Privacy Policy

1. Data Controller

The platform ruke.hr ("Ruke") is operated by DJECA BUDUĆNOSTI j.d.o.o., OIB (tax ID): 74236938498, MBS: 081205364, Pula, Croatia ("data controller", "we", "us").

When you use our services or book a cleaning, you entrust us with personal data. This policy explains what we collect, why, and your rights.

Privacy enquiries: info@ruke.hr

2. Data We Collect

• Booking data: name, phone number, email, property address, property details, and any access instructions you provide.
• Account data: email address and hashed password (passwords are never stored in plain text).
• Provider application data: name, phone, email, nationality, OIB (Croatian tax number), cleaning experience, and weekly availability.
• Provider identity verification: identity document and photo, reviewed by the Ruke team as part of a manual identity verification process.
• Job proof photos: check-in and check-out photos uploaded by your assigned provider.
• Reviews: rating and written feedback you submit after a completed job.
• Technical data: IP address, browser type, and standard server logs (retained 30 days).

3. Legal Basis for Processing (GDPR Art. 6)

• Contract performance (Art. 6/1/b): booking, provider dispatch, and delivery of the requested service.
• Legitimate interests (Art. 6/1/f): fraud prevention, service quality improvement, and transactional email communication.
• Legal obligation (Art. 6/1/c): financial record-keeping under Croatian Accounting Act and EU law.
• Consent (Art. 6/1/a): marketing communications — you may withdraw at any time by emailing info@ruke.hr.

4. Data Sharing

We share data only as necessary to deliver the service:

• Assigned provider: your first name, address, and access instructions — only after a booking is confirmed.
• Supabase (Ireland/EU): our database host.
• Revolut Business (UK/EU): provider payout processing.
• Resend (USA): transactional email delivery; EU standard contractual clauses apply.
• Vercel (USA): platform hosting; EU region; standard contractual clauses apply.

We do not sell or rent your personal data to third parties.

5. Data Retention

• Booking records: 7 years (Croatian Accounting Act obligation).
• Account data: until deletion request or 3 years of inactivity.
• Job photos: 12 months from the job date.
• Server logs: 30 days.
• Provider identity documents: removed upon end of cooperation, maximum 3 years.

6. Your Rights (GDPR)

As an EU data subject you have the right to:

• access the personal data we hold about you,
• correct inaccurate data,
• request erasure ("right to be forgotten"),
• object to processing or request restriction,
• data portability,
• lodge a complaint with AZOP (Croatian Data Protection Authority, azop.hr) or any EU supervisory authority.

To exercise any right, email info@ruke.hr. We respond within 30 days.

7. Cookies

We use only functional cookies necessary for the site to operate (session authentication, language preference). We do not use tracking or advertising cookies without your explicit consent. You can manage preferences via the banner on our website.

8. Security

All data is encrypted in transit (HTTPS/TLS 1.2+). Passwords are hashed using bcrypt/scrypt. Access to production data is restricted to authorised personnel via multi-factor authentication.

9. Contact

DJECA BUDUĆNOSTI j.d.o.o. · OIB: 74236938498 · Pula, Croatia
info@ruke.hr