Ko je rukovalac podataka

DRAGAN ANTIĆ PR PSEUDOCODE STUDIO (PIB 111671714, MB 65582651), preduzetnik registrovan u Republici Srbiji. Kao rukovalac, odlučujemo o tome kako i zašto se obrađuju podaci o tvom nalogu, u skladu sa Zakonom o zaštiti podataka o ličnosti (Sl. glasnik RS 87/2018) i GDPR-om kada se primenjuje. Za podatke o tvojim klijentima koje uneseš u aplikaciju, rukovalac si ti — videti tačku 5.

Kontakt za pitanja privatnosti: [email protected]

Šta prikupljamo

• Podaci o nalogu — ime, prezime, korisničko ime, email, lozinka (obrađuje je isključivo Firebase Authentication — mi je ne vidimo niti čuvamo). Opcionalno: avatar, kratka biografija.
• Kartoni klijenata — ime, kontakt (telefon/email), tip kože, alergije i kontraindikacije, istorija tretmana. Ove podatke unosiš ti, ne tvoj klijent.
• Fotografije — profilne i tretmanske fotografije (pre/posle) koje sam otpremiš.
• Pigment formule i beleške o tretmanu — recepture, boje, tehnike, beleške.
• Termini — zakazivanja i podaci vezani za kalendar.
• Digitalne saglasnosti — formulari pristanka koje tvoji klijenti potpisuju.
• Push token uređaja — tehnički identifikator za slanje notifikacija (Firebase Cloud Messaging).

Ne prikupljamo analitičke ni marketinške podatke o korišćenju aplikacije i ne pratimo te van aplikacije.

Zašto ih koristimo

• Podaci o nalogu — da bi prijava i korišćenje aplikacije radili.
• Kartoni, formule, fotografije i saglasnosti — da bi ti vodio/vodila evidenciju svog poslovanja; ovo su tvoji radni podaci.
• Kontakt podaci klijenata — radi zakazivanja i komunikacije koju ti pokrećeš.
• Podaci o kontraindikacijama — radi bezbednosti tretmana koje izvodiš.
• Push token — da ti stignu podsetnici i obaveštenja koja uključiš.

Podatke ne koristimo za oglašavanje niti ih prodajemo.

Pravni osnov

Za podatke o tvom nalogu: izvršenje ugovora (Uslovi korišćenja) i naš legitimni interes za bezbedno funkcionisanje servisa. Za podatke o tvojim klijentima: obrađujemo ih isključivo po tvom nalogu, kao obrađivač — pravni osnov obezbeđuješ ti kao rukovalac (po pravilu saglasnost klijenta i tvoj legitimni interes vođenja poslovanja).

Podaci o tvojim klijentima — posebna napomena

Podatke koje uneseš o svojim klijentima PMUdesk obrađuje isključivo u tvoje ime, po tvom nalogu, kao obrađivač podataka. Ne pristupamo tim podacima osim radi tehničke podrške ili kada je to zakonom obavezno, i ne koristimo ih u sopstvene svrhe.

Podaci o zdravstvenom stanju (alergije, kontraindikacije) spadaju u posebnu kategoriju podataka (čl. 17 ZZPL, odnosno čl. 9 GDPR). Kao rukovalac, dužan/dužna si da pre unosa pribaviš izričitu saglasnost klijenta — za to služe digitalni obrasci saglasnosti u aplikaciji ili tvoj sopstveni obrazac u papiru.

Sa kim delimo podatke

Podatke ne prodajemo i ne delimo ni sa kim osim sa tehničkim podizvođačima bez kojih servis ne bi radio:

• Hosting i baza podataka — sopstvena serverska infrastruktura kod Hetzner Online GmbH (Nemačka, EU).
• Autentikacija i push notifikacije — Firebase (Google LLC) za prijavu na nalog i slanje notifikacija.
• Čuvanje fotografija — Cloudinary za profilne i tretmanske fotografije koje sam otpremiš.

Aplikacija nudi i prečice za poziv, SMS ili WhatsApp poruku klijentu — one se izvršavaju direktno na tvom uređaju, kroz tvoje aplikacije; ti podaci ne prolaze kroz naše servere.

