Privacy policy

Controller

NODUS ICT SOLUTIONS d.o.o., Dvadesetsedmog marta 9, 11050 Beograd (Zvezdara), Serbia, PIB 111833822, MB 21549053, operating the brand Balkania Tours. Contact for data protection questions: hello@balkaniatours.com.

We process personal data in line with the Law on Personal Data Protection of the Republic of Serbia and, for guests from the European Union, the GDPR.

What we collect and why

• Booking requests: name, email, phone, country of residence, notes you write, the tour, date and number of guests. Purpose: to check availability, confirm the booking, send payment details and meeting information. Legal basis: taking steps at your request before entering into a contract, and performing the contract.
• Quote requests and contact messages: name, email, phone if given, dates and the details you write. Purpose: to answer you. Legal basis: your request.
• Newsletter: email address. Purpose: occasional stories, at most once a month. Legal basis: your consent, which you can withdraw at any time by replying to any newsletter email.
• Invoices and payments: name, amount, reference and payment records, kept as required by accounting and tax law.
• Technical data: our server records IP addresses in logs for security and to limit spam on forms. We do not use advertising or analytics cookies. The contact page shows an embedded Google map, which Google may use to set its own cookies when you load that page.

Who receives the data

• The guide assigned to your tour receives your name, group size, phone and relevant notes.
• Service partners (hotels, rental companies, boat operators) receive the data needed for a service you have accepted.
• Our hosting provider and our email delivery provider process data on our behalf.
• When card payment is introduced, card data is entered only on the secure page of the payment processor and is never received or stored by us.

We do not sell personal data.

How long we keep it

Booking and payment records: as long as accounting and tax law requires (in Serbia, up to 10 years for accounting documents). Requests and messages that did not lead to a booking: up to 2 years. Newsletter addresses: until you unsubscribe.

Your rights

You can ask for access to your data, correction, deletion, restriction of processing, data portability, and object to processing. Where processing is based on consent, you can withdraw it at any time. Write to hello@balkaniatours.com; we reply within 30 days. You also have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia (poverenik.rs).

Security

The website uses an encrypted connection (HTTPS). Access to booking data is limited to the people who need it to run the tours.

Changes

If we change this policy, the new version is published on this page with the date of the change.