Privacy Policy

Platform vondi.rs

Version: 1.3
Effective date: 24 October 2026 (published 8 October 2026)

Note to version 1.3: the changes concern purchases of makers' handmade items on consignment storefronts (until that programme is available on vondi.rs, nothing changes there for other users), and also all users: the processor Cloudflare, Inc. is listed (sections 4.7 and 5.6) and the legal basis for transfers of data outside Serbia is clarified (sections 5.2, 5.4 and 8.5).

---

1. DATA CONTROLLER

The controller of personal data processed on the vondi.rs platform is:

VONDI GLOBAL D.O.O. (hereinafter "Vondi", "we", "the platform") acts as an intermediary (marketplace) providing a technology platform that connects sellers and buyers. Vondi is not the seller of products listed by sellers on the platform. The exception is handmade items of makers on consignment storefronts, which Vondi sells in its own name and for the account of the maker under a commission (consignment) agreement (Arts. 771-789 of the Law on Obligations); for makers' data see section 2.4, and for data of buyers of such items see section 5.5.

Please direct all data protection questions to: [email protected].

---

2. WHAT DATA WE COLLECT

2.1. Buyer data

Registration data:

• First and last name
• Email address
• Phone number
• Delivery address (street, number, city, postal code)

Order data:

• Purchase history (products, dates, amounts)
• Product reviews and ratings
• Order statuses

Payment data:

• Tokenised card data (last 4 digits, card type, expiry date)
• We do NOT store full payment card numbers on the platform — tokenisation is performed by the payment provider AllSecure (PCI DSS Level 1)

Technical data:

• IP address
• Browser type and version
• Device type and operating system
• Cookie data (see section 8)
• Date and time of page access

Data you provide voluntarily:

• Messages to sellers and makers through the messaging system on vondi.rs (section 5.5)
• Profile data you enter yourself

Location data:

• Collected only with the user's explicit consent
• Used solely to determine the delivery zone and calculate shipping costs

2.2. Seller (storefront owner) data

Legal entity data:

• Company or sole-trader (preduzetnik) name
• PIB
• MB
• Registered address
• Bank details for payouts

Activity data on the platform:

• Product catalogue (names, descriptions, prices, images)
• Sales statistics
• Commission settlements

Representative contact data:

• Contact person's first and last name
• Contact person's email and phone

2.3. Data shared with courier services

To carry out delivery, we share the following recipient data with courier services:

• First and last name
• Delivery address
• Phone number
• Order number

2.4. Data of makers (consignors) on consignment storefronts

A maker is a natural person without a registered company or sole-trader business whose items Vondi sells in its own name and for the maker's account under a commission agreement. We process the maker data required by the commission agreement (Article 14) and its Annex 4 (Maker's statement and data):

• First and last name
• Personal identification number (JMBG)
• Identity card number
• Address of residence and the address from which items are shipped
• Phone number and email address
• Current account for payouts (bank and account number)
• Compulsory social insurance status (whether the maker is employed or insured on the basis of another activity, receives a pension, or is not insured on any basis)

Vondi does not ask for a copy of the identity card. The JMBG and identity card number are used only for the purposes for which regulations require them (section 3).

What is public. On vondi.rs, on the product label (deklaracija) and in promotional materials we show only the maker's first and last name, town (place of making), the maker's story and photos of the items. The JMBG, identity card number, address, phone, email, bank account and insurance data are not published. The maker's name and address appear on the parcel as the place of dispatch and are seen by the courier and by the buyer of that item. At the request of an injured party or a competent authority, Vondi discloses the maker's identity as the producer of the item.

Signing the agreement. The commission agreement, its annexes and intake sheets are signed electronically via the Documenso platform at sign.vondi.rs (section 4.6).

---

3. PURPOSES AND LEGAL BASIS FOR PROCESSING

Processing is carried out in accordance with the Serbian Personal Data Protection Law ("Official Gazette of RS", No. 87/2018, hereinafter "ZZPL"), the national act implementing approaches related to Regulation (EU) 2016/679 (GDPR). For users located in the EU/EEA, the GDPR also applies (Art. 3(2) — extraterritorial scope).

