Skip to content

Privacy Policy

Effective date: 2026-12-01

This Privacy Policy explains how we process personal data when you use the Kirija website (the "Website"), in accordance with the Law on Personal Data Protection of the Republic of Serbia (Zakon o zaštiti podataka o ličnosti, "Službeni glasnik RS" no. 87/2018, "ZZPL").

1. Controller

The controller of your personal data is [Company name], [Company address], registration and tax numbers: MB [—], PIB [—] ("we", "us").

For all questions about personal data and to exercise your rights, contact us at news@daniil.it or by telephone at .

2. What data we process

2.1 Account data

Email address, password (stored only in an irreversibly hashed form, so we cannot read it), name and phone number if you provide them, preferred language, account role and status, sign-up date and login records.

2.2 Listing data

The exact address and location of the property, property details, price and rental terms, descriptions, photos, floor plans and video links, the poster's contact details, information about the poster's relationship to the property (owner or authorised person) and a record of acceptance of the poster authorisation. If a representative posts a listing, we may receive data about the owner from them.

2.3 Inquiry data

When you send an inquiry about a property or a general request to find a property: name, phone number, email address, preferred contact method, desired move-in date, number of occupants, information about pets, your message and the listing concerned. Our team adds the inquiry status and internal notes.

2.4 Communication with us

The content of emails and other messages you send us, and notes on phone conversations with our team.

2.5 Modification log and security data

Who changed a listing, when and what was changed, moderation decisions and their reasons, IP addresses, browser details (user agent), logins and failed login attempts, and changes to account roles and status.

2.6 Brokerage data

If you conclude a brokerage agreement with us: the data needed to conclude and perform the agreement, including identity data and documents we are required to collect by law (for example, proof of ownership or authorisation and identity document data), and data on payment of the commission.

2.7 Technical and usage data

We measure visits using self-hosted Umami analytics, which does not use cookies and does not store your full IP address. It records only aggregated data, such as the pages visited, the referring website, the type of browser and device, and the country. Cloudflare processes technical data (such as the IP address and browser data) to deliver and protect the Website and to perform the anti-bot check.

2.8 Favourites

If you are logged in, we store the listings you have saved as favourites.

Please do not include personal data of other people or sensitive data (for example, health data) in listing descriptions, photos or inquiry messages.

3. Purposes and legal bases

  • Creating and managing your account and sending service emails (account activation, password reset, moderation decisions, expiry reminders): performance of the contract, i.e. the Terms of Use.
  • Publishing and moderating listings: performance of the contract, and our legitimate interest in ensuring the quality of listings and preventing fraud.
  • Handling inquiries and acting as an intermediary (contacting prospective tenants and owners, arranging viewings): taking steps at your request before entering into a contract, and performance of the contract (for posters, on the basis of the poster authorisation).
  • Concluding and performing brokerage agreements and keeping the records required by law: performance of the contract and compliance with our legal obligations (in particular under the laws on real estate brokerage, the prevention of money laundering, and tax and accounting).
  • Keeping the modification log and showing the public change history: our legitimate interest in transparency, data integrity, resolving disputes and preventing abuse. The public history does not contain personal data.
  • Security and abuse prevention (anti-bot checks, rate limiting, recording IP addresses): our legitimate interest in protecting the Website and its users.
  • Machine translation of listing descriptions: performance of the contract (advertising the property) and our legitimate interest in making listings understandable to tenants who speak other languages. Descriptions should not contain personal data, and contact details are removed during moderation.
  • Visit statistics (cookieless analytics): our legitimate interest in improving the Website.
  • Remembering your language choice: our legitimate interest in providing the Website in the language you have chosen.
  • Establishing, exercising and defending legal claims, and responding to requests from public authorities: our legitimate interest and compliance with our legal obligations.

Where processing is based on our legitimate interest, you have the right to object. Where processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal. We do not send promotional messages without your prior consent.

Providing data is necessary to use certain functions (an account, posting a listing, an inquiry). Without the data, we cannot provide that function.

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. Automated checks only flag submissions for review by a moderator.

4. Who can see your data

4.1 The public

The public sees the listing details without the exact address and without the poster's contact details: only the neighbourhood and an approximate area on the map (about 300 m), photos without metadata and with a watermark, and the approved change history of the listing (dates and price changes), without personal data.

4.2 Posters

The poster sees the full history of their own listings. The poster does not receive inquiries or the contact details of inquirers through the Website.

4.3 Our team

Our administrators and moderators have access to all data, including IP addresses, to the extent necessary for their work, and are bound by confidentiality.

4.4 Owners and tenants in the brokerage process

To arrange a viewing and a lease, we share the necessary data between the parties (for example, the name and phone number of a prospective tenant with the owner, or the exact address of the property with the prospective tenant), only to the extent necessary and with your knowledge.

