PRIVACY POLICY

Last updated: 20 October 2026

This Privacy Policy explains how DALIBOR GOGIC PR DLBR handles personal data on DLBR websites and in DLBR EID. It distinguishes data DLBR controls from verification data DLBR processes for a customer.

Who is responsible

The controller for DLBR's website, business-contact, account, billing, and service-security processing is DALIBOR GOGIC PR DLBR, Laze Kostica 16, 22320 Indjija, Serbia. Registration number (MB): 66796060. Tax identification number (PIB): 113398540. D-U-N-S®: 680882977. Contact: mail@daliborgogic.com, +381 69 581 41 10. You can also contact privacy@dlbr.app about privacy matters.

When a business customer uses DLBR EID to verify a person, that customer decides why and how the verification takes place and acts as controller. DLBR processes the verification data for that customer under its documented instructions and the applicable data processing agreement (DPA). Contact the customer that requested your verification to exercise rights over that verification. DLBR will assist the customer as required by the DPA and applicable law.

Data, purposes, and legal bases

DLBR uses the following data for these purposes and legal bases:

Where DLBR relies on legitimate interests, those interests are operating, securing, supporting, and improving its business service while respecting people's rights. If you do not provide information needed to answer an inquiry, create an account, or complete a requested verification, DLBR or the customer may be unable to provide that service.

Data sources and recipients

DLBR receives information directly from you, from the business customer that manages your account or requested a verification, and from the browser or service systems you use. Verification claims come from the wallet or other verification method selected by the customer and are processed under that customer's instructions.

DLBR shares data with the customer whose service you use, infrastructure and communications providers that host or operate DLBR EID, and professional advisers who support DLBR's business. DLBR may disclose data to public authorities when the law requires it. DLBR uses Cloudflare infrastructure for hosting and related platform services, including transactional email delivery. If you consent to optional analytics, page-view and interaction data is also sent to Google Analytics 4, provided by Google.

Where data is stored: verification sessions, including selected claims and verification details, are stored and processed in Cloudflare Durable Objects in Cloudflare's EU jurisdiction. Claims and verification details are deleted within 30 seconds after the result. The Gateway runtime D1 database used for verification audit records is configured for Cloudflare's EU jurisdiction; audit records never contain claim values. These storage settings do not guarantee that Worker execution or all related processing stays in the EU. Other parts of the service, including account administration data, request routing, logs, traces, queues, email delivery and backups, may use Cloudflare's global network and involve processing outside the EU. If you allow analytics, the marketing website sends page-view and predefined interaction events to Google Analytics 4. Google may process those events outside the EEA under its applicable service terms and transfer safeguards. DLBR does not send form values, account information, wallet presentations or verification claims to Google Analytics. For customer verification data, any transfer that requires a legal transfer mechanism must be documented under the DPA before it begins. For personal data DLBR controls, contact privacy@dlbr.app to ask about any applicable transfer mechanism and safeguards.

DLBR is established in Serbia. Where GDPR applies to customer verification data transferred to DLBR or its providers outside the European Economic Area, the customer and DLBR must document a valid transfer mechanism and any required safeguards in a transfer record under the DPA before that transfer begins. The DPA page alone does not complete or execute those transfer safeguards. Contact privacy@dlbr.app for information about the mechanism applicable to your service and how to obtain a copy of relevant safeguards.

Cookies and browser storage

Optional Google Analytics 4 is off unless you allow it in Cookie settings. Before consent, the site sends no analytics requests and creates no analytics identifier. After consent, a small browser client sends page views and predefined interaction events directly to Google; it does not load Google's tag script. Page paths, titles and limited referrer information are included; URL query strings and fragments are excluded. Events cover pilot CTA and sales-contact clicks, pilot-form starts, submission attempts and accepted requests, generic submission error categories, wallet-directory availability filters and country selections, onboarding FAQ openings, and time spent with a page visible. Event parameters contain only predefined labels and country codes; form contents and search text are excluded. Google may also derive basic technical and country/region information when processing analytics requests.

