Privacy Policy

1. Who processes the data

The data controller is Bus Logic DOO, Svetosavska 24, 12000 Požarevac, Republic of Serbia. Company ID (PIB) 108324229, registration number 20976870.

Contact for all questions regarding personal data and for exercising user rights: info@podrzavam.rs.

Bus Logic DOO determines how the system operates, enables the collection and storage of data and processes it in order to connect and organize users who wish to take part in the community.

2. How data enters the system

A user may register and enter their own data themselves.

If a user wants help with registration, an activist may enter the data on their behalf, but only at the user's request and based on the data the user has provided. An activist has no right to record another person on their own initiative.

When an activist enters the data, the user must be informed of this Policy and give explicit consent to the processing of their data. The giving of consent must be recorded in the system.

3. What data we process

Mandatory data

For registration we process:

• first and last name;
• phone number.

The phone number is used to register, identify and contact the user.

Data the user provides voluntarily

Depending on the features they wish to use, a user may enter or allow the entry of:

• date of birth;
• street and number;
• town;
• country;
• data on belonging to a particular activist or community level;
• comments on news, posts and notifications;
• confirmations of attendance at meetings, support rallies and other events;
• data on participation in activities and campaigns;
• information about turning out to vote, when this feature is enabled;
• questions, problem reports and suggestions the user sends through the app, and the responses to them;
• photographs the user chooses to provide;
• other data the user voluntarily enters through the relevant feature of the app.

The app does not record whom a user voted for. According to how the system operates, the IP address and device data are not kept as user profile data.

Data of activists and organizers

For activists and other authorized persons who use a dedicated portal to access the system, data needed to create an account, sign in and securely access the portal may also be processed, including:

• email address;
• login and authentication data, including a protected record of the password;
• data required for two-factor authentication, when it is used;
• the email address linked to a Google account, if the user chooses to sign in with a Google account.

This data is used solely to enable and protect access to the portal and the corresponding features of the system.

4. The special nature of this data and the legal basis

The fact that someone registers as a supporter of the community, takes part in its activities or expresses support for a particular political idea may reveal that person's political opinion or affiliation. For this reason, the processing of this data is carried out on the basis of the user's explicit consent.

Consent is voluntary. A user may withdraw it at any time, without giving reasons. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

The system records the version of the text the user consented to and the record of consent, so that it can be established to what and when the user consented.

5. Why we process data

We process data in order to:

• register and maintain accounts;
• record users who wish to be part of the community;
• connect users with activists and the corresponding levels of organization;
• communicate and send information;
• organize meetings, rallies, campaigns and other activities;
• record users' voluntary participation in activities;
• process questions, suggestions and problem reports;
• enable and protect access to the portal for activists and other authorized persons;
• enable other features the user chooses.

Data is not used for purposes unrelated to the app's functions and the purpose for which the user provided it without prior notice and an appropriate legal basis.

6. Location

During certain activities — such as meetings, campaign activities, support rallies or voting day — a user may be offered the option to turn on location tracking.

Tracking:

• is turned on by the user;
• is never activated automatically;
• can be turned off at any time;
• automatically stops after 12 hours at the latest if the user does not turn it off sooner.

Location is used to track and record users' field activity during a specific activity. A separate consent, distinct from the consent for other data processing, is requested for location. Refusing or withdrawing consent for location does not affect other account features.

Location data is kept only for the period needed for the purpose of the specific activity or campaign, after which it is deleted or anonymized. The retention period is determined by the duration and purpose of the specific activity.

7. Who can see the data

The system is organized in levels.

• A user/member sees their own data.
• An activist sees their own data and the data of users connected to them.
• A headquarters leader sees data in the part of the organization for which they are responsible, including connected activists and their members.
• A coordinator has access to data in the part of the organization for which they are responsible, including connected headquarters leaders, activists and members.
• A guarantor has access to data in the part of the hierarchy connected to them.
• System administrators have access to all data, within the powers needed to administer and maintain the system.

Anyone with access to data may use it only within their authorization and for the purpose for which access was granted. Data is not given to other individuals or organizations for their own purposes without an appropriate legal basis. Where such disclosure requires the user's consent, the data is disclosed only after their consent.

8. Technical service providers

The following providers' services are also used to run the app, including:

• Infobip — for sending messages and sign-in codes via Viber or SMS;
• DigitalOcean — for server infrastructure, the database and content storage;
• Expo, Google and Apple — for delivering notifications to users.

These providers may process only the data needed to provide the specific service, in accordance with the relevant contractual and legal obligations. Where data is processed outside the Republic of Serbia, the appropriate rules on transferring data to other countries apply. Data may be provided to a competent state authority where there is a legal obligation to do so.

9. Links and connected services

The app may contain links or enable access to third-party services, including state services, benefit programs and other connected platforms. When a user leaves the app via a link, the privacy rules of that service apply to the processing it carries out.

If data from the PodržAVam app is forwarded directly to another service, the user must, before it is forwarded, be informed what data is being sent, to whom and why, and where necessary their consent is obtained.

10. How long we keep data

We keep user account data for as long as the user wishes to be part of the community, i.e. until they withdraw consent or request deletion. Some data may be deleted earlier if it is no longer needed for the purpose for which it was collected.

Location data is kept only for the period needed for the purpose of the specific activity or campaign, after which it is deleted or anonymized. Photographs and other content the user voluntarily provided are kept as long as they are needed for the purpose for which they were provided, or until the user requests their deletion.

11. What happens when a user deletes their account

When a user requests deletion of their account:

• the account is deactivated;
• their personal data is deleted from the active system;
• photographs and other content that enable identification of the user are deleted;
• discussion content that needs to be kept for continuity may remain only with a label such as “Deleted user”, without any data that enables identification of that person;
• data in backups is removed through the regular backup deletion cycle and is not restored to the active system.

Audit or security logs may contain only the minimum data necessary for system security, detecting abuse or meeting a legal obligation, and should not contain a complete copy of the deleted user profile. If a user has exercised the right to erasure, their complete data is not kept merely so that, if they ever register again, their previous history could be restored.

12. User rights

A user has the right to:

• be informed about the processing of their data;
• request access to their data;
• request correction of inaccurate data;
• withdraw consent;
• request deletion of data;
• request restriction of processing where the conditions are met;
• exercise the right to data portability where the legal conditions are met;
• lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection.

A request can be sent to info@podrzavam.rs. Requests are answered within the statutory deadline.

13. Automated decision-making

The app does not make decisions that produce legal or other significant effects on a user solely through automated processing, without appropriate human review.

14. Data protection

Bus Logic DOO applies appropriate technical and organizational measures to protect data from unauthorized access, alteration, loss, misuse or unauthorized disclosure. Access to data is restricted according to role and level of authorization in the system.

15. Adulthood

The app is intended for adults. If Bus Logic DOO learns that a minor's data has been entered into the system, that data will be removed.

16. Users outside Serbia

The app may be available to users in Serbia, the European Union and other countries. If, because of the user's location or the way the service was offered to them, the regulations of the European Union or another country apply to certain processing, Bus Logic DOO will carry out such processing in accordance with the applicable data protection regulations.

17. Changes to this Policy

If this Policy changes, users will be notified in an appropriate manner. If the change involves a new purpose or scope of processing for which consent is required, new consent will be requested from the user before such processing.

Text version: 2.0 · Last updated: August 2026.