1. Who processes data

For website visitor, customer and setup contact data, the controller is Maksim Malbaša (“Program”, “we”).

Privacy contact: [email protected].

2. Our data processing roles

When Program is the controller

We determine the purposes and means of processing data needed for visiting the website, purchases and billing, establishing a subscription, setting up a workspace, account management, security and support.

When the agency is the controller and Program is the processor

An agency using Program is generally the controller of data its users enter into the workspace: owners, principals, buyers and tenants, search requirements and contact history, properties, contracts, payments, EOP and AML records, photos, documents, internal messages and employee data. Program processes this data on the agency’s behalf to provide the service.

Requests relating to workspace data should first be directed to the agency that entered it. We will assist the agency in responding in accordance with the law and the data processing agreement.

3. What data we process

AML data in particular

The agency determines which identification and financial data must be collected and on what basis. Entries and documents may contain sensitive facts about individuals; data irrelevant to the specific check should not be entered. Special categories of data or data concerning criminal proceedings and convictions may only be processed with an appropriate legal basis and safeguards.

We do not store payment card numbers in Program. Paddle collects payment details directly through its checkout. Passkey biometrics remain on the device or with the passkey provider; Program receives a cryptographic public key and data needed to verify sign-in, not a fingerprint or facial image.

4. Purposes and legal bases

Listing matching and risk assessment

The CRM compares a contact’s specified criteria, such as location, area and budget, with active properties. AML features compare names with available lists and calculate or flag risk based on entered facts and approved rules. Results may create a review task or restrict the next case-processing step until the required decision is recorded.

A possible match does not confirm identity or prove unlawful conduct. An authorized agency representative verifies the facts, determines further action and records the decision. Program does not automatically submit reports to the authorities. The agency determines how results are used and the legal basis for that processing.

We do not use agency workspace data for our own advertising or sell it. If we introduced consent-based marketing, users could withdraw consent at any time without affecting the lawfulness of earlier processing.

5. Recipients, suppliers and international transfers

We restrict access to authorized persons and suppliers who need it for a specific service. In the current implementation, these may include:

• Paddle — merchant of record, billing, taxes, fraud prevention and subscription management; Paddle is a separate controller for its own processing. See the Paddle Privacy Notice.
• Cloudflare R2 — separate storage for backups encrypted before upload. The Eastern Europe (EEUR) location hint is selected; it does not guarantee storage in a particular country;
• Hetzner — hosting infrastructure provider in Finland, where Program’s application server and MongoDB database are located. Data on that server and in the database is stored and processed in Finland;
• DNS and TLS suppliers — domain and certificate services, to the extent engaged for production;
• The agency’s SMTP supplier — sending activation, sign-in and service messages through the account connected by the agency;
• Xiaomi MiMo API — text and photos only when a signed-in user initiates AI editing or sorting;
• OpenStreetMap Nominatim — address queries and standard technical connection data when a user uses address suggestions;
• AML check sources — public or imported lists, questionnaires and other sources used by the agency. Downloading a list from an external server differs from checking a name against a locally stored copy: a local check does not itself send the entire dossier to the source;
• Google Fonts in the workspace — the application may load fonts from Google servers. Fonts on the sales website, legal pages and setup page are served locally, without visitor requests to Google Fonts.

Hosting the application server and database with Hetzner in Finland involves storing and processing data outside Serbia. Other suppliers may process data in other countries, depending on their infrastructure locations. Before production processing, the Provider must document processing locations and apply an appropriate transfer mechanism and contractual safeguards required by data protection law. The agency should not use optional AI features for personal data until that relationship and the necessary safeguards are contractually confirmed.

Listings published by the agency on its website

The agency may enable publication of an individual property through the public API. Selected listing details and photos then become publicly available. The public API excludes internal owner details, contracts, CRM contacts, AML dossiers, internal notes and commissions. Before enabling publication, the agency checks whether descriptions or photos nevertheless contain personal data. Removing a listing from Program does not automatically delete copies independently downloaded by a visitor or another website.

We may disclose data to a competent authority where required by law or necessary to protect rights and security, after checking the basis and scope of the request.

6. Cookies and browser storage

Program uses a technically necessary, secure HTTP-only session cookie to sign in to the workspace. The cookie lasts no longer than eight hours, carries the Secure and SameSite=Lax attributes and is not used for advertising.

During onboarding, the access token is stored in the browser’s sessionStorage and removed when the tab is closed or the user signs out of setup. The test Paddle checkout may set its own technical cookies under Paddle’s policies.

The workspace stores the language selection (program-language) and light or dark theme (program-theme) in localStorage. These settings remain on the device until changed or site data is cleared. They are not used for tracking across other websites.

