Privacy Policy
Notice on Personal Data Processing
1 DATE OF ENTRY INTO FORCE OF THE NOTICE ON PERSONAL DATA PROCESSING
01.01.2024
2 PURPOSE OF THE NOTICE ON PERSONAL DATA PROCESSING
This Notice on the processing of user's personal data (hereinafter: Notice) informs users of the "Prodajem Auto" service at the website https://prodajemauto.rs (hereinafter: Service) about the processing of their information.
Based on the legal regulations on personal data protection ("Official Gazette of RS", 87/2018) (hereinafter: PDPL), the Service takes care of the protection of your data. The text includes all cases of data collection and processing, as well as the purpose of data processing.
Personal data is any information related to an identified or identifiable natural person, directly or indirectly, especially based on identity markers such as name, unique citizen identification number, location data, electronic communication network identifiers, or one or more features of their physical, physiological, genetic, mental, economic, cultural, and social identity.
For questions, complaints, requests, and additional information about the Privacy Notice and the exercise of your rights, you can contact us by email at [email protected].
- AMENDMENTS AND ADDITIONS
- The Notice is subject to changes, and we will inform you of any changes.
- LEGAL BASIS OF PROCESSING
- In the case of transactional data, user verification, user identification, and prevention of possible misuse, your data may be provided to third parties such as government authorities and banks.
For some processing purposes, we process your personal data based on your consent for the processing of personal data, with prior notification of all essential aspects of the processing. It is essential to know that you can withdraw your consent at any time and without justification, resulting in the cessation of further processing.
We may process your personal data if required by law, such as our legal obligation under Article 45 of the Advertising Law, which requires us, as the sender of the advertising message, to clearly identify the person advertising during the advertising period and for 30 days after the advertisement expires.
3 PURPOSE OF DATA PROCESSING
The majority of data processing is used internally for the functioning of the Service and is not accessible to third parties. The most frequently processed data includes: Ad data, advertiser's name and surname, address, postal code, region, city, country, phone, email, and IP address accessing the Service.
The data collection bases are to enable the provision of the Service, security, and protection of users of the internet Service facilitating the sale and purchase of new and used vehicles, parts, and equipment.
The sole purpose of data collection and processing is the functionality of the Service for improving service, security, protecting our business, and enhancement.
4 TYPES OF COLLECTED DATA AND PROCESSING
Account creation on the Service: For the need to create an account, the Service uses the data entered during registration. These data are stored until the account is deleted from the Service. When accessing the Service, possible identification data may include email, password, mobile phone number, or identification via social networks (Facebook and Gmail). By registering on our Service, you enter into a contractual relationship with the Company, clearly indicated during registration and each login to the Service system.
Assistance in buying/selling vehicles/parts: For the purpose of facilitating buying or selling, the Service processes data such as viewing history, location, and finds those closest to your requirements, offering assistance in search or sale. The processed data for this purpose include: Address, place, city, country, ad viewing history, and price. Also, if you have indicated that your data is visible to other users on the Service, it will be publicly available within the ads to all users who access the internet Service.
Sharing ads on social media: The Service has the option to share an ad on official social channels such as Facebook, Instagram, LinkedIn, and Twitter. The ad can be shared on social media only if the user has given consent for this purpose.
Sending promotional messages: Users have the option to give consent to the Company for sending promotional messages through certain services.
Refund process: In cases where it is necessary to refund funds to a Service user who is a natural person, it is necessary for the user to provide their ID number for this purpose. The legal basis for processing is the law, i.e., the Company's legal obligation.
Notifications: Some of your data may be used to send notifications related to the functioning of the Service, Company news, promotions, and other notifications.
5 RETENTION PERIOD OF YOUR DATA
We keep your personal data until the account is deleted or the account is revoked. The Service reserves the right to terminate and delete a user's account in case of non-compliance with the terms of use. Ad data is kept for a minimum of 30 days after the ad expires and a maximum of 90 days after the ad expires. Some parts of your records in the system must remain recorded for the system's operation but are made unrecognizable and impossible to link to you or the deleted account.
Exceptionally, we may keep your data even after withdrawing consent or achieving the purpose, in situations where it is necessary to fulfill our legal obligation (e.g., Accounting Law, etc.) or for submitting, realizing, or defending a legal request.
6 SECURITY OF YOUR DATA
To ensure the security of the processed data, we strive to apply necessary standards for the protection of personal data and implement all necessary technical, organizational, and personnel protection measures in accordance with the requirements of the applicable PDPL, as well as technical measures to protect access to the place where the data is stored. Third parties processing data also have an obligation to apply all necessary technical, organizational, and personnel measures.
7 TRANSFER OF PERSONAL DATA TO OTHER COUNTRIES
Some processors who may access personal data are based in foreign countries, primarily in EU member states or Council of Europe member states under Convention 108. The transfer of data to these countries is based on the assumed level of adequate protection of personal data in these countries, in accordance with the law.
If some processors are based outside the mentioned group of countries, the transfer of data would be possible only with the application of the provisions of Article 65 of the PDPL, regulating the transfer with the application of appropriate protection measures.
