Privacy policy
Version 1.0 · Effective from 28 October 2026
This is a translation. The Serbian version is legally binding; if the texts differ, the Serbian version prevails.
1. Who processes your data
1.1. The controller of your personal data is Kafeterija&Love&Brands d.o.o., with its registered office in Belgrade, Studentski trg 15, 11000 Belgrade, company registration number 20982187, tax ID (PIB) 108353310 (“Kafeterija”, “we”).
1.2. For any question about privacy and to exercise your rights, contact us at aplikacija@kafeterija.com or in writing at [ADDRESS], marked “Data protection”. [Data protection officer: NAME, CONTACT — CONFIRM whether one is appointed.]
1.3. This policy applies to visitors of the kafeterija.com website, customers of the online shop, users of the Subscribe subscription, members of the loyalty programme, recipients of promotional messages, people who contact us with a complaint or enquiry, and employees of business customers who have been assigned a Subscribe plan. Video surveillance in our cafés is covered by a separate notice displayed in the café.
2. What data we process, why and on what basis
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| User account | Name and surname, e-mail, phone, date of birth [IF ASKED FOR], password (encrypted), addresses, settings | Performance of a contract (use of the account) | While the account exists, and then [12 months] to resolve any disputes |
| Purchases in the online shop | Customer and address details, order contents, amount, payment method, payment and delivery status | Performance of a contract; legal obligation (accounting, fiscalisation) | Accounting records for the periods set by accounting and tax regulations [TO CONFIRM WITH THE ACCOUNTANT]; everything else [3 years] |
| Subscribe subscription | Plan, activation and renewal dates, history of charges, pauses and cancellations | Performance of a contract | During the subscription and [3 years] after it ends; accounting data as regulations require |
| Card payment and recurring charges | Card token, last 4 digits, card type, transaction ID and status (we never receive the full card number) | Performance of a contract | While the subscription lasts; transaction data as regulations require |
| Delivery | Name, address, phone, note for the courier | Performance of a contract | Until delivery and [2 years] for complaints |
| Loyalty programme | Points balance and history, membership level, purchase history | Performance of a contract (joining the programme) | While the membership lasts and [12 months] after |
| Personalised offers | Purchase history, favourite products and cafés, responses to messages | Consent | Until consent is withdrawn |
| Newsletter and promotional messages (e-mail, SMS) | E-mail, phone, record of consent and unsubscription | Consent | Until consent is withdrawn; proof of consent and unsubscription for a further [RETENTION PERIOD] |
| Complaints and customer support | Contact details, proof of purchase, description of the problem, correspondence, photos | Legal obligation (complaints register); performance of a contract | Complaints register at least 2 years; other correspondence [2 years] |
| Withdrawal from the contract and refunds | Data from the withdrawal statement | Legal obligation; performance of a contract | [3 years] |
| Security and fraud prevention | IP address, sign-in logs, device data, suspicious transactions | Legitimate interest (protecting users and systems) | [12 months], unless a specific incident requires longer |
| Measuring visits to the website, without cookies | Pages visited, where the visit came from, device and browser type, country and city derived from the IP address. We do not store the IP address, and the data stays on our own server | Legitimate interest (improving the website and the shop) | [25 months] |
| Analytics and marketing on the website | Cookie and device identifiers, data on visits and use | Consent | According to the cookie lifetime (Cookie policy) |
| Device location [IF USED] | Approximate location, only while the page is open, to show the nearest cafés | Consent (permission in the browser or phone) | Not stored |
| Business customers (B2B) | Details of contact persons and the Administrator; name and work e-mail of employees assigned a plan | Performance of the contract with the business customer; legitimate interest | During the contract and [3 years] after |
2.1. We do not ask for your consent for processing that is necessary for purchases, subscriptions and delivery, because its basis is the contract you conclude with us. We ask for consent only for promotional messages, personalised offers, optional cookies and location, and that processing is not a condition for using our services.
