Skip to main content
Sign in

Privacy Policy

Version of October 20, 2026, in force from that date. Published in Serbian, Russian and English; if the versions differ, the Serbian version prevails.

This policy explains how Red Box processes personal data on the RedBox.biz platform under the Law on Personal Data Protection of the Republic of Serbia. The Platform is intended for companies, so the personal data in it is mainly that of company employees and representatives.

1. Controller

Red Box DOO, Trg Nikole Pašića 5, sprat 1, Beograd, Serbia, registration number 21808016, tax ID (PIB) 113130422. Write to iburtnik@gmail.com with any question about your data.

2. What data, why, on what basis and for how long

  • Name, email address, language, password hash and two-factor authentication key: for the account and sign-in. Basis: performance of the contract. Kept while the account exists.
  • IP address, browser, sessions and the security log: to protect against intrusion and abuse. Basis: legitimate interest. Kept for 12 months.
  • Company details, the signatory’s name and position: for contracts, invoices and acts. Basis: performance of the contract and the legal duty to keep accounting records. Kept for 10 years after the end of the year in which the deal was completed.
  • Requests, estimates, quotes, correspondence, stages and payment marks: to run the deal and as evidence in a dispute. Basis: performance of the contract and legitimate interest. Kept for 5 years after the deal is completed.
  • Records of accepted documents (version, date, IP address): as evidence that the agreement was concluded. Basis: legitimate interest. Kept while the agreement is in force and for 10 years after it ends.
  • Reviews with the company name, product and amount: for publication on the partner’s page. Basis: consent you give before publication. Kept while the review is published or until you withdraw consent.
  • Search queries and product links: for search and delivery estimates. Basis: performance of the contract, and legitimate interest for guests. Results are cached for up to 24 hours.

When the period ends, data is deleted or anonymised.

3. Who receives your data

Logistics partners you send a request to receive your company details, the request and the correspondence. They process this data as independent controllers for their contract with you. Public authorities receive data only on a lawful request. We do not sell data or use it for third-party advertising.

4. Processors

The following process data on our behalf and under a contract:

  • Fornex: hosting of the server and database in a data centre in Europe;
  • an email delivery service: sign-in, deal and invoice emails;
  • Cloudflare: DNS and site protection, sees the visitor’s IP address;
  • Google (Gemini API, USA): analysis of the search query text and packing suggestions; receives only the query text and the product card, no account data;
  • Alibaba.com: product search; receives only the query text, no personal data.

Do not enter passport details, card numbers or other unnecessary personal data in search or chat.

5. Transfers outside Serbia

Where data goes to a country that does not ensure an adequate level of protection, such as the USA, we transfer it only with safeguards provided by law, primarily standard contractual clauses, and only to the extent the function needs.

6. Automated processing

The ranking of offers and the estimates are produced automatically but have no legal effect on you: you choose the supplier and the partner. We do not profile you for advertising.

7. Your rights

You have the right to access your data, have it corrected or erased, restrict processing, receive your data in a machine-readable format, object to processing based on legitimate interest and withdraw consent at any time; withdrawal does not affect the lawfulness of earlier processing. Write to iburtnik@gmail.com; we reply within 30 days. You may also lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik, Bulevar kralja Aleksandra 15, Beograd, poverenik.rs).

8. Security

We encrypt connections, store passwords only as hashes, support two-factor authentication, isolate company data at database level, keep a log of important actions and make backups. We report a breach that puts your rights at risk to the Commissioner within 72 hours and, if the risk is high, to you without undue delay.

9. Cookies and browser storage

We use only strictly necessary cookies: rb_session to keep you signed in (up to 14 days) and RB_LOCALE for the chosen language (1 year). The browser also temporarily keeps an unfinished request and a company invitation so they are not lost during registration. There are no analytics or advertising cookies, so no consent is asked for them.

10. Changes to this policy

We announce material changes by email. The date of the current version is shown at the top of the page.