8 YOUR RIGHTS REGARDING THE PROCESSED PERSONAL DATA
TRANSPARENCY: When you provide us with personal data, we will transparently inform you about the purpose for which we need the data, who uses this data, and provide you with all other relevant information for processing your data (this right is fulfilled by providing this Notice).
RIGHT TO ACCESS: You have the right to be informed whether we process your personal data, and if we do, you have the right, based on the conducted insight, to request correction, supplement, update, deletion of data, as well as termination and temporary suspension of processing.
RIGHT TO CORRECT, SUPPLEMENT, AND UPDATE: Processed data should be accurate and complete. You have the right to have your inaccurate personal data corrected without undue delay, or incomplete data supplemented.
RIGHT TO DELETE: You have the right to have your personal data deleted in accordance with the PDPL. If it is necessary to continue processing to fulfill our legal obligations (e.g., Accounting Law, etc.) or for submitting, realizing, or defending a legal request, we will delete only the part of the data that is no longer necessary.
IMPORTANT: If you request the right to delete your personal data and delete your user account, you will no longer be able to register with the same email address.
RIGHT TO PORTABILITY: If you want (i) to receive in a structured, commonly used, and machine-readable format the personal data you provided us during registration or (ii) to transfer to another data controller the personal data you provided to us as a data controller, you have the right to request this from us, provided that the processing is based on consent or a contract and the processing is done automatically.
RIGHT TO LIMIT PROCESSING: You have the right to request the limitation of the processing of your personal data in certain situations.
RIGHT TO OBJECTION: You have the right to object to the processing of your personal data based on a legitimate interest.
RIGHT TO APPEAL TO THE COMPETENT AUTHORITY: the right to file a complaint with the Commissioner for Access to Information of Public Importance and Personal Data Protection – Bulevar kralja Aleksandra number 15, 11120 Belgrade, phone: +38111 3408 900, e-mail: [email protected].
ALL OTHER RIGHTS PROVIDED BY LEGAL REGULATIONS: The data subject can exercise their rights by sending a request to the email address: [email protected].
Regarding the exercise of the above-mentioned requests, the Company will provide you with all necessary additional information and assistance in accordance with the conditions and manner prescribed by the applicable PDPL.
You can exercise your rights by sending a request to the following email address: [email protected].
We will respond to your request as soon as possible, but no later than 30 days from the date of receipt of the request. In case of complexity or a large number of requests, we may need an additional period to respond to the request. This period cannot exceed 90 days, and we will inform you separately about it.
If your request is obviously unfounded or is repeated frequently, we may reject it or charge you for its realization. It is considered that the request is repeated when you address us with a request to exercise any of the rights more than once in one year. If you contact us two or more times in one year for the same right, we will respond to your request only if you have a justified reason.
9 WHO HAS ACCESS TO YOUR DATA
Depending on the specific purpose, certain personal data of users may be accessed by:
The Company as the owner of the Service.
Newly established entities or entities acquiring ownership of the Company, if the Company is involved in mergers, acquisitions, share sales, or other changes in status.
As users, you have the option to give consent to the Company to share your ad message on social media platforms such as Facebook, Twitter, Instagram, and LinkedIn, in which case some of your personal data will be shared.
Our partners, who perform certain processing tasks for the Company as processors, such as external collaborators providing specific services, such as Mailchimp, CarVertical, as well as software companies that develop and maintain software where data is stored.
Exceptionally, personal data may be provided to competent state authorities if it is a legal obligation of the Controller, and only to the extent necessary to fulfill a specific legal obligation.
To any other recipient when reasonably necessary, e.g., in case of danger to life.
All recipients are obliged to take appropriate technical, organizational, and personnel measures to protect your personal data. In situations where we are the controllers and data processing is carried out by a third legal entity as a processor at our request, we regulate relationships with processors by contract, covering all essential aspects of personal data processing and protection measures.
Texts (comments), ratings, and other content posted by users in designated sections such as news, advice, guestbooks are visible and accessible to all site visitors until the user requests their deletion.
10 CONSENT AND WITHDRAWAL OF CONSENT
If you have given us consent for processing, you can withdraw it at any time. In case of withdrawing consent, we will cease further processing of your personal data and delete the personal data within a maximum period of 90 days from the date you sent the consent withdrawal. Withdrawal of consent is free, and you can send it to the following email address [email protected] or on your profile page on the Service.
11 WEBSITE POLICY
We use various technologies on our website; some of them we control ourselves (first-party), and some are controlled by other organizations (third-party).
Technologies we use include (but are not limited to) cookies and scripts. Some of them are necessary for the functioning of this website and for our understanding of your use of the website. We also use these technologies for marketing and other purposes, as described below.
The use of cookies enables certain functionalities of our website and enhances your user experience. To provide better user service, our website uses certain external scripts that do not transmit your personal data, such as AdWords, Google Analytics, Google Tag Manager, Facebook API, Google Firebase.
You can learn more about the cookies used on our Service at the following link: https://prodajemauto.rs/obavestenje-o-privatnosti/kolacici.
Also, our website may contain third-party cookies or external scripts; you can read more about it at the following link: https://prodajemauto.rs/obavestenje-o-privatnosti/kolacici.