Privacy Policy
Last updated: July 2026
This policy explains what personal data we collect when you use the Questionmark online store, why we collect it, and what rights you have. We process data in accordance with the Personal Data Protection Act of the Republic of Serbia.
1. Data controller
The data controller is Questionmark doo Beograd. For any questions regarding personal data protection, contact us at info@questionmark.rs.
2. Data we collect
When you create an account we store your name, email address, phone number and password — the password only in hashed form, so we can never see it. When you place an order we store delivery details: recipient name, address, phone and email. If you subscribe to the newsletter, we store your email address. We never store or see card details — card entry happens exclusively on the bank's secure page.
3. Signing in with Google or Facebook
If you choose to sign in with your Google or Facebook account, we receive only basic data from those services: your name, email address, account identifier and profile picture. We never receive your password and have no access to your posts, messages or friend list, nor do we ever publish anything on your behalf.
4. How we use your data
We use your data to process and deliver orders (delivery details are passed to the courier service), to charge payments through the bank, to send order status notifications and — only with your consent — to send the newsletter. We never sell your data or share it with third parties for marketing purposes.
5. Cookies and analytics
The site uses essential cookies and browser local storage for the cart, wishlist and sign-in. To understand how the site is used we rely on our own in-house analytics — no Google Analytics and no third-party marketing cookies that track you across the web.
6. Security and storage
All communication with the site is encrypted (HTTPS). Passwords are stored only in hashed form, and access to data is limited to people who need it to process orders. Data is stored on protected infrastructure within the European Union (AWS, Frankfurt).
7. Your rights
You have the right to access your data, correct it, restrict processing and object, as well as the right to unsubscribe from the newsletter at any time — an unsubscribe link is included in every message.
8. Data deletion
You can request deletion of your account and all personal data at any time by sending a request to info@questionmark.rs from the email address linked to your account. We delete the account and personal data within 30 days at the latest; invoice records are kept for the periods required by law. These instructions also apply to accounts created by signing in with Google or Facebook.