---

4. DATA PROCESSORS (THIRD PARTIES)

To provide the platform service, we engage the following data processors (Art. 45 ZZPL):

4.1. Payment providers

AllSecure (Exchange Group GmbH) — card payment processing.

• Jurisdiction: Austria (EU/EEA)
• Certification: PCI DSS Level 1
• Data scope: card data, transaction amount, order ID
• Data Processing Agreement (DPA) in place

PaySpot (Banca Intesa) — IPS QR payment processing.

• Jurisdiction: Serbia
• Data scope: order ID, transaction amount
• DPA in place

4.2. Courier services

Product delivery is carried out through partner courier services (including Pošta Srbije / Post Express).

• Data scope: recipient name, delivery address, phone number
• DPAs in place

4.3. Partner warehouses (fulfilment)

Storage and dispatch from partner warehouses.

• Data scope: shipping label data (name, address, recipient phone)
• DPAs in place

4.4. Hosting provider

Server infrastructure hosting the platform.

• Data scope: all platform data (encrypted)
• DPA in place

4.5. Google Ireland Limited / Google LLC (analytics)

With your consent for analytical cookies we engage Google Analytics 4 (see section 8.5 and the Cookie Policy).

4.6. Documenso (electronic signing of agreements with makers)

Documenso: electronic signing of commission agreements, annexes and intake sheets with makers.

• Documenso is open-source software that Vondi itself runs on its own server infrastructure at sign.vondi.rs; no data is provided to the software vendor
• Data scope: maker data contained in the documents for signature (section 2.4) and the signing record (document content, time of signing, signer identity)
• This data is processed by Vondi as controller; Documenso is not a separate processor. The processor is the server infrastructure provider referred to in section 4.4

4.7. Cloudflare, Inc. (network protection, content delivery, backup of the agreement archive)

Cloudflare, Inc. (San Francisco, California, USA) provides Vondi with three services:

• network and site protection (CDN): requests to vondi.rs and most of its subdomains, including sign.vondi.rs, pass through the Cloudflare network (TLS, attack protection, content delivery). Data scope: technical request data (IP address, headers, page address) and the content transmitted through the request, including the documents for signature referred to in section 4.6;
• Cloudflare Access: access control to Vondi's internal services for employees. Data scope: e-mail and sign-in data of employees and associates;
• Cloudflare R2: backup of the archive of signed agreements and intake sheets with makers (section 2.4). Documents are written to R2 exclusively in encrypted form; only Vondi holds the decryption key, Cloudflare does not.
• Data processing agreement: Cloudflare Data Processing Addendum, which forms part of the agreement for the use of Cloudflare services (Self-Serve Subscription Agreement, clause 6.1)

All processors are bound to Vondi via Data Processing Agreements (DPA) in accordance with Art. 45 ZZPL, defining:

• Scope and purposes of processing
• Security obligations
• Prohibition of further transfer to third parties without our consent
• Obligation to delete data after contract termination

4.8. Other recipients of data

In addition to the processors in sections 4.1-4.7, data may be received by:

• Raiffeisen banka a.d. Beograd - the bank where Vondi holds its accounts, in the course of the company's financial operations;
• State authorities - where required by law (Tax Administration, courts, public prosecutor's office).

We do not sell your data to third parties for commercial purposes.

---

5. DATA TRANSFERS

5.1. Storage territory

Personal data is stored on servers located in the Republic of Serbia and/or EU Member States. The backup of the archive of agreements with makers (section 4.7) is kept in Cloudflare R2 storage with EU jurisdiction, in encrypted form.

