
• restrict how we use your data;
• object to processing based on our legitimate interests;
• receive the data you gave us in a structured, machine-readable format and have it passed to another controller, where processing is based on steps taken at your request;
• withdraw your consent at any time where we rely on consent, without affecting processing before the withdrawal.

To use these rights, write to info@directbalkan.com. We may first need to confirm your identity. We reply without undue delay and within the time limits set by law.

You can also lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia (poverenik.rs). If you live in the European Union and the GDPR applies, you can also complain to the data protection authority in your country.

Automated decisions

We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects. Decisions about inviting owners into onboarding are made by people.

Changes to this notice

We update this notice when the way we process data changes, for example before we add analytics or offer paid services. The date at the top shows the current version. Questions: info@directbalkan.com.