ĐINA'S DOO Novi Sad
Privacy policy
1. Who we are and what this Policy covers
The controller of your personal data is:
- Business name: ĐINA'S DOO Novi Sad
- Registered office: Bulevar oslobođenja 88, 21000 Novi Sad, Republic of Serbia
- Company registration number: 66187799
- Tax ID (PIB): 112559171
- Entry number in the Register of Real Estate Brokers: 269
- Legal representative: Đina Mandić
- Email: nekretnine@djinas.rs
- Phone: +381 21 472 4444
(hereinafter: “ĐINA'S”, “we” or the “Controller”)
This Privacy Policy explains what personal data we collect, why, on what basis, who we share it with, how long we keep it and what rights you have. It applies to:
- visitors to the djinas.rs website;
- buyers, sellers, tenants and landlords of real estate we work with or who contact us;
- people interested in the Greek “golden visa” service;
- people who contact us by phone, email or social media.
Applicable law. We process data in accordance with the Law on Personal Data Protection (“Official Gazette of the RS”, No. 87/2018; hereinafter: the “LPDP”). Because we offer real estate in Greece and Slovenia and the site is also available in Greek, the processing of data of people located in the European Union is also subject to the General Data Protection Regulation (EU) 2016/679 (hereinafter: the “GDPR”), in accordance with its Article 3(2). For each legal basis and right in this Policy, we cite the corresponding provision of the LPDP and the GDPR.
Representative in the EU. In accordance with Article 27 of the GDPR, we have appointed a representative in the European Union, whom people in the EU and supervisory authorities may contact on any matter relating to data processing: M&N-IRE, d.o.o., Koper, Slovenia
We have not appointed a data protection officer, as there is no legal obligation to do so (Art. 56 LPDP / Art. 37 GDPR). For any privacy question, write to us at privatnost@djinas.rs.
2. What data we collect
We collect only the data we need to broker the sale and rental of real estate, to communicate with you and to meet our legal obligations.
| Category | Data | Source |
|---|---|---|
| Enquiries and contact | first and last name, phone, email, the property you are interested in, the content of your message | you, via the form on the site, phone, email or social media |
| Listing a property for sale or rent | first and last name, contact details, address and description of the property, price, photos, ownership details | you, via the “Tell us about your property” form or in person |
| Brokerage agreement and transaction | details from your ID card or passport, personal identification number (JMBG), address, property and ownership details, contract details, viewing records | you; public registers (real estate cadastre) |
| Anti-money laundering | a copy of your identity document, details of the beneficial owner, source of funds and politically exposed person status | you; public records (see section 4) |
| Greek golden visa | first and last name, contact details, planned investment amount, number of family members; later in the process also passport details and details of family members | you (see section 5) |
| Technical data | IP address, approximate location derived from the IP address, device and browser type, language, site usage data | automatically, when you use the site (see section 10) |
We do not ask for special categories of personal data (e.g. data about health, religion or ethnic origin). Please do not include them in your messages.
3. Why we process data and on what basis
| Purpose | Legal basis | LPDP / GDPR |
|---|---|---|
| Replying to an enquiry about a property or service, scheduling viewings | steps taken at your request before entering into a contract | Art. 12(1)(2) / Art. 6(1)(b) |
| Concluding and performing the brokerage agreement, advertising your property, preparing the sale or lease | performance of a contract | Art. 12(1)(2) / Art. 6(1)(b) |
| Keeping the broker records required by the Law on Brokerage in the Sale and Lease of Real Estate | legal obligation | Art. 12(1)(3) / Art. 6(1)(c) |
| Actions and measures to prevent money laundering and terrorist financing | legal obligation | Art. 12(1)(3) / Art. 6(1)(c) |
| Issuing invoices and keeping business books | legal obligation | Art. 12(1)(3) / Art. 6(1)(c) |
| Showing the site in the right language based on approximate location, site security | legitimate interest | Art. 12(1)(6) / Art. 6(1)(f) |
| Visit analytics (Google Analytics) and targeted advertising (Meta Pixel) | your consent, given through the cookie banner | Art. 12(1)(1) / Art. 6(1)(a) |
| Sending property offers that match your requirements after your original enquiry is closed | your consent | Art. 12(1)(1) / Art. 6(1)(a) |
| Establishing and defending legal claims, including collecting commission | legitimate interest | Art. 12(1)(6) / Art. 6(1)(f) |
Where we rely on legitimate interest, we have assessed that it does not override your interests and rights; you have the right to object to that processing. You may withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal.
