- We use data to make purchases, room try-ons, and accounts work — we do not sell it or use it for advertising without your consent.
- We send the room try-on photo to Google Gemini only to create the image; we delete it from the server no later than 24 hours, unless you save the try-on yourself.
- The seller from whom you buy receives your name, address, and phone number only when they accept the order — solely for delivery.
- You can request a copy, correction, or deletion of data at any time: Your data.
Who processes your data
The data controller for the website furnituria.co is Furnituria d.o.o., , registration number , VAT ID (hereinafter: "we"). Contact for data inquiries: info@furnituria.co.
furnituria.co is a platform: showrooms, workshops, and manufacturers (sellers) sell on it. When you buy, you conclude a purchase agreement with the seller. For the data received for delivery, fiscal receipt, and complaints, the seller is an independent controller and is responsible for them by law. Sellers who sell on their own website ("Buy from seller") process data according to their privacy policy.
What data we process
| Category | Data | Source |
|---|---|---|
| Account | first and last name, email, phone, delivery addresses, password (encrypted only) | from you |
| Orders | products, prices, payment method, delivery address, shipment number and status, delivery confirmation | from you, the seller, and the courier |
| Try in room | room photo, selected products and style, generated image | from you |
| Wishlist and notifications | selected products; email for price or stock notifications; phone notification subscription | from you |
| Communication | contact form messages, reviews and accompanying photos, data requests | from you |
| Newsletter | email, name (if you enter it), time and method of giving consent | from you |
| Technical data | truncated IP address fingerprint (for abuse protection), device and browser type, server logs, cookies (see Cookie Policy) | automatski |
| Sellers and partners | company and contact person data, current account, WhatsApp number, team members, sales and commission | from the seller |
We do not request or process special categories of data (health, religious beliefs, etc.). We do not make decisions about you solely by automated means, nor do we profile you for advertising.
Why and on what basis
| Purpose | Legal basis (PDPA Art. 12 / GDPR Art. 6) |
|---|---|
| Account, order, delivery, payment, room try-on you initiate, notifications you request | contract performance and actions at your request |
| Invoices, complaints, contract withdrawal, business document retention | legal obligation (Consumer Protection Law, accounting and tax regulations) |
| Newsletter, analytical cookies, phone notifications | your consent — you can withdraw it at any time |
| Website security, prevention of fraud and abuse, confirmation that the order has been delivered, service improvement | legitimate interest (you can object) |
Room try-on and artificial intelligence
When you initiate a try-on, we send the room photo and selected products to Google Gemini (Google LLC), which creates an image with the product in your room. Google processes this photo as our processor, according to its terms for the Gemini API.
- The photo and generated image are automatically deleted from our server no later than 24 hours.
- If you save the try-on in "My Try-ons", we store it until you delete it or request account deletion.
- Please do not photograph people, documents, apartment numbers, or other identifiable information.
- The image is an illustration: colors, scale, and appearance may differ from the actual product.
To whom we give data
- To the seller from whom you buy — name, address, phone, and order items, only when they accept the order, solely for delivery, invoicing, and complaints.
- To the courier service chosen by the seller (e.g., BEX, Post Express, GLS) — recipient's data and the cash-on-delivery amount.
- Google (Gemini) — the photo for the room try-on, as described above.
- To the hosting provider — Contabo GmbH, Germany; the server is in the European Union. Emails are sent by our server.
- WhatsApp (Meta) — only if you click 'Video call' or 'Send message' to the seller yourself; the conversation takes place on WhatsApp, according to their policy. We only record that contact has been established, without content.
- To partners — when you go to the seller's website through us, we only forward an anonymous visit ID so that the sale can be attributed to the platform; they do not receive your personal data from us.
- To state authorities — only when required by law.
We do not sell or rent data.
Transfer of data outside Serbia
The server is in Germany (EU), which is considered a country with an adequate level of protection under the LPDP (Law on Personal Data Protection). Google may also process the try-on photo in the USA; such transfer is based on standard contractual clauses and the EU-US Data Privacy Framework.
How long we store data
| Data | Deadline |
|---|---|
| Photo and room try-on image | up to 24 hours; saved try-ons until you delete them |
| Account | until you delete it or request its deletion |
| Orders and invoices | as required by accounting regulations (up to 10 years), then deleted or anonymized |
| Newsletter and price/stock notifications | until unsubscribed (link is in every email) |
| Contact form messages and requests | as long as necessary for a response, up to 2 years |
| Cookie consent log | 3 years (proof of consent) |
| Server and attack protection logs | briefly, within regular log rotation |
Your rights
Under the LPDP (Arts. 26–38) and GDPR (Arts. 15–22), you have the right to:
- obtain a copy of your data and information on how we process it;
- request the correction of inaccurate or completion of incomplete data;
- request deletion ('right to be forgotten'), except for data we are legally obliged to retain;
- request restriction of processing;
- receive data in a machine-readable format (data portability);
- lodge an objection to processing based on legitimate interest;
- withdraw consent at any time (newsletter, cookies, notifications), without affecting prior processing.
Send your request via the Your Data page or to info@furnituria.co. We respond without delay, and no later than 30 days. If you believe the processing is unlawful, you can file a complaint: Commissioner for Information of Public Importance and Personal Data Protection (Bulevar kralja Aleksandra 15, 11120 Belgrade, www.poverenik.rs).
How we protect data
- All traffic is encrypted (HTTPS); passwords are stored only in encrypted form.
- The site operates on a separate part of the server, with restricted access, attack protection, and daily backups.
- The seller sees customer data only when they accept an order; seller team members see only what they are authorized for.
- Only authorized persons have access to administration.
Minors
The site is not intended for persons under 15 years of age. If we learn that we have collected data from a minor without parental consent, we will delete it.
Policy changes
We change the policy when the site's operation or regulations change. The effective date is at the top of the page; we notify users with an account of significant changes via email.