The sales page does not set its own analytics cookie. Paddle connects when you request test checkout; its Privacy Notice applies to processing within checkout.

The current implementation does not contain its own behavioural analytics or advertising cookies. If optional analytics or marketing cookies are introduced, they will only be activated after appropriate notice and user choice where consent is required.

7. How long we retain data

• sign-in session: up to 8 hours; one-time challenges, links and codes: until the expiry indicated in the message or interface, after which they are automatically removed or become unusable;
• Paddle webhook technical records: up to 90 days under the current configuration;
• subscription and setup data: throughout the contractual relationship and afterwards while needed for billing, support, security, statutory records or legal claims;
• CRM, contracts, payments, EOP history, documents and messages: according to purpose, agency instructions and applicable retention obligations; ending a subscription does not itself mean immediate deletion of records;
• AML dossiers, evidence and history: according to recorded periods and the agency’s applicable legal obligations. Expiry does not trigger unrestricted automatic deletion: an authorized person confirms the procedure, and an active hold may prevent deletion;
• backups, where created: according to the backup and recovery plan for the particular installation. Deletion from the working database does not mean immediate removal from an existing backup; separate retention periods and controlled access apply to backups.

Where a fixed period cannot be specified in advance, we use the following criteria: subscription duration, the purpose of collection, agency instructions, statutory business-document retention periods, limitation periods, security needs and the technical backup cycle. After the applicable period expires, we delete or irreversibly anonymize the data.

8. How we protect data

This section describes the scope of confirmed technical measures and security procedures. Where a measure requires further verification or special configuration, this is expressly stated. Keys, access addresses, administrator accounts and detailed infrastructure configuration are not part of this public notice.

8.1. Protection in transit, databases and disks

User connections to the service use HTTPS. Agencies have separate logical databases and application permissions. A separate database does not imply a separate physical server or disk for each agency.

From 9 September 2026, Program’s entire MongoDB storage, including CRM and AML fields, messages, attachments, indexes and metadata, resides on a LUKS2 encrypted volume using AES-XTS. Encrypted storage also covers instance working directories, agency server configuration, older operational copies, application logs and temporary files; swap uses encryption with a new random key on each server boot. The production application refuses to start without verifying encrypted storage. This does not constitute encryption of the entire operating-system disk, customer devices or every provider server snapshot.

8.2. What is encrypted in the application

This is not end-to-end encryption that prevents the Provider from accessing data. The application processes readable data when an approved feature requires it; an authorized infrastructure administrator with the appropriate privileges may technically be able to access data and keys.

8.3. Backup encryption and recovery

Managed Program instances have automatic daily backups of the database and files needed for recovery, with a local copy and a separate copy in Cloudflare R2. Data is encrypted before upload using restic, with AES-256 protection and authentication, using a key separate from the AML keys. The database copy includes all databases on the dedicated MongoDB instance, including additional agency databases, and uses a brief write lock for consistency. The existing dedicated AML archive tool continues to use AES-256-GCM.

The active plan retains seven daily local copies and 30 daily, 12 weekly and 12 monthly recovery points in separate storage. A full repository read and test database restore, comparing content, record counts and indexes, are scheduled weekly. Checks run in an isolated encrypted space. Pruning old copies requires a recent successful recovery test. The initial backup and test restoration were successfully verified on 9 September 2026. The schedule does not guarantee every run succeeds or promise a specific amount of data loss or recovery time; failures are recorded for operator intervention. Customer exports and provider snapshots remain separate types of copies.

8.4. Key storage and replacement

Keys are supplied to services through protected server configuration, separate from the business database, public website and user interface. The AML key is specific to each agency workspace; the dedicated backup archive key is stored separately from the archive itself. This separation does not mean keys have a separate physical server. The key for automatic volume unlocking and backup access remains in protected server configuration. A full-server snapshot may therefore contain the keys; data-volume encryption alone does not protect such a snapshot. The current installation does not use an independent key management service or a hardware security module.

Routine application rebuilds retain existing keys so data remains readable. Automatic periodic key rotation is not a confirmed feature. Replacing a key requires a controlled plan: an inventory of affected data and backups, a protected new key, re-encryption where necessary and verification of decryption and recovery. The old key remains protected while data legitimately retained depends on it. Suspected compromise prompts consideration of key replacement and re-encryption while preserving evidence and data availability.

8.5. Infrastructure administrator access

Owner, administrator, moderator and agent roles and individual permissions govern access within the application; AML features have separately assigned access. Infrastructure administration is a separate, privileged level of access. Its purpose is maintenance, support, recovery and incident response, to the extent necessary and subject to confidentiality obligations.

