Privacy Policy
Version 1.0 · Valid from: [DATUM OBJAVE]
This policy explains what data we collect, why, how long we keep it and what rights you have. It is written so that every parent can understand it. If anything is unclear, write to us.
1. Who is the controller
[NAZIV PRAVNOG LICA], [ADRESA], Serbia, MB [MB], PIB [PIB]. Data protection contact: [privatnost@talenat.org].
Data protection officer: [IME ILI „nije imenovano"].
Representative in the European Union (Article 27 GDPR): [NAZIV I ADRESA PREDSTAVNIKA U EU – obavezno pre aktivnog nuđenja usluge u EU].
2. What data we collect
| Who | Data |
|---|---|
| Parent | first and last name, email, password (stored only in encrypted form), language, country, record of consents (which document, version, time, IP address) |
| Athlete (child) | first and last name, year of birth, sport, position, club, city and country, profile photograph, sports videos, description entered by the parent |
| Scout | first and last name, email, organisation, role, country, verification evidence |
| Everyone | messages and comments on the platform, reports and moderation decisions, data on the purchase of a Premium package (without card data) |
| Technical data | IP address, type of device and browser, login and error logs |
We do not collect precise location, health data, biometric data or other special categories of data. We do not use videos for facial recognition.
3. Why and on what legal basis
| Purpose | Legal basis |
|---|---|
| Opening and managing the account, displaying the profile, messages | Performance of a contract (Terms of Use) |
| Processing the child’s data and showing it to scouts | Consent of the parent or guardian |
| Scout verification, moderation, abuse prevention, child safety | Legitimate interest and protection of the child’s vital interests |
| Retaining evidence and cooperating with authorities | Legal obligation and the establishment, exercise or defence of legal claims |
| Billing and invoices | Performance of a contract and legal obligation (accounting) |
| Notifications about the account and changes to the rules | Performance of a contract |
| Marketing messages | Only with separate consent, which you can withdraw with one click |
4. Children
We process a child’s data only with the consent of a parent or guardian, regardless of the child’s age and country – in this way we also meet the strictest rules (Serbia: parental consent under 15 years; EU: up to 16 years depending on the country; USA – COPPA: under 13 years). Consent to show the profile to scouts is given separately and can be withdrawn at any time, after which the profile stops being visible.
A parent can at any time view, change, download or delete all of the child’s data.
5. To whom data is disclosed
- Verified scouts – the child’s profile and videos, in accordance with the parent’s consent. The scout does not see the parent’s contact details; they communicate through the platform.
- Processors working on our behalf, under a data processing agreement:
| Processor | Service | Data location |
|---|---|---|
| Supabase Inc. | Servicedatabase, user login | Data locationEU (Frankfurt, Germany) |
| Vercel Inc. | Servicewebsite hosting | Data locationglobal network, headquartered in the USA |
| BunnyWay d.o.o. (Bunny.net) | Servicestoring and displaying videos | Data locationEU (Slovenia), global CDN network |
| [Resend ili drugi] | Servicesending email | Data location[lokacija] |
| [PROCESOR PLAĆANJA] | Servicepayment | Data location[lokacija] |
- Competent authorities – when required by law or when a child’s safety is at risk.
We do not sell data and we do not share it with advertisers.
6. Transfers outside Serbia and the EU
Where a processor processes data outside Serbia or the EU (e.g. in the USA), the transfer is made with appropriate safeguards – standard contractual clauses or the EU–US Data Privacy Framework, in accordance with the Zakon o zaštiti podataka o ličnosti (Personal Data Protection Act) and the GDPR. You can request a copy of the safeguards at [privatnost@talenat.org].
7. How long we keep data
| Data | Period |
|---|---|
| Account, child’s profile, videos | while the account is active; after deletion removed within 30 days, including backups |
| An individual deleted video | removed from view immediately, from storage within 30 days at the latest |
| Profile of an athlete who has turned 18 | hidden immediately, deleted after 90 days if not downloaded |
| Inactive account (24 months without login) | notification, then deletion after 30 days if you do not log in |
| Record of consents | 3 years after account deletion (proof that consent was given) |
| Reports and moderation decisions | 1 year from the decision |
| List of permanently blocked addresses | for as long as the ban lasts, in protected (hashed) form |
| Evidence of sexual content or a criminal offence | until taken over by the competent authorities and until the proceedings end |
| Invoices and payment data | periods prescribed by accounting regulations (up to 10 years) |
| Technical logs | up to 90 days |
8. Your rights
You have the right to: access to data and a copy; rectification; erasure; restriction of processing; portability (download in a machine-readable form); objection to processing based on legitimate interest; withdrawal of consent at any time (this does not affect the lawfulness of earlier processing).
Send your request to [privatnost@talenat.org] or from the account settings. We respond without delay, within 30 days at the latest (exceptionally with an extension where the request is complex, of which we notify you).
Right to complain: Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti (Commissioner for Information of Public Importance and Personal Data Protection), Bulevar kralja Aleksandra 15, 11000 Beograd, www.poverenik.rs. Users from the EU can also contact the supervisory authority of their country.
9. Security
We maintain a written information security programme and review it at least once a year. Measures include: an encrypted connection (HTTPS) and encryption of data in storage; access rules at database level, so that each user sees only what they are allowed to; temporary protected links for videos and a watermark; limited access for employees on a “need-to-know” basis; two-factor login for administrators; a log of all administrative actions.
In the event of a personal data breach we notify the Commissioner within 72 hours, and affected users without delay where there is a high risk to their rights.
10. How we rank profiles
In search, scouts are shown first the profiles with a Premium package (marked “Premium”), then the others, according to the filters the scout selects (sport, country, age, position) and the date of the last update. We do not use profiling or automated decisions that have legal consequences for users.
11. Cookies
We use only necessary cookies – for logging in to the account, security and the selected language. We do not use cookies for ads or analytics. If we introduce them in the future, we will ask for your consent before switching them on.
12. Changes to the policy
We notify you of material changes by email and in the application at least 15 days in advance. The version and the date it takes effect are stated at the top.