5.2. Cross-border transfers

Transfers of personal data outside the Republic of Serbia are governed by Chapter V of the ZZPL (Art. 63-72):

• Without prior approval - to states and international organisations where an adequate level of protection is ensured (Art. 64 para. 1 ZZPL). Under Art. 64 para. 2 ZZPL, an adequate level of protection is deemed to be ensured in states and international organisations that are parties to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, and in states, parts of their territories or sectors for which the European Union has established that they ensure an adequate level of protection. The list of states where an adequate level of protection is deemed to be ensured is published in the "Official Gazette of the Republic of Serbia" (Art. 64 para. 7 ZZPL); the list in force: Decision on the list of countries, parts of their territories or one or more sectors of certain activities in those countries and international organisations where an adequate level of personal data protection is deemed to be ensured ("Official Gazette of RS", No. 55/2019). The list includes, among others, all European Union Member States.
• Subject to appropriate safeguards (Art. 65 ZZPL) - e.g. standard contractual clauses prepared by the Commissioner (Art. 65 para. 2 item 2), or contractual provisions based on the Commissioner's special approval (Art. 65 para. 3).
• Binding corporate rules (Art. 67 ZZPL) and the special situations under Art. 69 ZZPL.

In the sections below we state, for each recipient outside Serbia, where the data is located and what the transfer is based on.

5.3. AllSecure (payments)

Payment provider AllSecure (Exchange Group GmbH) is located in Austria — an EU/EEA Member State. Transfers are based on an adequate level of protection.

5.4. Google LLC (analytics)

If you consent to analytical cookies, data is transferred to Google Ireland Limited (Dublin, Ireland) and Google LLC (Mountain View, California, USA). Ireland is on the list of countries with an adequate level of protection (Decision "Official Gazette of RS", No. 55/2019, part I; Art. 64 ZZPL). Google Ireland further transfers the data to Google LLC in the USA on the basis of the European Commission's standard contractual clauses and the EU-US Data Privacy Framework. The European Union has established an adequate level of protection for US organisations certified under the EU-US Data Privacy Framework, and Art. 64 para. 2 ZZPL also refers to such decisions of the European Union; the Decision "Official Gazette of RS", No. 55/2019 lists the United States of America only "ograničeno na "Privacy Shield framework"" (limited to the "Privacy Shield framework") (part II, item 7), and the EU-US Data Privacy Framework is not listed in it. Additional safeguards: IP address anonymisation, prohibition on passing PII in event parameters, advertising features disabled. Details in section 8.5 and in the Cookie Policy.

5.5. Sharing with sellers

When you place an order, we share the following with the seller:

• Buyer name, delivery address and phone number — for order fulfilment
• Sellers are required to use this data solely for order fulfilment

Buying a maker's handmade item. When you buy an item from a maker's consignment storefront, the seller is Vondi and the item is shipped by the maker from the maker's address. For shipping, the maker receives the data on the shipping label (adresnica): your name, delivery address and phone number. The maker processes this data as Vondi's processor (Art. 45 ZZPL), solely to print the label and ship the item: the maker does not use it for anything else, including contacting you outside the messaging system on vondi.rs, does not share it with third parties other than the courier and the post, and after handing over the parcel deletes or destroys every remaining copy. The maker does not receive your other data from Vondi, and receives complaint notices without your name and contact details.

If you write to a maker through messages on vondi.rs, the maker sees you under a label assigned by the platform, without your name and contact details. If you have ordered an item from the maker, the maker also receives the shipping label data for shipping (paragraph above). The maker processes the content of the correspondence as Vondi's processor and may not use the data you write for anything other than replying in the correspondence. Please do not write your phone number, e-mail or address to the maker. You declare withdrawal and complaints to Vondi (Terms of Use, Uslovi korišćenja, sections 6.12 and 7). If you declare them in the correspondence with the maker, Vondi receives them as of the day you sent the message. The content of the correspondence is kept by Vondi. Vondi reviews it when you or the maker call Vondi in, when you declare withdrawal or a complaint in the correspondence, to resolve a dispute and to prevent abuse. Vondi also reviews the correspondence with the maker without being called in, in order to receive withdrawals and complaints: the system flags messages containing words about a return, complaint, damage or withdrawal.