Application roles and encryption do not technically prevent all access by a privileged system administrator. The need for such access, granting and revoking permissions, and recording interventions are governed by the maintenance procedure. We do not claim that every infrastructure access is covered by application auditing or automatic two-person approval.

8.6. Passkeys and administrator multi-factor authentication

Program supports passkey authentication and time-limited sessions. The existence of a passkey feature does not itself confirm that every administrator sign-in method requires multi-factor authentication (MFA), an additional PIN or biometric verification.

Application sign-in, operating-system access and the hosting-provider administrator account are checked separately. Mandatory MFA at all these levels is not currently confirmed by this policy. Where an agreed level of protection requires mandatory MFA, its application must be confirmed for every relevant administrator and access-recovery procedure.

8.7. Security logs and monitoring

The system maintains operational records of access and server errors, as well as audit records of supported business and AML actions. Records may contain IP addresses, timestamps, technical request details, actor identity and action type. They are used to investigate problems, detect abuse and verify events, in accordance with the purposes and retention periods in sections 4 and 7.

Log access is restricted according to the task; only necessary content is extracted when sharing with Support or other recipients, and credentials are removed. Operational monitoring and the existence of logs do not mean that continuous security-team monitoring, centralized analysis of all events or immutable storage of all records are in place. These measures are not confirmed by this policy. AML alerts relate to business checks and client risk assessment; they do not confirm monitoring of attacks on infrastructure.

8.8. Vulnerability and update management

The security-report handling procedure includes checking the affected component, whether the issue applies and its possible consequences. Actively exploited issues and risks of unauthorized access or data disclosure take priority. A fix or temporary safeguard is introduced with an impact check, testing and a recovery option, and the decision and result are recorded in the maintenance log.

Automatic operating-system security updates are enabled on the server that was checked. The application, its libraries and container images require separate review and controlled updating. This does not confirm the absence of vulnerabilities, that every package is currently up to date, or that continuous scanning, regular independent penetration tests or a fixed deadline for every fix have been agreed.

You can report a security issue to [email protected]. Provide a brief description, time and impact without sending passwords, keys, access tokens or unnecessary personal data. For sensitive evidence, first agree on a method of delivery.

8.9. Handling incidents and data breaches

The procedure includes recording the report and time of awareness, assessing scope and risk, containing consequences, protecting evidence, addressing the cause and verifying recovery. Depending on the incident, it may be necessary to revoke sessions or permissions, isolate the affected service, replace credentials and carry out controlled key replacement. Findings, measures and follow-up checks are documented with restricted access.

When Program acts as a processor for an agency, we notify the agency of a breach of its data without undue delay after becoming aware of it and provide available information to assist with its obligations. When Program is the controller, we notify the Commissioner of a breach likely to pose a risk to individuals’ rights and freedoms without undue delay, where possible within 72 hours of awareness; reasons are provided for any delay. Where there is a high risk, we also notify affected individuals without undue delay, unless a statutory exception applies. Information is supplemented as the investigation progresses. These obligations are governed by Articles 52 and 53 of the Law on Personal Data Protection.

No measure eliminates every risk. Users should protect their devices and administrator access and report suspected incidents without delay using the contact in section 10.

9. Data subjects’ rights

Depending on the legal basis and circumstances, you may request:

• information about and access to your data, and a copy;
• correction of inaccurate or completion of incomplete data;
• erasure or restriction of processing;
• data portability where legal conditions are met;
• objection to processing based on legitimate interests;
• withdrawal of consent for future processing where processing is based on consent;
• information about safeguards for international transfers;
• protection in relation to decisions based solely on automated processing where legal conditions are met.

Send your request to the contact in section 10. We may request reasonable verification of identity and authority. If the request concerns data entered by an agency, we will forward it to that agency or act on its instructions.

For requests where we are the controller, we provide information about action taken without undue delay and within 30 days at the latest. Where an extension is necessary due to the complexity or number of requests, the period may be extended by a further 60 days, with notice of the reasons within the first 30 days. Erasure is not unconditional, for example where retention is required or data is needed to protect a legal claim. The Commissioner’s guidance for citizens explains rights and requests in more detail.

You have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11120 Belgrade, Commissioner’s contact details, or another competent supervisory authority.

10. Contact, children and changes

Program is a business service and is not intended for children. We do not knowingly collect children’s data as platform users. The agency is responsible for not entering such data without an appropriate legal basis and necessity.

We may change this policy when features, suppliers or legal obligations change. We will publish a new version and date, and notify active users of material changes through an appropriate channel.