This policy explains how the EkoMate mobile app (Android and iOS) and the ekomate.eco website handle your personal data. EkoMate is the app for Reciklomat machines: you drop in packaging, scan the QR code on the machine’s screen and earn points you can exchange for vouchers from local partners.
In short: to create an account we only need your email address, a username and your city. Your name, profile photo, location, step count and notifications are optional. We do not store your location. We do not sell data, show ads or use tracking or analytics tools. You can delete your account yourself, right in the app.
Who is responsible for your data
The data controller is:
Suprabit d.o.o. Beograd
Makenzijeva 24, 11050 Belgrade, Serbia
Company ID: 21526991, Tax ID: 111713493
Email: info@suprabit.rs
Phone: +381 11 7155171
For any privacy question, or to exercise your rights, write to us at info@suprabit.rs.
What data we collect
Account data
- Email address (required): used to sign in. The app has no password: we email you a one-time code.
- Username (required): your public nickname in the app.
- City (required): chosen from a list, so we can show you content from your area.
- App language: Serbian, Bosnian or English.
- First and last name (optional): you can add them in your account settings. If you sign in with Google, we take your name from your Google account. If you sign in with Apple, we receive it only if Apple shares it.
- Profile photo (optional): picked from your gallery or taken with the camera in the app. You can remove it at any time.
- Invite code (optional): if you signed up through a friend’s invitation, we record who invited you.
Signing in with Google or Apple
If you choose to sign in with Google or Apple, we receive your email address, your name and a unique account identifier from them. For Apple sign-in we also keep an encrypted token that lets us tell Apple when you delete your account. We never see your Google or Apple password.
Device data
When you sign in and every time you open the app, we send: a device identifier, the device name (the one set on your phone), the manufacturer, the platform and the operating system version. We need this to keep you signed in, deliver notifications to the right device and prevent abuse (for example, opening several accounts to collect invite rewards).
Recycling, points and activity in the app
- Recycling: when you scan the QR code on a Reciklomat, we record the machine, the time, the type and number of items dropped in (including the barcode and product name) and the points earned.
- Points and rewards: points balance, transaction history, level, experience, daily quests, achievements and leaderboard rank.
- Vouchers: which vouchers you bought with points and redeemed.
- Community: which communities and partners you follow, which events you signed up for and whether you checked in, and which posts you opened.
- Favourite machines: Reciklomats you marked as favourites.
Location (optional)
If you allow location access, the app uses it only while it is open, to show you the nearest Reciklomats and events nearby and how far away they are. The app does not track your location in the background.
Coordinates are sent to our server only so it can calculate distances. We do not store your location in our database or link it to your profile. The server’s technical logs, which record every request, are deleted automatically after 30 days at most. Without location the app works normally, just without distances.
Step count (optional)
If you allow access to Apple Health (iOS) or Health Connect (Android), the app reads only your total step count for the current day, and only while you have an active walking daily quest. It writes nothing to these apps and reads no other type of health data.
We send only the daily step total to our server and store only your quest progress. We use this data solely for daily quests and rewards in the app. We do not use it for advertising, we do not sell it and we do not share it with anyone.
Camera and photos
The camera is used to scan the QR code on a Reciklomat and, if you choose, to take a profile photo. When scanning, only the content of the QR code is sent to our server, never an image. The app accesses your photos only when you pick a profile photo yourself.
Calendar (optional)
When you tap “Add to calendar” on an event, the app adds that event to the calendar on your phone. No calendar data is sent to us.
Notifications (optional)
If you allow notifications, we store a token for sending notifications to your device. We notify you about achievements, new vouchers, events, posts from communities you follow and new leaderboard seasons. You can turn notifications off in your phone’s settings.
Technical logs
Like any internet service, our server records technical data about requests: IP address, time, the requested address, app or browser details and, if you are signed in, your internal user number. We use these only for security, troubleshooting and monitoring the system.
What we do not collect
We do not ask for your phone number, date of birth, gender, home address or contacts. The app has no ads, uses no analytics or tracking tools and does not build a profile of your behaviour for advertising.
Why we use your data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and running your account, signing in, awarding points, vouchers, quests, the leaderboard, event sign-ups | Performance of a contract: providing the service you use when you create an account |
| Showing distances to machines and events (location) | Consent, given through your phone’s permission |
| Daily quest with steps | Consent, given through the Apple Health or Health Connect permission |
| Notifications | Consent, given through your phone’s permission |
| Showing your first and last name on the leaderboard | Consent, given with the switch in your account settings |
| Security, preventing fraud and abuse of the invite programme, troubleshooting | Legitimate interest in keeping the app safe and reliable |
| Meeting legal obligations | Legal obligation |
You can withdraw your consent at any time by turning off the permission in your phone’s settings or the switch in the app. Withdrawing consent does not affect processing carried out before you withdrew it.
