VELEPRODAJA TEKSTILA I POZAMANTERIJE

Personal data is information that directly or indirectly relates or may relate to your personality. As a legal basis governing data protection and the conditions for processing your data, we apply the Law on Personal Data Protection (“Sl. glasnik RS”, no. 87/2018).

The legal entity – company S&SAX DOO D.O.O BEOGRAD-Palilula, PIB: 100212724, Registration number: 17309676, Address: Slanački Put 32 G, 11060 Belgrade – Palilula, Phone: +381 (0) 63 244 512; (hereinafter SELLER), as the data controller, prior to the collection and processing of personal data in accordance with Article 23 of the Law on Personal Data Protection, hereby informs about the conditions of personal data collection and processing.

INFORMATION WE COLLECT

Public data

It is possible to visit and use our site without revealing your identity or any other data related to it. When visiting our website, considering the nature of the Internet, data is collected that records users, but is not sufficient to identify a specific person and represents statistical indicators used to improve the quality of the website. Such information may include the name of the Internet browser, number of visits, average time spent on the page, computer type, and technical information about the connection used by the user when visiting the website, such as the operating system and Internet service provider, IP (Internet Protocol) address assigned by providers that are different for each Internet user, as well as similar information.

Personal data

What types of personal data do we use?

1. PERSONAL DATA: for contact such as name, surname, address, email, phone number
2. BUSINESS CONTACT DATA: such as the address of the business entity, business email
3. SENSITIVE PERSONAL DATA: gender, personal identification number, date of birth
4. CONTRACT DATA: such as the content of the business cooperation agreement
5. PAYMENT INFORMATION: such as bank account number, claims for damages, payment of obligations from the contract

Purpose of data processing / legal basis:

1. For providing services: for the delivery of goods you purchased from us through the www.melbi.rs online store, we need to have your contact information in order to deliver the goods to your desired address;
2. Fulfilling requests – resolving complaints, objections: we strive to resolve them appropriately in accordance with the Law. In order to have enough information to carry out this procedure and make the correct decision, as well as to provide feedback regarding the complaint – it is necessary to collect certain data about you. Also, if you want a refund, it will be necessary to fill out the prescribed form – the so-called NI form, in which your personal identification number is entered, as required by applicable regulations.
3. Contracting – in order to conclude a contract, it is necessary to check whether the person with whom we are entering into a contractual relationship is authorized to do so. The same is the case with the execution of certain contractual provisions by persons designated for that. Sometimes it is necessary to verify the identity of these persons in order to be sure that we are acting correctly. We undertake these activities for the purpose of acting on the basis of the contract we have concluded with you in order to fulfill legal obligations.
4. Notification of offers – if you have signed up to occasionally receive notifications about promotions and other benefits, you have shared some of your data with us that we can use to send these notifications – as long as you want it.
5. We take security measures – such as CCTV cameras and we have access to security data about our office premises to ensure that our colleagues, customers, visitors and property are protected.

SELLER processes certain personal data that is considered sensitive in nature for the purpose of fulfilling obligations we have in the manner and to the extent prescribed by law:

• Data on your health condition, which includes records of your absence from work for health reasons; medical documentation, medical findings, etc. for the purpose of processing possible claims for damages that occurred in our retail facility or business premises. We will not record your data from your health record, unless it is explicitly necessary. It is possible that this data will be forwarded to our insurance company for processing your claim for damages. In the event that you initiate legal proceedings against us, the data in question may be submitted for inspection to the competent court during the proceedings.

Who has access to your personal data?

We provide your personal data to the following persons:

• Third parties acting on our behalf (processors). In these cases, such third parties may use your personal data exclusively for the purposes listed above and exclusively in accordance with our instructions;
• Associates in sectors dealing with the above-mentioned services may have access to your personal data, but only when it is strictly necessary to perform their work tasks, and when the associate is obliged to maintain the confidentiality of information;
• Insurance companies that provide services to the SELLER and associates
• Third parties who are responsible for storing your personal data, independently of the SELLER (these are persons engaged externally, independent auditors, lawyers, tax advisors, etc.)
• If required by law or court order, for example law enforcement agencies or other government bodies.

How long do we keep your personal data?

We keep your personal data for a certain period of time while it is needed for the purpose of processing, after which we delete it or disable access – it becomes anonymous.

The criteria based on which the time for which the data is stored is determined are:

• The length of your contractual relationship;
• As long as we have established relationships with you;
• According to the legal conditions that apply to us.