Prenos podataka van Srbije i EU

Baza podataka je u EU (Nemačka). Google i Cloudinary mogu obrađivati pojedine podatke (autentikacija, push, fotografije) na serverima van EU, uključujući SAD. Takav prenos vrši se uz odgovarajuće zaštitne mere — standardne ugovorne klauzule (SCC) koje ovi provajderi primenjuju u svojim ugovorima o obradi podataka.

Koliko dugo čuvamo

• Podaci o nalogu — dok je nalog aktivan, i najduže 30 dana nakon brisanja naloga.
• Podaci o klijentima uneti u aplikaciju — dok ih ti (rukovalac) ne obrišeš ili dok je tvoj nalog aktivan.
• Kada obrišeš klijenta ili podatak, on se najpre označava kao obrisan (nije više vidljiv ni dostupan u aplikaciji), a trajno se uklanja iz sistema najkasnije u roku od 30 dana.

Tvoja prava

Imaš pravo na pristup, ispravku, brisanje, ograničenje obrade, prenosivost podataka i prigovor na obradu. Zahtev šalješ na [email protected] — odgovaramo najkasnije u roku od 30 dana, obično znatno brže. Imaš i pravo pritužbe Povereniku za informacije od javnog značaja i zaštitu podataka o ličnosti.

Za podatke koje je o tebi uneo tvoj PMU majstor (ako si klijent salona) — obrati se najpre svom majstoru, koji je rukovalac tih podataka; mi ćemo mu pružiti tehničku podršku da tvoj zahtev ispuni.

Bezbednost

Prijavu i lozinku obrađuje Firebase Authentication — PMUdesk ne čuva tvoju lozinku. Sve komunikacije idu preko šifrovane veze (TLS/HTTPS). Podaci svakog studija su tehnički izolovani od podataka drugih studija, promene nad kartonima klijenata se evidentiraju, a pristup produkcijskoj bazi je ograničen po principu najmanjih privilegija.

Maloletnici

PMUdesk nije namenjen licima mlađim od 18 godina i svesno ne prikupljamo njihove podatke. Nalog mogu otvoriti samo punoletni PMU profesionalci.

Kolačići i lokalno skladištenje

Veb aplikacija koristi isključivo neophodne, funkcionalne kolačiće i lokalno skladištenje: sesiju prijave, izbor jezika i teme — bez analitičkih ili marketinških kolačića trećih strana. Mobilna aplikacija ne koristi kolačiće niti tehnologije praćenja.

Sajt pmudesk.com koristi Google Analytics 4 (Google LLC) za agregiranu statistiku poseta — kolačiće _ga i _ga_*. Ovi kolačići se postavljaju isključivo uz tvoju prethodnu saglasnost, koju tražimo cookie banerom pri prvoj poseti sajtu. Saglasnost možeš povući brisanjem kolačića i lokalnog skladištenja iz podešavanja pregledača — pri sledećoj poseti ćemo ti ponovo prikazati baner.

Push notifikacije

Push notifikacije (podsetnici za termine i korekcije) su opcionalne — uključuješ ih i isključuješ u podešavanjima aplikacije ili uređaja, u svakom trenutku.

Izmene politike

Ovu politiku povremeno menjamo. O značajnim izmenama te obaveštavamo unutar aplikacije najmanje 14 dana pre stupanja na snagu, a datum poslednje izmene uvek stoji na vrhu dokumenta.

Who is the data controller

DRAGAN ANTIĆ PR PSEUDOCODE STUDIO (Tax ID/PIB 111671714, Reg. No./MB 65582651), a sole proprietor registered in the Republic of Serbia. As the controller, we decide how and why your account data is processed, in accordance with the Serbian Personal Data Protection Act (Official Gazette RS 87/2018) and the GDPR where applicable. For your clients' data that you enter into the app, you are the controller — see section 5.

