Personal data is information that directly or indirectly relates, or can relate, to your personality. As the legal basis governing data protection and the conditions for processing your data, we apply the Law on Personal Data Protection ("Official Gazette of RS", No. 87/2018).

GEM STRATEGY DOO, Kralja Petra Prvog 334/k, Mladenovac, Serbia (hereinafter GEM STRATEGY), as the data controller, prior to the collection and processing of personal data in accordance with Article 23 of the Law on Personal Data Protection, hereby informs you of the conditions for the collection and processing of personal data.

INFORMATION WE COLLECT

Public Data

It is possible to visit and use our site without revealing your identity or any other data related to it. When visiting our website, taking into account the nature of the Internet, data is collected that records users but is not sufficient in itself to identify a specific person and represents statistical indicators used to improve the quality of the website. Such information may include the name of the Internet browser, the number of visits, average time spent on the page, type of computer, and technical information about the connection the user uses when visiting the website, such as the operating system and the Internet service provider, the IP (Internet Protocol) address assigned by providers which is different for each Internet user, and similar information.

Personal Data

What types of personal data do we use?

1. PERSONAL DATA: for contact such as name, surname, address, email, phone number
2. BUSINESS CONTACT DATA: such as the address of the business entity, business email
3. SENSITIVE PERSONAL DATA: gender, national ID number (JMBG), date of birth
4. CONTRACT DATA: such as the content of the business cooperation agreement
5. PAYMENT INFORMATION: such as bank account number, claims for compensation, payment of contractual obligations

Purpose of data processing / legal basis:

1. For providing services: to deliver the goods you purchased from us via the www.reformerconcept.rs online store, we need to have your contact details to deliver the goods to the desired address;
2. Execution of requests - resolving complaints and remarks: we strive to resolve them appropriately in accordance with the Law. To have sufficient information to conduct this process and make a correct decision, as well as to provide feedback regarding the complaint – we need to collect certain data about you. Also, if you want a refund, it will be necessary to fill out the prescribed form – the so-called NI form, in which your national ID (JMBG) is entered, as required by current regulations.
3. Contracting – to conclude a contract, we need to verify if the person we are entering into a contractual relationship with is authorized to do so. The same is the case with the execution of certain contractual provisions by persons designated for that purpose. Sometimes we need to verify the identity of these persons to ensure we are acting correctly. We undertake these activities for the purpose of acting based on the contract we have concluded with you to fulfill legal obligations.
4. Notification of offers – if you have signed up to periodically receive notifications about promotions and other benefits, you have shared some of your data with us, which we can use to send these notifications – as long as you wish to receive them.
5. We undertake security measures – such as CCTV cameras and have access to security data about our office premises to ensure that our associates, customers, visitors, and property are protected.

GEM STRATEGY processes certain personal data considered to be of a sensitive nature for the purpose of fulfilling our obligations in the manner and to the extent prescribed by law:

• Data on your health status, which includes records of your absence from work for health reasons; medical documentation, medical findings, etc., for processing any claims for compensation for damages that occurred in our retail facility or business premises. We will not record your data from the medical record except when explicitly necessary. It is possible that this data will be forwarded to our insurance company to act upon your claim for damages. In case you initiate court proceedings against us, the relevant data may be submitted for inspection to the competent court during the proceedings.

Who has access to your personal data?

We provide your personal data to the following persons:

• Third parties acting on our behalf (processors). In these cases, such third parties may use your personal data exclusively for the purposes stated above and solely in accordance with our instructions;
• Associates in sectors dealing with the above-mentioned services may have access to your personal data, but only when strictly necessary to perform their work tasks, and when the associate is obliged to maintain the confidentiality of the information;
• Insurance companies providing services to the business entity GEM STRATEGY and associates;
• Third parties responsible for storing your personal data, independent of GEM STRATEGY (these are externally engaged persons, independent auditors, lawyers, tax advisors, etc.);
• If required by law or a court order, for example, law enforcement authorities or other state bodies.

How long do we store your personal data?

We store your personal data for a certain period as long as they are needed for the purpose of processing, after which we delete them or disable access – they become anonymous.

The criteria used to determine the period for which the data is stored are:

• The duration of your contractual relationship;
• As long as we have established relations with you;
• According to the legal conditions applicable to us.