DATA PROCESSING WHEN VISITING THE WEBSITE

When using certain functionalities (applications, requests) on our site in the contact form, requests for offers for the sale of goods, requests for receiving news, information and promotions… SELLER processes your personal data (personal identity data and contact information) only if you have voluntarily provided it on our website in order to use our services and products. This personal data may include name, surname, e-mail, phone number and / or other contact information and will be used in accordance with the privacy policy and the purpose for which you left it.

Purpose of data processing / legal basis: When visiting our website, the browser you use on your device will automatically and without your activity send to the server of our website:

• IP address of the device from which the request was sent and which has access to the internet,
• date and time of access,
• name and URL of the downloaded file,
• website / application from which it is accessed (referrer URL),
• browser you are using and, if necessary, the operating system of the computer that supports the internet, as well as the name of your provider.

The specified data is temporarily stored by the server in a so-called log file for the following purposes:

• ensuring the establishment of a smooth connection,
• ensuring comfortable use of our website/application,
• assessment of the security and stability of the system.

The legal basis for processing the IP address is Article 12, paragraph 1, point 6) of the Law on Personal Data Protection (legitimate interest). Our legitimate interest arises from the above-mentioned purpose of data processing.

Recipients / categories of recipients: Generally, we do not transfer this data to third parties.

Storage period / criteria for determining the data storage period: The data is stored temporarily, during the visit to the page, and then automatically deleted. After you leave our website, the geolocation data is deleted.

Cookies: We use so-called cookies on our website in accordance with Article 12, paragraph 1, point 6) of the Law on Personal Data Protection (legitimate interest). We believe that the interest in optimizing our website is justified in terms of the above-mentioned provision. Cookies are small files that are stored on your device (laptop, tablet, smartphone, etc.) when you visit our website. Cookies do not harm your device, do not contain viruses, trojans or other malicious software. Information is stored in cookies that is obtained in connection with the device you are using. However, this does not mean that we are familiar with your identity. On the one hand, the use of cookies serves to make your visit to the website more pleasant. For example, we use so-called session cookies to recognize that you have already visited certain parts of our page or that you are already logged in to your user account. They are automatically deleted after you leave our website. In addition, we also use temporary cookies that are stored on your device for a certain period of time. When you revisit our website, it is automatically recognized that you have already been on the page and which settings you have set, so you will not have to repeat these actions.

On the other hand, we use cookies to statistically record the use of our website, in order to optimize the offer and display information that is tailored to your interests. These cookies allow us to automatically recognize you when you revisit our website. These cookies are automatically deleted after a certain time. Most browsers automatically accept cookies. However, you can set your browser so that cookies are not stored on your computer or that a message always appears before a new cookie is created. However, completely disabling cookies may mean that you cannot use all the functions of our website.

DATA PROCESSING FOR SECURITY REASONS (VIDEO SURVEILLANCE)

Purpose of data processing / legal basis: We also process your data through video surveillance that we have introduced in our stores and business premises in order to protect you and us, and on the basis of a legally justified interest in order to protect property, employees, customers and visitors, and especially for protection against the following identified risks:

• unauthorized access to premises and facilities;
• removal, i.e. alienation and unauthorized use of protected items;
• introduction of weapons, explosive, radioactive and other dangerous objects and substances;
• burglaries, sabotage and violent attacks on the facility or seizure of items;
• unauthorized access to data and documentation; and
• protection of vehicles for the transport of money and other means of transport.

The legal basis for data processing through video surveillance is Articles 29 and 30 of the Law on Private Security.

Recipients / categories of recipients: Video recordings will not be publicly published and ceded to third parties, except in cases where this represents our legal obligation or authorization. Our partner who provides us with private security services, i.e. who is in charge of the physical and technical security of our stores, has access to the video recordings. In addition, for the needs of maintaining the video surveillance system, we have engaged a service technician who may have access to the video recordings only for the purpose of ensuring its functioning.

Storage period / criteria for determining the data storage period: Video recordings are kept for 30 days. Copies of video recordings are kept longer than 30 days in certain situations (conducting legal proceedings). Video recordings that are no longer needed are deleted without delay (termination of legal proceedings).

DATA PROCESSING THAT YOU PROVIDE TO US BY E-MAIL

Purpose of data processing / legal basis: We treat personal data that you provide to us via the contact form, by phone or by e-mail, of course confidentially. We process your data exclusively in accordance with the established purpose, and in order to respond to your inquiry. The legal basis for data processing is Article 12, paragraph 1, point 6) of the Law on Personal Data Protection (legitimate interest). Our and at the same time your (legitimate) interest in such data processing arises from the need to answer your questions, if it is necessary to solve existing problems and in order to ensure your satisfaction as our customer or as a user of our website.

