PRIVACY POLICY
Introduction
Trading Company “Taktik” d.o.o. Belgrade, with its registered office at the address Samarska Str. No. 2, registration number: 07522711, TIN:100009933 (hereinafter referred to as Taktik d.o.o., Company or Controller), that acts as the Controller in terms of the definition referred to in Article 4, paragraph 1, item 8) of the Law on Personal Data Protection (“Official Gazette of RS”, No. 87/2018, hereinafter referred to as the LPDP), and complies with the applicable legislation of the Republic of Serbia, on 18 December 2020 adopts this Privacy Policy (hereinafter referred to as the Privacy Policy).
This Privacy Policy is aimed to establish and regulate the matters, rules and procedures in accordance with the LPDP, whereby the terms and definitions used herein correspond to the terms and definitions provided in the LPDP.
With an aim to comply with the applicable regulations and to establish the good practice, in personal data processing the Controller shall:
ensure that the collection and further processing of personal data is always based on the adequate legal grounds;
ensure that the processing is performed in compliance with the rights of the data subjects, while taking care to always provide data subjects with adequate assistance in exercising all their guaranteed rights;
regularly publish and make publicly available all relevant information related to processing;
ensure that the collection and further processing of personal data is carried out exclusively for the purpose of achieving a specific purpose;
collect and process the minimum set of personal data that is really necessary for the Controller to achieve a specific purpose;
collect and process personal data in the time period necessary to achieve the purpose for which the data were collected;
ensure that the collected personal data are accurate and up-to-date;
ensure that data is protected from any unauthorized or illegal access by internal or external persons.
Starting from these basic principles, the Controller hereby informs the data subjects about all important aspects of the collection and processing of their personal data, while the term “data subject” means all principals, customers, suppliers, associates, business partners, negotiators, negotiators who later withdraw from cooperation, employees, persons engaged outside employment and third interested parties (hereinafter referred to as Data Subjects).
In case the data belonging to categories other than those listed within the term Data Subjects need to be processed, the Controller shall do so in accordance with the LPDP, without the need to amend the Privacy Policy. The need to amend the Privacy Policy will only exist if such processing becomes part of the Controller’s regular activities.
Website www.taktik.rs
Taktik d.o.o. takes the privacy of website users seriously and strives to protect the information about them, which it collects, uses and stores.
By this Privacy Policy, the Company provides website users with the information on personal data processing when they use our website and related services. If users do not agree with any provision of this Privacy Policy, we hereby ask them to immediately stop using our website, because any further use or access to the contents of our website will be considered as acceptance of this Privacy Policy.
By visiting our website, users accept that their data are used in accordance with this Privacy Policy and allow us to collect such information.
In doing so, the Company collects the minimum amount of data on users, primarily for the purpose of processing the requests of users and website visitors.
Several options within the website require providing us with personal data. This includes the possibility for users to send us a complaint, resume, job application. The Company may collect all information that users send us through the “career” and “contact” options (including, but not limited to the name, surname, e-mail address, as well as other information left on the website), whereby the Company shall not be responsible for the content of information provided by users.
The Company shall not provide user data to third parties, and if at any time we have to disclose such data to third parties (ex. government authorities), users will be notified thereof, and their consent will be sought.
The Company may disclose general information to third parties, such as the number of website visitors, but not the data that could reveal an individual’s identity.
When they browse the pages at www.taktik.rs, we do not collect personal data of users, such as their name and surname, address of residence, telephone number, etc. However, information about the server to which the user’s computer it is connected, IP address, browser data and similar data can be collected and monitored on a collective basis. Namely, we collect data transmitted by the user’s Internet browser, which is technically necessary for the user to see our website. Also, for analytical purposes, the software itself can collect data on the number of visits.
The Company takes reasonable precautions to protect user data and to prevent unauthorized access to their data, but is not responsible for security vulnerabilities that are beyond our control.
It is understood that users, by their decision to provide their personal data, understand and consent to the fact that the security and privacy of their data may not be fully guaranteed.
The Company reserves the right to amend this Privacy Policy, provided that any change becomes binding on users after its publication on our website.
Users undertake to read this Privacy Policy from time to time, in order to be informed of its possible amendments, and if users continue to use our website after any amendments to the Privacy Policy, it shall be understood that they have accepted the same as the applicable.
The Cookie Notice is provided as Annex 1 to this Privacy Policy and forms an integral part hereof.
What is personal data?
