Last updated: 29 September 2026
This policy explains which personal data we process when you use balkans.lu and what rights you have. The EU General Data Protection Regulation (GDPR) applies in Luxembourg. Supervisory authority: CNPD.
1. Controller
Controller: Haris Dacic, email hi@haris.lu, phone +352 621 139 988. Address: see Imprint.
2. Hosting
The site and database run on a dedicated server at Hetzner Online GmbH, location Helsinki, Finland (EU). The host may process technical access data (e.g. IP address, timestamp, user agent) in server logs as needed for operations, security and troubleshooting (Art. 6(1)(f) GDPR).
3. Business listings (submit)
When you submit a listing we process the data you provide, for example: business name, category, address/city, phone, email, website, social links, opening hours, description, optional module fields, logo/cover files, and an optional notification email (not shown publicly).
Purpose: review, publish and maintain the directory. Legal basis: consent and/or steps prior to a contract (Art. 6(1)(a)/(b) GDPR) and legitimate interest in a public directory for published listings (Art. 6(1)(f) GDPR).
Retention: indefinite until deletion on request or by us (e.g. rejection, legal issues). Published contact details are visible to directory users.
4. Reports (“incorrect information”)
Reports store a reference to the listing, your free-text message and other data needed to handle the report. Purpose: quality control. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Retention: indefinite until handled and no longer needed, or until a deletion request.
5. Favourites & location (browser only)
Favourites are stored only in your browser (localStorage) and are not sent to our server.
Optional geolocation runs only in your browser to sort by distance. The position is not stored on our server.
6. Admin access
Moderation uses a protected admin area used only by the operator. Session/auth data (e.g. a cookie) may be set where technically required.
7. Analytics (Umami)
We use Umami for anonymous/pseudonymous usage statistics (e.g. page views). Umami loads only after you consent via the cookie/consent banner (Art. 6(1)(a) GDPR).
Without consent, analytics does not run. You can change your choice later (re-open the banner or clear the stored preference).
8. Fonts
We use web fonts via next/font. Font files are served from our own server; your browser typically does not contact Google servers when loading pages.
9. External links (Google Maps & others)
Links to Google Maps, websites or social networks lead to third-party services with their own privacy policies. We do not embed Maps as a default tracking widget; we use links.
10. Cookies & local storage
- Strictly necessary: e.g. language preference, admin session (operator only), consent choice.
- Favourites: localStorage (local only).
- Analytics (Umami): only after consent.
A banner asks for consent before non-essential analytics technologies.
11. Sharing
No sharing for advertising. Hosting providers process data as needed to run the service. A future transactional email provider would only be used to communicate with submitters and would be documented here.
12. Retention & deletion
Listings and reports: indefinite until deletion. Requests: hi@haris.lu. We aim to respond within 60 days at most.
13. Your rights
Under the GDPR you may have rights of access, rectification, erasure, restriction, portability and objection to processing based on legitimate interests. You may withdraw consent (without affecting past processing).
Complaints: to the competent supervisory authority (in Luxembourg, the CNPD).
14. Minors
The service is not directed at children. Do not submit other people’s data without authority.