Privacy Policy

This policy explains how personal data is processed when you visit nitimusic.pro, create an account, purchase a subscription, listen to or watch content, download files or contact support. It also covers users authorised to upload content to the website.

The personal data controller and seller of NITI Music subscriptions is Aleksei Dekin pr Beograd, a sole trader registered in the Republic of Serbia. Address: Rada Neimara 73, Voždovac, 11107 Beograd, Srbija. This policy refers to the controller as “we”. NITI Music is the service name.

For personal data enquiries and requests for access, correction or deletion, contact Musicniti.info@gmail.com or the postal address above. Requests are handled personally by the controller.

The service is intended for users worldwide and is operated from Serbia. We apply the Law on Personal Data Protection of the Republic of Serbia. The GDPR applies to processing within its scope, including processing connected with offering services to people in the EEA. This policy does not limit mandatory rights under other applicable laws. Visiting the website or reading the policy does not, by itself, constitute consent to optional processing.

Account and access data. Your email address, internal user identifier, account creation date, role and access permissions, authentication and session information. Ordinary sign-in uses a link sent to your email address; no password is required for that sign-in method.

Subscriptions and payments. The selected plan and purchased subscription terms, validity dates, available features, download allowance and usage; order and payment identifiers, amount, currency, status, dates and information needed to confirm a payment, issue a refund or resolve a payment dispute. We receive information about the payment outcome from the party facilitating the payment.

Account activity. Favourites, ratings, identifiers of downloaded content, download counts and associated dates. We use this information for account features, download history, catalogue filtering and allowance management.

Technical information. IP address, browser and device information, request time and resource address, session information, request outcomes and errors needed for content delivery, troubleshooting and website security. A playback or download request may generate a technical record even where no separate listening history is stored in the account.

Browser data. Your language preference and played-track markers. The list of these markers is stored locally in the browser, separately for the relevant account, and is not sent to the website database as a listening history. See section 7.

Uploaded content. If you have upload permissions, we process the files, artwork, titles, artist names, descriptions and other metadata you provide, together with the association between the content and the uploading account.

Enquiries and complaints. Contact details, correspondence, attachments and information you submit. Copyright complaints may include a name, email address, organisation, content link, description of the alleged infringement and supporting information. We may also receive information from a complainant reporting content you uploaded.

Performance of a contract and steps requested before entering into a contract: account creation, sign-in links, access, purchasing and fulfilling subscriptions, payment handling, download accounting, favourites, ratings, uploads and necessary communications about these services.

Legal obligations: retaining mandatory payment documentation, meeting applicable accounting requirements and lawful requests from competent authorities, and fulfilling data protection obligations.

Legitimate interests: operating a secure and reliable website, preventing abuse and unauthorised access, diagnosing errors, handling complaints and protecting legal rights. We limit processing to what is necessary and consider its effect on your rights. You may object on grounds relating to your particular situation.

Separate consent: optional analytics or advertising technologies and marketing messages, if introduced and where consent is required by law. Consent is requested separately and can be withdrawn. Service messages about sign-in, security, payments and subscription fulfilment are not marketing communications.

Your email address and technical sign-in information are necessary for an account. Order and payment information is necessary for a paid subscription. Without this information, the corresponding service cannot be provided.

You choose whether to use favourites, ratings, uploads or support enquiries. Fields required for a particular form or feature are identified when you use it. Do not send health information, beliefs, identity documents or other sensitive information unless it is necessary for your enquiry and we have requested it on a lawful basis.

Administrative access to user data is exercised personally by the controller. Employees and other appointed administrators do not currently have that access. In addition, where necessary, data is received by the following categories of recipients:

• Website hosting, computing infrastructure, database and file storage providers: account information, operational records and uploaded content to the extent required for their service.
• Authentication, email delivery and email storage providers: email addresses, sign-in information, service messages, support correspondence and attachments.
• Audio and video delivery, network distribution and security providers: IP addresses, request parameters, session information and content access details.
• Parties involved in payment processing and settlement: email addresses, order details, amounts, currency and information required to complete and confirm payment. They may determine their own processing purposes for parts of their activities.
• Legal and accounting advisers, competent authorities and, where justified, parties involved in handling a complaint: only information necessary for the relevant task or required by law.

Processors acting on our instructions must comply with contractual confidentiality and data protection requirements. Independent controllers may issue their own privacy notices. Processing locations are described in section 6.

We do not sell personal data or disclose it to others for their own advertising. This policy does not restrict your right to obtain information about specific recipients where required by law.

The controller operates the service and handles enquiries from Serbia. The primary account database and the website’s server-side processing are located in the United States. File storage is configured for the Eastern Europe region without a restriction to a single country. Content delivery uses a distributed network; network request processing is not limited to the location of the primary database.

Storing data or accessing it from another country may constitute an international transfer. Such transfers require a basis under the applicable law, such as recognised adequate protection or appropriate contractual and supplementary safeguards. Serbian requirements and, where the GDPR applies, requirements for transfers outside the EEA are assessed separately.

The standard terms of technical services include data processing provisions and contractual transfer safeguards, including the European Commission’s standard contractual clauses under Decision (EU) 2021/914 within their scope of application. Such provisions can form part of the service agreement without a separately signed document. The safeguards applicable to a particular transfer depend on the recipient, the countries involved and the applicable law. The Eastern Europe storage region does not guarantee storage solely within the EU or EEA. Email, delivery and payment services may also process data in other countries according to the service used.

