Privacy policy
This document explains what data we collect when you use our site, why we collect it, who we share it with, and what your rights are. It is written to be readable, without unnecessary legalese.
Data controller
The data controller is KONDITORSKA INDUSTRIJA 19. DECEMBAR DOO NOVI SAD, a limited liability company registered at Vršačka 43B, 21000 Novi Sad, Serbia. Company number: 08752028. Tax ID (PIB): 100715608. Legal representative: Nebojša Ponjević. Contact for all data protection matters: petar.ponjevic@19decembar.rs.
What we collect
When you order: name, email, phone, delivery address, optionally a company name and an order note. When you use the contact form: name, email, optionally phone and company name, and your message. If you accept analytics cookies: anonymous page-visit data. We collect no payment data — payment is made in cash to the courier on delivery.
Why, and on what basis
Order data is processed to perform the contract — without a name, address and phone the parcel cannot be delivered. Contact messages are processed on the basis of our legitimate interest in answering you. Analytics is processed solely on your consent. Invoices are kept to meet a legal obligation.
Who we share it with
We share your data only with those without whom the service cannot be provided: the AKS courier service (name, address and phone, solely to deliver your parcel), Supabase (database hosting), Vercel (site hosting) and Resend (order emails). If you accept analytics cookies, visit data is also shared with Google Analytics. We never sell your data or pass it to third parties for marketing.
How long we keep it
Order records and the related invoices are kept for at least 5 years, because accounting and tax rules require it — that period runs from the end of the financial year in which the order was fulfilled. Contact form messages are kept for one year and then deleted. Google Analytics data is kept for 14 months. Your cookie choice is stored for 6 months. Once a period expires we delete or permanently anonymise the data.
Your rights
You have the right to request access to your data, correction of inaccurate data, erasure, restriction of processing, data portability, and to object to processing. You may withdraw analytics consent at any time with no effect on the rest of the service. Important: we will action an erasure request for all data we are not legally required to retain. Data contained in issued invoices cannot be deleted before the statutory period expires, because we are legally obliged to keep it — this is an explicit exception to the right to erasure. We respond to every request within 30 days at the latest. If you believe we have infringed your rights, you may contact the Serbian Commissioner for Information of Public Importance and Personal Data Protection (www.poverenik.rs).
Contact
For access, correction, erasure or any question about this policy, write to petar.ponjevic@19decembar.rs or to Vršačka 43B, 21000 Novi Sad, Serbia.