Politika privatnosti

Aplikacija: Obelus Marketing Automation · Važi od 22. oktobra 2026.

1. Rukovalac

Naziv: Obelus d.o.o.
Adresa: Vardarska 15, Niš, Srbija
PIB / MB: 112994946 / 21784524
Kontakt: info@obelus.rs

2. Šta je aplikacija

Obelus Marketing Automation je interna aplikacija kompanije Obelus d.o.o. Služi isključivo za upravljanje reklamama Obelusa. Preko zvaničnog Meta Marketing API-ja pripremamo, proveravamo i pratimo oglase za sopstvene proizvode (na primer IntelliPOS i TAS), na reklamnom nalogu, Facebook stranici i Instagram nalogu kojima upravlja Obelus.

Koriste je samo ovlašćeni zaposleni Obelusa. Ne pruža usluge drugim kompanijama.
Nema javnu prijavu preko Facebook naloga (Facebook Login). Posetioci i korisnici Facebooka i Instagrama ne prijavljuju se u aplikaciju i ne daju joj nikakve dozvole.
Aplikacija nema direktan pristup sadržaju razgovora na Messengeru i Instagramu. Nema dozvole za čitanje poruka i ne preuzima ih.

3. Koje podatke aplikacija obrađuje

Podaci o Obelus oglasima: kampanje, skupovi oglasa, oglasi i kreative, uključujući nazive, budžete, trajanje, izbor publike (država, uzrast, plasmani), tekstove, slike, statuse i rezultate Metine provere oglasa.
Zbirna statistika: broj prikaza, doseg, potrošnja i broj započetih razgovora. To su zbirni brojevi i ne sadrže identitet pojedinačnih osoba.
Podaci o Obelus nalozima: identifikatori i nazivi reklamnog naloga, Facebook stranice, Instagram naloga i tehničkog (sistemskog) korisnika, kao i dodeljene dozvole za pristup.
Pristupni ključevi: tehnički tokeni koje Meta izdaje za pristup Marketing API-ju.

Većina ovih podataka su poslovni podaci Obelusa, a ne podaci o ličnosti. Aplikacija ne obrađuje:

sadržaj poruka;
imena i profile osoba koje su videle oglas ili poslale poruku;
liste kupaca, prilagođene publike ni podatke prijave korisnika.

4. Poruke koje stižu preko oglasa

Neki naši oglasi nude dugme „Pošalji poruku". Kada osoba pošalje poruku preko Messengera ili Instagram Directa, razgovor se odvija u Meta servisima. Obelus odgovara kroz Metine alate (na primer Meta Business Suite), a ne kroz ovu aplikaciju.

Pozdravna poruka i brza pitanja u oglasu su unapred pripremljeni tekstovi. Na obradu poruka u Meta servisima primenjuje se Metina politika privatnosti.

5. Svrha i pravni osnov

Svrha je priprema, provera i praćenje sopstvenih oglasnih kampanja Obelusa. Podatke ne prodajemo, ne ustupamo drugima i ne koristimo za druge svrhe. Kada obrada obuhvata podatke o ličnosti, osnov zavisi od vrste podataka:

Podaci u vezi sa nalozima i oglasima Obelusa. Ovde se mogu naći identifikatori ili imena zaposlenih koji upravljaju nalozima. Osnov je legitimni interes Obelusa da upravlja sopstvenim oglašavanjem (član 12. stav 1. tačka 6) Zakona o zaštiti podataka o ličnosti). Smatramo da taj interes ne preteže nad interesima i pravima lica, jer:
- obrada je ograničena na podatke potrebne za rad sa našim nalozima;
- ne pravi profile pojedinaca;
- ne obuhvata sadržaj poruka;
- pristup imaju samo ovlašćeni zaposleni.
Podaci iz vašeg zahteva (na primer zahteva za brisanje). Osnov je zakonska obaveza rukovaoca da postupi po zahtevu (član 12. stav 1. tačka 3) Zakona).
Tehnički podaci posetilaca ove stranice. Osnov je legitimni interes za bezbednu i ispravnu isporuku stranice (videti tačku 8).

6. Gde se podaci čuvaju i ko im pristupa

Pristupni tokeni se čuvaju u lokalnim konfiguracionim fajlovima na računaru Obelusa. Pristup tim fajlovima je ograničen, a oni nisu u repozitorijumu koda.
Pregledi stanja kampanja i izveštaji čuvaju se lokalno, na računaru Obelusa.
Slike za oglase su javni marketinški materijali Obelusa i čuvaju se i u Cloudflare R2 skladištu.
Podatke o oglasima čuva i Meta, prema svojim pravilima.

Pristup imaju samo ovlašćeni zaposleni Obelusa.