If you participate in one of our surveys, such participation is voluntary. In anonymous surveys, we do not store data that allows us to conclude who the survey participant is. We only store the date and time of your participation. We consider any personal data that you have provided to us through the survey to be voluntarily provided and we store it in accordance with the provisions of the Law on Personal Data Protection. Please do not enter names or similar data in the free fields, which would allow us to conclude who it is, whether it is you or other persons. In the event that you have given your consent to conduct the survey, the legal basis for data processing is based on your consent in accordance with Article 12, paragraph 1, point 1) of the Law on Personal Data Protection. In that case, you have the right to revoke your consent at any time. The revocation of consent does not affect the admissibility of processing that was carried out on the basis of consent before the revocation. Details on data processing in connection with surveys are regulated by the data protection rules of each individual survey.

Recipients / categories of recipients: Generally, we do not transfer data to third parties. Exceptionally, the data will be processed by our partners (processors) on our behalf. All our partners are selected very carefully and are contractually obliged to keep personal data confidential, in accordance with Article 45 of the Law on Personal Data Protection.

In addition, in some cases there is a need to forward your inquiries to other contractual partners (e.g. suppliers for inquiries regarding certain products) in order for them to process the same. In these cases, the inquiry is previously anonymized, so that it cannot be determined who it is. If in a specific case there is a need to transfer your personal data, we will inform you about it in advance and ask for your consent.

The results of our surveys are generally used only for our needs. Generally, we do not forward this data to third parties, unless you have given us your explicit consent to do so.

Storage period / criteria for determining the data storage period: All personal data that you provide to us when asking a question (suggestions, praise or criticism) via this website or by e-mail, is deleted or anonymized no later than 90 days after giving the final answer. Experience has shown us that usually after 90 days there are no more return questions regarding our answer.

DATA PROCESSING FOR ADVERTISING PURPOSES

Purpose of data processing / legal bases: With your consent, we record your behavior as a user of our website and newsletter. Tracking user behavior primarily includes data on the sections you have visited and which links you have used. In this way, we create personalized user profiles with your personal data and/or with information about your e-mail address in order to possibly better adapt our address in the form of a newsletter, on-site advertising and printed material to your personal interests, and thereby improve our offer.

The legal basis for the above-mentioned data processing is Article 12, paragraph 1, point 6), of the Law on Personal Data Protection (legitimate interest) or Article 12, paragraph 1, point 1), of the Law on Personal Data Protection (consent). Processing customer data for our advertising purposes or for the advertising needs of third parties is considered a justified interest.

Right to object: You can object to the processing of data for the above-mentioned purposes at any time and completely free of charge, through any communication channel. After you object, we will no longer process your data, whereby the objection does not affect the processing that was carried out on the basis of consent before the objection. For this purpose, it is enough to send an e-mail or a letter by post to our contact address.

Recipients / categories of recipients: Generally, we do not forward this data to third parties.

Retention period / criteria for determining the data retention period: If you revoke your consent for individual advertising or do not agree with certain promotional activities, we will delete your data from the corresponding mailing list. If you object, your contact address will be blocked for further data processing for advertising purposes. Please note that in exceptional cases, even after receiving your objection, some advertising material may still be sent. This is technically due to the time required to prepare the advertising material and does not mean that we do not respect your objection. Thank you for your understanding.

DATA PROCESSING WHEN REGISTERING FOR THE NEWSLETTER

Purpose of data processing / legal basis: You have the option to subscribe to our newsletter on our website. If you have agreed to receive our newsletter, we use your e-mail address and possibly your name to send information about products, promotions, prize games / competitions, news and store offers. We store and process this data for the purpose of sending the newsletter.

The content of the newsletter includes promotions (offers, promotions, prize games, etc.) as well as products that are located on www.sax.rs

With your consent, we record your behavior as a user of our website www.sax.rs and newsletter. The evaluation of user behavior primarily includes data about the sections you visit and the links you use there. In this way, we create personalized user profiles with your personal data and/or with information about your e-mail address in order to enable the creation of an advertising offer by the SELLER in the form of newsletters and printed material, tailored to your personal interests and thereby improve our offer.

The legal basis for data processing when sending the newsletter is your consent in accordance with Article 12, paragraph 1, item 1) of the Law on Personal Data Protection.

In order to ensure that there are no errors when entering the e-mail address, we use the so-called double-opt-in procedure. When you enter your e-mail address in the registration field, we will send you a confirmation link to the same. Only when you click on this confirmation, your e-mail address will be entered into our mailing list.