Privacy contact: [email protected]

What we collect

• Account data — first and last name, username, email, password (handled exclusively by Firebase Authentication — we never see or store it). Optional: avatar, short bio.
• Client records — name, contact details (phone/email), skin type, allergies and contraindications, treatment history. This data is entered by you, not by your client.
• Photos — profile and treatment (before/after) photos that you upload.
• Pigment formulas and treatment notes — recipes, colours, techniques, notes.
• Appointments — scheduling and calendar-related data.
• Digital consents — consent forms signed by your clients.
• Device push token — a technical identifier for delivering notifications (Firebase Cloud Messaging).

We do not collect analytics or marketing data about your app usage, and we do not track you outside the app.

Why we use it

• Account data — so that sign-in and the app itself work.
• Records, formulas, photos and consents — so that you can run your business; this is your working data.
• Client contact details — for scheduling and communication that you initiate.
• Contraindication data — for the safety of the treatments you perform.
• Push token — so that reminders and notifications you enable can reach you.

We never use data for advertising and we never sell it.

Legal basis

For your account data: performance of a contract (the Terms of Service) and our legitimate interest in running the service securely. For your clients' data: we process it solely on your instructions, as a processor — the legal basis is provided by you as the controller (typically your client's consent and your legitimate interest in running your business).

Your clients' data — special note

Data you enter about your clients is processed by PMUdesk solely on your behalf and on your instructions, as a data processor. We do not access it except for technical support or where required by law, and we never use it for our own purposes.

Health-related data (allergies, contraindications) is a special category of personal data (Art. 17 of the Serbian PDPA / Art. 9 GDPR). As the controller, you must obtain your client's explicit consent before entering it — the in-app digital consent forms, or your own paper form, exist for exactly this purpose.

Who we share data with

We do not sell data, and we share it only with technical subprocessors without whom the service could not run:

• Hosting and database — our own server infrastructure at Hetzner Online GmbH (Germany, EU).
• Authentication and push notifications — Firebase (Google LLC) for account sign-in and notification delivery.
• Photo storage — Cloudinary, for profile and treatment photos you upload.

The app also offers shortcuts to call, text or WhatsApp a client — these run directly on your device, through your own apps; that data never passes through our servers.

Data transfers outside Serbia and the EU

The database is hosted in the EU (Germany). Google and Cloudinary may process some data (authentication, push, photos) on servers outside the EU, including the US. Such transfers rely on appropriate safeguards — the Standard Contractual Clauses (SCCs) these providers apply in their data processing agreements.

How long we keep it

• Account data — while your account is active, and no longer than 30 days after account deletion.
• Client data entered into the app — until you (the controller) delete it, or while your account is active.
• When you delete a client or a record, it is first marked as deleted (no longer visible or accessible in the app) and permanently removed from our systems within 30 days at the latest.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing. Send requests to [email protected] — we respond within 30 days at the latest, usually much sooner. You also have the right to lodge a complaint with the Serbian Commissioner for Information of Public Importance and Personal Data Protection.

If you are a salon client and your PMU artist entered data about you — contact your artist first, as they are the controller of that data; we will provide them technical support to fulfil your request.

Security

Sign-in and passwords are handled by Firebase Authentication — PMUdesk never stores your password. All communication is encrypted in transit (TLS/HTTPS). Each studio's data is technically isolated from other studios, changes to client records are logged, and access to the production database is restricted on a least-privilege basis.

Minors

PMUdesk is not intended for anyone under 18, and we do not knowingly collect their data. Accounts may only be opened by adult PMU professionals.

Cookies and local storage

The web app uses only essential, functional cookies and local storage: your sign-in session, language and theme preferences — no third-party marketing or analytics cookies. The mobile app uses no cookies or tracking technologies.

The pmudesk.com website uses Google Analytics 4 (Google LLC) for aggregated visit statistics — cookies named _ga and _ga_*. These cookies are only set with your prior consent, which we ask for via a cookie banner on your first visit to the site. You can withdraw consent by clearing cookies and local storage in your browser settings — we'll show you the banner again on your next visit.

Push notifications

Push notifications (appointment and touch-up reminders) are optional — you can turn them on or off at any time in the app or device settings.

Changes to this policy

We update this policy from time to time. We notify you of significant changes inside the app at least 14 days before they take effect, and the date of the last update is always shown at the top of the document.