7. Koliko dugo čuvamo podatke (kriterijumi)

Podatke čuvamo samo onoliko koliko je neophodno za svrhu zbog koje se obrađuju:

Pristupni tokeni se čuvaju dok je integracija sa Meta Marketing API-jem u upotrebi. Opozivamo ih i brišemo:
- kada se integracija ukine;
- kada se token zameni novim;
- ako postoji sumnja da je neovlašćeno korišćen.
Pregledi stanja kampanja i izveštaji se čuvaju dok traje kampanja i dok su potrebni za analizu njenih rezultata i poređenje sa kasnijim kampanjama Obelusa. Brišemo ih kada više nisu potrebni za tu svrhu.
Zahtevi lica i prepiska u vezi sa njima se čuvaju onoliko koliko je potrebno da se po zahtevu postupi i da se može pokazati kako je postupljeno.
Ako lice osnovano zatraži brisanje (videti tačku 9), podatke koji se na njega odnose brišemo i pre isteka gornjih kriterijuma, osim ako postoji zakonski izuzetak.

8. Pružaoci usluga

Meta Platforms: platforma za oglašavanje i Marketing API.
Cloudflare: hosting ove stranice i skladištenje marketinških slika. Pri isporuci stranice Cloudflare može da obrađuje tehničke podatke posetilaca i da vodi pristupne logove, na primer:
- IP adresu;
- vreme pristupa;
- traženu adresu;
- podatke o pregledaču.
Te podatke koristi za isporuku stranice i bezbednost, prema svojim pravilima (Cloudflare politika privatnosti). Obelus ove logove ne koristi za praćenje posetilaca.

9. Prava lica na koja se podaci odnose

U skladu sa Zakonom o zaštiti podataka o ličnosti („Sl. glasnik RS", br. 87/2018), imate sledeća prava, pod uslovima koje zakon propisuje:

Pristup (član 26): potvrda da li obrađujemo vaše podatke, uvid u njih i kopija podataka, uz informacije o svrsi, primaocima i čuvanju.
Ispravka i dopuna (član 29): ako su podaci netačni ili nepotpuni.
Brisanje (član 30): na primer kada podaci više nisu potrebni za svrhu, kada je uložen osnovan prigovor ili kada je obrada nezakonita. Brisanje se ne primenjuje u zakonom propisanim izuzecima, na primer kada je obrada potrebna radi ispunjenja zakonske obaveze ili radi podnošenja, ostvarivanja ili odbrane pravnog zahteva.
Ograničenje obrade (član 31): na primer dok se proverava tačnost podataka koju ste osporili, ili dok se odlučuje o vašem prigovoru.
Prigovor (član 37): na obradu zasnovanu na legitimnom interesu. Obradu tada prekidamo, osim ako postoje zakonski razlozi koji pretežu nad vašim interesima, pravima i slobodama, ili ako je obrada potrebna radi pravnog zahteva.
Prenosivost (član 36): primenjuje se samo kada je obrada zasnovana na pristanku ili ugovoru i vrši se automatizovano. Obrada opisana u ovoj politici se ne zasniva na pristanku ni ugovoru, pa se ovo pravo po pravilu ne primenjuje.
Pritužba Povereniku (član 82): možete podneti pritužbu Povereniku za informacije od javnog značaja i zaštitu podataka o ličnosti (poverenik.rs).

Zahtev pošaljite na info@obelus.rs.

Postupamo bez odlaganja, a najkasnije u roku od 30 dana od prijema zahteva (član 21).
Ako je to neophodno zbog složenosti i broja zahteva, rok se može produžiti za još najviše 60 dana. O produženju i razlozima obaveštavamo vas u roku od 30 dana od prijema zahteva.
Ako je potrebno da proverimo vaš identitet, možemo tražiti dodatne informacije.

Uputstvo za brisanje je na stranici Brisanje podataka.

10. Ova stranica

Ova stranica ne koristi kolačiće, analitiku, spoljne skripte ni spoljne fontove. Tehnički podaci i pristupni logovi koje vodi Cloudflare opisani su u tački 8.

11. Izmene

Ako se promeni način rada aplikacije, na primer ako dobije pristup porukama, prvo ćemo ažurirati ovu politiku i datum na vrhu stranice.

Privacy Policy

Application: Obelus Marketing Automation · Effective 22 October 2026. The Serbian version above is the primary version.

1. Controller

Name: Obelus d.o.o.
Address: Vardarska 15, Niš, Serbia
Tax ID / Reg. No.: 112994946 / 21784524
Contact: info@obelus.rs

2. What the application is

Obelus Marketing Automation is an internal application of Obelus d.o.o. It is used only to manage Obelus's own advertising. Through the official Meta Marketing API, we use it to prepare, check and monitor ads for our own products (for example IntelliPOS and TAS), on the ad account, Facebook Page and Instagram account managed by Obelus.

Only authorised Obelus staff use it. It does not provide services to other companies.
It has no public Facebook Login. Visitors and Facebook or Instagram users do not log in to the application and do not grant it any permissions.
The application has no direct access to the content of Messenger or Instagram conversations. It has no permission to read messages and does not retrieve them.

