Personal data privacy notice

1. Controller and contact

RED BOX d.o.o. Beograd, Trg Nikole Pašića 5, sprat 1, 11158 Beograd (Stari Grad), Srbija. MB: 21808016; PIB: 113130422.

RED BOX d.o.o. Beograd determines the purposes and means of processing for the accounts, security and correspondence described here. Send questions and requests to info@redbox.business or by post to the registered address. This is the controller's privacy contact; it does not represent the appointment of a separate data protection officer.

2. Information and sources

You provide a name, email, password stored as a protected hash, language preference and acceptance record. If you enable two-factor authentication, we also process information needed to check codes and recover access. Do not send us your passwords or recovery codes.

Organization records include its name, country, registration number, address, selected business activity type, membership and roles. An inviting administrator supplies your email and proposed role. We use the address for an invitation identifying the service, which you may ignore or ask us to delete.

Use generates session information, IP address and browser details, access times, invitations and security events, and records of who created an organization, sent or accepted invitations or changed roles. Correspondence contains the sender address, message and attachments you supply. Sensitive personal information is not required.

3. Purposes and legal bases

Information necessary for your account and requested functions is processed to enter into and perform a contract with you (Article 12(1)(2) of the Serbian law). For business contacts acting for an organization, membership administration, invitations and support, we rely where appropriate on the operator's and organization's legitimate interests in managing business collaboration (point 6), assessed against your rights.

Abuse prevention, access security and limited activity records rely on legitimate interests in security and establishing or defending legal claims. Legally required retention or disclosure relies on a legal obligation (point 3). Acceptance of terms is not marketing consent; this version does not send advertising campaigns. If future processing relies on consent, it will be requested separately and may be withdrawn.

Required registration details are needed to create an account, and organization details to create its profile. An invitation does not oblige you to register. We do not use automated decision-making or profiling producing legal or similarly significant effects on you.

4. Recipients and locations

Authorized personnel access information when needed for support and security. Authorized members of your organization can see your name, business email, role and relevant actions according to their permissions. Account data is not published as a public directory.

The website, database and business email are hosted on Fornex VPS infrastructure in Germany. Fornex provides infrastructure; the operator manages the application and email. Administration and support may involve access from Serbia. Sending email involves the recipient's email provider, whose locations depend on their chosen service.

Information may be disclosed to competent authorities where legally required and professional advisers where necessary for a legal claim. We do not sell personal data. Transfers to other countries are subject to the Serbian law's conditions; ask us for information about a particular recipient and applicable safeguards. Using a foreign provider does not by itself establish that all transfer conditions are met.

5. Retention and security

Account and organization information is kept while needed for an active service. Following a closure request, we assess what can be deleted, what forms part of shared business records and what must be kept for a legal obligation, security incident or legal claim. We tell the requester our decision and, for retained information, the reason and relevant period or criterion.

An account session lasts up to seven days and can be renewed through use. Invitation links last seven days; expiry of the link does not automatically delete its record. Expired records, correspondence and security records are reviewed according to purpose, last activity, incident resolution and relevant limitation periods. This version does not automatically delete every expired record.

If information exists in backups, removal may follow the backup replacement cycle; those copies are not used for routine operations and deletion requests must be reapplied upon restoration. We use access controls, protected connections and credential protection. No system can guarantee complete security.

6. Cookies

Login and security cookies support authentication; account sessions last up to seven days with renewal. The redbox-locale cookie remembers your language and is set as a browser session cookie without a persistent expiry. A browser may retain session cookies when restoring a previous session. Removing or blocking cookies may sign you out or change your language.

This version does not set advertising cookies or analytics tracking. If optional technologies are introduced, we will first provide information and obtain consent where required.

7. Rights and requests

Subject to statutory conditions, you have rights to information and access, correction, erasure, restriction, portability and objection, including objection to processing based on legitimate interests. Where consent is used, you can withdraw it without affecting the lawfulness of earlier processing. Rights have legal limits, including others' rights and mandatory retention.

Write to info@redbox.business identifying the relevant account or address. We may ask only for additional information necessary to verify identity and authority. We respond without undue delay and within 30 days. Where law allows an extension due to complexity or request volume, we will notify you within the initial period of the reasons and an extension of up to a further 60 days. You do not need a dedicated account button to request access or deletion.

You may complain to Serbia's Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs) and seek judicial protection. Additional mandatory rights under another applicable country's law are preserved. Material changes to this notice will be published with a new version and appropriate notice to users.