Privacy Policy
Effective from 3. 10. 2026, supplemented on 16. 10. 2026 (automatic translation of messages). Replaces the version dated 12. 5. 2024.
1. Controller
The controller of personal data collected on the bajk.si website and in the BAJK.SI mobile application is PTECH, Luka Pleško s.p., Celovška cesta 136, 1000 Ljubljana, company registration number 8024634000, tax number 79269885. Questions and requests concerning personal data may be sent to info@bajk.si or by post to the address above. We are not required to appoint a data protection officer and have not appointed one.
2. What data we process, why, and on what basis
For each purpose, the table below specifies which data we use and the applicable legal basis under the General Data Protection Regulation (GDPR).
A display name, e-mail address, and location are required for registration; an account cannot be created without them. Company and contact person details are also required for a business account. All other data (telephone number, website, description, avatar) are optional; omitting them does not otherwise affect use of the service, but the relevant function (for example, displaying a telephone number) will not be available. The data required to purchase a paid service cannot be omitted because they are required under tax regulations.
| Purpose | Data | Legal basis |
|---|---|---|
| User account and sign-in | display name, e-mail address, location (region and country), language, registration date, randomly generated system password, one-time sign-in codes, “stay signed in” token (with IP address and browser), sign-in log (e-mail address, IP address, browser, time) | performance of a contract (Terms of Use); account security as a legitimate interest |
| Profile (optional) | telephone number, website, description, avatar, telephone number and e-mail address display settings | performance of a contract; publication at the user's discretion |
| Posting classified ads | title, description, price, category, attributes, photographs (without EXIF metadata), location, contact details, classified ad draft, IP address at the time of posting, classified ad revision history | performance of a contract; legitimate interest (fraud prevention and evidentiary purposes) |
| Automatic translation of classified ads | classified ad title and description | legitimate interest (making classified ads accessible to visitors who speak other languages) |
| Messages between users | message content, attachments, time, participants, read status, reports concerning conversations | performance of a contract |
| Automatic translation of messages | text of a message written in a language other than the one set by the recipient (without attachments, names or e-mail addresses of the participants), the recipient’s account language, the translation | legitimate interest (communication between users who speak different languages); objection at info@bajk.si, after which messages from and to that user are not translated |
| Prevention of fraud and abuse | IP address, country and organisation associated with the IP address, VPN/proxy/hosting indicator, technical browser and connection data (browser fingerprint), e-mail domain, trust score, review decisions, list of blocked e-mail addresses, domains, and fingerprints | legitimate interest (security of users and the platform) |
| Payments and invoices | order details (service, amount, classified ad), payment status, Mollie transaction ID, invoice in PDF format; for companies, company name, address, tax number, and e-mail address; for recurring packages, name and e-mail address for the Mollie customer | performance of a contract; legal obligation (tax and accounting regulations) |
| Business registration | company name, tax and company registration numbers, address, contact person, telephone number, e-mail address, sign-in e-mail address, data from the public register of taxable persons, change log, data concerning the associated online store | performance of a contract; legitimate interest (company verification) |
| Service messages and news updates | e-mail address, name, language | performance of a contract (sign-in codes and notifications concerning classified ads, messages, payments, and changes to terms); consent given during registration or in the settings (news updates), which you may withdraw at any time using the link in each message; you may object to direct marketing at any time |
| Notifications | saved searches, favourite classified ads, price-drop notification settings, sent notifications, device token for push notifications in the application | performance of a contract; consent (push notifications on the device) |
| Statistics and advertising | aggregated visitor statistics, classified ad views, clicks; Google Analytics and Google AdSense data subject to consent | consent (cookies); legitimate interest (aggregated statistics without identification) |
| Visitor satisfaction | rating, comment, salted IP hash, user ID, page, browser, language | legitimate interest (improving the service) |
| Support and reports | content of messages sent to info@bajk.si and reports concerning classified ads and conversations | legitimate interest; legal obligation (removal of illegal content) |
3. What is public
The website is a public classified advertising platform. The following are visible to all visitors and search engines: the content of classified ads, including photographs; display name; location; year of registration; avatar; profile description and website; and publicly shared lists of favourite classified ads. A private user's telephone number and e-mail address are visible only if the user enables this in the settings. For business users, the company name, address and contact e-mail address are always public; a telephone number is public only if the company enters it in its public profile, while the contact telephone number from the business registration is not public.
Promotion of classified ads on social media. To select, prepare, and publish selected classified ads on the BAJK.SI Facebook and Instagram profiles, we process photographs, the title, brand, model year, size, price, and link to the classified ad, without the seller's name or contact details. The legal basis is the controller's legitimate interest in promoting classified ads and the website; selection and preparation are carried out on our behalf by Anthropic Ireland, Limited as a processor. You may object to such processing at any time by contacting info@bajk.si; following an objection, we will not include your classified ads in new posts and will remove any existing post from the profiles we manage, unless we demonstrate compelling legitimate grounds.