You can revoke your consent to receive the newsletter or create personalized user profiles at any time. The revocation of consent does not affect the permissibility of processing that was carried out on the basis of consent before revocation. You can do this, for example, by unsubscribing from the newsletter list on our website. You have an unsubscribe link at the end of each newsletter. If you revoke your consent, we will delete your data.

Recipients / categories of recipients: If we have engaged external partners to send the newsletter, they are contractually bound in accordance with Article 45 of the Law on Personal Data Protection. Any further disclosure of data to third parties is excluded.

Retention period / criteria for determining the data retention period: If you revoke your consent for our newsletter, we will delete your data from the corresponding mailing list for sending the newsletter.

DATA PROCESSING OF BUSINESS PARTNERS

The following notes regarding data processing apply to you if you have contacted us, if you are conducting negotiations with us for the purpose of concluding a contract and/or already have a contract concluded with us and if personal data is processed in connection with this. Which data is processed in each individual case depends primarily on the agreed services. For this reason, not all parts of this section will be relevant to you.

How do we collect your data and what categories of data do we process?

We generally collect data directly from you.

However, we may also collect data from other companies, government authorities or third parties, e.g. credit bureau, tax administration, etc. In addition, we may also collect personal data through our reporting systems on possible violations of laws or internal guidelines.

The following personal data may be processed: personal data (e.g. first and last name, address and other contact details, date and place of birth, as well as citizenship), identification and authentication data (e.g. excerpt from the commercial register, data from the identity card, signature sample), data related to our business relationship (e.g. payment data, order data), creditworthiness data, data on the company structure and ownership structure, photos and video recordings (e.g. during the delivery of goods), as well as other data similar to the above-mentioned categories of data.

Purpose and legal basis of data processing

Processing for the purpose of fulfilling contractual obligations (Article 12, paragraph 1, item 2) of the Law on Personal Data Protection)

The data is processed for the preparation of the conclusion of the contract, which precedes the contractual relationship, as well as for the purpose of fulfilling obligations after the conclusion of the contract.

Processing for the purpose of fulfilling a legal obligation (Article 12, paragraph 1, item 3) of the Law on Personal Data Protection)

The purpose of data processing arises, depending on the individual case, from legal regulations. Thus, for example, data is processed for the purpose of fulfilling obligations to preserve documentation and in connection with identification, e.g. on the basis of regulations for the prevention of money laundering, on the basis of tax control and reporting and processing of data within the framework of inquiries from state bodies.

Processing for the purpose of fulfilling legitimate interests (Article 12, paragraph 1, item 6) of the Law on Personal Data Protection)

It may be necessary to process personal data, which you have made available, within frameworks that go beyond the original fulfillment of the contract. Our legitimate interests for such processing are the selection of a suitable business partner, the fulfillment of legal requirements, the elimination of liability claims, access control, clarification of possible violations, prevention of criminal acts and processing of damages that have arisen on the basis of the contractual relationship.

In the event of the conclusion of a contract, for the purpose of fulfilling the above-mentioned legitimate interests, in individual cases, we collect data on your creditworthiness through a credit bureau. We process the creditworthiness data, which we received from the credit bureau, for the purpose of checking your creditworthiness. The credit bureau stores data, which e.g. they receive from banks or companies. This data primarily includes surname, first name, date of birth, addresses and information about payment history. Information about the stored data that relates to you can be obtained directly from the credit bureau.

Who has access to your data?

Within our company, only those sectors that need it to fulfill contractual or legal obligations or for the purpose of fulfilling legitimate interests have access to the data that you have made available to us. Within the framework of the contractual relationship, we also engage other service providers who may gain access to your personal data. Compliance with personal data protection regulations is ensured by contract in these cases.

How long do we keep your data?

We store personal data for as long as it is necessary to fulfill the above-mentioned purposes. In doing so, we take into account the legal storage obligations, for example the legal period of 5 years in accordance with the Law on Accounting.

Are you obliged to provide us with your data?

Within the framework of our business relationship, you are obliged to provide us with those personal data that are necessary for initiating, implementing and terminating the contractual relationship and for fulfilling the obligations associated with it, as well as for whose collection we have a legal obligation or we have the right on the basis of legitimate interests. Without this data, as a rule, we will not be able to start a business relationship with you.

What rights do you have as a data subject?

