Privacy Policy

1. Data Controller and Contact

Language of this document. This English text is a translation provided for your convenience. The processing of personal data described here is governed by Serbian law, and the Serbian version of this Privacy Policy is the sole legally authoritative text. In case of any discrepancy between the two versions, the Serbian text prevails.

The controller of personal data is Skyneting d.o.o., a company registered in the Republic of Serbia. SkyHosting is the brand under which this company provides web hosting, VPS server, domain registration, SSL certificate and website malware cleanup services.

Full name

Skyneting d.o.o.

Registered seat

Vožda Karađorđa 2A, 18000 Niš, Serbia

Registration number

21206199

Tax ID (PIB)

109586990

Phone

+381 18 307884

Data-protection contact

data-protection contact form

Website

www.skyhosting.rs

For any questions concerning the processing of personal data and to exercise your rights, please contact our data-protection contact person — through the contact form, by e-mail (contact listed in the table above), or by post to the company's registered seat, marked "for data protection".

Under Article 56 of the Law, Skyneting d.o.o. is not required to formally appoint a data protection officer (we do not carry out large-scale processing or systematic monitoring of individuals as a core activity). Nevertheless, we have designated a dedicated contact point solely for these matters, so that your requests are handled quickly and in one place.

The supervisory authority for personal data protection in the Republic of Serbia is the Commissioner for Information of Public Importance and Personal Data Protection (contact details in Section 15).

2. What This Policy Covers

This policy applies to the processing of personal data that Skyneting d.o.o. carries out through:

• the www.skyhosting.rs website and all of its pages;
• the client portal (account) at skyhosting.rs/portal — ordering, managing services, billing and technical support;
• registration and renewal of internet domains, SSL certificates and other services;
• communication with us — by e-mail, phone, live chat and the ticket system;
• signing up for our newsletter and other forms on the site (e.g. the free site scanner, reporting a hacked site).

This policy does not cover:

• third-party sites linked to from our site — they have their own privacy policies;
• content and data that you, as a user, store or collect on the hosting or VPS space you have leased — you are the controller of that data, and we are the processor (see Section 13);
• processing that RNIDS carries out as an independent controller over domain registrant data (see Section 12).

The contractual relationship between you and Skyneting d.o.o. is governed by the Terms of Service; this Privacy Policy is an integral part of them.

3. Principles and Legal Basis for Processing

We process data lawfully, fairly and transparently, collect it for specified and legitimate purposes, to the extent necessary for those purposes, strive to keep it accurate and up to date, keep it only as long as needed, and protect it with appropriate measures (Article 5 of the Law).

We base processing on one of the following legal grounds (Article 12 of the Law):

• Performance of a contract (Art. 12(1)(2)) — providing the leased service under the Terms of Service, domain registration and renewal, billing and technical support.
• Compliance with a legal obligation (item 3) — issuing and keeping invoices, tax and accounting obligations, responding to proper requests from competent authorities.
• Legitimate interest (item 6) — server and network security, preventing and investigating abuse, fraud and attacks, basic statistics without identifying individuals, debt collection and the protection of legal claims. When relying on this basis, we assess whether our interest outweighs your rights and freedoms; you have the right to object (Section 10).
• Consent (item 1) — sending the newsletter and promotional messages, as well as setting non-essential cookies. You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

4. What Data We Collect

Depending on how you use our services, we process the following categories of data:

• Account and identity data — first and last name, address, e-mail and phone number; for legal entities and entrepreneurs also the business name, tax ID and registration number, and the data of a contact person.
• Billing data — invoice data, amounts, history and payment method. We do not collect or store your card number, expiry date or CVV/CVC. Card payment is processed entirely on the bank's own page (Banca Intesa a.d. Beograd) with 3-D Secure protection (Visa Secure, Mastercard Identity Check); payment via PayPal is processed on PayPal's own page. In both cases we receive only confirmation of a successful or failed transaction.
• Domain data — registrant and administrative/technical contact data (name, address, e-mail, phone). See Section 12.
• Technical and usage data — IP address, date and time of access, requested addresses, device and browser type, server log records, data on incidents and attempted abuse.
• Support communication — the content of tickets, e-mail and chat correspondence, and any files you attach.
• Newsletter — e-mail address and data on sign-up, unsubscribe and message delivery.
• Cookies and similar technologies — see Section 6.