4. Data Processors and Recipients
In providing the service, we cooperate with the providers listed below, which, depending on the particular service, act either as our processors (acting on our instructions pursuant to a data processing agreement) or as independent controllers or recipients of data (determining the purposes and means of processing independently, in accordance with their own rules). For each provider, we specify the purpose for which we use it, the data it receives, where it processes such data, and the capacity in which it acts.
| Provider | Purpose | Data | Location | Role |
|---|---|---|---|---|
| Neoserv d.o.o. | hosting of the website, database and e-mail | all data | Slovenia | processor |
| Cloudflare, Inc. | storage and serving of listing photographs (img.bajk.si) | listing photographs | EU (servers), USA (Data Privacy Framework) | processor |
| Mollie B.V. | payments | amount, description containing the listing title, order ID; for recurring packages, name and e-mail address; the user enters payment details directly with Mollie | Netherlands | independent controller (payment institution) |
| Čebelca.biz (Refaktor d.o.o.) | issuance and fiscal verification of invoices | customer details on the invoice; private customers identified as “final customer” with their e-mail address | Slovenia; FURS | processor; FURS is an independent controller |
| OpenAI Ireland Ltd. (OpenAI group) | automated translation of listings and of messages between users; import of products from business users’ online stores | listing title and description; text of the message being translated (without data about the participants); content of publicly accessible store pages | Ireland / USA (Data Privacy Framework, Standard Contractual Clauses) | processor |
| Anthropic Ireland, Limited (Anthropic group) | selection and preparation of listings for publication on social media (assessment of photographs, title clean-up) | listing photographs and title | Ireland / USA (Data Privacy Framework, Standard Contractual Clauses) | processor |
| Meta Platforms Ireland Ltd. | posts on Facebook and Instagram | content of selected listings | Ireland / USA | independent controller |
| Google Ireland Ltd. | Google Analytics 4 and Google AdSense (only with consent); reCAPTCHA on registration and contact forms (legitimate interest: protecting forms against automated abuse). We host fonts on our own server, so no data are sent to Google in connection with them. | Analytics and AdSense: cookie and browser identifiers, page visits; reCAPTCHA: IP address, browser data, time and behaviour on the form | Ireland / USA (Data Privacy Framework) | processor (Analytics); independent controller (AdSense, reCAPTCHA) |
| Google LLC (Firebase Cloud Messaging) | push notifications in the mobile application | device token, notification content | USA (Data Privacy Framework) | processor |
| proxycheck.io (Pro Alpha Ltd., United Kingdom) | IP address checks (country, VPN/proxy, hosting) | IP address | United Kingdom (European Commission adequacy decision) | independent controller |
| StopForumSpam | checking for known spammers upon registration | hashed value (MD5) of the e-mail address and IP address | EU (European server europe.stopforumspam.org; the query is not logged by the provider) | independent controller |
| FlexyConsent | management of cookie consent | consent status | EU | processor |
| crm.bajk.si (controller’s own system) | processing of business registrations and the FURS public register of taxable persons | data from the business registration form | Slovenia | part of the controller (not a third party) |
| Business users’ online stores | import of products into the synchronised catalogue | import of publicly available product data; no personal data are transmitted | depending on the merchant | independent controller |
Transfers to third countries: transfers of data to Cloudflare, OpenAI, Anthropic, Meta and Google, or to their US companies, are based on the European Commission’s adequacy decision concerning the EU-US Data Privacy Framework where the recipient is certified under that framework, and otherwise on the European Commission’s Standard Contractual Clauses, together with an assessment of supplementary safeguards. The transfer to Pro Alpha Ltd. is based on the adequacy decision for the United Kingdom. You may request a copy of the safeguards at info@bajk.si. We do not sell data or disclose them to third parties for their own marketing purposes. We disclose data to law enforcement authorities and courts only on the basis of a lawful request.
5. Automated Decisions
Upon registration and publication, the system calculates a trust score (based on connection, browser and e-mail address data). Based on this score, the first listing may be withheld pending manual review; the decision on publication is made by a person. The score may also cause a new user’s initial conversations to be withheld. The content of messages between users is not routinely reviewed. An authorised person may access the content only in conversations withheld by the security system on suspicion of abuse or reported by a user. We do not disclose to the reported user who reported the conversation, unless required by law or by a competent authority. Registration is automatically rejected only for e-mail addresses and IP addresses that are flagged in the StopForumSpam database, with a high level of confidence, as sources of spam; otherwise, a low trust score merely means that the first listing and initial conversations of a new account remain pending manual review. A user who believes that a decision was incorrect may contest it, present their point of view, and request a manual review at info@bajk.si; the review is decided by a person.
