Skip to content
Meteor Commerce

Privacy policy

Last updated: 2 October 2026

This page describes what happens to your data when you use the Meteor Commerce website. It was written against the state of the site on the date above: for every piece of data it says why we collect it, where it is kept and who it is passed to. If anything here is unclear, or you want to exercise one of your rights, write to us at info@meteorkomerc.com.

Our Terms of use apply alongside this policy.

Who processes your data

Your data is processed by Meteor Commerce, and we are responsible for everything described here. You can reach us at:

  • Address: Staparski put bb, Sombor, Serbia
  • Telephone: +381 (0) 25/432-400, +381 (0) 25/448-916, +381 (0) 25/448-917
  • Email: info@meteorkomerc.com

Cookies

Ordinary browsing of this site sets one cookie. It is called pll_language and it holds only sr or en — which language you are reading. It exists so the site does not put you back into the other language on your next visit. It is set by the multilingual plugin, lasts one year, and is readable only by our own domain.

We do not use Google Analytics. We use no other visitor-measurement tool, we have no advertising pixels, we do not record how you move around a page, and we do not follow you to other sites. That is why there is no cookie banner either — there is nothing to consent to beyond the language you chose.

Besides that cookie, WordPress writes one technical entry into your browser's temporary storage, called wpEmojiSettingsSupports. It records whether your browser can draw emoji characters. It holds nothing about you and it is discarded when you close the browser tab.

None of this is an estimate. Before this policy was published, 43 addresses on the site were checked, in both languages, including a page that does not exist: not one set any cookie other than the one named above, and not one contained visitor-measurement or advertising code.

What our server records

Like every website, ours runs on a server that keeps a technical access log. Each time a page is opened it records:

  • the IP address the page was opened from
  • the date and time of the request
  • the address of the page that was opened
  • the browser and device type, and the page you arrived from

We do not read those records to analyse traffic; they exist for the operation and security of the server. One thing there is worth knowing: when you submit a form successfully, the site returns you to the same page with a marker in the address (for example ?mctw_form=karijera&mctw_status=ok). So the server log keeps a record that a form was submitted from a particular IP address at a particular moment. The contents of the form are not written to the log.

The access logs are kept by the company that hosts the site, for its own retention period. That period has not been confirmed to us yet, and we will add it here once we have it.

When you send a job application

There is an application form on our Careers page. If you submit it, what stays with us is:

  • Your name — a required field
  • Your email address — a required field
  • Your phone number — if you enter one
  • A short bio — the text you write in the form yourself
  • Your CV — if you attach one (PDF or Word, up to 5 MB)
  • Your IP address at the moment you submit
  • the site language and the address of the page the application was sent from

An application is kept in two places. First, as a record on the site itself that is not public: it does not appear in the site's search or in search-engine results, and only a signed-in user with permission to read private content can open it. Your name is in the title of that record, because that is how we recognise the application. Second, the application is also sent by email to info@meteorkomerc.com; that message contains every form field as you entered it and a link to the attached CV, and your email address is set as the reply-to address.

On the date this policy was written, no job application was stored on the site. This section describes what will happen when you send one.

We also use the IP address to guard against automated submissions: the same form can be sent from the same IP address once every 30 seconds. That temporary record is valid for 30 seconds only, and it is cleared by the daily clean-up WordPress runs by itself. The form also contains a hidden field that people never see but automated programs fill in — that is how we recognise them, and such a submission is not stored.

The CV you attach

We accept only PDF, DOC and DOCX files, up to 5 MB. Before storing it we rename the file to a random name, so the name itself does not reveal who sent it.

There is one thing we would rather state plainly. The file is written into the same folder as the site's images. That folder cannot be browsed — the server refuses such a request — and the file name cannot be guessed, but anyone who has the exact link can open your CV without signing in. We publish the link nowhere; it sits in the email we received, and it stays valid until we delete the file.

The attached file is not deleted automatically when we delete the application record — it has to be removed from the server separately. When you send us an erasure request, we delete the application record, the file itself, and the email from the mailbox.

The sign-up for offers and promotions

There is a form with a single field — an email address — on our online shop page. We keep it the same way as a job application: as a record on the site that is not public, and as an email to info@meteorkomerc.com. The IP address at the moment of sending and the form's identifier are kept alongside the address.

On the date this policy was written, four such sign-ups were stored on the site. They hold an email address and an IP address, and none of them holds a CV.