We do not intentionally collect special categories of personal data (e.g. data on health, religious, political or trade-union affiliation). Please do not include such data in tickets, e-mails or forms.

5. The Purposes for Which We Process Data

We do not use data collected for one purpose for a purpose incompatible with it. If a need for a new purpose were to arise, we would notify you in advance and, where required, seek your consent.

6. Cookies and Analytics

A cookie is a small file that a site places on your device. We use three groups:

• Necessary cookies — keep a logged-in user's session, remember shopping-cart content, distribute traffic and remember your cookie choice. Without them the site and portal do not work correctly, so they are set without consent (performance of a contract / legitimate interest).
• Functional cookies — set only after you accept them on the cookie banner. They cover the tawk.to live-chat widget: until accepted, the chat bubble does not load at all, so no chat cookie is set and no conversation data reaches tawk.to. See Section 7 for what tawk.to processes once you do accept.
• Analytics and marketing cookies — are set only after you accept them on the cookie banner. We load them through Google Tag Manager, and they include: Google Analytics 4 (visit statistics), Google Ads (measuring ad performance and remarketing), the Meta (Facebook) Pixel (measuring conversions and advertising on Meta platforms) and the LinkedIn Insight Tag (measuring conversions and advertising on LinkedIn). These services may set their own cookies and process data as independent controllers — see their own privacy policies for more.

You may change or withdraw your consent at any time via the “Cookie Settings” link in the site footer, by deleting cookies, and through your browser's own settings. Withdrawing consent does not affect the lawfulness of processing before withdrawal. Opting out of Google Analytics: tools.google.com/dlpage/gaoptout; ad settings: myadcenter.google.com and facebook.com/adpreferences.

7. Who We Share Data With

We do not sell your data. We share it only with the following categories of recipients, to the extent necessary for the given purpose:

• Infrastructure providers (processors) — Hetzner Online GmbH (Germany and Finland), and Scaleway SAS (France and the Netherlands); hosting of servers and data.
• Domain registries — RNIDS (the Serbian National Internet Domain Registry Foundation) for .rs and .срб domains; Enom, LLC and NameSilo, LLC (both US-based) and other registries for international (gTLD) domains. Transfer of registrant data is necessary for domain registration.
• Payment processing — Banca Intesa a.d. Beograd (card payment on the bank's own page) and PayPal (payment via a PayPal account, through a WHMCS add-on); in both cases payment is processed on the service provider's own page, and we receive only confirmation of the transaction.
• Accounting — the bookkeeping agency that keeps our business records.
• Live chat support — tawk.to Inc. (United States), for real-time chat with our support team on the website. The chat widget can set cookies and may process the content of your conversation to provide the service.
• IT tool providers — our newsletter-sending service; Google (Analytics, Ads, Tag Manager), Meta (Pixel) and LinkedIn (Insight Tag) for analytics and advertising, with your consent.
• Competent state authorities — when there is a legal basis and a proper request.

We have concluded a data-processing agreement with our processors in accordance with Article 45 of the Law, obligating them to process data only on our instructions, with appropriate protective measures and a duty of confidentiality.

8. Transfer of Data Outside the Republic of Serbia

Part of the processing takes place outside the Republic of Serbia:

• Germany, Finland, France and the Netherlands (Hetzner, Scaleway) — European Union member states, which are considered to provide an adequate level of personal data protection, so no separate basis for transfer is required.
• The United States (Enom, NameSilo, Google, Meta, LinkedIn, tawk.to) — the transfer is carried out on the basis of Article 65(1)(2) of the Law (transfer necessary for the performance of a contract concluded with you, e.g. registering an international domain), or on the basis of standard contractual clauses and additional protective measures at the relevant providers.

You may request a copy of the relevant safeguards through the contact form or at our data-protection contact (Section 1).

9. How Long We Keep Data

After the retention period expires we delete the data or permanently anonymise it, unless a specific regulation requires longer retention or the data is needed for ongoing or anticipated legal proceedings.

