Personal data
Privacy policy
Effective: 18 October 2026
This policy explains how Andrei Protopopov PR, trading as ReenCar, processes personal data when you visit reencar.com and its language versions, submit a form, contact us, follow a link to a messaging service or use a ReenCar service.
1. Controller
The controller responsible for the processing described in this policy is Andrei Protopopov PR.
- Address
- Ulica Dr Ilije Đuričića 2A, Novi Sad, Serbia
- Registration number
- 68165695
- PIB
- 115186044
- Privacy contact
- mail@reencar.com
2. Scope and data we collect
Depending on how you interact with ReenCar, we may process:
- identity and contact details, such as your name, email address, telephone number and messenger username;
- company and professional information that you provide in a request;
- the content of messages, forms, service requests and support conversations;
- account, service-use, vehicle, VIN, OEM-search and subscription information where relevant to a ReenCar product;
- payment status and transaction references, but not full payment-card details;
- technical and security data, including IP address, browser, device, timestamps and request logs;
- analytics and advertising attribution data, such as pages viewed, actions, referrer, UTM tags and click identifiers, where you have given the required consent.
Form fields marked with an asterisk are required. Without your name, preferred contact channel, contact detail and confirmation that you have read this policy, we cannot submit the form or reply to your request. Other form fields are optional.
3. Purposes and legal bases
| Purpose | Main data | Legal basis |
|---|---|---|
| Reply to an enquiry and prepare an offer | Contact details, message, product, language | Steps before entering into a contract — Article 6(1)(b) GDPR |
| Provide a service and manage an account | Account, requests, service history, payment status | Performance of a contract — Article 6(1)(b) |
| Accounting and mandatory records | Order, transaction and payer information | Legal obligation — Article 6(1)(c) |
| Protect services and prevent abuse | IP address, user agent, logs and timestamps | Legitimate interests in security — Article 6(1)(f) |
| Measure website use | Online identifiers, device, pages and actions | Consent — Article 6(1)(a) |
| Advertising attribution and conversion measurement | UTM tags, click IDs, referrer and landing page | Consent — Article 6(1)(a) |
| Send marketing messages | Contact and consent record | Separate optional consent — Article 6(1)(a) |
4. Recipients and service providers
We disclose personal data only where needed for the purposes above. Recipients may include:
- Google Cloud for website and application hosting;
- ReenCar-managed n8n automation server hosted in Estonia, and the PostgreSQL database and its backups provided through Supabase Cloud on AWS in the eu-central-1 region (Frankfurt, Germany); attribution data is sent to the n8n automation only after advertising and attribution consent;
- Google Analytics through the Google tag, loaded only after analytics consent, and Google Ads attribution only after advertising and attribution consent;
- Google / YouTube for privacy-enhanced video embeds from youtube-nocookie.com, loaded only after external-media consent or a direct request to play a video;
- messaging providers such as Telegram and WhatsApp when you choose to open or use those services;
- payment providers where a paid service is offered;
- professional advisers and public authorities where access is legally required.
Providers acting for ReenCar receive only the data needed for their task and are subject to contractual or legal confidentiality and security duties. Third-party messaging and payment services may also act as independent controllers under their own policies.
5. International transfers
ReenCar is established in Serbia, which is outside the EEA. Its n8n automation server is hosted in Estonia, while PostgreSQL data and database backups are hosted through Supabase Cloud on AWS in the eu-central-1 region (Frankfurt, Germany). Google, Supabase and other providers may process limited data in the EEA and other countries.
Where Chapter V GDPR applies, ReenCar will make a transfer only after an applicable transfer mechanism and any required supplementary safeguards have been put in place. Information about the mechanism actually used for a particular transfer can be requested at mail@reencar.com.
6. Retention
| Data | Typical retention rule |
|---|---|
| Enquiries that do not become a contract | Up to 3 years after the last meaningful contact |
| Customer, contract and service data | For the contract and the applicable limitation period |
| Invoices and accounting records | For the period required by Serbian accounting and tax law |
| Security and technical logs | Normally up to 12 months; longer only where needed to investigate an incident |
| Analytics and advertising data | According to the relevant tool setting or until consent is withdrawn, whichever requires earlier deletion |
| Consent records | For as long as needed to demonstrate compliance and handle claims |
Data may be kept longer where required by law, a dispute or a security investigation. It is then restricted to that purpose.
7. AI-assisted processing
ReenCar may use AI-assisted tools to classify messages, search for OEM information and prepare responses. These tools are not used to make decisions producing legal or similarly significant effects without human involvement.
8. Your rights
Subject to applicable law, you may request:
- access to and a copy of your personal data;
- correction of inaccurate or incomplete data;
- erasure or restriction of processing;
- data portability;
- an objection to processing based on legitimate interests;
- withdrawal of consent at any time, without affecting processing carried out before withdrawal.
Send a request to mail@reencar.com. We may ask for information reasonably needed to confirm your identity.
9. Complaints
You may complain to the data-protection authority in the EEA country where you live, work or believe an infringement occurred. You may also contact the Serbian Commissioner for Information of Public Importance and Personal Data Protection.
10. Security, children and changes
We use technical and organisational measures appropriate to the nature and risk of the processing. No online system can be guaranteed completely secure.
ReenCar services are intended for businesses and adults and are not directed to children. We do not knowingly collect children’s data through this website.
We may update this policy when our services, providers or legal duties change. The effective date at the top shows the current version.