5.6. Cloudflare, Inc.

The contracting party is Cloudflare, Inc. (USA); requests to the site pass through the Cloudflare global network. The backup of the archive of agreements with makers is kept in Cloudflare R2 with EU jurisdiction, exclusively in encrypted form, and only Vondi holds the key. Cloudflare, Inc. is certified under the EU-US Data Privacy Framework (participant list: https://www.dataprivacyframework.gov/list) and relies on it for transfers of data to the USA; if the certification lapses, transfers are made under the European Commission's standard contractual clauses contained in the Cloudflare Data Processing Addendum (clause 6.4). For EU Member States an adequate level of protection exists under Art. 64 ZZPL and the Decision "Official Gazette of RS", No. 55/2019 (part I). For US organisations certified under the EU-US Data Privacy Framework the European Union has established an adequate level of protection, and Art. 64 para. 2 ZZPL also refers to such decisions; the Decision "Official Gazette of RS", No. 55/2019 lists the USA only "ograničeno na "Privacy Shield framework"" (limited to the "Privacy Shield framework") (part II, item 7).

---

6. DATA RETENTION PERIODS

We do not keep data longer than the periods above: when they expire, we delete or anonymise the data.

---

7. DATA SUBJECT RIGHTS

Under ZZPL ("Official Gazette of RS", No. 87/2018) you have the following rights:

7.1. Right of access (Art. 26 ZZPL)

You have the right to obtain confirmation as to whether your personal data is being processed, a copy of that data, and information about purposes, categories, recipients and retention periods.

7.2. Right to rectification (Art. 29 ZZPL)

You have the right to request the correction of inaccurate or the completion of incomplete personal data.

7.3. Right to erasure — "right to be forgotten" (Art. 30 ZZPL)

You have the right to request the deletion of your personal data if:

• The data is no longer needed for the original purposes
• You withdraw consent and there is no other legal basis for processing
• You object to processing (Art. 37) and there are no overriding legitimate grounds
• The data was processed unlawfully

Exceptions: we cannot delete data whose retention is our legal obligation (tax documents, fiscal receipts — see section 6).

7.4. Right to restriction of processing (Art. 31 ZZPL)

You may request restriction of processing if you contest the accuracy of the data, processing is unlawful, or you have filed an objection (pending verification).

7.5. Right to data portability (Art. 36 ZZPL)

You have the right to receive your personal data in a structured, machine-readable format and to transmit it to another controller.

7.6. Right to object (Art. 37 ZZPL)

You have the right to object to processing of your data based on legitimate interest (Art. 12 para. 1 point 6), including profiling. Objections to direct marketing are upheld unconditionally.

7.7. Right to withdraw consent (Art. 15 ZZPL)

If processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

In accordance with Art. 15 para. 4 ZZPL, withdrawing consent must be as easy as giving it. Methods of withdrawal:

• For cookie consent — via the "Podešavanja kolačića / Cookie Settings" link in the site footer (a single click in the same dialog);
• For marketing communications — via the "Unsubscribe" link in every email;
• For other consents — via a request to [email protected].

7.8. Right to lodge a complaint with the Commissioner (Art. 82 ZZPL)

Without prejudice to any other legal remedy, you have the right to lodge a complaint with the supervisory authority:

Commissioner for Information of Public Importance and Personal Data Protection

• Website: https://www.poverenik.rs
• Address: Bulevar kralja Aleksandra 15, 11120 Beograd, Serbia
• Email: [email protected]
• Phone: +381 11 3408 900

How to file a request

To exercise any of these rights, send a request to [email protected] including:

• Your name and the email registered on the platform
• A description of your request (which right you wish to exercise)

Response time: 30 days from receipt of the request. In case of complexity or a large number of requests, the deadline may be extended by an additional 30 days (to 60 days total) with notification of the reasons.

Identification: to protect your data, we may request additional identity verification before fulfilling your request.

---

8. COOKIES AND RELATED TECHNOLOGIES

Detailed information is contained in a separate document — Cookie Policy. Key provisions are summarised below.