6. How Long We Retain Data
We retain data only for as long as necessary for the purpose for which it was collected or for as long as required by law.
| Data | Retention period |
|---|---|
| Account and profile | until the account is deleted (by the user in the settings or upon request) |
| Listings | published for 90 days, then retained as expired listings in the user's account until deletion; deleted together with the account |
| Draft listing | 60 days |
| Messages and attachments | until both participants delete the conversation, and for a further 60 days thereafter; after an account is deleted, the other participant's copy remains with the display name frozen; automatic translations of messages are kept and deleted together with the message |
| Reports of conversations and listings | until the review is completed, for no longer than 12 months |
| Login log (OTP) and “stay signed in” tokens | tokens for no longer than 90 days; login log for 12 months |
| Security data (trust score, fingerprint) | until the account is deleted; IP address data for 30 days; review queue for 90 days after the decision; blocklists (e-mail, fingerprint) for up to 5 years from the most recently identified misuse, or longer in the event of a recurring security risk; we periodically review whether continued retention is justified |
| History of registrations and listing changes (security archive) | 24 months, including after the account is deleted, for evidentiary purposes and the prevention of misuse |
| Orders, invoices | 10 years from the end of the year of issue (tax regulations) |
| Business registration and company change log | for the duration of the business relationship; log for 365 days |
| Saved searches, favourites, device tokens | until the account is deleted; sent notification log for 60 days, activity log for 365 days; guest favourites for 30 days from the most recent activity |
| Satisfaction ratings | 24 months |
| Server logs (IP, requests) | up to 30 days at the hosting provider |
| Support messages and other correspondence | until the matter is resolved and for no longer than 24 months; longer only in connection with a legal claim, until its final resolution |
| Promotional posts of listings on Facebook and Instagram | for as long as the listing remains relevant to the promotion of the website; upon a substantiated objection, we remove them without delay |
| Backups | deleted data is removed from the hosting provider's rolling backups when the backups are overwritten, generally within 30 days |
We may retain data required to establish, exercise or defend legal claims for a longer period, until the proceedings are concluded.
7. Cookies and Similar Technologies
On your first visit, a consent management window (FlexyConsent) is displayed. Without consent, only strictly necessary cookies are loaded; Google Analytics and personalised Google AdSense advertisements are loaded only after consent has been given. You may change your consent at any time via the Cookie Settings link in the website footer.
| Cookie / storage | Purpose | Duration | Type |
|---|---|---|---|
| oc_session | user session | until the browser is closed | strictly necessary |
| motp_remember | stay signed in | 30 days | strictly necessary (optional) |
| ftr_lang_choice, ftr_lang_pick | selected language | 1 year / 5 minutes | strictly necessary |
| fable_theme | light or dark mode | 1 year | strictly necessary (preference) |
| ffav_token | guest's favourite listings | 1 year | functional |
| fable_top_notice_dismissed, fable_fb | dismissed notice, display of satisfaction survey | up to 1 year | functional |
| adsm_fc_* | frequency capping for sponsored advertisements | until midnight | functional |
| FlexyConsent cookie | stored consent | up to 1 year | strictly necessary |
| _ga, _ga_* | Google Analytics 4 (visitor statistics) | up to 2 years | analytics, subject to consent |
| Google AdSense cookies (e.g. __gads, IDE) | display and measurement of advertisements | up to 13 months | advertising, subject to consent |
| _GRECAPTCHA | Google reCAPTCHA on forms | 6 months | strictly necessary (security) |
| browser local storage (fable-theme, ffb_*, floc_last_city) | display mode, survey, most recently selected location | until deleted | functional |
We use the device's location only if the user presses the location detection button in the location selector; we use the coordinates to determine the nearest location and do not store them.
8. Your Rights
You have the following rights in relation to your personal data:
- Access. You may request information about the data we process and a copy of that data.
- Rectification. You may rectify inaccurate data; you can update most of it yourself in your profile.
- Erasure. You may delete your account yourself in the settings; please send any other requests to info@bajk.si.
- Restriction and objection. You may request the restriction of processing and object to processing based on legitimate interests.
- Data portability. You may receive the data you have provided to us in a machine-readable format.
- Withdrawal of consent. You may withdraw your consent (cookies, push notifications, price-drop notifications) at any time, without affecting the lawfulness of processing carried out before its withdrawal.
- Complaint. You may lodge a complaint with the Informacijski pooblaščenec RS, Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si.
We respond to requests within one month at the latest. To verify your identity, we may require confirmation via the e-mail address associated with the account.
9. Security
We use passwordless login with one-time codes, an encrypted connection (HTTPS), restricted access to data, the removal of metadata from photographs, protected access to attachments and invoices, and backups maintained by the hosting provider. Complete security of data transmission over the internet cannot be guaranteed; users are requested to safeguard access to their e-mail accounts.
10. Children
The services are intended for persons who are at least 15 years old. If we become aware that we have collected data relating to a younger child without parental consent, we will delete it.
11. Amendments
We update this Policy when the services change. We notify registered users of material amendments by e-mail or by means of a notice on the website. The current dated version is always published on this page.