You have the right to receive information about your data that we process, upon request and free of charge. In addition, in accordance with the legal requirements, you have the right to correct and delete your data, the right to data portability, as well as the right to restrict processing. If we process your personal data on the basis of consent, you have the right to revoke that consent at any time. The revocation of consent does not affect the permissibility of processing that was carried out on the basis of consent before revocation. Please contact our data protection officer in writing or by e-mail at the address below in the cases mentioned. In addition, if you do not agree with the processing of your personal data, you have the option of submitting a complaint to a state body (Commissioner for Information of Public Importance and Personal Data Protection).

Responsible person (controller)

The responsible person for the processing of your data, i.e. the data controller, is the legal entity – company S&SAX DOO D.O.O BEOGRAD-Palilula, PIB: 100212724, Registration number: 17309676, Address: Slanački Put 32 G, 11060 Belgrade – Palilula, Telephone: +381 (0) 63 244 512; E-mail: office@sax.rs. Our person in charge of personal data protection is also available to you at the following address: Slanački put 32g, Belgrade – Palilula.

DATA PROCESSING ON SOCIAL NETWORKS

The operator of a specific social network platform is also partly responsible for the processing of your data. In addition, in some cases we are also the operator of the platform and in that sense there is joint responsibility in accordance with Article 43 of the Law. SELLER, manages the following social network pages:

• Instagram: https://www.instagram.com/saxhoreca/

1. Operator responsibility

We have only limited influence on the processing of data by social network platform operators (e.g. administration of members and sharing of information). Where we can influence and adjust the parameters for the processing of your data so that the social network platform operator acts in accordance with data protection, we take all measures available to us. However, in many places we cannot influence the operator’s data processing, nor do we know exactly what data the operator processes.

The platform operator manages the entire IT infrastructure of the service, adheres to its own data protection rules and has a special user relationship with you (if you are a registered user of the social network service). In addition, the operator is solely responsible for all questions in relation to the data of your user profile, which we as a company do not have access to.

More detailed information about data processing by social network platform operators and about the possibilities of objection can be found in their data protection rules:

• Facebook: https://www.facebook.com/privacy/explanatio
• Instagram: https://help.instagram.com/519522125107875

2. Our responsibility
3. a) Purpose / legal basis of data processing:

On our social network pages, we process your data for the purpose of informing consumers about offers, products, services, promotions, prize games, important information, news in the company, for the purpose of interaction with visitors to social networks as well as for the purpose of providing answers to questions asked, praise and criticism.

We reserve the right to delete content if necessary. In addition, we will share your data or content on our page if this is a function of the social network platform. We also process your data for the purpose of communicating with you.

The legal basis for processing your data is Article 12 paragraph 1 item 6 of the Law (legitimate interest). Data processing is carried out in the interest of realizing our public relations and communication.

The operator cannot influence the processing of your data, which the SELLER performs for the purpose of communicating with consumers.

As we have already mentioned, in those places where the social network platform operator provides us with the opportunity, we take care to adjust our pages in accordance with data protection.

1. b) Recipients / categories of recipients:

Data that you have entered on our social network pages, such as e.g. comments, video recordings, pictures, likes, public notices, etc. are published by the platform operator, and we do not process them at any time for any purpose other than the intended one. We reserve the right to delete illegal content, if necessary. This is the case, for example, in the case of misdemeanor or illegal posts, hate comments, comments (explicitly sexual content) or attachments (e.g. pictures or video recordings), which, among other things, violate copyright, personal rights, constitute a criminal offense or violate the ethical principles of the SELLER.

We will possibly share your content on our page in the given case if this is a function of the social network platform. We also process your data for the purpose of communicating with you. If you send us an inquiry via social network, we can refer you to other, safe communication channels, i.e. which guarantee confidentiality. Keep in mind that you always have the option of sending us confidential inquiries via the email address listed in the general information or via the contact form.

We generally do not forward your data that you send us in a confidential manner (e.g. private notices, correspondence or e-mail) to third parties. In exceptional cases, our external partners, to whom we entrust certain tasks in order to bring the services we provide to the highest level, may have access to your data. In that case, these are processors who use the data on our behalf. All our partners are selected in a very careful way and are contractually obliged to keep personal data secret in accordance with Article 45 of the Law.

Also, there may be a need to forward part of your confidential inquiries to contractual partners (e.g. suppliers for inquiries regarding specific products), for the purpose of processing your inquiry. However, in these cases, the inquiry is previously anonymized, so that the third party cannot associate them with you in any way. If in an individual case the forwarding of your personal data is necessary, we will inform you about this in advance and ask for your consent.