After consent, a random analytics identifier and session metadata are kept in this site's local storage. The identifier is valid for 30 days from creation, without extending that period on activity; the session changes after 30 minutes of inactivity. An expired identifier is replaced when analytics is next used. Local storage may retain an expired record until you return or clear it. The client does not set analytics cookies. DLBR does not send account information, wallet presentations or verification claims and does not use analytics for advertising. Your analytics choice is valid for 180 days and is stored locally; you can change or withdraw it at any time through Cookie settings. Withdrawal removes the analytics identifier and session metadata and stops further sending. Google Analytics event and user-level retention is set to two months, with no reset on new activity; see Google's data retention information. When you select Light or Dark on a DLBR site with the theme switcher, it stores dlbr-theme-choice in local storage for that site and in a cookie scoped to .dlbr.app for up to one year, so the preference is shared across DLBR subdomains. Choosing System removes that saved preference and cookie; with no saved preference, the display follows your device setting. You can also clear browser storage in your browser settings. DLBR does not use fingerprinting or verification data to build advertising profiles. Google signals, user-provided data collection, granular location and device data collection, and ads personalization are disabled for this analytics property.

Retention

DLBR keeps personal data only for as long as the relevant purpose requires, then deletes or anonymises it unless law requires further storage. Current service retention criteria include:

• The analytics choice is valid for 180 days. The browser analytics identifier becomes invalid after 30 days and is replaced on the next use; withdrawal removes the identifier and session metadata immediately. Expired browser records may remain until the next visit or until you clear browser storage. Google Analytics event and user-level data is retained for two months, without extending that period on new activity; aggregated reporting follows separate Google retention rules.
• Verification claims and details are held temporarily for result delivery and deleted within 30 seconds after the result.
• This short claim-retention period is not zero data retention. A minimal terminal session status and status-only event history may remain after claims and verification details are removed. Verification audit records in the Gateway runtime D1 database, configured for Cloudflare's EU jurisdiction, contain identifiers, statuses, credential and issuer details, diagnostic categories, and timing information, but never contain claim values. Some idempotency, audit, and webhook-failure metadata has no automatic age-based deletion configured; retention and deletion terms for pilot processing are agreed with each pilot customer.
• Closed support-ticket message content is deleted after 90 days under the service retention process. Ticket metadata may remain where needed to manage support and security.
• Browser diagnostic reports are retained as a rolling set of up to 500 reports; newer reports replace older reports.
• Account, contact, invoice, and payment records remain while the business relationship is active and afterward as needed for accounting obligations, disputes, and legal claims.

Where DLBR processes verification data for a customer, the DPA and that customer's retention instructions govern the applicable retention period. Backup copies may remain until the normal backup cycle replaces them, with access restricted and restored data subject to deletion instructions.

Your rights and requests

Depending on the law that applies and the role DLBR has for the data, you may have the right to request access, correction, deletion, restriction, or portability; object to processing based on legitimate interests; and withdraw consent where processing relies on consent. You may also complain to a supervisory authority. If DLBR processes the data for a customer, contact that customer first; DLBR will help the customer respond.

Send requests about data DLBR controls to privacy@dlbr.app. DLBR may ask for information needed to verify your identity, but will not request more than reasonably necessary. Where the GDPR applies, DLBR responds without undue delay and within one month; for complex or numerous requests, it may extend the period by up to two further months and will tell you within the first month. Under Serbia's Personal Data Protection Law, DLBR responds within 30 days and may extend by a further 60 days when necessary, with notice and reasons within the initial 30 days.

You may complain to the Serbian Commissioner for Information of Public Importance and Personal Data Protection (Poverenik) or, where the GDPR applies, to the supervisory authority in your place of habitual residence, place of work, or the place of the alleged infringement.

Automated decisions and security

DLBR returns verification status and related signals to the customer. The customer decides how to use those results; DLBR does not decide whether an individual qualifies for the customer's product or service.

DLBR uses access controls, encryption in transit, tenant separation, and operational audit controls to protect personal data. No online service can guarantee absolute security. If a personal data breach affects your rights, DLBR or the relevant customer will notify you when the law requires it.