Privacy Policy

1. Controller and legal framework

The controller of your personal data is a sole trader registered in the Republic of Serbia. Contact for any processing question: info@malvine.online.

Processing is governed by the Serbian Personal Data Protection Act. The supervisory authority is the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11120 Belgrade, Serbia.

Official sources

2. Data we process

• Account data: identifiers from sign-in providers you choose (e.g. email, subject id), profile fields you provide.
• Usage data: first-party in-app actions — for example searches, page views, and feature use. To count these actions we store a random identifier in your browser and reuse it across visits; it is not linked to any advertising network, and we do not use third-party advertising analytics. On account deletion, usage events are anonymized so aggregate product learning is preserved without identifying you.
• Payment data: we do not store full card numbers. Payments are processed by Dodo Payments (and other region-specific providers where applicable).
• Support: messages you send to info@malvine.online.

3. Purposes and legal bases

• Providing access, billing and entitlements — performance of our contract with you: Article 12(1)(2) of the Act.
• Service security and improving the software from first-party usage events — legitimate interest: Article 12(1)(6). You may object to this processing at any time, see the section on your rights.
• Complying with our legal obligations, for example tax and accounting duties — Article 12(1)(3).
• Consent, where consent is required; you can withdraw it at any time and withdrawal does not affect processing carried out before it: Article 12(1)(1) and Article 15.

The identifier from the sign-in provider you choose is necessary to create an account and perform the contract: without it access cannot be granted (Article 23(2)(5) of the Act). Other profile fields and the career questionnaire are optional, and declining them affects nothing but the corresponding features.

Official sources

4. Who receives data, and in which role

An infrastructure provider in Germany (IP-Projects) hosts the application and its databases and acts as a processor: on our instructions and under a processing agreement, as Article 45 of the Act requires.

Dodo Payments provides checkout and payment processing and, in that relationship, is an independent controller rather than our processor: the contract of sale is concluded with them, their buyer terms and their privacy policy apply, and they process payment data for their own purposes. We pass them your email address, the amount, and your country, and receive back an order reference and payment status. Rights over that payment data are exercised against them; we will help you make contact.

The sign-in providers you choose yourself confirm your identity at login and act under their own terms. We do not sell personal data and do not share it for anyone else's advertising.

Official sources

5. Transfers to other countries

The application and its databases are hosted in Germany, that is, outside Serbia. Germany is a party to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, so under Article 64(2) of the Act an adequate level of protection is presumed and no separate authorization from the Commissioner is needed.

Payment data at checkout is processed by Dodo Payments as an independent controller under its own terms — including any transfer outside that circle that it makes; the grounds and safeguards are described in its privacy policy (linked below).

If we ourselves need to transfer data outside the circle of adequate protection, it will only be possible with the safeguards the Act prescribes — for example the Commissioner's standard contractual clauses under Article 65.

Official sources

6. Retention

We keep data only as long as needed for the purposes above or as required by law — the storage limitation principle, Article 5 of the Act. Usage events are deleted automatically 18 months after they are recorded. Account data is kept while your account exists.

Official sources

7. Your rights

• Access to your data and information about the processing — Article 26.
• Rectification and completion of inaccurate data — Article 29.
• Erasure, the "right to be forgotten" — Article 30.
• Restriction of processing — Article 31.
• Portability in a machine-readable format — Article 36. In your profile this is the export button on the Data tab.
• Objection to processing based on legitimate interest — Article 37. In your profile, on the Data tab, this is the "Object to processing" switch: collection stops and events already recorded are anonymized.
• We take no decisions based solely on automated processing that produce legal effects for you, so Article 38 of the Act does not apply to our processing.

Account data export and deletion are available in your profile, on the Data tab under "Your data". Any right can also be exercised by writing to info@malvine.online — we answer within the deadlines the Act sets.

Official sources

8. Complaint and judicial protection

If you believe the processing breaches the law, you may lodge a complaint with the Commissioner — Article 82 of the Act. That does not remove your right to judicial protection: Article 83 covers challenging the Commissioner's decision, Article 84 a court claim against the controller to protect your rights, and Article 86 compensation for material and non-material damage.

We ask you to write to us first: data questions are resolved faster by email, and your right to complain does not depend on it.

Official sources

9. Data protection contact

info@malvine.online. The controller's postal address and registration details are in the block above and in the footer of every page.