Privacy policy

What data we keep

• Account: e-mail (for sign-in, never public), display name, town, site language, e-mail settings, the time you accepted the rules.
• Optional: phone (hidden by default), shop name, and for traders the business name, address, MB and PIB — the law requires these to be public.
• What you publish: listings, photos, requests, questions, appraisals, comments and reviews after deals. These are public.
• Your profile also shows numbers: how many confirmed sales and purchases you have, how many things you found for others and how many appraisals you gave, plus others' reviews of you. What you bought and for how much is not shown.
• Messages between users — only the people in the conversation can see them.
• Your dukat history and notifications.
• For sign-in: an encrypted fingerprint of the code (we don't keep the code itself) and the IP address, to stop guessing. Deleted after one day.
• A message sent with the “Write to us” form (on the “Support divno” page): the text, topic, the page you came from and — if you enter it — an e-mail address for our reply.
• Saved listings: what you saved with the “Save” button. Only you see the list; the seller doesn't see who saved. Deleted when you remove a listing from the list or delete your account.
• Anonymous counters, so we know what people find interesting: how many times a listing was viewed, which listings are viewed one after another, and how often the suggestions under a listing are clicked. The database holds only listings and numbers — no IP address, no account, no cookies. To avoid counting one view twice, the server keeps an unreadable fingerprint in memory for up to a day (never written to disk).
• A technical server log (IP address, page address, time) for security and debugging; kept briefly and overwritten automatically.

Cookies: sign-in (sessionid), form protection (csrftoken), your chosen language, the dismissed top bar and your statistics choice (dv_consent). Only if you allow statistics — also Google Analytics cookies (_ga, _ga_…), up to 2 years; they are deleted as soon as you withdraw your permission.

Why and on what basis

• So the site can work for you (account, listings, messages, requests, dukats) — performance of the contract, i.e. the Terms of use.
• Protection against abuse and spam (limits, IP at sign-in, server log) — legitimate interest.
• Trader details are public because the Consumer Protection Law requires it — a legal obligation.
• We send e-mails about messages and requests because they're part of the service; you can turn them off with one click.
• Visit statistics (Google Analytics) — your consent (Personal Data Protection Act, Arts. 12 and 15). You withdraw it as easily as you gave it: “Statistics settings” at the bottom of the site.

Who else processes data

• Hetzner Online GmbH (Germany) — the server holding the database and photos; data centre in Finland (EU).
• Brevo (France, EU) — sending e-mails: sign-in codes and notifications. It receives your e-mail address and the message text.
• ImprovMX — forwards e-mails you send to @divno.rs addresses.
• Google Ireland Ltd. and Google LLC (USA) — visit statistics (Google Analytics), only with your consent: pages viewed, time, approximate location (city), device and browser. Google does not store IP addresses. Data may be transferred to the USA; Google is certified for this under the EU–US Data Privacy Framework, and by giving consent in the bar you explicitly agree to that transfer (Art. 69(1)(1) of the Act). Retention: 2 months.
• Google and Meta (Facebook) — only if you choose to sign in with them: we receive your name, e-mail address and account ID, nothing else (no password, friends or posts). They can see that you are signing in to divno.
• Telegram — only if you link the bot yourself: we store the chat ID and username, and the photos and text you send the bot become a listing draft. Notifications then go through Telegram. Unlink with one click in “My account” or with the /stop command.
• Google (Translate) — only the texts of published listings, requests, questions, appraisals, comments and reviews, for automatic translation. No names or e-mail addresses. So don't put personal data in a listing.

We don't disclose data to anyone else unless the law requires it (for example, a court order).

How long

• Account and posts — until you delete the account or the post.
• Sign-in codes — one day. Server log — briefly, it overwrites itself. Messages from the “Write to us” form — one year, then deleted automatically.
• When you delete your account we erase your e-mail, name, phone, town, shop or trader details, sources, addresses, payment methods, all listings and all photos. Appraisals, comments, messages to others and dukat history remain, but without your name (“Deleted account”), because they are part of other people's conversations and history.

Your rights

• Access and portability: “Download data” in your account gives you all your data in one file (JSON).
• Correction: you edit all profile details yourself in your account.
• Erasure: “Delete account” in your account, immediately.
• Objection, restriction of processing and anything else — write to the address below; we reply free of charge within 30 days at the latest.
• Complaint: to Serbia's Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs).

Children

The site is for adults. If we learn an account was opened by someone under 18, we delete it.

Changes

If we change how we keep data, we'll update this page and the date at the top, and e-mail you about important changes.

Data controller

Konstantin Stein, fizičko lice
Rakovac, Srbija
kontakt@divno.rs

Laws

The Serbian text of the law prevails.

• Zakon o zaštiti podataka o ličnosti („Službeni glasnik RS“, br. 87/2018) — Law on Personal Data Protection