1. c) Retention period / criteria for determining the retention period:

We delete all personal data that you provide us with your inquiry (questions, suggestions, praise or criticism), i.e. we safely anonymize the data no later than 90 days after we give you a final answer. We keep your data for 90 days because in individual cases it may happen that you, as a consumer, contact us again regarding the answer to the same question and in that case we must have the opportunity to build on the previous correspondence. Experience has shown us that as a rule, after 90 days, there are no more follow-up questions regarding our answers.

All public posts that you have posted on the page will be permanently available, unless we delete them when updating a specific topic or due to a legal violation, violation of our guidelines or if you delete the post yourself.

We have no possibility to influence the deletion of your data by the operator himself. In that case, the data protection rules of the specific operator apply.

1. d) Prize games

Purpose / legal basis of data processing:

You have the opportunity to participate in various prize games on our page, via our newsletter, on our social networks or on the website www.sax.rs. Unless otherwise specified in a specific prize game, or if you have not given us a different explicit consent, we will process the personal data that you have provided to us as part of participation in the prize game exclusively for the purpose of realizing the prize game (e.g. drawing/determining the winner, notifying the winner, sending the prize, if necessary, anonymously publishing the winner). If you use your full name and surname on the social network or you are recognizable through photos on your profile, we cannot exclude your identification by other users.

The legal basis for processing your data within the framework of prize games is in principle Article 12 paragraph 1 item 2) (execution of the contract) of the Law. In the case of giving consent within the framework of the prize game, the legal basis for data processing is consent in accordance with Article 12 paragraph 1 item 1) of the Law. In that case, you have the right to revoke your consent at any time. The revocation of consent does not affect the permissibility of processing that was carried out on the basis of consent before revocation.

Recipients / categories of recipients:

We forward data to third parties only when it is necessary for the realization of the prize game, i.e. for sending the prize (e.g. sending the prize by the sponsor of the prize game or forwarding data to the logistics company) or if you have given us explicit consent for this. Please keep in mind that in some cases it is possible to participate in the prize game on pages with public access (e.g. on the bulletin board or via comments), so that other users can also publicly see the fact of your participation through your interaction with us. In such cases, others on the social network may also have knowledge of your prize. If you use your full name and surname on the social network or you are recognizable through photos on your profile, we cannot exclude your identification by other users.

Retention period / criteria for determining the retention period:

After the prize competition is completed and the winners announced, the personal data of the participants will be deleted, except for the data of the winners that we are legally obliged to keep when organizing the prize competition. In the event that the prize is a product with a warranty, the winner’s data is kept for the duration of the legal right to the warranty in order to order a repair or replacement if necessary. When participating in a prize competition on a social network (e.g. via a post or comment), we have no way of influencing the deletion of your data by the operator. In this case, the data protection rules of the operator apply.

1. e) Sending newsletters

Purpose / legal basis of data processing:

You can also subscribe to our newsletter via a social network. If you have given your consent to receive our newsletter, we will only process your email address and, if necessary, your name in order to send you (if possible, individual) information about products, promotions, prize competitions and news from the range of stores, as well as customer satisfaction surveys. We store and process this data for the purpose of sending newsletters. The content of the newsletter includes product offers, promotional discounts, prize competitions, etc.

With your consent, we will record your behavior as a user of our page, which is collected on www.sax.rs as well as in our newsletter. The evaluation of user behavior primarily includes the categories in which you move on the page or newsletter in question and which links you access there. In doing so, personalized user profiles are created that are linked to your person and/or email address, so that marketing communications (primarily in the form of newsletters, advertising banners and printed advertising) are as focused as possible on your personal interests and to improve the advertising offer.

The legal basis for the above-mentioned processing of your data is your consent in accordance with Article 12, paragraph 1, item 1) of the Law.

To ensure that there is no error when entering the email address, we have set up a so-called double opt-in procedure: after you enter your email address in the registration field, we send you a confirmation link. Only when you click on that link, your email address is entered into our mailing list.

You can revoke your consent to receive newsletters, participate in customer satisfaction surveys and create personalized user profiles at any time. You can find the unsubscribe link in this text or at the end of each newsletter. By unsubscribing, we consider that you have revoked your consent to the creation of your personalized user profile and receipt of the newsletter. We will then delete your user data. The revocation does not affect the permissibility of the processing carried out on the basis of consent before the revocation.

Recipients / categories of recipients:

If external partners – data processors – are engaged to send newsletters, they are contractually bound in accordance with Article 45 of the Law.

Storage period / criteria for determining the storage period:

If you revoke your consent to receive our newsletter, your email address will be blocked from receiving newsletters. Your data will be deleted from the corresponding mailing lists six months thereafter. When registering on a social network, we have no way of influencing the deletion of your data by the operator. In this case, the data protection rules of the specific operator apply.