3. Data the application processes

Obelus ad data: campaigns, ad sets, ads and creatives, including names, budgets, schedules, audience settings (country, age, placements), texts, images, statuses and the results of Meta's ad review.
Aggregated statistics: impressions, reach, spend and number of conversations started. These are aggregated numbers and do not contain the identity of individual people.
Obelus account data: identifiers and names of the ad account, Facebook Page, Instagram account and technical (system) user, and the access permissions assigned to them.
Access keys: technical tokens issued by Meta for access to the Marketing API.

Most of this is Obelus business data, not personal data. The application does not process:

message content;
the names or profiles of people who saw an ad or sent a message;
customer lists, custom audiences or user login data.

4. Messages sent through ads

Some of our ads offer a "Send message" button. When a person sends a message via Messenger or Instagram Direct, the conversation takes place in Meta's services. Obelus replies using Meta's tools (for example Meta Business Suite), not through this application.

The welcome message and quick questions in an ad are pre-written texts. Message processing in Meta's services is governed by Meta's Privacy Policy.

5. Purpose and legal basis

The purpose is to prepare, check and monitor Obelus's own advertising campaigns. We do not sell or share the data and do not use it for any other purpose. Where personal data is involved, the legal basis depends on the type of data:

Data related to Obelus accounts and ads. This may include identifiers or names of staff who manage the accounts. The basis is Obelus's legitimate interest in managing its own advertising (Article 12(1)(6) of the Serbian Law on Personal Data Protection). We consider that this interest does not override the interests and rights of the people concerned, because:
- processing is limited to the data needed to operate our accounts;
- it creates no profiles of individuals;
- it does not include message content;
- only authorised staff have access.
Data in your request (for example a deletion request). The basis is the controller's legal obligation to act on the request (Article 12(1)(3) of the Law).
Technical data of visitors to this website. The basis is the legitimate interest in delivering the website securely and correctly (see section 8).

6. Where data is stored and who can access it

Access tokens are kept in local configuration files on an Obelus computer. Access to these files is restricted, and they are not in any code repository.
Campaign snapshots and reports are kept locally, on an Obelus computer.
Ad images are public Obelus marketing materials and are also stored in Cloudflare R2 storage.
Meta also stores the ad data, under its own rules.

Only authorised Obelus staff have access.

7. How long we keep data (criteria)

We keep data only for as long as necessary for the purpose for which it is processed:

Access tokens are kept while the Meta Marketing API integration is in use. We revoke and delete them:
- when the integration is discontinued;
- when a token is replaced with a new one;
- if unauthorised use is suspected.
Campaign snapshots and reports are kept while the campaign runs and while they are needed to analyse its results and compare them with later Obelus campaigns. We delete them when they are no longer needed for that purpose.
Requests from individuals and related correspondence are kept as long as needed to act on the request and to be able to show how it was handled.
If a person justifiably requests deletion (see section 9), we delete the data related to them even before the above criteria are met, unless a legal exception applies.

8. Service providers

Meta Platforms: advertising platform and Marketing API.
Cloudflare: hosting of this website and storage of marketing images. When delivering this website, Cloudflare may process technical data of visitors and keep access logs, for example:
- IP address;
- time of access;
- requested URL;
- browser information.
It uses this data for delivery and security, under its own rules (Cloudflare Privacy Policy). Obelus does not use these logs to track visitors.

9. Rights of data subjects

Under the Serbian Law on Personal Data Protection (Official Gazette RS No. 87/2018), you have the following rights, under the conditions set by the law:

Access (Article 26): confirmation of whether we process your data, access to it and a copy, with information about purpose, recipients and retention.
Rectification and completion (Article 29): if the data is inaccurate or incomplete.
Erasure (Article 30): for example when the data is no longer needed for its purpose, when a justified objection has been made, or when processing is unlawful. Erasure does not apply in the exceptions set by law, for example when processing is needed to comply with a legal obligation or to establish, exercise or defend a legal claim.
Restriction of processing (Article 31): for example while the accuracy of data you have contested is being checked, or while your objection is being decided.
Objection (Article 37): to processing based on legitimate interest. We then stop the processing, unless there are legal grounds that override your interests, rights and freedoms, or the processing is needed for a legal claim.
Data portability (Article 36): applies only where processing is based on consent or contract and is carried out by automated means. The processing described in this policy is not based on consent or contract, so this right does not normally apply.
Complaint to the Commissioner (Article 82): you may lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (poverenik.rs).

Send your request to info@obelus.rs.

We act without undue delay and at the latest within 30 days of receiving the request (Article 21).
Where necessary, given the complexity and number of requests, this period may be extended by up to 60 more days. We inform you of the extension and the reasons within 30 days of receiving the request.
If we need to verify your identity, we may ask for additional information.

Deletion instructions are on the Data deletion page.

10. This website

This website uses no cookies, no analytics, no third-party scripts and no external fonts. Technical data and access logs kept by Cloudflare are described in section 8.

11. Changes

If the way the application works changes, for example if it is given access to messages, we will first update this policy and the date at the top of the page.