This Policy explains how personal data is processed when visiting and using the website paychat.rs (the “Website”), in accordance with the Personal Data Protection Act (“Official Gazette of RS”, No. 87/2018 — the “Act”).
This Policy applies to the Website only. Registration for and use of the PayChat service within the Viber application are governed by a separate document, “Terms of Service and Privacy Policy of the PayChat Service”, available on the Website.
PayChat d.o.o., Belgrade, company registration number 22097172, tax ID 114964066.
E-mail: support@paychat.rs · Contact form: https://paychat.rs/contact.html
Given the scope and nature of the processing carried out through the Website, PayChat is not required to appoint a data protection officer within the meaning of Article 56 of the Act. Requests and enquiries should be addressed to the contacts above.
Through the contact form at https://paychat.rs/contact.html we process your name and surname, e-mail address, telephone number and the content of your message, together with the date and time of submission and the technical data required for the security check.
This data is used to receive and consider enquiries, communicate with visitors, provide requested information and support, and resolve reported issues and complaints.
Legal basis: Article 12(1)(2) of the Act — taking steps at the request of the data subject prior to entering into a contract, where the enquiry concerns a possible business relationship; or Article 12(1)(6) of the Act — the legitimate interest of PayChat in responding to visitor enquiries.
Voluntary nature. Providing this data is voluntary and constitutes neither a statutory nor a contractual obligation. All form fields are marked as required so that we can reliably act upon the enquiry; a visitor who prefers not to provide a telephone number may write to us directly at support@paychat.rs. The only consequence of not providing the data is that we will be unable to respond — access to the Website’s content remains unrestricted.
Please do not submit PIN codes, passwords, one-time codes, payment card or bank account details, or any other confidential information through the form.
PayChat does not maintain its own record of visitors’ IP addresses and does not use IP addresses to identify visitors, for advertising, or for profiling.
On each access to the Website, the providers of hosting, content delivery and security services temporarily record technical data in their system logs — the IP address, date and time of access, the page requested, the browser and operating system type, and information on errors and security events. These logs serve solely to deliver content, resolve technical issues, and detect and prevent attacks and abuse.
Legal basis: Article 12(1)(6) of the Act — the legitimate interest of PayChat in ensuring the secure and functional operation of the Website. An assessment has established that this interest is not overridden by the interests and rights of visitors, given the short retention periods and the fact that the data is not used for profiling.
Necessary and functional cookies serve the basic operation of the Website and do not require separate consent. These are: the record of the language selected for the Website, which remains stored until the visitor deletes it; the technical record of the previously visited page, which is deleted when the browser tab is closed; the short-lived technical identifiers of the platform that delivers the Website and detects automated traffic; and the authentication token, which is created only if the sign-in functionality is used.
Analytics cookies are set solely with the visitor’s prior consent, on the basis of Article 12(1)(1) of the Act. They last no longer than two years and may be deleted at any time through browser settings.
On a first visit, a notice is displayed with two equally weighted options: “Accept analytics cookies” and “Necessary only”. No analytics cookie is set before the first option is chosen. Declining does not restrict access to the Website’s content.
Consent may be changed or withdrawn at any time through the “Cookie settings” option in the Website footer, as easily as it was given. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal (Article 15(3) of the Act).
Google Analytics 4 (Google LLC) is used, subject to the visitor’s consent, to produce aggregate statistics on how the Website is used. The data processed includes pages visited, duration of the visit, approximate geographic area, device, browser and operating system type, how the visitor arrived at the Website, and a randomly generated browser identifier. PayChat does not receive the full IP address in its reports. We do not use Google Analytics for personalised advertising, remarketing, or building marketing profiles.
Cloudflare Turnstile (Cloudflare, Inc.) is used on the contact form page to verify that the form is being used by a genuine visitor. When the form is submitted, a one-time token is generated and its validity confirmed with the service provider, in the course of which the IP address and browser data are processed. The service is not used to track visitors over time or for advertising. As it is necessary to protect the form, no separate consent is sought for it.
Supabase is used for the backend functionality supporting the contact form.
The Website does not use marketing or advertising cookies, session recording tools, or A/B testing and personalisation services.
Data is accessed by PayChat employees and associates only to the extent necessary for the purposes described in this Policy, applying the principle of least privilege.
The categories of recipients are:
With providers that process data on PayChat’s instructions, the relationship is governed in accordance with Article 45 of the Act, by a written agreement or binding terms of service containing obligations of confidentiality, application of protective measures, restrictions on engaging sub-processors, and the handling of data upon termination of the service.
PayChat does not sell visitors’ personal data and does not disclose it to third parties for their own direct marketing.