3. Joint responsibility, Art. 43 of the Law on Personal Data Protection

With the social network operator, there is partly a relationship in accordance with Art. 45 of the Law (joint responsibility):

For the web tracking methods enabled by the social network platform operator, the operator and we are jointly responsible. Web tracking can thereby occur independently of whether you are logged in or registered on the social network platform. As we have already mentioned, unfortunately we can only have a limited influence on the operator’s web tracking methods, for example, we cannot switch them off.

The legal basis for web tracking methods is Article 12, paragraph 1, item 6) of the Law (legitimate interest). The justified and legitimate interest consists in optimizing the social network platform and the specific fan page.

You can find other information about the recipients, i.e. categories of recipients, as well as the storage period, i.e. the criteria for determining the storage period, in the data protection rules of the platform operators. We have no influence on these rules.

You can find the possibility to exercise your right to prevent these web tracking methods in the data protection rules of the operator, which are listed in point 2. On this issue, you can contact the platform operators via the operator’s contact details listed in their rules.

With regard to the statistics that the social network platform operator makes available to us, we can only conditionally influence them and prevent them. However, we make sure that no additional optional statistics are provided to us.

From all of the above, please be aware of the fact that it is not possible to exclude the possibility that the social network platform operator uses data from your profile as well as data about your behavior in order to, for example, assess your habits, personal relationships, tendencies, etc. The SELLER has no influence on the processing or forwarding of your data by the social network operator.

4. Your rights

In accordance with Article 26 of the Law, you have the right to request information or details about the processing of your data free of charge.

In addition, provided that the legal conditions are met, you have the right to rectification (Article 29 of the Law), erasure (Article 30 of the Law) as well as the right to restriction of processing (Article 31 of the Law).

If the processing of your data is based on Article 12, paragraph 1, item 5 or 6 of the Law, you have the right to object to the processing of data in accordance with Article 37 of the Law. If you object, we will be obliged to stop processing your data, unless we demonstrate that there are legal reasons for processing data that outweigh the interests, rights or freedoms of the persons to whom the data relate.

If you have provided us with your data yourself, in accordance with Article 36 of the Law, you have the right to transfer this data to another controller. As a rule, on social networks, you can exercise this right only directly towards the social network operator, because only the operator has access to the data from your profile.

If the processing of your data is based on your consent in accordance with Article 12, paragraph 1, item 1) of the Law, you have the right to revoke your consent at any time. The revocation of consent does not affect the permissibility of the processing carried out on the basis of consent before the revocation.

In order to exercise the aforementioned rights, as well as in the event that you have additional questions or complaints, please contact our person in charge of personal data protection via the contact details listed in the following point of this text.

In addition, in accordance with Article 82 of the Law, you have the right to lodge a complaint with the state authority responsible for the protection of personal data (Commissioner for Information of Public Importance and Personal Data Protection).

If you want to exercise your rights regarding the specific processing of your data, please contact us. We will then check your request (e.g. a request for notification or an objection) or, if necessary, forward it to the competent social network platform, if the subject of your request is the processing of data by the operator.

5. Contact of the person in charge of personal data protection:

If you have any additional questions or concerns regarding the processing of your data, please feel free to contact us and we will do our best to help you.

For these purposes, the person for the protection of personal data in the company S&SAX DOO D.O.O BEOGRAD-Palilula, PIB: 100212724, Registration number: 17309676, Address: Slanački Put 32 G, 11060 Belgrade – Palilula, Phone: +381 (0) 63 244 512; is at your disposal, whom you can contact in writing or by email: E-Mail: office@sax.rs

YOUR RIGHTS

1. Overview

In addition to the right to revoke your consent, if the legal conditions are met, you have the following rights:

• the right to information about your personal data that we process, in accordance with Article 26 of the Law on Personal Data Protection,
• the right to rectification of inaccurate or incomplete data, in accordance with Article 29 of the Law on Personal Data Protection,
• the right to erasure of your stored data, in accordance with Article 30 of the Law on Personal Data Protection,
• the right to restriction of processing of data, in accordance with Article 31 of the Law on Personal Data Protection,
• the right to data portability, in accordance with Article 36 of the Law on Personal Data Protection,
• the right to objection, in accordance with Article 37 of the Law on Personal Data Protection.