We do not make decisions based solely on automated processing, including profiling, that would have legal effects on you (Art. 38 LPDP / Art. 22 GDPR).
4. Prevention of money laundering and terrorist financing
As a real estate broker, we are an obliged entity under the Law on the Prevention of Money Laundering and the Financing of Terrorism. The law requires us, before concluding a transaction, to:
- establish and verify your identity, by inspecting your identity document and keeping a copy of it;
- identify the beneficial owner, if you act on behalf of a legal entity;
- check whether you are a politically exposed person or a family member of one;
- in certain cases, collect information on the source of funds.
We process this data solely to meet a legal obligation (Art. 12(1)(3) LPDP / Art. 6(1)(c) GDPR) and keep it for the period prescribed by that law. If you do not provide it, we cannot conclude a contract or take part in the transaction. The law also requires us, in prescribed cases, to submit data to the Administration for the Prevention of Money Laundering, without informing the person the data relates to.
5. Greek golden visa and real estate abroad
For people interested in buying property in Greece or Slovenia, or in the Greek “golden visa”, we initially process only the data from the enquiry form: name, contact details, planned investment amount and number of family members. We need the investment amount and the number of family members to suggest suitable properties and estimate the costs of the process.
If you decide to buy, the further process also involves passport details, details of family members (including minor children) and information on the source of funds. We pass this data on to:
- a lawyer in Greece, Christina Kafkaletou, Athens, Greece, who reviews each case and represents you in the process, as an independent controller;
- a partner real estate agency in Greece or Slovenia, to carry out the purchase;
- the competent authorities of the Hellenic Republic, when submitted by you or your lawyer.
You provide us with the data of your family members. Please inform them of this Policy. The data of minor children is provided by their parents or guardians, and we process it only to the extent needed for the process.
6. Who we share data with
We do not sell your data. We share it only when it is needed for the work you have entrusted to us or when the law requires it.
| Recipient | Purpose | Role |
|---|---|---|
| The other contracting party (buyer, seller, tenant, landlord) and their broker | carrying out the sale or lease | independent controller |
| Notary public, lawyer, real estate cadastre | certifying contracts, registering rights | independent controller |
| Lawyer and partner agencies in Greece and Slovenia | buying property abroad, Greek golden visa | independent controller |
| Real estate listing portals To be added | publishing listings of your property (without your contact details, unless agreed otherwise) | independent controller |
| Hosting, email and CRM service providers Must be added | technical support for the business | processor |
| Accounting agency [To be added] | keeping business books | processor |
| Google (Analytics), Meta (Pixel), MaxMind (GeoLite) | analytics, advertising, showing the language | see sections 7 and 10 |
| Administration for the Prevention of Money Laundering, courts, tax and other competent authorities | when required by law | independent controller |
We have concluded data processing agreements with our processors (Art. 45 LPDP / Art. 28 GDPR).
7. Transfers of data outside Serbia
We transfer data outside the Republic of Serbia in the following cases:
- to Greece and Slovenia, when we broker the purchase of property in those countries. EU member states ensure an adequate level of protection (Art. 64 LPDP), so no special authorisation is required;
- to the USA, when you use the site, if you have consented to analytics and marketing cookies (Google, Meta). The transfer relies on standard contractual clauses (Art. 65 LPDP / Art. 46 GDPR), or on the European Commission's adequacy decision for recipients certified under the EU–US Data Privacy Framework (Art. 45 GDPR).
For people in the EU: the Republic of Serbia is not a country for which the European Commission has adopted an adequacy decision. We therefore apply GDPR standards to the processing of your data in Serbia, and the obligations under the GDPR bind us directly (Art. 3(2) GDPR).
On request, we will provide you with information on the safeguards applied.
8. How long we keep data
We keep data only as long as needed for the purpose it was collected for, or as long as the law requires (Art. 5(1)(5) LPDP / Art. 5(1)(e) GDPR). When the period expires, we delete the data or permanently anonymise it.
| Data | Retention period |
|---|---|
| Data collected to prevent money laundering | 10 years from the end of the business relationship or the execution of the transaction, in accordance with the Law on the Prevention of Money Laundering and the Financing of Terrorism |
| Brokerage agreements and broker records | for the periods prescribed by the Law on Brokerage in the Sale and Lease of Real Estate, and at least until the limitation period for contractual claims expires |
| Invoices and accounting documents | for the periods prescribed by the Law on Accounting |
| Enquiries that did not lead to a contract | [12 months] from the last communication |
| Property listings for which no brokerage agreement was concluded | [12 months] from the listing |
| Data for sending offers based on consent | until consent is withdrawn |
| Analytics data (Google Analytics) | [14 months] |
If data is needed for a dispute or proceedings before a competent authority, we keep it until the proceedings are finally concluded.
