Privacy Policy

This Privacy Policy ("Policy") applies to the processing of personal data of users of the platform LakoTermin ("Service") provided by Khristina Iarchenko Preduzetnik HAY Photo, registered at Prvomajska 103, 24000, Subotica, Republic of Serbia.

1. Data Controller

The data controller is Khristina Iarchenko Preduzetnik HAY Photo. You may contact us at [email protected] or by postal mail at the address above.

2. What data we collect

We may collect the following categories of personal data: full name, email address, telephone number, selected service, booking time, and other data you voluntarily provide when using the Service.

3. Purposes and legal basis for processing

We process your data for: (a) providing the booking service and associated features; (b) communicating with you (confirmations, reminders etc.); (c) fulfilling legal obligations. The legal grounds for processing are: your consent, performance of contract, legal obligation or legitimate interest of the controller. Where the legal basis is consent, you may withdraw it at any time without affecting the lawfulness of processing carried out prior to withdrawal.

4. Transfer of data outside the Republic of Serbia

When transferring your data outside the Republic of Serbia, we will ensure adequate protection in accordance with the Law on Personal Data Protection (Official Gazette of the Republic of Serbia, No. 87/2018).

5. Data retention

We will retain personal data only as long as necessary for the purposes stated and in accordance with our internal retention policy and applicable legislation.

6. Your rights

You have the right to access your data, request correction, deletion, restriction of processing or data portability. Where the legal basis is consent, you may withdraw it at any time. Where processing is based on legitimate interest, you have the right to object. To exercise your rights, contact us at [email protected]. If you believe your data is being processed in violation of the Law on Personal Data Protection, you have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (www.poverenik.rs, [email protected]).

7. Data security

We have implemented appropriate technical and organizational measures to protect your personal data against unauthorized or unlawful processing, accidental loss, destruction or damage.

8. Cookies

The Service may use cookies for core functionality or for analytics/marketing purposes. Where applicable, you will be informed and consent will be obtained.

9. How we use Google User Data

When you connect your Google account, LakoTermin requests access to your Google Calendar solely to synchronize your bookings and appointments. We access and use Google user data only to create, update, and display calendar events related to your bookings, in order to prevent double-bookings and keep your schedule organized in one place. We do not use Google user data for advertising, we do not sell it, and we do not share it with third parties except as strictly necessary to provide this synchronization feature. LakoTermin's use and transfer of information received from Google APIs adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke our access to your Google data at any time through your Google Account settings.

10. Amendments to the Policy

We encourage you to review this Policy periodically. In case of material changes, we will publish an updated version specifying the date of effect.

11. Contact

For questions regarding data protection, please contact us at [email protected].

12. Our own visit counter

In addition to Google tools, which load only after you accept cookies, we keep our own visit statistics. It sets no cookies and writes nothing to your browser: the page sends only its address, the display language and the window width. To tell visitors apart we compute an irreversible hash of your IP address and User-Agent header with a salt that changes every day: the IP address itself is never stored, and yesterday’s hashes do not match today’s, so these data cannot be used to follow a person across days. Hashes are deleted after 90 days, and the result is nothing but daily totals visible only to the platform administrator.