Privacy policy

Effective from October 29, 2026. This is a translation; the Serbian version prevails.

Uredno is a web application for issuing invoices, keeping the KPO book and tracking the tax obligations of flat-tax entrepreneurs (paušalci) in Serbia. This policy explains which personal data we process, why, for how long and what your rights are, under the Serbian Personal Data Protection Act (Official Gazette 87/2018, “ZZPL”).

1. Who the controller is

[LEGAL_OPERATOR], [LEGAL_ADDRESS], [LEGAL_ID]. For anything about your data, write to info@uredno.site.

2. Two roles

• For your account data (email, name, password) we are the controller.
• For the data you enter about your business and your clients (invoices, clients, documents) you are the controller. We process it only on your behalf and only to run the application, as a processor under Article 45 ZZPL. We use it for nothing else, never sell it and do not look at it unless you ask us to for support or the law requires it.

3. What we process

• Account: email address, name (if you enter one), your password as a bcrypt hash (we never know the password itself), sign-up date, confirmations of your address and of accepting these terms.
• Business data you enter: company details (name, address, tax and registration numbers, bank accounts, signature, logo), clients, invoices, proformas, payments, the KPO book, tax obligations and payments, deadlines, templates, the service catalogue and documents you upload.
• Technical data: the session cookie; your notification subscription (the push service address), a record of notifications and emails sent (to whom, when, subject); for an invoice’s public link, the number of openings and the time of the first and last, with no IP address and no device details.

We use no analytics, advertising cookies or tracking tools.

4. Purpose and legal basis

• Providing the service under the Terms of use (performance of a contract, Article 12(1)(2) ZZPL): the account, storing and processing your data, emailing invoices when you ask, notifications you turn on.
• Security and preventing abuse (legitimate interest, Article 12(1)(6) ZZPL): limits on attempts, one-time links for confirming your address and changing your password.

Emails sent by the application itself (address confirmation, password change) are part of the service. We send no marketing without your separate consent.

5. Who else processes data

• Railway Corporation (USA): server and database. Data centre: [HOSTING_REGION].
• Brevo (Sendinblue SAS, France): sending email, that is the recipient’s address, the message and its attachment.
• Browser push services (Google, Apple, Mozilla, Microsoft): only the encrypted notification, if you turn notifications on.
• Google Fonts and cdnjs (Cloudflare): fonts and libraries. Loading them, your browser sends its IP address to those services.
• National Bank of Serbia: the application downloads its exchange rate list. None of your data is sent to the NBS.

Data transferred outside Serbia goes to countries with an adequate level of protection or under the safeguards of Articles 63 to 65 ZZPL.

6. How long

For as long as you have an account. When you delete it (Settings → Delete account), all data is removed from the database at once and from backups within 30 days at the latest. One-time links expire within one to 24 hours.

Keeping your business records, such as the KPO book, is your obligation as the taxpayer. Download your data before deleting the account.

7. Security

Each account sees only its own data. Passwords are stored as bcrypt hashes, the connection is encrypted (HTTPS), the session sits in a cookie scripts cannot read, and uploaded files are checked by their content. No system is perfectly secure: if a breach may put your rights at risk, we will tell you and the Commissioner as the law requires.

8. Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability (Settings → Download all data), and the right to object. To exercise them, write to info@uredno.site; we answer within 30 days. You may also complain to the Commissioner for Information of Public Importance and Personal Data Protection (www.poverenik.rs).

9. Cookies and local storage

We use one necessary cookie, for signing in. Your browser keeps your theme and language choice. There are no other cookies, so we do not ask for cookie consent.

10. Changes

We will tell you about material changes to this policy in the application or by email before they take effect.