9. Your rights
| Right | What it means | LPDP / GDPR |
|---|---|---|
| Access | to find out whether we process your data and receive a copy of it | Art. 26 / Art. 15 |
| Rectification and completion | to have inaccurate data corrected or incomplete data completed | Art. 29 / Art. 16 |
| Erasure | to have your data deleted when it is no longer needed, when you withdraw consent or when the processing is unlawful, unless the law requires us to keep it | Art. 30 / Art. 17 |
| Restriction of processing | to have processing temporarily suspended, e.g. while we check the accuracy of the data | Art. 31 / Art. 18 |
| Portability | to receive the data you gave us, which we process on the basis of a contract or consent, in a machine-readable format, or to have it transferred to another controller | Art. 36 / Art. 20 |
| Objection | to object to processing based on legitimate interest; if you object to direct marketing, we always stop the processing | Art. 37 / Art. 21 |
| Withdrawal of consent | at any time, without affecting the lawfulness of processing before the withdrawal | Art. 15(3) / Art. 7(3) |
| Complaint to a supervisory authority | if you believe the processing is unlawful (section 11) | Art. 82 / Art. 77 |
| Judicial remedy | a lawsuit against the controller, independently of a complaint | Art. 84 / Art. 79 |
How to exercise your rights. Send a request to privatnost@djinas.rs, by post to our registered office or, if you are in the EU, to our representative in the EU. We may ask for additional information to confirm your identity.
We will reply without delay, and at the latest within 30 days of receiving the request. In complex cases we may extend this period by a further 60 days, and will let you know within the first 30 days (Art. 21 LPDP / Art. 12(3) GDPR). Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.
We cannot honour the right to erasure for data we are required to keep under anti-money laundering rules until the legal period has expired.
10. Cookies and analytics
Cookies are small text files that a site places on your device. On this site we use:
- necessary cookies, without which the site does not work (e.g. remembering the language you chose and your cookie choice). No consent is needed for these;
- analytics cookies (Google Analytics), which help us understand how the site is used;
- marketing cookies (Meta Pixel), which make it possible to show ads on Facebook and Instagram to people who have visited the site.
We set analytics and marketing cookies only if you consent to them through the banner, and only after you consent. You can refuse consent with a single click on “Reject all” or withdraw it at any time through the “Cookie settings” link at the bottom of the site.
You can change your choice at any time:
Approximate location. This product includes GeoLite Data created by MaxMind, available from https://www.maxmind.com. To show you the site in the right language, we use your IP address to determine the country you are visiting from, using the MaxMind GeoLite database hosted on our own server. We do not determine your exact location and we do not store this information.
11. Contact and complaints
For any questions and requests concerning personal data:
- email: privatnost@djinas.rs
- post: ĐINA'S DOO Novi Sad, Bulevar oslobođenja 88, 21000 Novi Sad, Serbia
- phone: +381 21 472 4444
- representative in the EU: Nest Seekers Greece, Athens, Greece
If you believe the processing of your data is unlawful, you can lodge a complaint with:
- the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11120 Belgrade, Serbia, www.poverenik.rs;
- if you are in the EU, the supervisory authority of the member state where you live or work, or where the infringement took place (Art. 77 GDPR), for example the Hellenic Data Protection Authority (www.dpa.gr) or the Information Commissioner of the Republic of Slovenia (www.ip-rs.si).
We recommend that you contact us first, so that we can try to resolve the issue.
12. Minors
Our services are not intended for people under 15, and we do not knowingly collect their data through the site (Art. 16 LPDP; for people in the EU, Art. 8 GDPR). We process the data of minor children in the Greek golden visa process as described in section 5.
13. Data security
We apply technical, organisational and staffing measures appropriate to the risk (Art. 50 LPDP / Art. 32 GDPR): an encrypted connection on the site (HTTPS), access to data only for authorised employees bound by confidentiality, protection of identity documents collected to prevent money laundering, and processing agreements with all our processors.
In the event of a personal data breach, we will notify the competent supervisory authority within 72 hours of becoming aware of it, and notify you without undue delay where the breach is likely to result in a high risk to your rights (Arts. 52 and 53 LPDP / Arts. 33 and 34 GDPR).
14. Changes to this Policy
We may change this Policy when we introduce new services or tools or when the law changes. The current version is always published on this page, with the date of the last change.
Last updated: 29 September 2026.