8.1. What are cookies and related technologies

• HTTP cookies — small text files stored by the browser on your device when you visit vondi.rs. They may be session (deleted when the browser closes) or persistent (stored for a specified duration).
• localStorage — persistent browser storage accessible only to the vondi.rs domain. Used to store cart, language settings, profile cache.
• sessionStorage — temporary storage, cleared when the tab is closed. Used for short-lived session data (e.g. access token).
• IndexedDB — structured browser storage for offline functionality.
• Service Worker caches — cached resources (images, scripts, styles) enabling PWA offline mode.
• Pixels / web beacons — small 1×1 px images used by third parties for tracking. Currently not used on vondi.rs.

8.2. Cookie categories and legal bases

Strictly necessary — no consent required

Exceptions under Art. 5(3) of Directive 2002/58/EC (ePrivacy) and ZZPL Art. 12 para. 1 point 2 (performance of contract) apply. Without these cookies, the platform cannot perform the contract concluded with you (login, cart, payment).

Examples: authentication tokens, shopping cart, CSRF protection, language settings, storing your cookie preferences.

Analytical — consent required

Legal basis: consent — ZZPL Art. 12 para. 1 point 1 + GDPR Art. 6(1)(a) for EU/EEA users. Used to analyse visitor behaviour and improve the service.

Examples: Google Analytics 4 (cookies _ga, _ga_*), internal server-side event analytics.

Marketing — consent required

Legal basis: consent — ZZPL Art. 12 para. 1 point 1. Currently not used on the platform. The category is reserved for future tools (Facebook Pixel, Google Ads, etc.); when activated, we will update this document and ask for your new consent.

8.3. Cookie consent banner and management

On your first visit we display a banner with three options:

• "Prihvati sve" / "Accept all" — accept all cookie categories (including analytical and marketing);
• "Odbij opcione" / "Reject optional" — keep only strictly necessary;
• "Podešavanja" / "Settings" — configure each category individually.

Your decision is stored in localStorage under the key vondi_cookie_consent (retention: 12 months). After 12 months we request consent again. We also re-request consent on material updates to the Cookie Policy.

You can change your preferences at any time via the "Podešavanja kolačića / Cookie Settings" link in the footer. You can also manage cookies through your browser settings; disabling strictly necessary cookies may impair platform functionality.

8.4. Withdrawal of consent

You can withdraw consent for analytical and marketing cookies at any time via the "Cookie Settings" link in the footer. Pursuant to Art. 15 para. 4 ZZPL, withdrawing consent must be as easy as giving it — on vondi.rs this is implemented as a single click in the same dialog.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

8.5. Data transfers to the US (Google LLC)

When analytical cookies are activated, data is transferred to the following processors:

• Google Ireland Limited (Dublin, Ireland) — primary contracting entity,
• Google LLC (Mountain View, California, USA) — ultimate recipient.

Legal basis for cross-border transfers:

• Standard Contractual Clauses (SCC) of the European Commission (Decision 2021/914 of 4 June 2021) — between Google Ireland and Google LLC;
• EU-US Data Privacy Framework (DPF) — Google LLC is certified under the DPF (status: https://www.dataprivacyframework.gov/).

Both instruments are instruments of European Union law. Our transfer from Serbia goes to Google Ireland Limited (Ireland is on the list in the Decision "Official Gazette of RS", No. 55/2019, part I; Art. 64 ZZPL). For US organisations certified under the EU-US Data Privacy Framework the European Union has established an adequate level of protection, and Art. 64 para. 2 ZZPL also refers to such decisions of the European Union; the Decision "Official Gazette of RS", No. 55/2019 lists the USA only "ograničeno na "Privacy Shield framework"" (limited to the "Privacy Shield framework") (part II, item 7), and the EU-US Data Privacy Framework is not listed in it.

