Privacy
Translated from Russian. Where the versions differ, the Russian one prevails.
Version 1 · effective 2 November 2026
1. Controller
Denis Batalin, Subotica, Serbia. Questions about data: info@sumarket.rs.
2. What data we process
| Whose | Data |
|---|---|
| Provider | Name, e-mail, password (only as a hash), languages spoken, district; listings, prices, photos; contacts (phone, WhatsApp, Telegram, Viber and Messenger appear on the card only with featured placement); documents for licence checks |
| Client | Name, e-mail, message text, preferred date of the service; reviews — the name, rating and text are published, the e-mail is not |
| All visitors | IP address, browser type, pages and time of the visit — in technical logs |
We do not collect data on health, religion or other special categories. If you write such details in a message yourself, they are processed only to deliver the message.
3. Why, and on what basis
| Purpose | Basis |
|---|---|
| Running the account, publishing listings, delivering messages | Performance of the agreement with you |
| Publishing reviews and ratings | Your consent when you send the review; a review can be deleted on request |
| A copy of a client’s first message to a provider for the project administration: to help if the provider does not answer, to handle a complaint | Legitimate interest — quality of the service and users’ safety |
| Featured placement: price, payment, receipt | Performance of the agreement with you; accounting and taxes — legal obligation |
| Licence checks for licensed services | Performance of the agreement and legitimate interest — users’ safety |
| Protection against spam, fraud and attacks | Legitimate interest |
| Answers to complaints and requests | Legitimate interest, legal obligation |
| Log of consents and accepted versions of documents | Legal obligation, legitimate interest — proof of consent |
| Newsletter | Your consent, which you can withdraw at any time |
| Anonymous statistics: what people search for, which services are missing | Legitimate interest — developing the service |
| Visit statistics in Yandex Metrica (section 7) | Your consent in the cookie banner; you can withdraw it at any time |
4. Who receives data
| Recipient | Why | Where |
|---|---|---|
| VDSina (VPS hosting provider) | Hosting the site and the database | Netherlands |
| DeepSeek | Translating listing texts and the provider’s name in a listing; translating a message — only when the “Translate” button is pressed | China |
| Yandex (Yandex Cloud Postbox, Yandex 360) | Sending e-mails: registration confirmation, message notifications with their text, moderation decisions; the project’s mailbox | Russia |
| Yandex (Yandex Metrica) | Only with your consent in the cookie banner: visit data (section 7) | Russia |
| Google (Gmail) | The administration’s mailbox: copies of clients’ first messages to providers — the client’s name and e-mail, the text, the listing | USA |
| The payee’s bank (Alfa-Bank) and the donation platform | Only when featured placement is paid for: the payer’s name and the amount | Russia; Serbia |
| VDSina | Backups of the database and photos — on the same server | Netherlands |
| Telegram | With featured placement — once a month the listing title, the provider’s name and a link in the list in Subotica’s channels. To moderators through the bot: listings awaiting review, reviews (the author’s name and e-mail), complaints, payment conversations with the bot and the receipt | outside the EU |
| Public authorities | Only when the law requires | Serbia |
Serbia recognises EU countries as ensuring an adequate level of data protection. DeepSeek (China), Yandex (Russia) and Google (USA) operate outside the EU. Only the public details of a listing, which the provider publishes themselves, go to the Telegram channels; the bot’s notifications are seen only by moderators.
We do not sell data or pass it on for advertising.
5. How long we keep data
| Data | Period |
|---|---|
| Account, listings and photos, the provider’s conversations, reviews and complaints about their listings | While the account exists; erased at once when the account is deleted |
| Archived listings | Until the provider deletes them or the account |
| Conversations | While the provider’s account exists; a guest’s conversation — 12 months after the last message |
| Licence document file | 30 days after the check; after that only a note remains: type, number, expiry, date of the check |
| Technical logs | 30 days; IP addresses are anonymised after 7 days |
| Consent log | While the account exists and for 3 years after it is deleted |
| Yandex Metrica statistics | Under Yandex’s rules; Metrica’s cookies — until you withdraw consent or delete them in the browser |
| Backups | 14 days; deleted data disappears from them within that time |
6. Your rights
You may:
- find out what data we keep about you and get a copy (in your account — “Download my data”);
- correct inaccurate data;
- delete your account and data (in your account — “Delete account”);
- restrict processing or object to it;
- receive your data in a machine-readable form;
- withdraw consent to the newsletter and to visit statistics (“Cookie settings” at the bottom of every page).
Requests go to info@sumarket.rs; we answer within 30 days. You may also complain to the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik, poverenik.rs).
7. Cookies and statistics
Without your consent the site sets only one strictly necessary cookie — the sign-in to a provider’s account
(sm_session). Your choice in the cookie banner is kept in your browser (localStorage) for 12 months; after that
the banner asks again.
Visits are counted by Yandex Metrica (OOO “Yandex”, Russia) — only if you pressed “Allow” in the banner. It sets
_ym_* cookies and sends Yandex the visit data: page addresses, where you came from, device and browser, IP
address. Webvisor and the click map are off: Metrica does not record what you type into forms. Yandex processes
this data under its own privacy policy (yandex.ru/legal/confidential). The basis is your consent. You can withdraw
it at any time: “Cookie settings” at the bottom of every page → “Necessary only”; the counter stops and its cookies
are removed.
There are no advertising cookies.
8. Security
The connection to the site is encrypted. The site and the database are on a server in the EU; e-mails go through Yandex (section 4). Only moderators and administrators have access: they sign in with a personal password and their actions are logged. Backups are made every night and kept for 14 days. If a breach threatens your rights, we will inform the Commissioner and you within the time the law sets.
9. Age
The Platform is for people over 18. We do not knowingly collect children’s data.
10. Changes to this policy
We announce significant changes on the site and by e-mail. Earlier versions are available on request.