This explains what we know about you, why we know it, and how to get rid of it. We wrote it to be readable — if anything stays unclear, ask us at support@park-one.app.

1. Who processes your data

The ParkOne app is developed and maintained by „LUPON VENTURES“ d.o.o. Sarajevo, Trg Solidarnosti 4, Sarajevo, Bosnia and Herzegovina (VAT/JIB 4227619600001) — hereinafter "we". We are the data controller for your account data. For anything related to your data, write to support@park-one.app — we answer every request within 30 days at the latest.

Through the app you buy a city's parking ticket, not ours. We are responsible for your account data (name, email, vehicles). The city where you parked is responsible for the purchased tickets and the parking charge — it owns that record, it runs enforcement, and it handles complaints.

2. What data we collect

We collect only what the app cannot work without:

What we do not do: we do not track your movement, do not read your contacts, do not show ads, do not sell or share your data with third parties for marketing, and do not profile you.

3. The basis on which we process it

• Performance of a contract — without an account, a vehicle and a ticket the service does not exist.
• Legal obligation — a purchased ticket is the city's financial record and must be kept.
• Legitimate interest — account security and preventing abuse.
• Consent — only for phone notifications. You can turn them off whenever you want, in your phone's settings or in the app, and everything else keeps working.

4. Card data never reaches us

When you enter a card in the app, the card number, expiry date and security code (CVV) go directly to a certified processor, from your phone. They do not pass through our servers and we never see them at any point — so we cannot store them, lose them, or give them to anyone.

The processor returns to us only a reference used to charge the card later, and a masked number for display. That reference cannot be used for anything outside charging for parking in this app.

5. Who we share data with

• The city where you park — receives the ticket (plate, zone, time, amount), because it issues it and enforces it.
• The card payment processor — the bank or payment service the city uses (Monri, Bankart or another, depending on the city).
• The notification delivery service — so the ticket-expiry message reaches your phone.
• Competent authorities — only where the law explicitly requires it.

No one else. We do not sell data.

6. How long we keep it

• Account data (email, name, phone, vehicles, cards, devices) — for as long as you have an account. When you delete it, it is deleted immediately.
• Purchased tickets — kept by the city as a financial record, for the period that city sets under its own regulations. After that period the licence plates on the ticket are deleted too, leaving only the record that a ticket of that value was sold.

7. Deleting your account

You can delete your account yourself, in the app: Account → Delete account. You do not need to call us and we do not need an explanation.

Deleted: the account, email, name, phone, password, all vehicles, all saved cards and all registered devices. Permanently and irreversibly.

Kept: the tickets you bought — but with no link to you. After deletion it is impossible to tell from them whose they were. The city keeps only the record that a ticket of that day, zone and amount was sold, because the law requires it.

If you no longer have the app, the instructions are on the account deletion request page.

8. Your rights

At any time you have the right to:

• find out which data we hold about you and receive a copy of it,
• correct what is inaccurate (name, phone and vehicles you change yourself in the app),
• delete your account,
• restrict or object to the processing,
• withdraw consent for notifications,
• lodge a complaint with the Personal Data Protection Agency in Bosnia and Herzegovina.

For everything except account deletion (which you do yourself), contact support@park-one.app. We respond within 30 days at the latest.

9. Security

All traffic between the app and our servers goes over an encrypted connection (HTTPS). Passwords are stored as an irreversible hash. Only staff who need it for their work have access to data, and each city sees only its own data — cities do not see one another's data.

10. Children

The app is not intended for persons under 16, and we do not knowingly collect their data. If we learn that we have, we delete it.

11. ParkOne Kontrola — the app for enforcement officers

ParkOne Kontrola is a separate app and is not intended for drivers. It is used by staff the city tasks with parking enforcement. If you are not an enforcement officer, nothing in this section applies to you.

The user does not open the account. An officer's account is created by the city and closed by it. There is no registration in the app, and therefore no account deletion from it — ending access is requested from the city that issued the account.

The app uses the camera for two things, and nothing else:

• reading the licence plate of the vehicle being checked;
• a photo of the vehicle as proof, when a penalty notice is issued.

The photos and checks belong to the city and are kept in its records — it is responsible for them and it handles appeals against an issued fine.

The app does not track the officer's location. It does not request location permission and has no code that reads it. The only permissions it requests are internet and camera access.

12. Changes

If we change this policy, a new version is published on this page with a new date. When a change is important, we will notify you through the app — we will not change it quietly.