Privacy policy

Last updated: 11 November 2026

1. Who processes your data

The data controller is:

• Sim Master doo Beograd (Sim Master centre)
• Dunavska 68, 11000 Belgrade, Serbia
• Tax ID (PIB): 113195695 · Registration no. (MB): 21821586
• Email: simmasterbgd@gmail.com · Phone: +381 60 49 46 481

We process personal data in line with the Serbian Law on Personal Data Protection (Official Gazette of RS, No. 87/2018). For any privacy question, write to the email address above.

2. What we collect and why

User account

When you create an account or sign in with Google, we store:

• your full name and email address;
• your password only as a one-way hash (Argon2id). We do not know your password and cannot read it;
• if you use Google sign-in: your Google identifier, name and verified email address as sent to us by Google. We get no access to your Gmail, contacts or anything else;
• your chosen language, the dates your account was created and your email confirmed, and the time and IP address of your last sign-in;
• a log of sign-in, sign-up and password-reset attempts (email address, IP address, time and whether the attempt succeeded).

Purpose: running your account, signing you in and protecting accounts against abuse (such as password guessing). We show you your previous sign-in and its IP address on the “My account” page so you can spot a sign-in that was not yours.
Legal basis: performance of our agreement with you (using the account) and our legitimate interest in protecting accounts and the site.

Offers and news by email (marketing)

We send emails about offers, tournaments and news only if you chose to receive them, by ticking the box when signing up or switching them on in “My account”. The box is not pre-ticked and is not required to create an account. To send them we use your name, email address and chosen language. As proof of consent we keep when you agreed or unsubscribed, where (form, account page, unsubscribe link), which wording you saw and from which IP address.

You can unsubscribe at any time with one click on the unsubscribe link in every such email, or in “My account”. Unsubscribing does not affect important account messages (email confirmation, password changes).
Legal basis: your consent.

Bookings and the contact form

When you send a booking or a message, you send us your name, email and phone number, and for bookings also the date, time, duration, number of seats, chosen game and a note, or for messages the subject and text. The forms are delivered through the Web3Forms service, which forwards them to our email.

Purpose: replying to you and arranging your session.
Legal basis: steps taken at your request before entering into an agreement, or performance of that agreement.

“Driver of the race” voting

So that everyone votes once per round, the site sets a dod_voter cookie in your browser and sends a technical device fingerprint. On the server we keep only pseudonymised (HMAC) values derived from that cookie, the device fingerprint and the network. We do not keep your IP address in readable form, and we do not link these values to your name. Details are in the voting terms.
Legal basis: your consent, given by accepting the voting terms, and our legitimate interest in a fair vote.

Technical data

Like any website, our hosting provider’s server records basic technical data about visits (IP address, time, page requested, browser type) to run and secure the site. We do not use visitor analytics, advertising networks or behavioural tracking.

3. Cookies and local storage

We only use what the site needs to work. There are no analytics or advertising cookies, which is why there is no cookie consent banner.

• __Host-sm_session: keeps you signed in. Deleted when you sign out or close the browser; a sign-in always expires after 1 hour of inactivity or 2 hours after signing in.
• dod_voter: prevents voting twice in “Driver of the race”; valid for 1 year.
• sm.locale (browser local storage): remembers whether you chose Serbian or English.
• sm.intro.seen, sm.switchAnchor, sm.srRefreshAt: technical markers that remember the intro animation was shown, your place on the page when switching language, and when results were last refreshed. They contain no personal data.

4. Who we share data with

We never sell your data or share it for advertising. Only authorised Sim Master staff and the following service providers, acting on our behalf, have access:

• Netcom (netcom.rs): hosting for the website, the database and the email server we send from (noreply@simmaster.rs);
• Google: Google sign-in (only if you choose it), the site’s fonts (when a page loads, your browser sends your IP address to Google), and the simmasterbgd@gmail.com mailbox that receives messages and bookings;
• Web3Forms (web3forms.com): forwarding bookings and messages from the site to our email;
• an email campaign service (e.g. Brevo or Mailchimp): only for people who agreed to email updates, and only their name, email address and language.

We may also disclose data to public authorities where the law requires it.

5. Transfers outside Serbia

Google, Web3Forms and the email campaign service may process data outside Serbia, including in the United States. We only allow such transfers with the safeguards required by the Law on Personal Data Protection, such as the standard contractual clauses those providers apply.

6. How long we keep data

• Account: until you delete it. On request we delete your account and related data within 30 days.
• Consent to email updates: we send them until you unsubscribe; the record of consents and unsubscribes is kept while the account exists, as proof.
• Sign-in attempt log: 90 days, then deleted automatically.
• Email links (email confirmation, new password): stored only as a hash, valid for 24 hours and 1 hour respectively, and deleted one week after they expire.
• Bookings and messages: as long as needed to reply and hold your session, and at most 4 years, unless the law (e.g. accounting rules) requires longer.
• Voting data: until the end of the championship season; the dod_voter cookie expires after 1 year.

7. How we protect data

The site works only over an encrypted HTTPS connection. Passwords and email links are stored only as hashes, only the application can access the database and only with minimal permissions, and password-guessing attempts are limited automatically. No system is completely invulnerable, but we maintain and update the site regularly.

8. Your rights

At any time you have the right to:

• find out whether we process your data and get a copy of it;
• have inaccurate data corrected or incomplete data completed;
• have your data deleted, including your account;
• restrict processing, or object to processing based on legitimate interest;
• receive your data in a structured, machine-readable format (portability);
• withdraw your consent, without affecting processing done before you withdrew it.

Send your request to simmasterbgd@gmail.com from the email address your account is registered with. We reply without delay and within 30 days at the latest. You can change your password yourself on the Forgot password page.

If you believe we process your data unlawfully, you can lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11120 Belgrade, www.poverenik.rs (opens in a new window).

9. Minors

People under 15 may create an account only with the consent of a parent or guardian.

10. Changes to this policy

We may update this policy from time to time, for example when we add new services such as Sim Market listings or a loyalty programme. The date of the last change is shown at the top of this page, and we will email account holders about significant changes.