3. Where we get data from
3.1. We mostly get data directly from you. We collect some technical data automatically, and for optional technologies only after your consent. Data of employees who have been assigned a business Subscribe plan comes from their employer (name and work e-mail).
4. Is providing data mandatory
4.1. Data marked as required in a form is necessary to open an account, make a purchase or subscribe, and we cannot provide the service without it. Providing other data is voluntary.
5. Who we share data with
5.1. We do not sell data. We share it only to the extent needed for the purposes above:
| Recipient | Purpose | Role |
|---|---|---|
| Banca Intesa a.d. Beograd (AllSecure payment gateway) | Processing card payments DinaCard, Visa, Mastercard, recurring charges, refunds | [PAYMENT PROVIDER ROLE] |
| Scops Loyalty [FULL NAME AND SEAT] | Technical support for user accounts, the Subscribe subscription and the loyalty programme | Processor |
| D Express | Delivering parcels | [Processor / independent controller — TO CONFIRM] |
| [HOSTING / E-COMMERCE PLATFORM] | Hosting the website and online shop | Processor |
| [E-MAIL / SMS PLATFORM] | Sending notifications and promotional messages | Processor |
| [Meta Platforms, Google and others as per the scan] | Analytics and advertising, only with consent | Under the provider's terms |
| Accounting firm, lawyers, auditors | Statutory and professional services | Processors or independent controllers, bound by confidentiality |
| Public authorities | Only when the law requires it | Independent controllers |
6. Transfers of data to other countries
6.1. Some of our partners (for example, cloud, analytics and advertising service providers) may process data outside the Republic of Serbia. We make such transfers only to countries that ensure an adequate level of protection, or with appropriate safeguards under the Personal Data Protection Act, such as the standard contractual clauses adopted by the Commissioner. [CONFIRM ALL TRANSFERS AND SAFEGUARDS FOR EACH PARTNER.] You can get more information at aplikacija@kafeterija.com.
7. Automated decision-making and profiling
7.1. Your loyalty programme membership level is set automatically, by the number of points collected, as described in the Loyalty Programme Rules. If you have consented to personalised offers, we automatically choose the offers we show you based on your purchase history. We do not make decisions that produce legal effects or significantly affect you based solely on automated processing.
8. Your rights
- Access: to find out whether we process your data and to get a copy of it;
- Rectification and completion: of inaccurate or incomplete data (you can change most of it yourself in your Account);
- Erasure: when the data is no longer needed, when you withdraw consent or when other legal conditions are met, except data we must keep by law;
- Restriction of processing: in the cases provided by law;
- Portability: to receive the data you gave us in a structured, machine-readable format, when it is processed on the basis of consent or a contract;
- Objection: to processing based on legitimate interest. You can object at any time to processing for direct marketing, including profiling, and we then stop such processing;
- Withdrawal of consent: at any time, without affecting the lawfulness of processing before the withdrawal: through the unsubscribe link, in your Account or cookie settings, or at aplikacija@kafeterija.com;
- Complaint to the Commissioner: Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11000 Belgrade, www.poverenik.rs.
8.1. You can send a request to aplikacija@kafeterija.com. We reply without delay and within 30 days at the latest. That period may be extended by a further 60 days in accordance with the law, in which case we inform you. To protect your data, we may ask for additional information to confirm your identity.
9. Minors
9.1. An account may be opened by people who have reached the age of 16. Consent to promotional messages and optional cookies may be given by people who have reached the age of 15. Payment and the Subscribe subscription are available to adults only.
10. Security
10.1. We apply technical and organisational safeguards proportionate to the risk, including encrypted communication, access control and logging, tokenisation of payment data at the payment service provider and contractual obligations of our partners. In the event of a data breach we act in accordance with the law, including notifying the Commissioner and, where necessary, the people the data relates to.
11. Changes to this policy
11.1. We may change this policy because of changes to our services or to regulations. The effective date is shown at the top. We inform you of material changes by e-mail or on the website before they apply.