4.5 Processors

We use the following service providers, who process data on our behalf and in accordance with our instructions, under data processing agreements:

  • Hosting provider: servers (virtual private server) and backup copies located in the European Union.
  • Cloudflare, Inc.: content delivery network and proxy, protection against attacks, and the anti-bot check (Cloudflare Turnstile) on sign-up, posting, editing, inquiries and password reset. Cloudflare processes the IP addresses and technical data of all visitors.
  • Zoho (Zoho Mail, EU data centre): sending email and our team's mailboxes.
  • Anthropic PBC or another machine translation provider we use: machine translation of listing descriptions. The provider receives only the text of the listing, not account data or contact details.

Umami analytics runs on our own server, so analytics data is not shared with third parties.

4.6 Public authorities and advisers

We disclose data to courts, the police, the tax administration and other public authorities when required by law, and to our legal and financial advisers, who are bound by confidentiality.

We do not sell personal data.

5. International transfers

Our servers are located in the European Union, and Zoho processes our email in its EU data centre. Under the ZZPL, member states of the European Union are considered to provide an adequate level of personal data protection.

Cloudflare and Anthropic may process data outside Serbia and the European Union, including in the United States. For such transfers we rely on standard contractual clauses and other appropriate safeguards provided for by the ZZPL. You can request information about these safeguards by email.

6. How long we keep data

  • Account data: while the account exists. After you delete your account, personal data is deleted or anonymised within 30 days.
  • Listings: while the account exists (including expired listings, so that you can renew them). After the account is deleted, they are removed from public view and personal data is deleted or anonymised within 30 days.
  • Modification log: entries are kept permanently, as the log cannot be changed. After an account is deleted, the user in the log is pseudonymised (for example, "deleted user #123").
  • Inquiries: deleted 24 months after they are received.
  • IP addresses in logs: deleted after 12 months.
  • Brokerage agreements and accounting records: for the periods prescribed by law.
  • Correspondence: as long as necessary to deal with your request, unless we need to keep it longer to establish or defend legal claims.
  • Backup copies: these are encrypted and overwritten in regular cycles. Deleted data may remain in backups until they are overwritten, but it is not used for any other purpose.

7. Your rights

Under the ZZPL, you have the right to:

  • access: obtain confirmation of whether we process your data and a copy of it;
  • rectification: have inaccurate data corrected and incomplete data completed;
  • erasure: have your data deleted, unless we are required to keep it or need it to establish or defend legal claims (log entries are pseudonymised rather than deleted);
  • restriction of processing: in the cases provided for by law;
  • data portability: receive the data you provided to us in a structured, machine-readable format;
  • objection: object to processing based on our legitimate interest;
  • withdrawal of consent: where processing is based on consent;
  • complaint: lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti), www.poverenik.rs.

You can export your data (in JSON format) and delete your account yourself in your account settings. You can exercise your other rights by sending a request to news@daniil.it. We may ask you to confirm your identity. We will respond within 30 days of receiving the request; where necessary, given the complexity and number of requests, this period may be extended by up to 60 days, of which we will inform you. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.

8. Cookies

The Website uses only strictly necessary cookies:

  • session cookie: keeps you logged in;
  • security cookie (CSRF): protects forms against misuse;
  • language cookie: remembers the language you have chosen.

Cloudflare may set its own strictly necessary security cookies to protect the Website and to perform the anti-bot check. We do not use advertising or tracking cookies, and our analytics works without cookies. Because these cookies are necessary for the Website to work, your consent is not required. You can block them in your browser settings, but then some functions (such as logging in) will not work. More information is available in the Cookie Notice.

9. Security

We protect data with appropriate technical and organisational measures, including:

  • encrypted connections (HTTPS);
  • passwords stored only in a hashed form, using a strong algorithm;
  • mandatory two-factor authentication for administrators;
  • access to data restricted to those who need it for their work;
  • an append-only modification log;
  • encrypted backup copies in a separate location;
  • removal of metadata (including GPS location) from photos;
  • never publishing the exact address of a property or the poster's contact details.

No system is completely secure. In the event of a personal data breach, we will act as required by the ZZPL, including notifying the Commissioner and, where required, you.

10. Minors

The Website is not intended for persons under 18, and we do not knowingly collect their personal data.

11. Data about other people

If you provide us with data about other people (for example, the owner of the property or future co-tenants), you must be authorised to do so and must inform them of this Privacy Policy.

12. Changes to this Privacy Policy

We may update this Privacy Policy. The new version is published on the Website with a new effective date, and we will inform registered users of material changes by email.

13. Contact