Serbia data protection notice
Information about Serbia’s data protection law. Whether it applies to kookey depends on the operator and service, which have not been confirmed yet. We’ll share the legal review before the hosted service opens.
1.Applicability and controller details
The hosted-service operator’s location and legal identity have not been confirmed. Whether Serbian data-protection law applies depends on the operator, service, and users; that review is not complete. Before the hosted service opens, we’ll identify its operator and explain which laws apply to the service and its users. If Serbia’s Law on Personal Data Protection applies, we’ll identify the controller and explain the relevant rights and responsibilities in the Privacy Notice.
2.Data protection principles and lawful grounds
Personal data must be processed lawfully, fairly, and transparently; collected for specified and legitimate purposes; limited to what is necessary; kept accurate; and stored no longer than needed. The controller must be able to identify the applicable legal ground for each purpose and keep enough records to demonstrate compliance. Consent, where used, must be specific, informed, freely given, unambiguous, and as easy to withdraw as to give. A service must not make unnecessary consent a condition of a contract.
3.Children and online services
kookey’s planned minimum age is 13. Under Article 16 of Serbia’s Law on Personal Data Protection, a minor who has turned 15 may independently consent to personal-data processing in the use of information-society services. For a child under 15, consent for that processing must be given by a parent exercising parental rights or another legal representative, and the controller must take reasonable steps, taking available technology into account, to verify that authorization. This rule concerns consent-based processing for an information-society service; it is not a general statement that every processing activity must use consent.
Source: Serbian Law on Personal Data Protection — Official Gazette No. 87/2018 (Serbia) · Checked October 8, 2026
4.Security and breach response
The controller and any processors must use appropriate technical, organizational, and personnel measures to protect personal data against accidental loss, damage, unauthorized access, alteration, disclosure, or other misuse. A processor must notify the controller without undue delay after learning of a personal-data breach. Under Article 52, when a breach may create a risk to people’s rights and freedoms, the controller must notify the Commissioner without undue delay and, where feasible, within 72 hours of becoming aware; Article 53 requires communication to affected people without undue delay where the breach is likely to create a high risk, subject to the statutory exceptions.
5.Data protection officer and impact assessment
The controller will assess whether the law requires a data protection officer, including whether core activities involve large-scale regular and systematic monitoring or large-scale processing of special-category data or data relating to criminal convictions and offences. Before a processing operation likely to result in a high risk, the controller will carry out a data protection impact assessment as required by the law. A social platform’s scale, profiling, children’s use, public sharing, and direct messages are relevant to these assessments.
6.Rights and supervisory complaints
People may exercise the rights provided by the Serbian law, including access, correction, erasure, restriction, data portability, objection, and rights relating to automated decisions, subject to applicable conditions and exceptions. A person may lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection and may also have a right to judicial protection and compensation. Requests can be submitted to the controller using the contact details on the Legal Contact page.
Source: Serbian Commissioner — How to exercise data rights (Serbia)
7.Processors, storage, and cross-border transfers
The controller will use written processor arrangements that define processing subject matter, duration, nature, purpose, data types, data subjects, instructions, confidentiality, security, sub-processors, assistance with rights and breaches, and return or deletion at the end of service. The operator will map where data is stored and accessed. Transfers to another country will be assessed under the Serbian law’s adequacy and safeguard requirements before they occur; an EU transfer mechanism alone does not automatically satisfy Serbian transfer rules.