This Privacy Policy explains how NIKOLA MILENKOVIĆ PR AGENCIJA ZA RAČUNARSKO PROGRAMIRANJE KRAGUJEVAC, a sole proprietor registered in the Republic of Serbia (“Ovyrena”, “we”) collects and uses personal data when you visit ovyrena.com or use the Ovyrena service and mobile apps. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Serbian Law on Personal Data Protection.
1. Who is responsible
For data about our website visitors, Owners and Employees, the controller is NIKOLA MILENKOVIĆ PR AGENCIJA ZA RAČUNARSKO PROGRAMIRANJE KRAGUJEVAC, Janka Katića 3A, 34000 Kragujevac, Republic of Serbia, registration number 64662198, tax ID 110116517. Contact: hello@ovyrena.com.
We have not appointed a Data Protection Officer, because our processing does not require one under Article 37 GDPR or the Serbian Law on Personal Data Protection. Questions about privacy can be sent to the address above. People in the European Union and the United Kingdom can contact us directly at the same address.
For data that our customers enter about their own customers (for example the names and bookings of their guests or clients), the business using Ovyrena is the controller and we act only as its processor. Questions about that data should go to the business you dealt with.
2. What we collect
- Account data: name, email address, password (stored only as a secure hash), and profile settings.
- Company data: business name, Locations and addresses, time zone, currency, Employees, Job Titles and Roles.
- Usage and technical data: IP address, browser and device type, log-in times and security logs, used to keep the Service running and secure.
- Mobile app data: a device push token, used only to deliver notifications you asked for.
- Billing data: plan, subscription status and invoices. Card details are collected and processed by Lemon Squeezy, never by us.
- Communications: messages you send us and the emails we send you, such as invitations and account notices.
3. Why we use it and our legal basis
- To provide the Service and perform our contract with you (Art. 6(1)(b) GDPR).
- To keep the Service secure, prevent abuse and fix problems, based on our legitimate interests (Art. 6(1)(f)).
- To send service messages such as invitations, password resets, trial reminders and billing notices (contract).
- To meet legal obligations such as tax and accounting (Art. 6(1)(c)).
- To send Owners occasional news and offers about Ovyrena, based on our legitimate interest in telling existing customers about our own service (Art. 6(1)(f)). Every such email has an unsubscribe link, and you can opt out at any time. We never send marketing to your Customers or Employees.
5. International transfers
Our servers are in the European Union. Some providers, such as SendGrid, Cloudflare and Lemon Squeezy, may process data in the United States. Where this happens we rely on an adequacy decision, such as the EU–US Data Privacy Framework, or on Standard Contractual Clauses and additional safeguards.
6. How long we keep it
We keep account and Company data for as long as your account exists. When a Company is archived its data is retained so that it can be reactivated, until the Owner asks us to delete it. We delete an account or a Company within 30 days of a verified request. Signed-in session records are deleted 7 days after they expire, and server and security logs are kept for up to 90 days. Billing records are kept as long as Serbian tax and accounting law requires.
7. How we protect it
Passwords are hashed, connections are encrypted with HTTPS, authentication cookies are HttpOnly and Secure, and access inside a Company is controlled by Roles. Access to production systems is limited to staff who need it.
8. Your rights
You have the right to:
- access the personal data we hold about you;
- correct inaccurate data;
- ask us to delete your data or restrict its use;
- receive your data in a portable format;
- object to processing based on legitimate interests;
- withdraw consent at any time, where processing is based on consent.
To exercise these rights, email hello@ovyrena.com. You can also complain to your data protection authority, in Serbia the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik), or the supervisory authority in your EU country.
9. Children
Ovyrena is a business service and is not directed at children under 16.
11. Changes to this policy
We will post any changes on this page and, for significant changes, notify Owners by email.