Privacy Policy

Last updated: April 2026.

This Privacy Policy is a translation of the Serbian original. In the event of any discrepancy or inconsistency between this translation and the Serbian version, the Serbian version shall prevail and be considered the authoritative text.

1. About us and this policy

This Privacy Policy describes how the sole trader Aldin Rizvanovic, operating under the business name NEKRET9 (hereinafter: Nekret9, we or us), collects, uses, stores and protects your personal data when you use the Nekret9 platform available at www.nekret9.com.

We process your personal data in accordance with the Law on Personal Data Protection of the Republic of Serbia (LPDP, Official Gazette RS No. 87/2018) and the applicable EU General Data Protection Regulation (GDPR), to the extent applicable.

For any questions regarding the protection of your personal data, please contact us at: privacy@nekret9.com

2. Personal data we collect

2.1. Platform users

  • Full name
  • Email address
  • Phone number
  • Profile photo (optional)

2.2. Partners — Agents

In addition to the data in section 2.1, we also collect:

  • Real estate agent licence number
  • Professional description and specialisation
  • City and country of operation

2.3. Partners — Agencies

In addition to the data in section 2.1, we also collect:

  • Real estate agency licence number
  • Tax identification number (PIB)
  • Company registration number (MB)
  • Agency name, description and location

2.4. Partners — Investors

In addition to the data in section 2.1, we also collect:

  • Tax identification number (PIB)
  • Company registration number (MB)
  • Business description and location

2.5. Property data

When creating a property, partners enter property data which may include:

  • Property address and location
  • Price, area, description and photos
  • GPS coordinates (optional, subject to your consent to share location)

2.6. Automatically collected data

We automatically collect certain technical data during your use of the platform:

  • IP address
  • Browser type, version and operating system
  • Device information (mobile, desktop)
  • Pages visited and duration of visit
  • Cookies and similar technologies (see Cookie Policy)

3. Purposes and legal basis for processing

PurposeLegal basis
Registration and management of user accountPerformance of contract (Art. 12(1)(b) LPDP)
Email address and phone number verification (OTP)Performance of contract (Art. 12(1)(b) LPDP)
Manual verification of partner data (licences, PIB, MB)Performance of contract / Legitimate interests (Art. 12(1)(b)(f) LPDP)
Processing payments for subscription plansPerformance of contract (Art. 12(1)(b) LPDP)
Platform analytics via Google AnalyticsConsent (Art. 12(1)(a) LPDP)
Marketing via Facebook PixelConsent (Art. 12(1)(a) LPDP)
Platform security and fraud preventionLegitimate interests (Art. 12(1)(f) LPDP)
Compliance with tax and legal obligationsLegal obligation (Art. 12(1)(c) LPDP)

4. Who we share your data with

We share your personal data only to the extent necessary to provide our services, with the following categories of recipients:

Infobip d.o.o.

Sending SMS and WhatsApp messages for phone number verification (OTP). Infobip processes only your phone number and the content of the verification message.

Google LLC

Google account sign-in (Google OAuth), platform analytics (Google Analytics, subject to your consent) and displaying maps and property locations (Google Maps).

Meta Platforms Inc.

Measuring the effectiveness of marketing campaigns via Facebook Pixel. Used exclusively with your consent through the cookie consent banner.

OTP banka Srbija a.d. Novi Sad

Processing card payments for subscription plans and advertising-credit top-ups. Card data is entered on the bank's secure page and processed directly by the bank in accordance with banking regulations; it is never stored by Nekret9.

Nekret9 does not sell, rent or otherwise commercially share your personal data with third parties.

5. Where we store your data

The application and user files are stored on servers in the Republic of Serbia, with the hosting provider UNLIMITED.rs, based in Belgrade.

The database is stored on the MongoDB Atlas platform, which uses AWS infrastructure in the eu-central-1 region (Frankfurt, Germany). Frankfurt is located within the European Union, and data transfers are carried out in accordance with appropriate safeguards under the GDPR and Standard Contractual Clauses (SCC).

By transferring data to Frankfurt, we ensure that your data is protected at a level equivalent to the requirements of the Serbian LPDP.

6. How long we retain your data

We retain your personal data for as long as your account is active and for as long as necessary to provide our services.

After the account deletion process has been successfully completed, all your personal data is anonymised within a reasonable timeframe.

Certain categories of data (e.g. financial records related to completed transactions) may be retained for longer periods in accordance with statutory obligations (tax and accounting regulations).

7. Account deletion

You may submit an account deletion request through the dedicated page within the platform. Nekret9 will notify you at each stage of the process:

  1. You submit a deletion request through the platform.
  2. Nekret9 confirms receipt of your request.
  3. The deletion and anonymisation process is initiated.
  4. You receive a notification upon completion of the process.
  5. All your personal data is anonymised and can no longer be linked to you.

8. Your rights

Under the LPDP, you have the following rights regarding your personal data:

Right of access (Art. 26 LPDP)

You may request a copy of the personal data we process about you.

Right to rectification (Art. 29 LPDP)

You may request correction of inaccurate or incomplete data.

Right to erasure (Art. 30 LPDP)

You may request deletion of your data under certain conditions.

Right to restriction of processing (Art. 31 LPDP)

You may request a temporary restriction on the processing of your data.

Right to data portability (Art. 36 LPDP)

You may request your data in a structured, machine-readable format.

Right to object (Art. 37 LPDP)

You may object to processing based on legitimate interests.

Right to withdraw consent

You may withdraw consent given for analytics or marketing at any time, without affecting the lawfulness of prior processing.

You have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (www.poverenik.rs) if you believe that the processing of your data is not in accordance with the law.

To exercise any of the above rights, please contact us at: privacy@nekret9.com

9. Data security

We implement appropriate technical and organisational security measures to ensure the security of your personal data, including:

  • Encryption of all communications via HTTPS/TLS protocol
  • Secure password hashing
  • Access to data restricted exclusively to authorised persons
  • Regular reviews of security measures and procedures

10. Minors

The Nekret9 platform is intended exclusively for persons over 18 years of age. We do not knowingly collect personal data from minors. If we suspect or discover that we have collected data from a person under 18, we will immediately take steps to delete such data.

11. Changes to this policy

Nekret9 reserves the right to amend this Privacy Policy at any time. You will be notified of any significant changes via email or a prominent notice on the platform.

Continued use of the platform after publication of changes implies acceptance of the updated Privacy Policy.

12. Contact

For any questions, requests or complaints regarding the protection of your personal data, please contact us:

Aldin Rizvanovic PR Agencija za nekretnine NEKRET9 Novi Pazar

AVNOJ-a 6, 36300, Novi Pazar, Republic of Serbia

PIB: 113883971 | MB: 67157559

privacy@nekret9.com