Privacy Policy

1. Data Controller

The data controller responsible for your personal data is CockpitShop d.o.o., ul. Bulevar Sv. Petra Cetinjskog 22, 81000 Podgorica, Crna Gora, PIB: 52183947, CRPS: 4-0097341/X (hereinafter "CockpitShop", "we", "us"). Contact: support@cockpitshop.org, +382 20 245 110.

For GDPR purposes, CockpitShop operates under dual legal framework: the EU General Data Protection Regulation (GDPR) 2016/679 and the Montenegrin Law on Personal Data Protection (Official Gazette of Montenegro, no. 79/08, 70/09, 44/12 and 22/17). Our national supervisory authority is the Agencija za zaštitu ličnih podataka (AZLP), Rimski trg 46, 81000 Podgorica, Montenegro, registration 05-030/26-1847.

2. Personal Data We Collect

We collect and process the following categories of personal data:

2.1 Account and Purchase Data

• Full name and company name provided at checkout
• Business email address (used for account access and invoicing)
• Country of residence or business registration
• VAT number (for B2B invoice purposes)
• SEPA bank transfer reference numbers (not full account details)
• Order and invoice history
• Module activation and cancellation records

2.2 Technical and Usage Data

• IP address and approximate geolocation
• Browser type, operating system and device type
• Pages visited on the CockpitShop website and timestamps
• Module connection logs (connection status, sync timestamps, error codes)
• API key validation events (not the API key value itself)
• Session identifiers for account portal access

2.3 Hotel Guest Data (Processor Role)

When you use CockpitShop modules that access reservation data from your Dirs21 account, we may process personal data relating to your hotel guests (name, contact details, stay dates, room type, payment status). In this context, CockpitShop acts as a data processor on your behalf, and you are the data controller. This processing is governed by the Data Processing Agreement.

3. Legal Basis for Processing

Contract performance (Art. 6(1)(b) GDPR): Processing necessary to provide the Service — account management, module activation, invoicing, support.

Legitimate interests (Art. 6(1)(f) GDPR): Security monitoring, fraud prevention, system performance optimisation, and sending service-related communications about your active modules.

Legal obligation (Art. 6(1)(c) GDPR): Retention of invoices and tax records as required by Montenegrin accounting law (minimum 10 years).

Consent (Art. 6(1)(a) GDPR): Marketing communications (if you have opted in) and non-essential cookies. You may withdraw consent at any time without affecting prior processing.

4. How We Use Your Data

We use your personal data for the following purposes:

• Creating and managing your CockpitShop account
• Processing orders and activating module subscriptions
• Sending invoices, payment reminders and account notifications by email
• Providing customer and technical support
• Monitoring module connection status and sending alerts for connectivity issues
• Detecting and preventing fraud and unauthorised account access
• Complying with legal obligations including tax record retention
• Improving our software and service based on aggregated, anonymised usage data

5. Data Retention

Account and purchase data is retained for the duration of your active subscription plus 3 years, unless longer retention is required by law. Invoices and tax records are retained for 10 years as required by Montenegrin accounting law. Technical logs are retained for 90 days. Hotel guest data processed in our processor role is retained only as long as necessary for the module's function and is deleted within 30 days of module cancellation.

6. Data Sharing and Third Parties

We do not sell your personal data to third parties. We may share data with:

• Cloud infrastructure providers — hosting and database services within the EEA, under GDPR-compliant data processing agreements
• Email delivery services — for sending transactional emails, under data processing agreements
• Accounting and tax authorities — as required by applicable law
• Courts or law enforcement — when required by a valid legal order

All third-party processors are required to implement appropriate technical and organisational measures to protect your data and to process it only on our documented instructions.

7. International Transfers

Your personal data is stored and processed within the European Economic Area. We do not transfer personal data to third countries outside the EEA. If any such transfer becomes necessary in future, it will be subject to appropriate safeguards under GDPR Chapter V, including Standard Contractual Clauses approved by the European Commission.

8. Your Rights

Under GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15) — request a copy of the personal data we hold about you
• Right to rectification (Art. 16) — correct inaccurate or incomplete data
• Right to erasure (Art. 17) — request deletion of your data, subject to legal retention obligations
• Right to restriction of processing (Art. 18) — limit how we use your data in certain circumstances
• Right to data portability (Art. 20) — receive your data in a structured, machine-readable format
• Right to object (Art. 21) — object to processing based on legitimate interests
• Rights relating to automated decision-making (Art. 22) — we do not make solely automated decisions with legal or significant effects

To exercise any of these rights, email support@cockpitshop.org from your registered email address. We will respond within 30 days. If you believe we have violated your rights, you may lodge a complaint with the AZLP: Agencija za zaštitu ličnih podataka, Rimski trg 46, 81000 Podgorica, Montenegro.

9. Cookies

Our website uses cookies as described in our Cookie Policy. Essential cookies are required for the website to function and cannot be disabled. Non-essential cookies (analytics, preferences) are only set with your consent, which you can provide or withdraw via the cookie banner or by contacting us.

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration or disclosure. These include: AES-256 encryption for stored API credentials; TLS encryption for all data in transit; role-based access controls; and regular security reviews. For more detail, see our Security page.

11. Contact

For privacy-related enquiries or to exercise your rights: CockpitShop d.o.o., ul. Bulevar Sv. Petra Cetinjskog 22, 81000 Podgorica, Crna Gora. Email: support@cockpitshop.org. Phone: +382 20 245 110.