Privacy policy

Who processes the data

The data controller is Milan Vlasić, a licensed real estate agent in New South Wales (Australia), based in Sydney. For any question about your data, write to milan@bre.rs or call +61 400 460 377.

When you write or call

I process the data you send yourself: your name, email address, phone number and what you tell me about the property you are selling, buying or inheriting. I use it to answer your enquiry, assess the situation and, if we agree to work together, run the job.

The legal basis is taking steps at your request before a contract is concluded and, once we agree, performing the contract (Serbian Law on Personal Data Protection, Article 12, paragraph 1, item 2).

Giving the data is voluntary, but without a contact and a basic description of the property I cannot answer. Do not send personal documents, account numbers or passwords in your first message; if the job needs them, we will agree on a safe way.

Associates in Belgrade

For properties in Belgrade I work through associates. If we agree to start, I pass on to the associate working on the job only the data needed for that job, and I tell you in advance.

Email and hosting

The address milan@bre.rs runs with the provider DreamWeb, which stores messages for me. The site runs on a server of a hosting provider in Germany (European Union), and the site and the server are maintained by the site's developer, D. Svilenković. They process data only on my instructions and only as far as needed to keep the email and the site running.

I do not sell data and I do not give it to others for advertising. I can give it to a public authority only when the law requires it.

Transfer of data abroad

I work from Sydney, so I read and answer messages from Australia. Australia is not on the list of countries with an adequate level of data protection, so data is transferred there on the basis of Article 69, paragraph 1, item 2 of the Law: the transfer is necessary for me to answer your enquiry and take the steps you asked for.

The site's server is in Germany, which has an adequate level of protection under Article 64, paragraph 2 of the Law.

Server logs and language

On every visit the server records the IP address, the time, the page address and the browser type. These logs are used only for security and troubleshooting and are deleted automatically after 14 days. The legal basis is the legitimate interest in running the site securely (Article 12, paragraph 1, item 6).

When you change the language, the choice is stored only in your browser (localStorage, key bre-lang), so that the site opens in that language next time. This is necessary for a function you chose yourself and is not sent to anyone. You remove it by clearing the site's data in your browser.

Cookies and analytics

The cc_consent cookie remembers your choice from the cookie bar (“Accept” or “Necessary only”) for one year. It is necessary, because without it the site would not know what you chose. The site does not use advertising cookies.

Only if you choose “Accept” does the site load Google Analytics 4, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). It shows me how many visits there were, which pages are read and on what kind of devices. Until you choose, and if you choose “Necessary only”, Google's code is not loaded and nothing is sent to it (Google Consent Mode, consent is denied by default). Google Analytics 4 does not store IP addresses, Google signals and ad personalisation are turned off, and visit data is kept for 14 months. Analytics sets the cookies _ga and _ga_7TX54184W7, which last up to 2 years.

The legal basis for analytics is your consent (Law on Personal Data Protection, Article 12, paragraph 1, item 1, and Law on Electronic Communications, Article 160). You can withdraw consent at any time through the “Cookie settings” link at the bottom of the page, and the analytics cookies are then deleted. Google may also process data in the USA: Google LLC is certified under the EU-US Data Privacy Framework, for which the European Commission has found an adequate level of protection (Article 64, paragraph 2 of the Law), and it also applies standard contractual clauses.

How long I keep data

I keep correspondence while the conversation or the job lasts, and for no longer than 24 months after the last contact, unless a regulation or a contract requires longer. At your request I delete it earlier. Server logs are kept for 14 days and analytics data for 14 months.

Your rights

With regard to your data, you have the right to:

• find out whether I process your data and get a copy of it (Article 26);
• ask for data to be corrected or completed (Article 29);
• ask for deletion (Article 30) and restriction of processing (Article 31);
• receive the data you gave me or ask me to transfer it to another controller (Article 36);
• object to processing based on legitimate interest (Article 37).

I do not make decisions automatically, without a person involved, and I do not build profiles. Where processing is based on consent, you can withdraw it at any time, without affecting processing done before the withdrawal.

How to send a request

Write to milan@bre.rs. I answer without delay and within 30 days at the latest; if the request is complex, the deadline can be extended by another 60 days, and I will tell you so within the first 30 days. Exercising your rights is free of charge. If I am not sure who is sending the request, I may ask for additional proof of identity.

If you believe your data is processed unlawfully, you can lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia, Bulevar kralja Aleksandra 15, 11120 Belgrade, office@poverenik.rs, poverenik.rs.

Data security and minors

The site works only over an encrypted connection (HTTPS), and the server is updated regularly. The site is intended for adults. If I learn that a child under 15 has sent me data without a parent's consent, I delete it.

Changes to this policy

When the way the site works or the way data is processed changes, I update this page and change the date of the last update. The rules for using the site are on the Terms of use page.