Personal data is any data that refers to a Data Subject and that identifies that person, i.e. all information on the basis of which the Data Subject’s identity is identified or identifiable (directly or indirectly), and especially based on the identity marks (such as name and identification number), location data, identifiers in electronic communications networks or on the basis of one or more features of his physical, physiological, genetic, mental, economic, cultural or social identity.
What data are collected and processed by the Company (Controller)?
The Controller collects and processes the following data about Data Subjects, to the extent necessary to achieve a specific purpose:
general identification data (data from personal (ID) documents – name, surname, place, municipality and country of birth, day, month and year of birth, ID card number, personal ID number, address of residence, bank account number, for foreign citizens – number, date of issue and type of travel document, citizenship);
contact information (contact phone, e-mail address, etc.) hereinafter jointly referred to as the Data.
How are personal data collected?
Personal data are collected by the Controller directly from Data Subjects.
What is the legal basis for data collection and processing?
Before performing any activities aimed at data collection and processing, the Controller identifies the existence of the appropriate legal basis and, if possible, documents it. The Controller collects and processes personal data on the basis of informed consent of a Data Subject, which means that the Data Subject, with his/her unambiguous statement of will, (or other appropriate action such as further use or access to the website content) confirms (expressly or tacitly) to be acquainted with all important aspects of the personal data processing, and consents to such processing. In the case of express consent, its form and content must be in accordance with the LPDP.
Example of the Statement: Consent to the processing of personal data is given in Annex 2 to this Privacy Policy and forms an integral part hereof and is also available from the Legal Department of the Controller. Consent to the processing of personal data may be given within the framework of a contract concluded by the Company and a Data Subject.
The consent is voluntary and can be revoked at any time, provided such revocation shall not affect the processing of personal data that was performed before the revocation.
If the Controller collects and processes data on the basis of a legitimate interest, it must determine whether it violates the fundamental rights, freedoms and interests of a Data Subject, because otherwise the data will not be collected and processed.
What is the purpose of personal data collection and processing?
The Controller collects and processes the data in order to:
comply with the legal regulations in conducting business and registered activities (sales of goods, marketing, etc.)
create a database of Data Subjects;
inform a Data Subject about the Controller’s activities.
If the Controller needs to process the data for other purposes, the Controller will do so in accordance with the LPDP, without the need to amend the Privacy Policy. The need to amend the Privacy Policy will only exist if such processing becomes part of the Controller’s regular activities.
How are personal data stored and what security measures are applied?
Personal data are collected and stored by the Controller both physically and/or electronically in the Controller’s internal records (databases) which it maintains and regularly updates, in relation to which it applies all necessary organizational, technical and personnel security measures, aimed to ensure optimal data protection, including also:
control of physical access to the system where data are stored;
data access control;
data transfer control;
data entry control;
data availability control;
other information security measures necessary for the protection of personal data.
The Company reviews all security measures it applies, in order to assess their effectiveness. The Company reserves the right to apply other measures in order to protect the data.
Employees of the Company are obliged to respect the Privacy Policy, and persons who are no longer employed by the Company are prevented from further access to data.
Privacy Policy violation and data breaches
In case of the Privacy Policy violation, in addition to internal procedures, the relevant laws will apply.
In case of a data breach that may pose a risk to the rights and freedoms of Data Subjects, the Company is obliged to notify the Commissioner for Access to Information of Public Importance and Personal Data Protection (hereinafter referred to as the Commissioner), no later than 72 hours from the moment of becoming aware of such breach. Otherwise, the Company is obliged to explain the reasons why it did not inform the Commissioner about the personal data breach within the prescribed period. The notification is delivered to the Commissioner in writing – directly, by mail or by e-mail: office@poverenik.rs. The notice must contain: a description of the nature of the data breach, including the type of data, the approximate number of data subjects and the approximate number of data whose security has been compromised, contact details of the Data Protection Officer or information on other ways in which information about the data breach can be obtained, description of possible consequences of such data breach, description of measures taken or proposed by the Company in connection with the data breach, and measures taken to reduce adverse consequences.
The Company is obliged to notify the Data Subject of such data breach, with no delay, if the personal data breach may produce a high risk to the rights and freedoms of the Data Subject, and is obliged to describe the nature of the data breach in a clear and understandable manner. In the Notice sent to Data Subjects the Company is obliged to provide the contact details of the Data Protection Officer or information on other ways in which information about the data breach can be obtained, description of possible consequences of such data breach, description of measures taken or proposed by the Company; and measures taken to mitigate the adverse consequences.
What are the rights of Data Subjects?