Certain service providers have their seat, or their infrastructure, outside the Republic of Serbia, and consequently some technical and analytics data may be processed in other countries.
Transfers are carried out in accordance with Articles 64 to 69 of the Act: without additional conditions where the country is covered by the decision of the Government of the Republic of Serbia on the list of countries providing an adequate level of protection; subject to the appropriate safeguards under Article 65 of the Act where no such decision exists, including standard contractual clauses, the provider’s binding corporate rules, and technical measures such as encryption and access control; and, as regards analytics data, on the basis of the visitor’s explicit consent under Article 69(1)(1) of the Act.
Notice of possible risks. In some countries, data protection rules differ from those of the Republic of Serbia, the authorities of those countries may under certain conditions gain access to data, and the exercise of rights and effective legal remedies may be more difficult. By accepting analytics cookies, the visitor gives explicit consent to such a transfer, having been informed of these risks. A visitor who does not wish this should select the “Necessary only” option.
Data from the contact form is retained for up to one year after the correspondence concludes, or up to three years where the enquiry relates to a possible legal claim. Complaints are retained for up to three years after the proceedings conclude. Requests to exercise data subject rights are retained for up to two years, in order to demonstrate that they were acted upon.
Event data in the analytics account is retained for two months, and data associated with a user identifier for no longer than fourteen months from collection, with no extension of that period on subsequent visits. Analytics cookies on the visitor’s device last up to two years.
The language preference remains until the visitor deletes it; data in temporary session storage is deleted when the browser tab is closed; the authentication token, where present, lasts until sign-out or deletion of local data. Technical logs held by service providers are retained by them for the short periods set out in their own rules.
Once the applicable period expires, we delete or anonymise the data, or otherwise render it irreversibly unlinkable to any individual.
PayChat applies technical, organisational and personnel measures to protect data against unauthorised access, loss, alteration, destruction and other forms of unlawful processing: encryption of communications, control and restriction of access, confidentiality obligations for persons accessing data, protection of the contact form against automated requests, backups, protection of administrative systems, and regular updating of the components in use.
In the event of a personal data breach that may give rise to a risk to the rights and freedoms of natural persons, PayChat acts in accordance with Articles 52 and 53 of the Act.
No method of transmitting or storing data over the internet can guarantee absolute security.
A person whose data we process has the right to:
Right to object. The data subject has the right to object at any time to processing based on PayChat’s legitimate interest, in accordance with Article 37 of the Act. Upon receipt of an objection we will cease processing that data, unless we demonstrate compelling legitimate grounds which override the interests, rights and freedoms of the objecting party, or which relate to the establishment, exercise or defence of a legal claim.
PayChat does not use data collected through the Website for automated decision-making, including profiling, that would produce legal effects concerning the visitor or similarly significantly affect them (Article 38 of the Act).
In order to protect the data, we may request information necessary to confirm the identity of the person making the request.
Requests may be submitted by e-mail to support@paychat.rs or through the contact form.
We will act without undue delay and no later than 30 days from receipt of the request, in accordance with Article 21 of the Act. That period may be extended by a further 60 days where necessary due to the complexity or number of requests, of which we will inform the applicant within 30 days. If we do not act upon a request, we will inform the applicant of the reasons within the same period, together with information on the right to lodge a complaint and to seek judicial protection.
Handling requests is free of charge. Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, PayChat may charge the necessary administrative costs or refuse to act, in accordance with Article 21(5) of the Act.
A person who considers that their data is being processed contrary to the Act may lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11120 Belgrade, telephone +381 11 3408 900, e-mail office@poverenik.rs. Lodging a complaint does not affect the right to judicial protection under Article 84 of the Act, nor the right to compensation for damages.
Before lodging a complaint, we encourage you to contact PayChat so that the matter can be addressed directly.
The Website is not intended for minors and we do not knowingly collect the personal data of minors through it. In accordance with Article 16 of the Act, consent in relation to an information society service may be given independently by a person who is at least 15 years of age; for a younger person, consent is given or confirmed by a parent or other legal representative. Data collected without an appropriate legal basis is deleted without delay.
The Website may contain links to other websites and services, including Viber, social networks and mobile banking applications. PayChat does not operate those services and is not responsible for their independent processing activities. We recommend reading their privacy policies before using third-party services.
This Policy may be amended to reflect changes in the Website’s functionality, the technologies and service providers used, the manner of processing, or legal requirements. The current version is published on the Website with the date of the last update indicated. Where changes significantly affect visitors’ rights, a notice will be displayed in a prominent place, and where processing is based on consent, fresh consent will be sought.