This document is provided in English. The English version is authoritative and legally binding in the event of any discrepancy.
Last updated: 1 July 2026
This service ("TripHook", the "Service", available at triphook.me) is operated by:
POLEMARHI DOO
Vojvode Mišića 46/1, 35250 Paraćin, Republic of Serbia
Company registration number (matiÄŤni broj / MB): 21688746
Tax identification number (PIB): 112505565
Contact for privacy matters: privacy@triphook.me
POLEMARHI DOO is the data controller responsible for your personal data processed through the Service.
Because POLEMARHI DOO is established in Serbia (outside the EU/EEA) and offers services to individuals in the European Union, we have appointed an EU representative under Article 27 GDPR:
European Representative under Article 27 of GDPR — We have appointed EU Rep as our Representative under Article 27 of the EU General Data Protection Regulation ("GDPR"). All GDPR queries from EU Data Subjects or Data Protection authorities should be submitted to eurep.ie via their dedicated form (https://eurep.ie/queries_for_data_subjects_agents_supervisory_authorities/). BizLegal Ltd trading as EU Rep have their registered office at 27 Cork Road, Midleton Co. Cork, Ireland. Company number 635921.
We process personal data under two regimes that apply to us at the same time:
Where this policy refers to a right or obligation, it applies under whichever regime gives you the stronger protection.
We collect only what the Service needs to function. We do not collect identity-verification documents, passport images, passport numbers, or biometric data of any kind.
| Data | Where | Purpose |
|---|---|---|
| Email address | Sign-up, account | Account creation, sign-in, service communications |
| Password | Sign-up, sign-in | Authenticating you — stored only as a salted hash by our authentication provider (Supabase), never in plain text |
| Display name | Sign-up, account | Identifying you to other users on the Service |
| Date of birth | Account | Verifying you meet our minimum age (18). Used only for the age-eligibility gate at sign-up; never displayed to other users |
| Profile bio, languages, interest tags, home/origin city | Account | Personalising discovery and matching |
| Trip posts, messages, bids, requests | In-app activity | Operating the marketplace and communication features |
| Ratings, feedback, comments you write | In-app activity | Reputation and quality features |
| Business contact details (email, phone, address) — for providers/bidders | Provider profile, listings, bids | Operating the provider/bidder side of the marketplace |
| Provider bank payee details (IBAN or local account number, payee/beneficiary name) — providers only, where the scan-to-pay feature is enabled | Provider profile / listing | Displaying the provider's own published payee details (as text and as a scan-to-pay QR code) so a crew member can pay their share via their own banking app. We never receive, hold, initiate, or reconcile the payment — the QR is a static encoding of details the provider gave us to publish (display-only; see the booking-payment note in Section 4). Retained for as long as the provider keeps the listing/account; deleted with the provider account |
| Data | Purpose | Note |
|---|---|---|
| Search activity, interest tags, anonymous session identifier | Improving discovery and matching | Some events are tied to an anonymous session, not your account |
| Referral and affiliate-click data, including the browser user-agent string | Attribution of referrals | The user-agent is an indirect identifier / device characteristic — disclosed here for transparency |
Cookies cm_anon_id and cm_src | Affiliate / referral / mood attribution | Non-essential — set only after you opt in via the cookie banner: cm_anon_id once you accept, and cm_src if you then arrive via a shared trip link. You can withdraw at any time (see Section 7); withdrawal stops setting them and clears any already set |
Cookie cm_lang | Remembering your chosen interface language | Strictly necessary / functional — stores only a two-letter language code (e.g. en, fr), no identifier and no tracking, so the site (including server-rendered pages) displays in the language you selected. First-party, SameSite=Lax, expires after 12 months. Set without a consent banner, as permitted for functional preference cookies |
| Booking reference codes, notification payloads | Delivering bookings and notifications | — |
We do not run third-party analytics, advertising SDKs, or error-tracking services that capture your personal data. We do use an operational error-monitoring service (Sentry, EU data region) purely to detect and fix technical faults; it is configured to capture errors only, with performance tracing and session replay disabled and personal data (request contents, cookies, IP) scrubbed before transmission.