We should be precise here, because it concerns what you actually agreed to. The form contains no consent box and no statement of purpose, and the confirmation you see after sending promises one thing only: that we will let you know when the online shop is available. So addresses collected before a consent box exists are not used for promotional messages — we use them only for that one notification. Before we sent any promotional message to those addresses we would ask for your consent and add a one-click way to unsubscribe, which the form does not have today.

The store map

The district map on the home page is an image held in the page's own code and served from our own server. We do not use the Google Maps API, there is no embedded map, and we never ask for your location. Clicking a store opens its address and phone number on our own page.

Each store also carries a Show on Google Maps button. That is an ordinary link: your browser contacts Google only if you click it, and from that point Google's terms and privacy policy apply, not ours.

Third parties

We do not sell, rent or share your data for advertising. The only parties it reaches are:

  • Our hosting provider — the site, the database, the attached files and the access logs all sit with them. We will add their name, where they are based, and the terms on which they process data for us.
  • Bunny Fonts (fonts.bunny.net) — the site loads its typeface from that service. On every page view your browser fetches the stylesheet and the font files themselves from it, so that service sees your IP address and browser type, as does any server a browser sends a request to. It was chosen precisely because it sets no cookies.
  • An email delivery service — the notification about your submission passes through it on its way to our mailbox.
  • State authorities — only where the law obliges us to hand data over.

There is no embedded content from other services on the site — no YouTube player, no maps, no forms from other tools. The social icons in the footer are ordinary links and load nothing until you click them. Comments are switched off, so there are no author avatars and no service delivering them.

The server the site runs on and the font service may be located outside Serbia. We are confirming where those services are based, and the basis for transferring data to other countries, with our legal adviser, and we will add it here.

How long we keep data

We will be plain here, because it is the only way this page can be true. The site does not delete anything by itself today. There is no scheduled job that removes an application, a CV or an email address when a period runs out — deletion is a manual job.

We have not set retention periods yet. We are setting them, and we will publish them on this page together with the date from which they start to apply. Until then, this is what happens:

  • We delete a job application and the attached CV at your request, without asking why, and once a selection process has ended.
  • We delete an email address from the notification list at your request.
  • Server records and business email correspondence are kept as long as they are needed for operations, and for as long as our hosting provider's own periods.

When we delete something, it is removed immediately from the systems in use. Backups kept by our hosting provider expire on their own schedule, so the data may exist in them for some time after that; we will add that period here. If a message has already been forwarded outside our mailbox, we cannot reach that copy.

The lawful basis for processing

Under Serbia's personal data protection law, every processing operation needs a basis. These are the bases by purpose, drawn up from the state of the site; our legal adviser is confirming them and we will correct this list if needed.

  • A job application: your own act of applying, and our interest in filling a position. The fields you did not have to complete — phone number and CV — you provide by your own decision.
  • The notice that the online shop is available: your own act of sending us an address for exactly that notice. Promotional messages would require consent, which we do not ask for today and therefore do not send.
  • IP address, the anti-automation guard and server logs: our interest in keeping the site working and protected from abuse.
  • The language cookie: it is necessary for the site to work in the language you chose.
  • Loading the typeface from Bunny Fonts: our interest in presenting the page as it was designed. You can object to this processing at the address in this policy.

Your rights

Under the personal data protection law you have the right to:

  • request access to the data we hold about you, and a copy of it
  • request correction of inaccurate data, or completion of incomplete data
  • request erasure of your data
  • request restriction of processing, or object to processing based on our own interest
  • request the transfer of data you gave us yourself
  • withdraw consent where processing rests on it, without affecting anything processed before that point
  • lodge a complaint with the supervisory authority — the Commissioner for Information of Public Importance and Personal Data Protection

How to exercise your rights

Write to us at info@meteorkomerc.com. It is enough to say what you want; you do not have to give a reason for an erasure request. If we cannot tell from your request which record it concerns, we will ask you for something you entered in the form — never for a photo ID, and never for data we do not hold about you.

We will add here who answers these requests and the deadline we commit to. Until then, we answer at the address above, as quickly as we can.

How we protect your data

The site runs over an encrypted connection (HTTPS). Submissions from the site are not public and can be opened only by a signed-in user with permission to read private content; on the date this policy was written there is exactly one such user, and it is an administrator account. The forms are protected against automated submission and check the type and size of any attached file.

We do not claim more than that. We keep no record of which user opened which submission, and an attached CV is, as described above, reachable by anyone who comes to have the link.

Changes to this policy

When we change this policy we will change the date at the top of the page. Changes that materially alter what we do with your data will also be announced on the home page. We suggest looking at this page before you send us a form.