10. Your Rights

With respect to your personal data you have the following rights (Articles 21–40 of the Law):

• access — to find out whether we process your data and to obtain a copy;
• rectification and completion of inaccurate or incomplete data;
• erasure — when data is no longer needed, when you withdraw consent, or when processing is unlawful;
• restriction of processing and portability of data you provided to us, in a machine-readable format;
• objection to processing based on legitimate interest; we accept an objection to direct marketing unconditionally and without delay;
• withdrawal of consent at any time.

Limits on the right to erasure. We cannot fulfil an erasure request to the extent we are required or entitled to keep the data: invoices and bookkeeping records (tax and accounting regulations), data necessary for the duration of the contract, registrant data kept by RNIDS while the domain exists and for 10 years after expiry, data needed to establish, exercise or defend a legal claim, and data we keep for security purposes and to prevent abuse for as long as that need lasts.

How to exercise your right. Send a request by e-mail to our data-protection contact (Section 1) or through the contact form. We respond within 30 days at the latest; this period may exceptionally be extended by a further 60 days, of which we will notify you. To protect your data we may ask for additional information to verify your identity. Handling your request is free of charge, unless the request is manifestly unfounded or excessive.

Complaint to the supervisory authority. If you believe our processing breaches the regulations, you have the right to lodge a complaint with the Commissioner (contact in Section 15). We ask that you contact us first — in most cases we can resolve the issue quickly.

11. Security and Incident Reporting

We apply technical, organisational and personnel measures appropriate to the risk: encrypted transmission (TLS/SSL) on the site and portal, access control on a “need-to-know” basis, protection against unauthorised access, a firewall and DDoS protection, regular backups, and a duty of confidentiality for everyone with access to the data.

Nevertheless, no system of data transmission or storage is completely secure, and we cannot guarantee absolute data security. You also contribute to security — by keeping your passwords safe, enabling two-factor verification where available, and reporting suspicious activity promptly.

Personal data breach. If a breach occurs that may pose a risk to your rights and freedoms, we will notify the Commissioner without delay, and within 72 hours of becoming aware of it at the latest. If the risk to you is high, we will also notify you without undue delay.

12. Domain Registration (RNIDS, WHOIS)

To register and maintain an internet domain we are required to forward registrant and administrative/technical contact data (name, address, e-mail, phone) to the competent registry:

• for .rs and .срб domains — to RNIDS, in accordance with the General Terms on the Registration of National Internet Domain Names;
• for international (gTLD) domains — to the competent registry, through our partners Enom, LLC or NameSilo, LLC, in accordance with ICANN rules.

This data may be publicly available through the WHOIS service, to the extent determined by each registry. Providing accurate data is a condition for registering and keeping a domain — without it the domain cannot be registered or kept, and inaccurate data may lead to suspension of the domain under the registry's rules. RNIDS keeps registrant data for 10 years from the expiry of the registration. Processing that RNIDS carries out as an independent controller is governed by RNIDS's own privacy policy (Serbian).

13. Data You Process on Our Servers

For the content and personal data that you, as a user, upload, store or collect through your leased hosting or VPS space (e.g. data on your site's visitors, your store's customers, or recipients of your e-mails) — you are the controller, and Skyneting d.o.o. is the processor. In that role we act only on your instructions and in accordance with the Terms of Service, which contain data-processing provisions within the meaning of Article 45 of the Law; a separate data-processing agreement text is provided on request.

As controller, you are required to:

• have your own legal basis for that processing;
• inform your own visitors and users through your own privacy policy;
• not forward to us data that is not necessary for us to provide the service;
• notify us without delay of any request from an individual or a competent authority relating to that data.

14. Children's Privacy

Our services are not intended for minors under 15 years of age, and we do not knowingly collect their data without the consent of a parent or guardian (Article 16 of the Law). If we determine that we have collected such data without valid consent, we delete it without delay. If you believe a child has provided us with their data, please contact us through the contact form or at our data-protection contact (Section 1).

15. Changes to This Policy and Contact Details

Changes to this policy. We may occasionally amend this policy due to changes in regulations, services, or the manner of processing. The current version is always published on this page, with the date of the last change at the top. We will notify you of material changes by e-mail or a prominent notice on the site before they take effect. Continued use of our services after the changes take effect is deemed to be awareness of the changes.