Privacy policy

An officially signed copy of this document is also available in PDF format. Download PDF

1. INTRODUCTION

This Privacy Policy governs the manner in which the company Tripundo d.o.o. Belgrade (Zemun), with its registered office at Novogradska no. 13, Zemun, MB: 21951285, PIB: 113969151 (hereinafter: "Tripundo", "we", "our") collects, uses, stores, processes and protects the personal data of users of the Tripundo Platform.

This policy applies together with the General Terms of Business of Tripundo.

Tripundo processes personal data in accordance with:

• Regulation (EU) 2016/679 (GDPR);
• the Law on Personal Data Protection of the Republic of Serbia;
• other applicable regulations in the field of personal data protection.

2. WHO IS THE DATA CONTROLLER

The data controller is:

Tripundo d.o.o. Beograd (Zemun)

Address: Novogradska br. 13 Zemun

PIB: 113969151

Registration number: 21951285

Email: podrska@tripundo.com

The person at Tripundo responsible for handling data for the protection of personal data (DPO) has been appointed in accordance with the law. You can contact them regarding any questions relating to the processing of your personal data via the email address: podrska@tripundo.com

3. WHAT DATA WE COLLECT

Depending on the type of service, Tripundo may process the following categories of data:

3.1. User (guest) data

• first and last name;
• email address;
• phone number;
• country of residence;
• reservation data;
• data on communication with the accommodation;
• IP address;
• technical device data;
• data on the use of the platform.

3.2. Accommodation data

• the owner's first and last name;
• data on the company or entrepreneur;
• contact details;
• bank account data;
• data needed for identity verification;
• documentation submitted for regulatory and AML checks.
• Accommodation information and other rules or policies of the accommodation;

3.3. Payment data

Tripundo does not store full payment card data.

The processing of payment card data is carried out through an authorized Payment institution and certified payment processors in accordance with applicable standards.

Tripundo may receive:

• tokenized data;
• transaction status;
• transaction identifier;
• information necessary for processing complaints and chargeback procedures.

4. PURPOSES OF DATA PROCESSING

Data is processed for the purpose of:

4.1. Performance of the contract

• creating and managing reservations;
• connecting the guest and the accommodation;
• communication between the contracting parties;
• customer support.

4.2. Charging and financial operations

• reservation processing;
• payment execution;
• keeping records;
• resolving complaints;
• chargeback procedures.

4.3. Legal obligations

• accounting;
• tax obligations;
• AML/KYC checks;
• cooperation with state authorities.

4.4. Legitimate interest

• prevention of abuse;
• fraud prevention;
• system security;
• service improvement;
• analysis of the platform's performance;
• protection of legal claims.

4.5. Marketing

Marketing messages are sent exclusively on the basis of your explicit consent. You can withdraw your consent at any time, in a simple way, after which marketing messages will no longer be delivered to you.

5. TO WHOM WE DISCLOSE DATA

Data may be shared with:

5.1. With the accommodation

When a guest makes a reservation, Tripundo provides the accommodation with the data necessary to complete the reservation.

5.2. With payment institutions

For the purpose of processing payments and resolving complaints.

5.3. With IT providers

Hosting, cloud infrastructure, security systems, CRM systems and other technical partners.

5.4. With competent authorities

When it is prescribed by law or on the basis of a binding request from a state authority.

6. INTERNATIONAL DATA TRANSFER

Your personal data may be transferred to countries outside the European Economic Area (EEA) and the Republic of Serbia, primarily when using the services of certain IT providers and other partners whose registered office or servers are located in those countries. In every case of transfer, Tripundo applies appropriate protection measures to ensure a level of data protection equivalent to that within the EEA and Serbia. These measures primarily include the application of Standard Contractual Clauses (SCC) approved by the European Commission, reliance on adequacy decisions on the level of protection for certain countries, or other mechanisms in accordance with the [ZZPL](51) and the General Data Protection Regulation (GDPR).

7. DATA RETENTION PERIODS

Tripundo keeps data only as long as necessary to achieve the purpose of processing.

Approximate deadlines:

• Reservations — 5 years
• Financial documentation — 10 years
• Communication with users — 3 years
• Chargeback documentation — 10 years
• AML/KYC documentation — in accordance with the law
• Marketing consents — until revoked

All the aforementioned deadlines apply unless a different deadline is prescribed by a special regulation or another binding decision of the competent authorities.

After the expiry of the stated periods, the data is permanently deleted or anonymized so that it can no longer be linked to a specific natural person.

8. DATA SECURITY

Tripundo applies appropriate technical and organizational protection measures, including:

• access control;
• encryption of data transmission;
• multi-factor authentication where applicable;
• records of system access;
• regular security checks;
• backup systems;
• incident management procedures.

9. RIGHTS OF DATA SUBJECTS

The user has the right to:

• request access to their data;
• request the correction of data;
• request the deletion of data;
• request the restriction of processing;
• object to the processing;
• exercise the right to data portability;
• withdraw the given consent at any time.

Requests can be submitted to:

podrska@tripundo.com

Tripundo will respond without undue delay, and no later than 30 days from receipt of the request.

In addition to the aforementioned rights, you also have the right to file a complaint with the Commissioner for Information of Public Importance and Personal Data Protection, at the address Bulevar kralja Aleksandra no. 15, Belgrade, or via the email address: office@poverenik.rs.

10. COOKIES

Tripundo uses:

• necessary cookies;
• functional cookies;
• analytical cookies;
• marketing cookies (if the user has given consent).

Detailed information can be found in the separate Cookie Policy.

11. AUTOMATED DECISION-MAKING

Tripundo may use automated processes for:

• fraud detection;
• security checks;
• ranking of search results.

Tripundo does not make decisions that produce significant legal consequences for the user solely on the basis of automated processing.

12. AMENDMENTS TO THE POLICY

Tripundo reserves the right to amend this Privacy Policy.

A new version will be published on the Platform, with the effective date indicated.