Dukara is an application that personal trainers use to manage their clients: contact details, body measurements, training sessions, and session credits. This policy explains what personal data the application handles, on whose behalf, and what rights people have over it.
Dukara involves two different roles, and which one applies depends on whose data is being discussed. This distinction matters because it determines who you should contact about your data.
| Data | Controller | Processor |
|---|---|---|
| A trainer's own account: Google name, email address, profile picture, calendar connection | KERNEL DEV agencija Novi Sad | — |
| A client's data: name, contact details, body measurements, sessions, payments | The individual trainer who recorded it | KERNEL DEV agencija Novi Sad |
Clients do not have accounts in Dukara and never sign in. Their data is entered by their trainer. If you are a client and want to see, correct, or delete your data, contact your trainer first — they decide what is recorded about you. If you cannot reach them, you may contact the operator at the address in section 10.
Operator contact:
KERNEL DEV agencija Novi Sad
Bulevar Jaše Tomića 4, 21000 Novi Sad, Serbia
PIB 101234569 · Matični broj 20123450
Email:
Body measurements may be health data. Under Article 9 of the GDPR and Article 17 of the Serbian Data Protection Act, data concerning a person's physical condition falls into a special category with stronger protection. Measurements such as body weight and body-fat percentage can reasonably fall within it.
A trainer who records such measurements should obtain the client's explicit consent to do so, keep a record of that consent, and stop recording if it is withdrawn. Consent must be freely given and separate from the training agreement itself.
| Purpose | Legal basis |
|---|---|
| Authenticating a trainer and operating their account | Performance of a contract with the trainer |
| Storing and displaying client records on a trainer's behalf | The trainer's own basis — normally their contract with the client, or their legitimate interest in keeping training records |
| Recording body measurements | The client's explicit consent, obtained by the trainer |
| Reading calendar availability and writing session events | Consent, given at the moment the calendar is connected and withdrawable at any time |
| Keeping the service secure and diagnosing faults | Legitimate interest in a working, secure service |
Dukara does not use personal data for advertising, does not sell it, does not share it with data brokers, and does not use it to train machine-learning models.
Dukara runs on Google Cloud Platform and Firebase. The database and the
server-side functions are hosted in Google's europe-west3 region,
in Frankfurt, Germany, so data is stored inside the European
Economic Area.
Google acts as a sub-processor. Where Google support or infrastructure operations involve a transfer outside the EEA, those transfers are governed by the European Commission's Standard Contractual Clauses under Google's data processing terms.
Each trainer's data is stored in a separate area of the database, and the security rules enforce that a signed-in trainer can read and write only their own records. One trainer cannot reach another trainer's clients.
Calendar access is optional. Dukara works fully without it; sessions are simply not mirrored to a calendar.
When you connect a calendar, Dukara requests the narrowest permissions that allow it to work:
| Permission | What it allows |
|---|---|
calendar.app.created |
Create a dedicated Dukara calendar and manage only the events Dukara itself created. It cannot touch any of your other calendars. |
calendar.freebusy |
See when you are busy — start and end times only. |
Dukara never reads the content of your calendar events. It cannot see event titles, descriptions, guests, locations, or attachments, because it does not request any permission capable of reading them. This is a technical limit enforced by Google, not a promise about how the software behaves.
Clients may optionally connect their own calendar so their trainer can see their availability when booking. That grants free/busy access only — busy time blocks, never event details.
See the Google API Limited Use Disclosure for the specific commitments that apply to this data.
There are no other recipients. Data is not disclosed to third parties except where required by law.
Deletion is permanent. Backups are overwritten on a rolling basis and are not used to restore individual deleted records.
Under the Serbian Data Protection Act and, where it applies, the GDPR, you have the right to:
In Serbia the supervisory authority is the Commissioner for Information of Public Importance and Personal Data Protection (Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti), Bulevar kralja Aleksandra 15, 11000 Belgrade — poverenik.rs. If you are in the EEA, you may complain to your own national authority instead.
If you are a client, please contact your trainer first: they control what is recorded about you, and can act far faster than the operator can.
Questions about this policy, or a request concerning your data:
Requests are answered within 30 days.
Dukara is not intended for use by anyone under 18. A trainer who works with a minor must obtain consent from that minor's parent or guardian before recording any data about them, including measurements.
If this policy changes materially, the date at the top is updated and signed-in trainers are notified in the application. Continuing to use Dukara after a change means accepting the updated policy.