Privacy policy
Effective from 27 September 2026
Tilira is an application for keeping beekeeping records. This policy explains which personal data we process, why, how long we keep it and what your rights are under the General Data Protection Regulation (EU) 2016/679 (GDPR). The Croatian version is authoritative.
1. Controller
Tomislav Sismanovic
Email: admin@tilira.eu
Please send any question about your personal data to the email address above.
2. What data we process
Your account
Username, email address, optionally first and last name, country, language and time zone, your password (stored only as a cryptographic hash, never readable), two-factor login data if you turn it on, and the date you accepted the terms of use.
Beekeeping records
What you enter yourself: apiaries (name, kind, address or place, cadastral parcel, registry number, location on the map), hives and nuclei, queens, inspections, varroa counts, treatments and veterinary medicines (including the supplier, proof of purchase and veterinarian if you enter them) and reminders. An apiary's location can be personal data, as it may show where you live or where your property is.
Technical data
IP address, time and address of requests in the server logs, and counters of failed login and registration attempts to prevent abuse.
Contact form
The name, email address and message you send through the contact form.
What we do not store
What you type into the printable forms is not sent to our server. Your browser remembers the address and phone (such as on the annual colony count or the apiary sign) to save you typing, while the tax number (OIB), IBAN and date of birth are not stored anywhere, not even in your browser. We use no advertising tools and no tracking in your browser.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Opening and keeping your account, providing the application, forms and reminders | performance of a contract (Art. 6(1)(b) GDPR) |
| Reminder emails (can be turned off in your profile) | performance of a contract (Art. 6(1)(b)) |
| Emails to confirm your address and reset your password | performance of a contract (Art. 6(1)(b)) |
| Security: server logs, limits on login attempts, protection against spam registrations | legitimate interest (Art. 6(1)(f)) in protecting users and the service |
| Visit statistics for the public pages (see section 6a) | legitimate interest (Art. 6(1)(f)) in understanding how people find Tilira |
| Occasional surveys about the application (see section 6b); taking part is optional | legitimate interest (Art. 6(1)(f)) in improving the application |
| Directory of apiary commissioners (see section 6c) | the commissioner's consent (Art. 6(1)(a)), which can be withdrawn at any time |
| Membership of an association and the data the association sees (see section 6d) | your consent (Art. 6(1)(a)), which you can withdraw at any time |
| Answering a contact form message | legitimate interest (Art. 6(1)(f)) or steps at your request before a contract (Art. 6(1)(b)) |
We make no decisions based solely on automated processing and do no profiling.
4. Recipients and processors
- Server provider: Hetzner Online GmbH, Gunzenhausen; the data is stored on a server in Finland (European Union).
- Sending email: an email service provider that sends confirmations, password resets and reminders.
- Maps: map backgrounds (OpenStreetMap, OpenTopoMap) are fetched and kept by our server, so your IP address and the places you look at do not reach those providers.
We have data processing agreements with our processors. We do not sell data or give it to others for their own purposes. We do not transfer data outside the European Economic Area, unless stated for the email service provider.
5. How long we keep data
- Account data and beekeeping records: as long as you have an account. When you delete your account, they are deleted immediately and permanently.
- Server logs: at most 30 days.
- Database backups: at most 30 days, after which they are overwritten.
- Contact form messages reach us by email; we keep them as long as needed to answer, at most one year.
The law requires keeping the record of veterinary medicines for at least five years (Regulation (EU) 2019/6, Art. 108). That is your responsibility as the beekeeper; print or export the record before deleting your account.
6. Cookies and browser storage
We only use what the application needs to work or what you chose yourself, so no consent is required:
| Name | Purpose | Duration |
|---|---|---|
| sessionid | keeping you logged in | until logout, at most 2 weeks |
| csrftoken | protecting forms against forged requests | 1 year |
| django_language | the language you chose | until the browser is closed |
| tilira_tz | your browser's time zone (for dates and reminders) | 1 year |
| local storage and IndexedDB | the phone app working without a signal, printable form entries (except OIB, IBAN and date of birth), interface settings, the one-time phone app offer | until you clear them in the browser |
We use no cookies for analytics, advertising or tracking.
6a. Visit statistics
To know how many people visit Tilira and how they find us, we count visits to the public pages only (home, legal pages, contact, login and registration), and only while you are not logged in. Pages inside the application are not counted. No cookies or scripts are used in your browser and no IP address is stored. We keep only daily totals: views per page and the site you came from (its name, or a campaign label). To count the same visitor once a day, we compute a hash from the IP address, the browser and a random value valid for that day only, which cannot be turned back into the address; the hashes and that value are deleted the next day. The data stays on our server and is shared with no one.
6b. Surveys
Now and then we may ask you to fill in a short survey in the application. Taking part is optional: you can put a survey off, decline it, or turn all surveys off in your profile. For an anonymous survey (the survey says so) your answers are stored without your name and with the date only; we separately record only that you answered or declined, so it is not shown again. If a survey is not anonymous, the answers are linked to your account, included in your data export and deleted with your account. We use the answers only to improve the application and share them with no one.
6c. Directory of apiary commissioners
An apiary commissioner can be listed in a directory so beekeepers find them more easily. With their explicit consent, logged-in beekeepers from the same country see the name they entered, the area they cover, their association and the public email address and/or phone number they gave. The directory is not public on the internet. Before listing, an administrator checks that the applicant really is a commissioner and sees the note from the application for that. A commissioner can hide themselves from the directory or delete their details at any time; they are also deleted with the account. An apiary's municipality, entered to suggest its commissioner, is seen only by the apiary's owner.
6d. Associations
A beekeepers' association can register in Tilira and get its own public page with the details it entered itself (name, seat, the person authorised to represent it, a public contact). Before the page is published, an administrator checks the association, e.g. in the register of associations. Beekeepers join an association themselves, from its page, and the association confirms them. The association then sees your name and the date you joined; only if you choose so, it also sees your email address and the number of your hives by type, nuclei and apiaries. It never sees where your apiaries are, your inspections or treatments. We send the association's notices by email without revealing your address to the association, and you can turn them off. You can change your choice or leave the association at any time; the membership is also deleted with your account. If the association downloads the data it sees (e.g. the member list as CSV), it is an independent controller of that copy.
7. Your rights
You have the right to access your data, to rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interest. You can do most of this yourself in your profile:
- Download my data – an export of all your data (JSON);
- Delete account – permanent deletion of your account and records;
- correcting data in your profile and records.
For anything else, write to admin@tilira.eu; we will answer within one month. If you think the processing breaks the law, you can complain to the Croatian Personal Data Protection Agency (azop.hr) or the supervisory authority of your country.
8. Security
Traffic is encrypted (HTTPS), passwords are stored as a cryptographic hash, two-factor login is available, login attempts are limited, and each beekeeper sees only their own data.
9. Children
The service is not intended for people under 16.
10. Changes
We will tell you about material changes to this policy by email or in the application. The date at the top shows when the text last changed.