This policy explains what personal data Roota collects, why, and what rights you have. The controller is the operator named in the Legal notice ("we"). We process personal data under the Serbian Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti) and, where it applies, the EU General Data Protection Regulation.
1. What we collect
- Account data — name, e-mail address, password (stored only as a hash), chosen role (buyer or seller), interface language.
- Seller profile — business or farm name, legal form, registration numbers required by Serbian law (e.g. farm holding number), address, phone number, location on the map, listings and photos you upload.
- Buyer location — a city you pick or coordinates from your browser's geolocation (only after you allow it), plus the search radius. Signed-in users have it saved to their profile; guests have it saved in a cookie on their own device. We never derive location from your IP address.
- Messages — the content of conversations between buyers and sellers on the platform. Phone numbers and e-mail addresses in messages are automatically masked until an order is placed.
- Orders — items, quantities, delivery or pickup choice, delivery address, invoices, and status history (sellers on the Pro plan only).
- Subscription payments — for sellers buying the Pro plan: amount, payment reference, gateway (bank transfer via IPS QR, or PayPal) and the gateway's transaction identifier. We never see or store card numbers or bank credentials.
- Technical data — server logs with IP address, time, requested page and browser type, kept for security and troubleshooting.
2. Why we process it
- To provide the service you signed up for: your account, listings, messaging, orders and subscription (performance of a contract).
- To keep the platform safe: preventing abuse, enforcing the terms, rate-limiting, investigating incidents (legitimate interest).
- To meet legal obligations, such as accounting records for subscription payments and the operator information required by e-commerce law.
- To send you service e-mails you need: e-mail verification, password reset, subscription reminders. We do not send marketing e-mail.
3. Who sees your data
Other users. A seller's business name, location, listings and photos are public. A buyer's name is shown to the seller they contact. Phone numbers and e-mail addresses stay hidden in chat until an order is placed between the two of you.
Processors we rely on. Hetzner Online GmbH (Germany) hosts the service; Cloudflare, Inc. (USA, EU data-centres) delivers it and protects it from attacks; Brevo (Sendinblue SAS, France) sends our transactional e-mail; PayPal (Europe) S.à r.l. processes PayPal subscription payments for sellers outside Serbia. Each acts on our instructions under a data processing agreement. We do not sell personal data and do not use advertising networks or analytics trackers.
4. Cookies
We only set cookies that are necessary for the site to work:
| Cookie | Purpose | Lifetime |
|---|---|---|
| session, XSRF-TOKEN | Keeps you signed in during a visit and protects forms against cross-site request forgery | Session / 2 hours |
| remember_web | "Remember me" sign-in | Up to 5 years, only if you tick the box |
| ff2u_location | Your chosen city or coordinates and radius, for guests | 1 year |
| locale (session) | Your chosen language | Session |
Your browser's local storage additionally remembers that you dismissed the cookie notice and the location prompt. None of this is used for tracking or advertising.
5. How long we keep data
- Account and profile data: while your account exists. You can delete your account yourself from your profile page; listings, messages and the profile are then removed.
- Orders and invoices: as long as the seller needs them for their own records, and for the operator's subscription invoices the period required by accounting law (currently 10 years).
- Server logs: up to 30 days.
6. Your rights
You may ask us to access, correct, delete or export your personal data, to restrict or object to processing, and you may withdraw consent (for example, browser geolocation) at any time. Write to the e-mail address in the Legal notice; we answer within 30 days. You also have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia (Poverenik), or with your local supervisory authority if you are in the EU.
7. International transfers
Data is stored in Germany. Cloudflare and PayPal may process data in other countries under the EU Standard Contractual Clauses and equivalent safeguards recognised by Serbian law.
8. Changes
If this policy changes materially we will show a notice on the site and update the date above.