Risk acknowledgement: we acknowledge that US legislation (in particular FISA 702, EO 12333) may grant US government authorities access to data transferred to Google. Supplementary measures we apply:

• IP anonymisation enabled in GA4 — the last octet of IPv4 / the last 80 bits of IPv6 are zeroed before sending to Google;
• prohibition on passing personal identifiers (email, phone, name) in GA4 event parameters;
• GA4 data retention set to 14 months (the maximum permitted);
• Advertising Reporting Features disabled in GA4 — data is not used for retargeting.

Further details — in the Cookie Policy (section "Transfer outside Serbia").

8.6. Right to lodge a complaint

If you believe your rights regarding cookies have been infringed, you have the right to lodge a complaint with the supervisory authority — the Commissioner for Information of Public Importance and Personal Data Protection (contact details in section 7.8).

---

9. DATA SECURITY

Vondi applies technical and organisational measures to protect personal data in accordance with Art. 50 ZZPL:

9.1. Technical measures

• Encryption in transit: HTTPS (TLS 1.3) for all connections to the platform
• Encryption at rest: data on servers is stored encrypted
• Encryption of makers' sensitive data: the maker's JMBG, phone number and bank account number, as well as the archive of signed agreements, are stored encrypted with the AES-256-GCM algorithm
• Passwords: stored only as a bcrypt hash; we do not store passwords in readable form
• Payment tokenisation: full card numbers are not stored on the platform; processing is via AllSecure (PCI DSS Level 1)
• Backups: regular automatic backups with encryption
• Monitoring: intrusion detection and anomaly monitoring systems

9.2. Organisational measures

• Access control (RBAC): access to personal data is granted only to employees who need it for their job duties
• Staff training: regular data protection training
• Security audits: regular reviews of infrastructure and processes
• Access logging: all access to personal data is logged

---

10. DATA BREACHES

In the event of a personal data breach (leak, unauthorised access, loss), Vondi undertakes to:

10.1. Notify the supervisory authority (Art. 52 ZZPL)

Within 72 hours of becoming aware of the incident, we notify the Commissioner for Information of Public Importance and Personal Data Protection, unless the breach is unlikely to result in a risk to the rights and freedoms of data subjects.

10.2. Notify data subjects (Art. 53 ZZPL)

If the incident is likely to result in a high risk to the rights and freedoms of natural persons, we notify the affected individuals without undue delay, specifying:

• The nature of the breach
• Contact details for further information
• Likely consequences
• Measures taken and proposed to mitigate the impact

---

11. PROTECTION OF MINORS

The vondi.rs platform is not intended for persons under 15 years of age.

Vondi does not knowingly collect or process personal data of children under 15 years of age. If we learn that we have received data of a child without the consent of a legal representative, we will promptly delete such data.

If you are aware of a minor using the platform, please notify us at [email protected].

---

12. CHANGES TO THIS PRIVACY POLICY

Vondi reserves the right to amend this Privacy Policy.

Notification procedure:

• Material changes: notification by email to the address provided at registration and a notice on the platform at least 15 days before the changes take effect
• Minor changes (editorial, stylistic): publication of the updated version on the platform
• Continued use of the platform after the changes take effect constitutes acceptance of the updated Policy

Version history:

---

13. CONTACT INFORMATION

For all data protection questions, please contact:

---

APPLICABLE LAW

This Privacy Policy is drafted in accordance with:

• Serbian Personal Data Protection Law ("Official Gazette of RS", No. 87/2018) — ZZPL
• Serbian E-Commerce Law ("Official Gazette of RS", No. 41/2009, 95/2013, 52/2019)
• Serbian Consumer Protection Law ("Official Gazette of RS", No. 88/2021)
• Serbian Accounting Act ("Official Gazette of RS", No. 73/2019, 44/2021)
• Regulation (EU) 2016/679 (GDPR) — applies to EU/EEA users (Art. 3(2)) and serves as a benchmark for best practice

---

NOTE: This document is of a general informational nature. For specific legal questions, we recommend consulting a licensed attorney in the Republic of Serbia.

---

VONDI GLOBAL D.O.O. BEOGRAD
12 May 2026

---

This document was drafted in Serbian (Latin script) and that version is authoritative. The English and Russian versions are provided for information only.