Personal data processing notice

Data is collected and processed by the Institute for Security, Law and Criminology, a non-governmental organisation based in Montenegro. The Institute is the controller of the personal data collection created through this platform.

Address: Zabjelo — 4. jul D3/L-43, Podgorica, Montenegro
E-mail: ibpki.mne@gmail.com
Phone: +382 67 189 034

To be completed: the Institute's registration and tax number, and the name and contact details of the data protection officer.

We collect only what you yourself enter into the report form. We do not obtain data from other sources and we do not link it to any other database.

About the incident

The kind of violence, the platform or the way it happened, the date, whether it is still going on, a description of the incident in your own words, and a marker for whether someone is in immediate danger.

About the perpetrator and the evidence

Whether you know who is behind it, that person's name or nickname, a link to the profile, post or group, whether you have saved evidence, any files you attach, and whether the case has already been reported elsewhere.

About you

In what capacity you are reporting, the age of the person suffering the violence, the municipality and the school. If you do not choose an anonymous report — also your name, phone number, e-mail address and how you would like to be contacted. If you choose an anonymous report, those fields are not shown and none of it reaches us.

Two things worth keeping in mind

The description field is free text. We process everything you write in it, so please do not enter more personal data than we need in order to understand what happened.

Photographs you attach may carry information about the device that took them, and sometimes about the place and time they were taken. We do not strip that information — it stays in the file exactly as it was when you sent it.

A single report normally contains data about several people:

• about you, if you identify yourself;
• about the person suffering the violence, if that is not you — most often a child;
• about the person you are reporting, to the extent that you name them.

Data about the person you are reporting is an allegation, not an established fact. That is how we keep it — as a claim made in a report, still to be checked.

We do not keep your IP address with the report. The site promises that a report can be completely anonymous, and keeping the IP address would undo that promise. To protect the form from being flooded, we keep only a cryptographic fingerprint of the IP address, with a secret addition, in a separate record that is deleted after 24 hours. That record is in no way linked to the content of a report, and it cannot be used to establish who reported what.

The public part of the site uses no cookies, no Google Analytics and no other tool for measuring or tracking visits. A single cookie exists only in the administrative part, to keep a member of staff signed in, and only employees of the Institute receive it.

We do not ask for a personal identification number, an ID card number, or any payment details.

We use the data in order to:

• read the report and assess how serious the situation is;
• get back to you, if you left contact details;
• refer the case, with your consent, to a school, a social welfare centre or the police;
• keep aggregate statistics on violence — how many reports, of what kind, from which municipalities. The statistics contain no names and no individual can be identified from them.

The legal basis for processing your data is the consent you give by ticking the box at the end of the form. You may withdraw consent at any time, as described in section 10.

Data about other people named in a report — the child suffering the violence and the person being reported — cannot rest on their consent, because they are not the ones contacting us. We process it in order to protect the child, in accordance with the rules on protecting children from violence.

The legal basis for processing third-party data, and for acting when a child is in immediate danger, should be confirmed by the Institute's lawyer, with the exact name and article of the relevant law.

By the nature of the work, this platform deals with minors. A description of an incident may also reveal data that the law treats as particularly sensitive — about health, ethnic or religious affiliation, or sexual life.

We do not ask for such data separately and we do not single it out, but when it does appear in a report we treat it like the rest of the report: it is read only by a trained member of the Institute and it does not leave that circle without a basis described in section 8.

Reports are read by a trained member of the Institute, through a part of the site protected by a username and a password. That part is excluded from search engines and is not available to visitors.

When a new report arrives, a notification is sent to the Institute by e-mail. That notification deliberately does not contain the content of the report — it holds only the report number, the time it was received, the urgency marker, the number of attachments and a link to the administrative part. The content of the report is read only after signing in.

Competent institutions — a school, a social welfare centre or the police — receive a case with your consent. The exception is a situation in which a child's life or health is in immediate danger, where the Institute is obliged to act even without consent.

Technical service providers, who process data only on the Institute's instructions and do not use it for their own purposes:

• Hostinger — runs the server that hosts the site, the database and the Institute's e-mail;
• Google — notifications about new reports arrive at the Institute's Gmail address, so that message passes through Google's servers. As stated in section 7, it does not contain the content of the report.

In addition, when you open a page, your browser downloads part of the program code and the fonts from cdn.jsdelivr.net and fonts.googleapis.com. Those services see your IP address and basic information about your browser in the process. This happens on every page of the site, whether or not you send a report, and has nothing to do with the content of a report.

We do not sell data, we do not give it to advertisers and we do not use it for advertising.

Check which country Hostinger's servers are in and whether a data processing agreement has been signed with Hostinger. If the requirement turns out to be stricter, Bootstrap and the fonts can be moved to our own server and that leak of IP addresses removed.

We keep a report and its attachments for as long as is needed to act on it, and at most for the period prescribed for documentation of this kind. Once the period ends, the report is deleted and the attachments are removed from the server.

The record that protects the form against flooding is deleted automatically after 24 hours.

The Institute must set the exact retention period for reports and enter it here. Technical note: deleting reports once the period expires is not yet automated — it is done by hand, or the code has to be extended.

• The connection between your device and the site is encrypted (HTTPS), so what you type cannot be read along the way.
• Attached files are saved outside the public part of the site, under a randomly assigned name. They have no web address of their own and cannot be opened by a direct link — the only route to them runs through the administrative part, after signing in.
• The database is not reachable from the internet, only from the server itself.
• The administrative part is password-protected, excluded from search engines, and signs a user out after a period of inactivity.

In relation to your own data you have the right to:

• find out what data we hold about you and receive a copy of it;
• ask for a correction of inaccurate data or for incomplete data to be completed;
• ask for your data to be deleted;
• ask us to restrict the processing for a time, or object to it;
• withdraw your consent. Withdrawal applies from that point on and does not make unlawful what was processed while the consent was in force.

Send your request to ibpki.mne@gmail.com. We answer within the deadlines set by law.

There is one limit you should know in advance. If you reported anonymously, we hold nothing that connects you to that report — precisely because we promised you we would not. In that case we cannot establish which report is yours, and so we cannot act on a request for access or deletion either. That is the price of anonymity, not an oversight.

If you believe we are not processing your data properly, you can contact us directly, but you may also lodge a complaint with the Agency for Personal Data Protection and Free Access to Information, which supervises the application of data protection rules in Montenegro.

To be completed with the Agency's address and contact details.

If the way we process data changes, we change this text as well. The date below shows when it was last changed.

Last changed: 29 September 2026.