You may request information about applicable safeguards and an available copy of the relevant provisions at Musicniti.info@gmail.com. Agreement to use the website does not replace a lawful basis for an international transfer.

The website uses cookies and similar mechanisms for sign-in, session management, security and user features. Whether a mechanism is necessary depends on its purpose; local storage is not automatically strictly necessary.

Sign-in and session renewal cookies are retained for up to 7 days from creation or successful renewal. Signing out through the website removes these cookies from the browser. Cookie retention does not guarantee access throughout that period: authentication credentials may become invalid earlier. During ordinary sign-in by email link, the website does not persist the authentication session in browser local storage.

The language cookie lasts up to 365 days from its latest update. The language preference may also remain in browser local storage until changed, deleted or cleared by the browser.

Played-track markers are kept in local storage without a preset deletion period. They are available in the same browser for the relevant account and are not synchronised by the website between devices. Signing out does not by itself delete these markers. Keep this in mind on a shared device.

You can delete cookies and website data through your browser settings. This may end your session and reset your language preference and played-track markers. Clearing browser data does not delete your server-side account, download history or payment records.

If optional technologies requiring consent are used, they must be enabled only after a separate user choice, with an option to refuse and subsequently withdraw consent. Information about these technologies and how to control them is provided before they are enabled.

Account information is retained while the account exists. Favourites and ratings are retained until you remove them or the account is deleted. Download history is retained for account features and access accounting until account deletion, except for records that must be kept on the grounds described below.

Following account deletion, information no longer needed for another lawful purpose is deleted or irreversibly anonymised. The minimum required payment documentation is retained for the mandatory period applicable to each document type. Information relating to a particular dispute may be retained until final resolution and expiry of the applicable claims period. This does not justify retaining the entire account indefinitely.

Ordinary support correspondence unrelated to a payment dispute, another legal dispute or a specific retention duty is kept for up to 12 months after the enquiry is finally resolved, and then deleted. Correspondence needed for a particular dispute or legal obligation is retained on the relevant separate basis.

Under the free plans currently used, database and API logs are available to the controller for up to 24 hours, and website runtime logs for up to 1 hour. These are availability periods in the dashboard, not a single deletion period for all technical data. They do not apply to account, payment or download records, or to security records separately stored in the database or retained to investigate a specific incident.

For other security and authentication records, retention is determined by the need to verify access, investigate a specific incident and protect legal rights. Relevant criteria are whether the session or account remains active, whether an incident investigation is still open and whether an applicable legal duty or claims period requires the particular record to be retained. Records no longer needed for those purposes must be deleted or anonymised.

If deleted information remains temporarily in technical backup copies, residual retention depends on the relevant backup’s rotation or deletion cycle. Dashboard availability periods do not establish that cycle. Such residual copies must not be used for ordinary account operations; if a backup is restored, previously completed deletion requests must be applied again.

Data retained solely for legal obligations or a particular dispute is used only for those purposes. Section 7 explains retention of local markers and language preferences. Account deletion does not by itself clear browser data on your devices.

Subject to the applicable law, you have the right to:

• Learn whether your data is processed, access it and obtain a copy, together with information about purposes, sources, recipients and retention.
• Correct inaccurate data and complete incomplete data.
• Request erasure or restriction of processing where the legal conditions are met.
• Receive data you provided in a portable format where processing is automated and based on a contract or consent.
• Object to processing based on legitimate interests; you may object to direct marketing at any time.
• Withdraw consent without affecting the lawfulness of earlier processing.
• Exercise statutory safeguards concerning solely automated decisions that significantly affect you.

Send requests to Musicniti.info@gmail.com, preferably from the email address associated with your account. If we have reasonable doubts about your identity, we will request only the additional information necessary to verify it. You do not need to send a copy of an identity document by default.

Under Serbian law, we respond without undue delay and within 30 days. Where necessary, this period may be extended by a further 60 days, with notice and reasons provided within the initial period. Where the GDPR applies, the corresponding periods are one month and a possible extension by a further two months. Where both rules apply, we meet the earlier applicable deadline.

Requests are normally handled free of charge. Exceptions are limited to circumstances allowed by law, including manifestly unfounded or excessive requests, and the decision will be explained.

You may complain to the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia: https://poverenik.rs/. Where the GDPR applies, you may also complain to a competent supervisory authority, particularly where you habitually reside or work, or where the alleged infringement occurred. You do not have to contact us before making a complaint.

The website automatically checks subscription status, access duration, permitted file types and remaining downloads. These checks implement your selected plan. If your access is determined incorrectly, contact support for human review. This policy does not provide for separate profiling to make decisions with legal or similarly significant effects.

We apply safeguards proportionate to the risks, including access controls and protection of data in transit. Do not share sign-in links or session information with others. In the event of a personal data breach, authorities and affected users are notified in the circumstances and within the time limits required by applicable law.

Uploaded and published content, artwork, artist names, descriptions and other displayed information become available to the audience of the relevant section. Do not include unnecessary personal information. Your account email address is not intended for publication as an author contact.

Following a link to a payment page or another external resource may involve processing by its operator under separate terms. We remain responsible for our own processing and the lawfulness of our disclosures.

Registration and paid features are intended for users aged 18 or over. Tell us if you believe an account belongs to a minor. We will review the circumstances and restrict or stop processing that lacks a proper basis, while observing legal duties to retain certain records.

We update this policy when processing changes. Where required by law, we will provide appropriate notice of material changes before new processing begins. If a new purpose requires consent, we will request it separately. The date of the current version appears at the beginning of this document.