Privacy Policy
Last updated: October 2026.
This Privacy Policy is a translation of the Serbian original. In the event of any discrepancy or inconsistency between this translation and the Serbian version, the Serbian version shall prevail and be considered the authoritative text.
1. About us and this policy
This Privacy Policy describes how the sole trader Aldin Rizvanovic, operating under the business name NEKRET9 (hereinafter: Nekret9, we or us), collects, uses, stores and protects your personal data when you use the Nekret9 platform available at www.nekret9.com.
We process your personal data in accordance with the Law on Personal Data Protection of the Republic of Serbia (LPDP, Official Gazette RS No. 87/2018) and the applicable EU General Data Protection Regulation (GDPR), to the extent applicable.
For any questions regarding the protection of your personal data, please contact us at: privacy@nekret9.com
2. Personal data we collect
2.1. Platform users
- Full name
- Email address
- Phone number
- Profile photo (optional)
2.2. Partners — Agents
In addition to the data in section 2.1, we also collect:
- Real estate agent licence number
- Professional description and specialisation
- City and country of operation
2.3. Partners — Agencies
In addition to the data in section 2.1, we also collect:
- Real estate agency licence number
- Tax identification number (PIB)
- Company registration number (MB)
- Agency name, description and location
2.4. Partners — Investors
In addition to the data in section 2.1, we also collect:
- Tax identification number (PIB)
- Company registration number (MB)
- Business description and location
2.5. Property data
When creating a property, partners enter property data which may include:
- Property address and location
- Price, area, description and photos
- GPS coordinates (optional, subject to your consent to share location)
2.6. Automatically collected data
We automatically collect certain technical data during your use of the platform:
- IP address — used at the moment of your visit to determine your country and to protect the platform from abuse; in our statistics it is stored only in an irreversibly hashed form
- A random visit identifier (the “sid” cookie) and, in the mobile app, a random installation identifier — neither contains your name or contact details
- Device type, operating system and browser (with version), and whether the page was opened inside another app's browser (e.g. Instagram or Facebook) — derived from your browser's technical signature, which itself is not stored
- Pages and listings you viewed, time spent on a page, how far you scrolled, whether you started or submitted a form, searches, and contact buttons you tapped
- How you arrived: the website you came from, campaign parameters in the link (e.g. utm_source) and ad click identifiers (Facebook fbclid, Google gclid) when you arrive from an ad
- Cookies and similar technologies (see Cookie Policy)
- If you are signed in: while you are on the site, authorised members of our team can see which page you are currently viewing, linked to your account. This serves support and platform operations, is deleted automatically 3 minutes after your last activity, and no per-user browsing history is kept
2.7. Mobile application
When you use the Nekret9 mobile app, we additionally process:
- A random installation identifier generated by the app, so we can recognise the same installation in our statistics
- Screens you open and actions in the app (e.g. searches, saved listings, contacts) — sent to Google Analytics only if you allow analytics in the app's privacy settings
- Campaign parameters of the link through which the app was opened
- On iOS devices, data is shared with advertising partners (Meta) only if you allow it in the app and in Apple's tracking prompt (App Tracking Transparency)
2.8. Payments and advertising measurement
When you start a card payment, we record with the invoice the data needed to report the completed purchase to our advertising partners and to determine which campaign it came from:
- IP address and browser technical signature — deleted automatically as soon as the payment is confirmed
- Identifiers from the Google Analytics and Meta cookies (_ga, _fbp, _fbc) and ad click identifiers
- The page from which the payment was started and the campaign through which you first arrived on the platform
3. Purposes and legal basis for processing
| Purpose | Legal basis |
|---|---|
| Registration and management of user account | Performance of contract (Art. 12(1)(b) LPDP) |
| Email address and phone number verification (OTP) | Performance of contract (Art. 12(1)(b) LPDP) |
| Manual verification of partner data (licences, PIB, MB) | Performance of contract / Legitimate interests (Art. 12(1)(b)(f) LPDP) |
| Processing payments for subscription plans and advertising-credit top-ups | Performance of contract (Art. 12(1)(b) LPDP) |
| Our own visitor statistics (pseudonymised, on our servers, not shared with third parties) | Legitimate interests — understanding and improving the platform (Art. 12(1)(f) LPDP) |
| Platform analytics via Google Analytics (website and mobile app) | Visitors from the European Economic Area, the United Kingdom and Switzerland: consent (Art. 12(1)(a) LPDP). Other visitors: legitimate interests (Art. 12(1)(f) LPDP), with the right to switch it off at any time |
| Measuring and optimising advertising via Meta (Facebook Pixel and Conversions API) and Google, including sending hashed contact data to link registrations, enquiries and purchases to ads | Visitors from the European Economic Area, the United Kingdom and Switzerland: consent (Art. 12(1)(a) LPDP). Other visitors: legitimate interests (Art. 12(1)(f) LPDP), with the right to switch it off at any time. In the iOS app: only with your permission |
| Keeping a record of your privacy choices (what you chose, when and how) | Legal obligation — demonstrating consent (Art. 12(1)(c) LPDP) |
| Platform security and fraud prevention | Legitimate interests (Art. 12(1)(f) LPDP) |
| Compliance with tax and legal obligations | Legal obligation (Art. 12(1)(c) LPDP) |
4. Who we share your data with
We share your personal data only to the extent necessary to provide our services, with the following categories of recipients:
Infobip d.o.o.
