Privacy Policy
This Privacy Policy explains how MIBESIS d.o.o. processes the personal data of users of the Oglasna deska mobile application for Android (the "app"). The app is the companion application for the www.oglasna-deska.si classifieds website.
We process personal data in accordance with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Slovenian Personal Data Protection Act (ZVOP-2).
1. Data controller
The controller of your personal data is:
| Company | MIBESIS, družba za razvoj in informacijske storitve, d.o.o. (short form: MIBESIS d.o.o.) |
|---|---|
| Address | Spodnje Hoče, Zelena ulica 12, 2311 Hoče, Slovenia |
| Company reg. no. | 3936422000 |
| VAT ID | SI 75978296 |
| info@mibesis.com | |
| Phone | +386 30 451 362 |
| Legal representative | Miroslav Beranič, Director |
We are not required to appoint a Data Protection Officer under Article 37 GDPR. For any data protection question, please use the e-mail address above.
2. Scope of this policy
This policy covers the processing of personal data in the Oglasna deska mobile app and in the related back-end services (servers, APIs, push notification delivery). Because the app presents content from the oglasna-deska.si website, the rules of that website also apply to the listings you publish.
The app may contain links to third-party websites (for example an advertiser's website). We are not responsible for how they handle personal data; please read their own privacy policies.
3. What data we process
3.1 Data you provide
- Account data: e-mail address, username or display name, and a hashed password. An account is not required for browsing listings.
- Optional profile data: first and last name, phone number, town, profile picture – only if you enter them yourself.
- Listing content: title, description, category, price, location and photos attached to the listing. This content is published publicly, so do not include information you do not want to disclose.
- Messages: the content of messages you send to other users through the app, and the time they were sent.
- Saved searches and favourites: search criteria and references to listings you save.
- Support enquiries: the content of your question, your e-mail address and any attachments.
3.2 Data generated through use
- Server logs: IP address, date and time of the request, requested resource, response code and application identifier (user agent).
- Device and app data: device model, Android version, app version and selected language – used for troubleshooting and compatibility.
- Push notification token: a random identifier of the app installation that allows notifications to reach your device.
- Crash reports and basic usage statistics: information about app errors and screen usage counters in non-personal or pseudonymised form.
3.3 Data we do not collect
The app does not collect your contacts, calendar, SMS content, list of installed apps, health data, payment card data or special categories of personal data under Article 9 GDPR. We do not collect precise location in the background.
4. Device permissions
The app requests only the permissions required for a given feature. You may decline or revoke any permission at any time in your Android settings.
| Permission | Why we need it | Required |
|---|---|---|
| Internet and network state | Displaying listings and communicating with our server. | Yes |
| Notifications (POST_NOTIFICATIONS) | Alerts about new listings matching a saved search and about new messages. | No |
| Camera | Taking a photo directly while creating a listing. | No |
| Photos and media | Selecting existing photos for a listing. | No |
| Approximate location | Suggesting a location when searching or posting; we do not track location in the background. | No |
If you decline a permission, the app remains usable and only the related feature is unavailable.
5. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Displaying listings and operating the app | Server logs, device data | Legitimate interest (Art. 6(1)(f)) – providing a working service |
| Managing your user account | Account and profile data | Performance of a contract (Art. 6(1)(b)) – Terms of Use |
| Publishing and editing listings | Listing content, photos | Performance of a contract (Art. 6(1)(b)) |
| Messaging between users | Message content and metadata | Performance of a contract (Art. 6(1)(b)) |
| Push notifications about new listings | Device token, saved searches | Consent (Art. 6(1)(a)) – notification permission |
| User support | Contact details, content of the enquiry | Performance of a contract (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)) |
| Preventing abuse, spam and fraud | IP address, logs, content flags | Legitimate interest (Art. 6(1)(f)) – security of the service and its users |
| Fixing errors and improving the app | Crash reports, usage statistics | Legitimate interest (Art. 6(1)(f)) |
| Complying with legal obligations | Data required by law | Legal obligation (Art. 6(1)(c)) |
Where processing is based on consent, you may withdraw it at any time – for example by turning notifications off in the app or in Android settings. Withdrawal does not affect the lawfulness of processing carried out before it.