In relation to personal data, Data Subjects have the following rights:
the right to request information on personal data processing from the Controller;
the right to request access to personal data and information related to processing;
the right to request correction of incorrectly entered data and supplements to such data;
the right to request the erasure of data;
the right to restrict processing;
the right to data portability;
the right not to be subject to a decision made solely on the basis of automated processing, including profiling;
the right to be informed of a data breach, if that data breach may pose a high risk to the rights and freedoms of individuals;
the right to file a complaint to the Commissioner for Access to Information of Public Importance and Personal Data Protection;
the right to judicial protection if they believe that the rights from the LPDP have been violated;
other rights guaranteed by the applicable LPDP.
Data Subjects may exercise their rights by submitting a Request to Exercise Rights, in writing, to the person authorized for the protection of personal data. A template of the Request to Exercise Rights (hereinafter referred to as the Request) is given as Annex 3 to this Privacy Policy and forms an integral part hereof, and it is also available from the Legal Department of the Controller. Requests that are not sent directly to the authorized person will be forwarded to the authorized person.
The Controller will provide Data Subjects with all necessary additional information and assistance with regard to the exercise of their rights, all in accordance with the terms and conditions prescribed by the applicable LPDP.
Who, besides the Controller, can have access to the Data?
The Company may conclude a joint controllership agreement or a data processing agreement with another company, the content of which must be in accordance with the LPDP.
The Controller may also disclose personal data to third parties, some of whom are processors and some of whom are data recipients. The processor in terms of Article 4, paragraph 1, item 9) of the LPDP, is a natural or legal person, i.e. a government authority that processes personal data on behalf of the Controller, while the Recipient in terms of Article 4, paragraph 1, item 10) of the LPDP is a natural or legal person , i.e. the government authority to whom the personal data have been disclosed, regardless of whether it is a third party or not.
Access to data is limited to certain persons in accordance with the nature of the work and the performance of specific business tasks. Categories of persons who may have access to personal data:
employees and/or persons otherwise engaged by the Controller, in accordance with the nature of their work;
principals, partners or associates in individual programs;
IT companies that maintain the information systems of the Controller used for storing the collected data.
Certain processors may have access to personal data and may be established in foreign countries, primarily in EU/European Economic Area Member States. The disclosure of data to EU/European Economic Area Member States is done on the basis of the standard level of adequate protection of personal data in those countries, in accordance with the law.
All processors shall conclude special contracts which regulate all important aspects of personal data processing, as well as security measures.
Exceptionally, personal data may be submitted to the competent state authorities, if it is a legal obligation of the Controller, and only to the extent necessary to fulfill a specific legal obligation.
The Company has a developed practice of embedding a confidentiality clause in employment contracts and cooperation agreements or signing a special appropriate confidentiality document with associates, who may have access to data collected and processed by the Company.
Persons who in any way cooperate with the Company and who may have access to the data processed by the Company are expected to be acquainted with the Privacy Policy and to act in accordance with the same and will not be entitled to access the data before concluding an appropriate non-disclosure document with the Company.
How long will personal data be retained?
Data retention periods correspond to the purpose of processing and are in accordance with the relevant regulations and legal obligations. The Controller reserves the right to review and change the retention periods.
How can additional processing notices be obtained?
With regard to all inquiries, requests and complaints related to the collection and processing of personal data and this Privacy Policy, including the manner of exercising the rights and access to documents, Data Subjects can contact us by e-mail: zastitapodataka@taktik.rs, by phone: 011/712-92-21 or at the address: Samarska Str. No. 2, 11070 Belgrade, with the note: Attn. Data Protection Officer (The decision on appointing the Data Protection Officer is displayed on the bulletin board of the Controller).
The Data Protection Officer (hereinafter: the Authorized Person) will respond to any inquiry as soon as possible, but no later than within 30 days from the date of receipt of the request. The deadline can be extended for another 60 days if necessary, depending on the duly received written request, its complexity and the number of submitted requests. The Authorized Person is obliged to inform the Data Subject about the extension of the deadline and the reasons within 30 days from the day of receipt of the request.
If the request is obviously unfounded or excessive or if the same request is frequently repeated, the Authorized Person may refuse to act upon the request, provided that the Authorized Person bears the burden of proof.
The Authorized Person will identify the Data Subject based on the data provided in the submitted Request to Exercise Rights and will compare such data with the data possessed by the Company and will record the date of the review, and, if necessary, the Authorized Person may request additional information from the Data Subject.
Right to amend and supplement the Privacy Policy and binding effect.
The Company reserves the right to amend and supplement the Privacy Policy.
This Privacy Policy shall enter into force and effect and shall be binding on the Company from the date of its adoption.
In Belgrade,
date: 18/12/2020