Privacy Policy

1. Controller

The data controller is Pole Art Studio Eerie, Višegradska 4, 11000 Belgrade, company number 28761970, tax id (PIB) 115676627. For data questions write to contact@eeriepole.com. This policy explains what data we process, why, and what rights you have under the Serbian Personal Data Protection Act (ZZPL) and the GDPR.

2. What data we process

We process:

• your name and email address;
• your date of birth;
• your phone number, if you enter one;
• your chosen language and display settings;
• your bookings and attendance;
• the packages and payments recorded at the studio.

We process no special categories of data and make no automated decisions.

3. Purpose and legal basis

We process data to perform the contract: running your account, bookings, credits and packages, and to meet legal bookkeeping obligations. We do not ask for your consent for this processing, nor make the service conditional on it. We do not use your data for marketing.

4. How long we keep it

Account data is kept for as long as the account exists. When you delete your account, personal data is anonymized, while payment and attendance records remain, unlinked from you, for as long as accounting regulations require.

5. Your rights

You have the right to access, rectification, erasure and portability of your data, and the right to object. Name and email corrections are made by the studio at your request. You may lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection.

6. Controls in the app

Under Profile → Privacy you can download a copy of your data and permanently delete your account yourself, without asking the studio.

7. Cookies

We use strictly necessary cookies (the sign-in session, your chosen language and the display theme) and one analytics cookie that assigns a random identifier to measure how the app is used, described in the Analytics section. There are no marketing cookies.

8. Analytics

To understand and improve the app we use PostHog, a product analytics tool, hosted on EU servers (Frankfurt).

We record:

• usage events (screens opened, bookings, choices made while booking);
• session recordings, in which all input fields and other members' data are masked.

Analytics links you to a random identifier and, after sign-in, to your internal account identifier; your name, email and phone number are never sent to PostHog.

9. Processors

Data is processed on our behalf by providers bound by data processing agreements:

• Vercel, hosting of the application;
• Neon, the database;
• Resend, transactional email;
• Twilio, WhatsApp messages;
• PostHog, product analytics.

Some providers process data outside Serbia and the EU; such transfers rest on appropriate safeguards, including standard contractual clauses.

10. Minors

We collect a date of birth at registration so the studio knows a member's age. A person under 15 may use the service only with the consent of a parent or guardian, arranged with the studio directly, in line with the Personal Data Protection Act.