6. Who we share data with
- Other users: anything you publish in a listing or send in a message is visible to the recipients or to the public. Your account e-mail address is not published.
- Infrastructure provider: the app and its servers run on infrastructure we operate ourselves or rent from hosting providers in the European Union acting as processors.
- Push notification provider: we use Firebase Cloud Messaging by Google Ireland Limited to deliver notifications to Android devices. Only the device token and the notification content are transferred.
- Google Play: Google acts as an independent controller for installation data and crash reports submitted through the Android system.
- Competent authorities: where required by law or by an order of a competent authority.
We do not sell personal data and we do not pass it on to third parties for their own marketing.
7. Transfers outside the EEA
As a rule we process data within the European Economic Area. Where a processor (for example Google for push notification delivery) also processes data outside the EEA, the transfer is based on the European Commission's Standard Contractual Clauses or on an adequacy decision (the EU–US Data Privacy Framework).
8. Retention periods
| Category | Retention |
|---|---|
| User account data | Until the account is deleted; within 30 days of a deletion request at the latest |
| Published listings | Until the listing expires or is deleted, or until the account is deleted |
| Messages between users | Until the account is deleted, then up to 90 days in the other party's conversation |
| Server logs | Up to 12 months |
| Crash reports | Up to 12 months |
| Push notification token | Until you unsubscribe, uninstall the app or delete your account |
| Support correspondence | Up to 2 years after the enquiry is closed |
| Data required by tax or other legislation | Until the statutory period expires |
After the retention period we delete or irreversibly anonymise the data. Exceptionally, we keep it longer where necessary to establish, exercise or defend legal claims.
9. Data security
- All traffic between the app and our servers is encrypted with HTTPS (TLS).
- Passwords are stored only as salted hashes and cannot be recovered by us.
- Access to production systems is limited to authorised staff and protected by multi-factor authentication.
- Data is backed up regularly and the backups are encrypted.
- We apply the principles of data minimisation and data protection by design.
In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will inform you and report the breach to the Slovenian Information Commissioner within 72 hours.
10. Your rights
As a data subject you have the right to:
- access your personal data (Art. 15 GDPR);
- rectification of inaccurate data (Art. 16);
- erasure, the right to be forgotten (Art. 17) – see the account deletion instructions;
- restriction of processing (Art. 18);
- data portability in a machine-readable format (Art. 20);
- object to processing based on legitimate interest (Art. 21);
- withdraw consent at any time (Art. 7).
Send your request to info@mibesis.com. We will respond within one month of receiving it. For security reasons we may ask for additional proof of identity. Handling requests is free of charge.
If you believe we process your data unlawfully, you may lodge a complaint with the supervisory authority:
Dunajska cesta 22, 1000 Ljubljana, Slovenia
Phone: +386 1 230 97 30 · E-mail: gp.ip@ip-rs.si
www.ip-rs.si
11. Children
The app is not intended for and is not directed at children under 16. We do not knowingly create user accounts for persons under 16. If we discover that we have processed a child's personal data without the consent of the holder of parental responsibility, we delete it without delay. If you believe a child has provided us with personal data, please contact us at info@mibesis.com.
12. Tracking and advertising
- The app contains no third-party advertising networks.
- The app does not use the advertising identifier (Android Advertising ID) and does not track you across apps.
- We do not use your data for marketing profiling.
- We do not carry out automated decision-making producing legal or similarly significant effects on you (Art. 22 GDPR).
- If the app displays oglasna-deska.si web content in an embedded browser, that website's cookies may be used. Essential cookies enable basic functionality; for optional cookies you can make a choice in the banner shown.
13. Changes to this policy
We may update this policy when the app or the law changes. The version in force is always published on this page together with its effective date. We will notify you of material changes in the app or by e-mail. Continued use of the app after the changes take effect means you are aware of the updated policy.
14. Contact
For questions about this Privacy Policy or about the processing of your personal data, contact us:
- info@mibesis.com
- Phone
- +386 30 451 362
- Postal address
- MIBESIS d.o.o., Spodnje Hoče, Zelena ulica 12, 2311 Hoče, Slovenia
- Account deletion
- Instructions and form