2. Right to information in accordance with Article 26 of the Law on Personal Data Protection

In accordance with Article 26 of the Law on Personal Data Protection, you have the right to request information from us free of charge as to whether we process your personal data, access to this data, as well as information:

• on the purpose of processing;
• on the types of personal data being processed;
• on the recipients or types of recipients to whom the personal data have been or will be disclosed, in particular to recipients in other countries or international organizations;
• on the envisaged period for which the personal data will be stored, or, if that is not possible, the criteria used to determine that period;
• on the existence of the right to request from the controller (SELLER) rectification or erasure of personal data, the right to restriction of processing and the right to object to processing, the right to lodge a complaint with a state authority (Commissioner for Information of Public Importance and Personal Data Protection); on the source of personal data (available information), if the personal data are not collected from the data subject (from you); on the existence of automated decision-making, including profiling referred to in Article 38, paragraphs 1 and 4 of the Law on Personal Data Protection, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject (for you).

If personal data are transferred to another country or international organization, you have the right to be informed of the appropriate safeguards relating to the transfer, in accordance with Article 65 of the Law on Personal Data Protection.

3. Right to rectification in accordance with Article 29 of the Law on Personal Data Protection

You have the right to request that your inaccurate personal data be rectified without undue delay. Depending on the purpose of the processing, you have the right to have your incomplete personal data completed, including by means of providing a supplementary statement.

4. Right to erasure in accordance with Article 30 of the Law on Personal Data Protection

You have the right to request that your personal data be erased by us in the following cases:

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• you have withdrawn consent on which the processing is based, in accordance with Article 12, paragraph 1, item 1) or Article 17, paragraph 2, item 1) of the Law on Personal Data Protection, and there is no other legal ground for the processing;
• when you object to the processing in accordance with Article 37, paragraphs 1 or 2 of the Law on Personal Data Protection, and there is no other legal ground for the processing that overrides the legitimate interest, right or freedom of the data subject;
• the personal data have been unlawfully processed;
• the personal data have to be erased in order to comply with our legal obligations;
• the personal data have been collected in relation to the offer of information society services referred to in Article 16, paragraph 1 of the Law on Personal Data Protection.

If we have made the personal data public and are obliged to erase the data, we will take all reasonable steps, including technical measures, in accordance with available technologies and the feasibility of bearing the costs of their use, to inform other controllers who are processing the data that you have requested the erasure of all copies of the data and references to, or electronic links to, those data.

5. Right to restriction of processing in accordance with Article 31 of the Law on Personal Data Protection

You have the right to request that we restrict the processing of your personal data if one of the following applies:

• you contest the accuracy of the personal data, for a period enabling us to verify the accuracy of the personal data;
• the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
• the controller (we) no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defense of legal claims; or
• you have objected to processing pursuant to Article 37, paragraph 1 of the Law on Personal Data Protection, pending the verification whether the legitimate grounds of the controller (us) override your interests.

6. Right to data portability in accordance with Article 36 of the Law on Personal Data Protection

You have the right to receive your personal data, which you have previously provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from our side, if the following conditions are cumulatively met:

• the processing is based on consent in accordance with Article 12, paragraph 1, item 1) or Article 17, paragraph 2, item 1) of the Law on Personal Data Protection or on a contract, in accordance with Article 12, paragraph 1, item 2) of the same Law; the processing is carried out by automated means.

This right also includes the right to have your personal data transmitted directly from us to another controller, where technically feasible.

7. Right to object in accordance with Article 37 of the Law on Personal Data Protection

Under the conditions of Article 37, paragraph 1 of the Law on Personal Data Protection, data processing may be subject to objection for reasons that depend on your particular situation.

The aforementioned general right to object applies to all processing purposes described in these data protection rules, which are processed on the basis of Article 12, paragraph 1, item 6) of the Law on Personal Data Protection. In contrast to the right to object to the processing of data for commercial purposes (see point 6), we are obliged under the Law on Personal Data Protection to apply such a general right to object only if the reasons for this are of great importance, for example, a potential danger to life or health. In addition, you have the option of contacting the state authority responsible for the protection of personal data or the person in charge of data protection in the company S&SAX DOO D.O.O BEOGRAD-Palilula, PIB: 100212724, Registration number: 17309676, Address: Slanački Put 32 G, 11060 Belgrade – Palilula, Phone: +381 (0) 63 244 512;

These personal data protection rules apply to the website www.sax.rs and to the processing of data by us as the data controller:

S&SAX DOO D.O.O BEOGRAD-Palilula, PIB: 100212724, Registration number: 17309676, Address: Slanački Put 32 G, 11060 Belgrade – Palilula, Phone: +381 (0) 63 244 512; E-mail: office@sax.rs.