We do not ask for, require, or intentionally collect special-category personal data as defined in Article 9 GDPR — data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric data, health, sex life, or sexual orientation. Our interest tags are a fixed, non-sensitive set (live music, food and drink, beaches, city life, nature and outdoors, museums and galleries, sports matches). We do not run any automated analysis over your free-text bio or messages to infer sensitive characteristics, and we do not use any such characteristic to rank or match you. Please do not enter special-category data into free-text fields; if you choose to include such information voluntarily, we process it only as part of the general text you provide, never to infer or act on a sensitive attribute.
| Purpose | Legal basis (GDPR Art. 6 / LPDP equivalent) |
|---|---|
| Creating and operating your account; providing the marketplace, matching, messaging, and bidding | Performance of a contract (Art. 6(1)(b)) |
| Transactional emails (account verification, booking and request notifications) | Performance of a contract (Art. 6(1)(b)) |
| Optional marketing or product-update emails | Your consent (Art. 6(1)(a)) — withdrawable at any time |
| Affiliate / referral attribution and the related non-essential cookies | Your consent (Art. 6(1)(a)) |
| Security, fraud prevention, abuse and dispute handling | Our legitimate interests (Art. 6(1)(f)) |
| Commission billing and the related accounting/tax records (once payments are live) | Performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
A note on the marketplace: travellers (individual users) and providers/bidders (typically businesses) are processed for related but distinct purposes; where a bidder acts as a business, the contract basis applies to that relationship.
We use the interests, mood, budget, and activity you provide to personalise and rank the destinations, events, and travel-companion suggestions we show you. This processing is automated, but it produces only ranked suggestions and has no legal or similarly significant effect on you within the meaning of Article 22 GDPR — it is not solely automated decision-making that grants a right to human review. You can change your interests at any time, or switch to neutral, unranked results. Our legal basis is our legitimate interest in providing a relevant discovery service (Art. 6(1)(f)); where personalisation draws on preferences saved to your account, it also supports our contract with you (Art. 6(1)(b)).
We use a small set of service providers ("processors") who process personal data on our
instructions. They are:
| Processor | Role | Location / region |
|---|---|---|
| Supabase | Database, authentication, and storage | Frankfurt, Germany (eu-central-1) — provider is US-parented |
| Brevo (Sendinblue) | Transactional emails are delivered via Brevo, an EU-based email service provider, under a data processing agreement. This covers both account emails (password reset, sign-up confirmation, one-time verification codes) and notifications about your own activity (for example, a join request on your trip, or a quote received on a request you made). We do not send marketing email through this or any other provider. | EU-based (France) |
| Railway | Application hosting and background jobs | EU region — provider is US-parented |
| Redis (Railway-managed) | Caching / session data | EU region (Railway-managed, co-located with the application) |
| OpenStreetMap / Nominatim (OpenStreetMap Foundation) | Geocoding — resolving place-name text to coordinates; we send the place-name query string only | EU-hosted (OpenStreetMap Foundation) |
| OTP banka e-commerce gateway | Payment processing for marketplace commissions | Serbia — not yet active; enabled when paid features launch |
Our map basemap is self-hosted (Protomaps), so rendering a map does not transmit your data or IP address to an external map vendor.
We do not sell your personal data. We may disclose data where required by law or to protect the rights, safety, and security of users and the Service.
When a traveller posts a request for quotes (RFQ) or a provider responds with an offer, we share only the non-identifying essentials needed to evaluate it — destination, dates, budget, and stated requirements. Direct contact details are not shared at this stage. Where free-text accompanies a request, offer, or message, contact details (such as email addresses, phone numbers, social handles, and links) are masked automatically before the other party sees them, so the conversation stays on the platform.
Only once a booking is accepted do we share between the two parties the minimum details needed to fulfil that booking — this is necessary for the performance of the arrangement between them (Art. 6(1)(b)). We do not expose either party's contact details to the other before that point.
All personal data is stored within the European Union — our database is hosted by Supabase in Frankfurt, Germany, and our application and background services are hosted by Railway in an EU region. POLEMARHI DOO, as the sole data controller, accesses only its own EU-hosted data; we do not disclose your personal data to any separate organisation located outside the EU. In line with the European Data Protection Board's Guidelines 05/2021, a controller accessing its own EU-stored data does not constitute a transfer to a third country under Chapter V of the GDPR, and no Standard Contractual Clauses are strictly required on this basis. As an additional safeguard, our data-processing agreements with our processors incorporate the European Commission's 2021 Standard Contractual Clauses: our agreement with Supabase (database, authentication and hosting) was executed on 27 June 2026 and includes those Clauses, and the equivalent agreement with Railway (application hosting) will be executed before any production deployment to that platform. If we ever engage a sub-processor located outside the EU, we will rely on those Clauses or another appropriate Chapter V safeguard before any such processing begins.
Where a processor is US-parented but hosts your data in the EU, your data is stored in the EU; we disclose this so you can make an informed choice.