Sending SMS and WhatsApp messages for phone number verification (OTP). Infobip processes only your phone number and the content of the verification message.
Google LLC
Google account sign-in (Google OAuth), platform analytics on the website and in the mobile app (Google Analytics, including events we send from our servers, e.g. completed payments), measurement of advertising campaigns (Google Ads) and displaying maps and property locations (Google Maps). Analytics and advertising measurement follow the rules in section 3.
Meta Platforms Inc.
Measuring and optimising advertising campaigns via the Facebook Pixel (in your browser) and the Conversions API (from our servers). Under the rules in section 3, we send Meta events such as registration, contacting an advertiser, saving a listing and purchases, together with hashed (irreversibly encoded) email address, phone number, name, country and advertising identifiers, so that Meta can match them with its users. Meta does not receive your data in readable form.
OTP banka Srbija a.d. Novi Sad
Processing card payments for subscription plans and advertising-credit top-ups. Card data is entered on the bank's secure page and processed directly by the bank in accordance with banking regulations; it is never stored by Nekret9.
Nekret9 does not sell, rent or otherwise commercially share your personal data with third parties.
5. Where we store your data
The application and user files are stored on servers in the Republic of Serbia, with the hosting provider UNLIMITED.rs, based in Belgrade.
The database is stored on the MongoDB Atlas platform, which uses AWS infrastructure in the eu-central-1 region (Frankfurt, Germany). Frankfurt is located within the European Union, and data transfers are carried out in accordance with appropriate safeguards under the GDPR and Standard Contractual Clauses (SCC).
By transferring data to Frankfurt, we ensure that your data is protected at a level equivalent to the requirements of the Serbian LPDP.
Google and Meta may also process data in the United States. Such transfers are made on the basis of the EU–US Data Privacy Framework and Standard Contractual Clauses.
6. How long we retain your data
We retain your personal data for as long as your account is active and for as long as necessary to provide our services.
After the account deletion process has been successfully completed, all your personal data is anonymised within a reasonable timeframe.
Certain categories of data (e.g. financial records related to completed transactions) may be retained for longer periods in accordance with statutory obligations (tax and accounting regulations).
Analytics data is kept for limited periods:
- Page visits and visitor records: 12 months from the last activity
- Listing views and searches: 24 months
- Records of listing contacts and shares: while the listing's statistics are available to its owner; anonymised when you delete your account
- IP address and browser technical signature recorded at payment: deleted as soon as the payment is confirmed
- Which page a signed-in user is currently viewing: at most 3 minutes after the last activity
7. Account deletion
You may submit an account deletion request through the dedicated page within the platform. Nekret9 will notify you at each stage of the process:
- You submit a deletion request through the platform.
- Nekret9 confirms receipt of your request.
- The deletion and anonymisation process is initiated.
- You receive a notification upon completion of the process.
- All your personal data is anonymised and can no longer be linked to you.
8. Your rights
Under the LPDP, you have the following rights regarding your personal data:
Right of access (Art. 26 LPDP)
You may request a copy of the personal data we process about you.
Right to rectification (Art. 29 LPDP)
You may request correction of inaccurate or incomplete data.
Right to erasure (Art. 30 LPDP)
You may request deletion of your data under certain conditions.
Right to restriction of processing (Art. 31 LPDP)
You may request a temporary restriction on the processing of your data.
Right to data portability (Art. 36 LPDP)
You may request your data in a structured, machine-readable format.
Right to object (Art. 37 LPDP)
You may object to processing based on legitimate interests, including analytics and advertising measurement.
Right to withdraw consent and switch off analytics and marketing
You may withdraw consent given for analytics or marketing, or switch analytics and marketing off, at any time — via the “Cookie settings” button at the bottom of every page or in the mobile app's privacy settings, without affecting the lawfulness of prior processing.
You have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (www.poverenik.rs) if you believe that the processing of your data is not in accordance with the law.
To exercise any of the above rights, please contact us at: privacy@nekret9.com
9. Data security
We implement appropriate technical and organisational security measures to ensure the security of your personal data, including:
- Encryption of all communications via HTTPS/TLS protocol
- Secure password hashing
- Access to data restricted exclusively to authorised persons
- Regular reviews of security measures and procedures
- Pseudonymisation: visitor identifiers and IP addresses are stored in our statistics only as irreversible, secret-keyed hashes
10. Minors
The Nekret9 platform is intended exclusively for persons over 18 years of age. We do not knowingly collect personal data from minors. If we suspect or discover that we have collected data from a person under 18, we will immediately take steps to delete such data.
11. Changes to this policy
Nekret9 reserves the right to amend this Privacy Policy at any time. You will be notified of any significant changes via email or a prominent notice on the platform.
Continued use of the platform after publication of changes implies acceptance of the updated Privacy Policy.
12. Contact
For any questions, requests or complaints regarding the protection of your personal data, please contact us:
Aldin Rizvanovic PR Agencija za nekretnine NEKRET9 Novi Pazar
AVNOJ-a 6, 36300, Novi Pazar, Republic of Serbia
PIB: 113883971 | MB: 67157559
privacy@nekret9.com