Your data and account

Accounts are created in the Chisto.mk mobile apps with your email, mobile phone number, password, and phone verification using one-time codes. Keep credentials secret.

Update profile fields inside the app where offered. Use a strong unique password. If the app offers authenticator-based MFA, turning it on reduces takeover risk.

The public website may not provide full registration; use the apps for account features.

You may have the right to obtain confirmation of processing and a copy of your personal data (GDPR Art. 15). Where technically feasible, we provide self-service views in the product; otherwise submit a request via the channel above.

For data portability (GDPR Art. 20), you may request a structured, commonly used, machine-readable export (for example JSON or CSV) of data you provided and that we process by automated means based on contract or consent. We will provide it within a reasonable period, typically within thirty (30) days of verification unless applicable law requires a shorter or longer deadline.

If personal data is inaccurate or incomplete, you may request rectification (GDPR Art. 16) using the same channel. We will correct obvious errors promptly; complex disputes may require additional verification.

You may request deletion of your Account (GDPR Art. 17) via the data request channel or in-app settings if available. We review verified deletion requests within 30 days. After approval, we remove or anonymise personal data in production systems except where retention is necessary: for example to comply with accounting or tax law, to establish or defend legal claims during applicable limitation periods, to prevent abuse, or to meet a specific legal obligation. Backups and security archives may take up to 90 days to expire or be overwritten. We will explain any limited retention if it applies to you.

Some environmental report content you published may remain visible without personal identifiers, because civic environmental observations can document conditions in the public interest. Where possible, we detach your account or other personal identifiers while keeping non-personal report facts.

Service-related messages (security, reports, events) may be necessary.

Newsletters or marketing need a lawful basis, usually consent. Unsubscribe with the link in each email or contact us. Website contact and update notification emails are delivered through Resend today. Mailchimp will be used only if we later enable a newsletter list, and this page and the Privacy Policy will be updated before that happens.

On the website, use Cookie settings in the footer to allow or refuse optional Vercel Web Analytics. Strictly necessary storage still applies. See the Cookie Policy for detail.

We aim to respond to verified requests without undue delay and within any statutory deadline (for example one month under the GDPR, with possible extensions for complex requests).

If you are unhappy with our response, you may complain to Agency for Personal Data Protection of the Republic of Macedonia or your local data protection authority. You may also seek judicial remedy where applicable law allows.