This platform is operated by POLEMARHI DOO from Serbia, with all personal data hosted in the European Union (Frankfurt, Germany). While the website is accessible globally via the internet, our account features, interactive tools, and marketing activities are intended for residents of the European Union, the United States, and Serbia. We do not intentionally target, market to, or solicit user registrations from individuals residing in the United Kingdom, Canada, Australia, Brazil, or Turkey; we do not offer pounds sterling as a budget currency in our discovery tools and we do not run advertising aimed at those markets. (Independent marketplace providers may quote in their own currency, which we display as supplied.) Any use of the platform by individuals residing outside our primary intended markets is entirely voluntary and on a passive-availability basis. We have appointed a representative in the European Union under Article 27 of the GDPR (see Section 1). We have not appointed representatives in other jurisdictions because we do not target them; if we decide to actively offer services to any such market in future, we will take the steps that market's law requires beforehand.
We use strictly necessary cookies needed to run the Service (for example, to keep you signed in). We also use a functional preference cookie, cm_lang, which stores only the two-letter code of the interface language you choose (no identifier, no tracking) so the Service — including server-rendered pages — displays in that language. These do not require consent.
We also use non-essential cookies (cm_anon_id, cm_src) for referral and attribution purposes. These are set only after you opt in through our cookie banner — cm_anon_id once you accept, and cm_src if you then arrive via a shared trip link. If you do not accept, they are not set. Rejecting is as easy as accepting. You can withdraw your consent at any time from Account → Privacy & data (or by rejecting on the banner); withdrawal stops these cookies from being set and clears any already stored on your device.
| Data | Retention |
|---|---|
| Account & profile data | Until you delete your account; we then erase or anonymise it within 30 days, except where a longer statutory period applies (see accounting records below). Accounts left inactive for a prolonged period may be closed. |
| Trip posts, join requests, bids/RFQs, quotes (marketplace records) | Up to 7 years from the transaction, to meet tax and accounting obligations and to handle disputes or legal claims (a 5-year minimum applies under Serbian accounting law; we retain longer to cover VAT/audit windows). |
| Accounting & invoicing records (once paid features are live) | As required by the Serbian Law on Accounting (Zakon o raÄŤunovodstvu): invoices and source documents 5 years; journals and the general ledger 10 years; annual financial statements 20 years; payroll records permanently. |
| Marketing-consent records | Marketing data is deleted when you withdraw consent; the record that consent was given or withdrawn is kept for 3 years as proof of compliance. |
| Chat messages (trip group chat) | 90 days after the trip completes, with a 365-day hard ceiling. |
| In-app notifications | Deleted 12 months after creation; also removed immediately if you delete your account. |
| Search and discovery activity | Up to 24 months. |
| Server, security and audit logs | Operational and security logs up to 12 months; security-relevant audit logs may be kept for the life of the account plus 24 months for audit integrity. |
Affiliate / referral attribution cookies (cm_anon_id, cm_src) | Consent-based — see the cookie information in Section 7; cleared when you withdraw consent. |
Trip and booking messages. We retain messages exchanged in a trip group chat or booking conversation for 90 days after the trip or booking completes, subject to a maximum of 365 days, after which message content is deleted. We keep messages for this limited period so that (a) we can investigate safety reports and abuse, and (b) a participant can request a copy of their own conversation as evidence within a reasonable window. We are not a party to the arrangement between travellers and providers, or between users and any affiliate, and we do not retain messages to resolve transactional or payment disputes between them — those are matters between the parties. Our legal basis is the performance of our contract with you in operating the messaging feature (Art. 6(1)(b)) and our legitimate interest in safety, abuse-handling, and providing evidence on request (Art. 6(1)(f)); the limited retention window reflects the storage-limitation principle (Art. 5(1)(e)). Where a safety report, abuse or fraud investigation, or a legal claim is active or reasonably anticipated, the relevant messages may be retained beyond the standard window until it is resolved.
Under the GDPR and the Serbian LPDP you have the right to: access your data; rectify inaccurate data; erase your data ("right to be forgotten"); restrict or object to processing; data portability (receive your data in a portable format); and withdraw consent at any time where processing is based on consent.
To exercise any right, contact us at privacy@triphook.me. We respond within 30 days.
Erasure and our email provider. When you delete your account, we erase or anonymise your personal data in our systems, on the timescales and with the exceptions set out in Section 8 — some records survive in a form that is no longer tied to you. One residual is worth stating plainly: our email provider (Brevo, Section 5) keeps delivery logs for messages already sent to you, and those logs contain your email address. We have limited that retention to 3 months, after which they are deleted automatically. During that period the logs are used only to operate the sending service (spam prevention and sender-reputation measurement) and to investigate a delivery problem if one is reported — they are not used to contact you, to build a profile, or to make any decision about you. No email provider can delete these logs at the moment an account is erased, because the sending service depends on them.
If you believe we have mishandled your data, you may lodge a complaint with a supervisory authority:
We may update this policy. Material changes will be communicated through the Service or by email, and the "last updated" date above will change.
See also our Terms of Service and Impressum / Legal Notice.