Privacy Policy

1. Who is the data controller

The data controller for personal data processed through Siterka is the Siterka team, reachable at privatnost@siterka.com. The controller decides why and how your personal data is processed, in line with the Serbian Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti, "ZZPL") and, where applicable, the EU General Data Protection Regulation ("GDPR").

If you have questions about this policy, would like to exercise your rights, or wish to lodge a complaint, please use the contact details in the final section. We aim to respond to all data-protection requests within thirty (30) days.

2. What personal data we collect

When you register an account we collect the email address and chosen display name you provide, plus a hashed password. When you build a profile you may add identifying information such as your first and last name, city, role, languages, photographs, and a free-text bio. Caregivers may publish a rate, availability, and other similar informations; parents may publish details about the care they are seeking, including their children's ages and needs. An advert may also show a contact phone number and email address.

When you use the platform we collect message contents (subject to administrator review before relay), bookmarks, ratings, blog posts, and any uploads. We log technical metadata such as IP address, user-agent string, timestamp, and the URLs you visit in order to operate the service, prevent abuse, and diagnose problems. We use a strictly necessary session cookie to keep you logged in and a preference cookie to remember your chosen language and theme. Our email provider (Resend) also tells us what happened to the emails we send (whether each was delivered, rejected or reported as spam), and we use that only to stop sending to addresses that don’t work.

We do not collect special categories of personal data (such as health, religion, political opinion, or biometric data) from you in the ordinary course of operation. If you choose to disclose such information voluntarily — for example in a free-text bio — please do so with care, as the data will be visible according to the visibility settings of the surface where you posted it.

3. Lawful basis for processing

We rely on the following lawful bases under ZZPL Art. 12 and GDPR Art. 6: (a) performance of a contract with you — to provide the account, listings, messaging, and subscription features you have requested; (b) our legitimate interests — to keep the platform safe, prevent fraud and re-registration after an account is removed for breaking the rules, moderate user content, and improve the product, balanced against your rights; and (c) your consent — for any optional features that go beyond core service operation.

Where processing is based on consent you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. Withdrawing consent for non-core features may mean we can no longer provide those features; core service operation does not depend on consent.

4. Service providers (processors)

We rely on a small set of carefully chosen service providers to operate the platform. These providers process personal data only on our instructions and under written agreements that meet the requirements of Art. 45 ZZPL / Art. 28 GDPR. The current list is: DigitalOcean (hosting and database in the European Union), Cloudflare (DNS and edge network), Resend (transactional email delivery — verification, password reset, and notifications), and — only when you opt in via the cookie consent banner — Google LLC operating Google Analytics 4 in the United States and Ireland (page-view counts and aggregate usage statistics with IP-anonymisation enabled).

We do not sell, rent, or trade your personal data to third parties for advertising. We do not embed third-party advertising trackers. Google Analytics processes data only after you opt in via the consent banner; if you decline or have not yet chosen, the GA4 script is not loaded at all. If we ever introduce a new processor that involves a meaningful change in how your data is handled we will update this list and, where required, give you advance notice.

5. How long we keep your data

We keep your account data for as long as your account is active. If you self-suspend, your data remains on file but is hidden from the public; if you delete your account, your profile and posts are removed and your account record is erased except where law or legitimate interest requires retention. We back up the database every night, solely to recover from a failure, and keep the last seven on the server; older ones are deleted automatically. If we remove an account for breaking the rules, we may keep an irreversible fingerprint (hash) of its email address for up to two (2) years, solely to prevent signing up again with the same address; the address itself is not kept. We keep those delivery reports for at most 90 days; the mark on an account saying its address doesn’t work stays until the address works again or the account is deleted.

Messages are retained for as long as both participants keep their accounts; if either party deletes their account, message contents become inaccessible to that party while a copy may be retained for the other party's records. Aggregated and anonymised analytics may be kept indefinitely as they no longer identify you.

6. Your rights

You have the following rights under ZZPL and GDPR: access to your data; rectification of inaccurate data; erasure (the "right to be forgotten"); restriction of processing; portability of data you have provided to us in a structured, machine-readable format; objection to processing based on legitimate interest; and the right not to be subject to a decision based solely on automated processing that produces legal effects.

Most of these rights can be exercised directly from your profile settings: edit data, self-suspend, or hard-delete your account. For requests that are not self-serve — such as a structured data export or a question about a specific processing activity — please email privatnost@siterka.com from the address registered on your account so we can verify your identity.

We will respond to verified requests within thirty (30) days. We may extend this period by a further sixty (60) days for complex requests, in which case we will notify you of the extension and the reasons within the original window. There is no fee for exercising your rights, except where requests are manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse the request.

7. Children

Siterka is intended for adults. We do not knowingly collect personal data from children under 18, and we do not allow children to register accounts. If you believe a child has registered, please contact prijava@siterka.com and we will delete the account and any associated personal data without undue delay.

8. International transfers

Our primary infrastructure is hosted in the European Union (DigitalOcean, region FRA1). Where personal data is transferred outside Serbia or the EU — for instance to email-delivery providers — we rely on appropriate safeguards under ZZPL Art. 64–65 and GDPR Chapter V, including Standard Contractual Clauses where required. You can request a copy of the safeguards in place for a specific transfer by emailing us.

9. Security

We protect your data using a layered set of technical and organisational measures: TLS 1.2+ for data in transit, hashed passwords, server-side authorization checks at every endpoint, principle-of-least-privilege access for the small team that operates the service, and audit logging for moderation actions. The server and database are in the European Union (DigitalOcean, Frankfurt). We keep our infrastructure patched and we monitor for unusual activity.

No system is perfectly secure. You can help by choosing a strong, unique password, keeping your devices up to date, and not sharing your account credentials with anyone. If you notice suspicious activity on your account, change your password immediately and contact us at prijava@siterka.com.

10. Personal data breaches

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within seventy-two (72) hours where required, and inform affected users without undue delay. The notification will describe the nature of the breach, the categories of data affected, the likely consequences, and the measures we are taking in response.

11. Complaints

If you believe we have not handled your personal data in line with applicable law, conntact us on privatnost@siterka.com.

If you have any concern related to personal data we would appreciate the chance to address your concern together — please email privatnost@siterka.com.

12. Changes to this policy

We may update this policy as the product changes or as the legal landscape evolves. The current version, with the date of last update, will always be at /privacy. For material changes that affect your rights we will give you reasonable advance notice by email or an in-product banner.

13. Contact

For all privacy-related questions or requests, please email privatnost@siterka.com. For urgent security concerns, prijava@siterka.com.