Privacy Policy

Last updated: at platform installation.

1. Data controller

The controller for personal data collected through this platform is [organisation name], registered at [address], company number [number], email [contact email].

Processing is carried out under Regulation (EU) 2016/679 (GDPR) and the Macedonian Law on Personal Data Protection (Official Gazette 42/2020).

2. What we collect

2.1 Data you give us

Through the contact form we collect:

• your name — so we know who we are replying to;
• your email address — so we can reply;
• a phone number — optional, only if you enter one;
• the message and its subject;
• the artisan the message concerns, if you selected one.

2.2 Technical data

• A hash of your IP address — the address itself is not stored. We keep only a one-way cryptographic digest (SHA-256 with a secret key), used solely to rate-limit submissions from one source. The address cannot be recovered from it.
• Your browser's User-Agent — for abuse diagnostics.
• Server logs kept by the hosting provider under its own policy.

We use no analytics tools, no ad networks and no profiling.

3. Legal basis and purpose

4. How long we keep it

• Contact messages — at most 12 months, then deleted automatically.
• Administrative audit log — 24 months.
• Backups — the most recent 14 sets; older ones are rotated out.

If you ask for erasure before those periods expire, we act without delay.

5. Who we share it with

We do not sell or hand personal data to third parties for their own purposes. It is accessible only to:

• the platform's authorised editors, in order to answer your message;
• the hosting provider [hosting provider name], as a processor under an art. 28 GDPR agreement;
• the artisan you addressed, where answering requires it — and only to that extent.

Data is held on servers in [country/region] and is not transferred outside the EEA.

6. Your rights

At any time you have the right to:

• access your data and receive a copy (art. 15);
• rectification of inaccurate data (art. 16);
• erasure — the "right to be forgotten" (art. 17);
• restriction of processing (art. 18);
• data portability (art. 20);
• objection to processing (art. 21);
• withdrawal of consent at any time, without affecting the lawfulness of processing carried out beforehand.

Send requests to [contact email]. We respond within 30 days at the latest.

You may also lodge a complaint with the Agency for Personal Data Protection of the Republic of North Macedonia — azlp.mk.

7. Security

• All traffic runs over an encrypted HTTPS connection.
• Passwords are stored only as bcrypt hashes, never in readable form.
• Administrative access is protected by login rate-limiting and an audit log.
• All database queries are parameterised; uploaded images are re-encoded before storage.
• Regular backups are taken and are not reachable over the web.

8. Children

The platform is not intended for people under 16 and does not knowingly collect their data. If we become aware of such processing, we delete the data without delay.

9. Changes to this policy

Every change updates the date at the top of this page. Material changes are announced on the home page.