Who can see your data
Other users see your username, profile photo, level, points and rank on the leaderboard. They see your first and last name only if you turn on “Display my name publicly”.
Partners and communities (voucher providers and event organisers) see your username, profile photo, level and points balance when you follow them, buy one of their vouchers or sign up for one of their events. They do not see your email address or your name.
We also share data with service providers that help us run the app, only to the extent they need it:
- Hetzner Online GmbH (Germany): the servers that run the app and its database, located in the European Union.
- Our email delivery provider: sends you the one-time sign-in code.
- Expo (650 Industries, Inc., USA), Google Firebase Cloud Messaging and the Apple Push Notification service: deliver notifications to your device.
- Google and Apple: verify your identity when you sign in with them.
- The Reciklomat machine system: when you scan a QR code, it receives only your internal user number and the content of the code, to confirm the recycling. It does not receive your name or email address.
We do not sell or rent your data, and we do not share it with anyone for advertising. We disclose data to public authorities only where the law expressly requires it.
International transfers
The controller is based in Serbia and our servers are in the European Union, which is recognised as providing an adequate level of protection. Some service providers (Expo, Google, Apple) may also process data in the United States. In those cases the transfer relies on standard contractual clauses or other safeguards required by law.
How long we keep data
- Account and activity data: for as long as you have an account.
- One-time sign-in code: a few minutes, until it expires.
- Server technical logs: 30 days at most.
- Database backups: 14 days, after which they are deleted automatically.
When you delete your account, we immediately delete the data that identifies you (see the next section). We keep your recycling and points history without that data, for settlement with partners, legal obligations and aggregate statistics (for example, how much packaging has been recycled in total). We keep the device identifier from the invite programme to prevent abuse.
Deleting your account
You can delete your account yourself, at any time, right in the app:
- Open your profile and choose My account.
- At the bottom, under Danger zone, tap Delete account.
- The app shows you what you will lose (points, unused vouchers, event sign-ups). Confirm the deletion.
If you cannot access the app, email a deletion request from your account’s email address to info@suprabit.rs with the subject “Delete my EkoMate account”. We will delete the account within 30 days and let you know when it is done.
Deleted immediately: your first and last name, email address, profile photo, username (replaced with a “deleted user” label), the link to your Google or Apple account, device data and notification tokens, the communities and partners you follow, favourite machines, upcoming event sign-ups and your place on the current leaderboard. If you used Apple sign-in, we ask Apple to revoke our access.
Lost: all points and unused vouchers. Deletion cannot be undone.
Kept, without data that identifies you: your recycling, points transactions and other activity in the app (quests, achievements, redeemed vouchers, finished leaderboards) and your chosen city, for the reasons given in the section above. Backups and logs are deleted on their own within 14 and 30 days respectively.
Your rights
Under the Serbian Law on Personal Data Protection and, where they apply, the data protection laws of Bosnia and Herzegovina and the EU General Data Protection Regulation (GDPR), you have the right to:
- know what data we process about you and get a copy of it;
- correct inaccurate data (you can change most of it yourself in the app);
- have your data deleted;
- restrict processing;
- receive your data in a structured, machine-readable format (portability);
- object to processing based on legitimate interest;
- withdraw consent at any time.
Send your request to info@suprabit.rs. We will reply within 30 days. We may ask you to confirm that the request comes from your account’s email address.
If you believe we process your data unlawfully, you can lodge a complaint with:
- in Serbia: the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, Belgrade, www.poverenik.rs;
- in Bosnia and Herzegovina: the Personal Data Protection Agency, www.azlp.ba;
- in the European Union: the supervisory authority of the country where you live.
Security
All communication between the app and our server is encrypted (HTTPS). Your sign-in token is kept in your phone’s secure storage. Only authorised staff who need it for their work can access data on the server. No system is completely secure, but we work on protection continuously and, if a data breach could put you at risk, we will notify you and the competent authorities as required by law.
Children
The app has no minimum age. By law, users under 15 need the consent of a parent or guardian for their data to be processed, so they should create an account with that consent. We do not ask children for more data than anyone else, and the name, profile photo and other optional data stay optional.
If you are a parent or guardian and believe your child has created an account without your consent, write to us at info@suprabit.rs and we will delete it.
The ekomate.eco website
The website uses no cookies, analytics or tracking tools, and serves its fonts from its own server. The web server records only standard technical data about requests (IP address, time, page, browser details) for security and operation, and deletes it after 30 days at most.
Changes to this policy
If we change this policy, we will publish the new version on this page and update the date at the top. We will notify you in the app about important changes before they take effect.