DATA PROCESSING FOR WEBSITE VISITS

When using certain functionalities (applications, requests) on our site via the contact form, request for a quote for the purchase/sale of goods, request for news, information, and promotions... GEM STRATEGY processes your personal data (identity personal data and contact information) only if you have voluntarily provided them on our website to use our services and products. These personal data may include name, surname, email, phone number, and/or other contact information and will be used in accordance with the privacy policy and the purpose for which you left them.

Purpose of data processing / legal basis: When visiting our website, the browser you use on your device will automatically and without your activity send to our website's server:

• The IP address of the device from which the inquiry was sent and which has internet access,
• Date and time of access,
• Name and URL of the downloaded file,
• The website/application from which access is made (referrer URL),
• The browser you use and, if necessary, the computer's operating system that supports the internet, as well as the name of your provider.

The mentioned data is temporarily stored by the server in a so-called log file for the following purposes:

• Ensuring the establishment of a smooth connection,
• Ensuring comfortable use of our website/application,
• Evaluation of system security and stability.

The legal basis for processing the IP address is Article 12, paragraph 1, point 6) of the Law on Personal Data Protection (legitimate interest). Our legitimate interest arises from the aforementioned purpose of data processing.

Recipients / categories of recipients: Generally, we do not transfer this data to third parties.

Retention period / criteria for determining the retention period: Data is stored temporarily during the site visit and then automatically deleted. After you leave our website, geolocation data is deleted.

Cookies: On our website, we use so-called cookies in accordance with Article 12, paragraph 1, point 6) of the Law on Personal Data Protection (legitimate interest). We believe that the interest in optimizing our website is justified in terms of the aforementioned provision. Cookies are small files stored on your device (laptop, tablet, smartphone, etc.) when visiting our website. Cookies do not harm your device, do not contain viruses, Trojans, or other malicious software. Information obtained in connection with the device you are using is stored in cookies. However, this does not mean that we are aware of your identity. On the one hand, the use of cookies serves to make your visit to the website more pleasant. For example, we use so-called session cookies to recognize that you have already visited certain parts of our site or that you are already logged into your user account. They are automatically deleted after you leave our website. Additionally, we use temporary cookies that are stored on your device for a certain period. When you revisit our website, it is automatically recognized that you have already been on the site and what settings you have set, so you will not have to repeat these actions.

On the other hand, we use cookies to statistically record the use of our website, aiming to optimize the offer and display information tailored to your interests. These cookies allow us to automatically recognize you when you revisit our website. These cookies are automatically deleted after a certain time. Most browsers automatically accept cookies. However, you can set your browser so that cookies are not stored on your computer or that a message always appears before a new cookie is created. Nevertheless, completely disabling cookies may mean that you cannot use all the functions of our website.

DATA PROCESSING FOR SECURITY REASONS (VIDEO SURVEILLANCE)

Purpose of data processing / legal basis: We also process your data through video surveillance introduced in our stores and business premises for your and our protection, based on a legally justified interest for the protection of property, employees, customers, and visitors, and especially for protection against the following identified risks:

• unauthorized access to spaces and facilities;
• removal, i.e., alienation and unauthorized use of protected items;
• bringing in weapons, explosive, radioactive, and other dangerous items and substances;
• break-ins, diversions, and violent attacks on the facility or taking items;
• unauthorized access to data and documentation; and
• protection of vehicles for transporting money and other means of transport.

The legal basis for processing data via video surveillance is Articles 29 and 30 of the Law on Private Security.

Recipients / categories of recipients: Video recordings will not be publicly published or transferred to third parties, except in cases where it represents our legal obligation or authorization. Our partner who provides us with private security services, i.e., who is in charge of physical and technical security of our stores, has insight into video recordings. Additionally, for the purposes of maintaining the video surveillance system, we have engaged a service technician who may have insight into video recordings only for the purpose of ensuring its functioning.

Retention period / criteria for determining the retention period: Video recordings are stored for 30 days. Made copies of video recordings are stored longer than 30 days in certain situations (legal proceedings). Video recordings that are no longer needed are deleted without delay (completion of legal proceedings).

PROCESSING DATA PROVIDED TO US BY E-MAIL

Purpose of data processing / legal basis: Personal data provided via the contact form, by phone, or by email is, of course, treated confidentially. We process your data exclusively in accordance with the established purpose to respond to your inquiry. The legal basis for processing data is Article 12, paragraph 1, point 6) of the Law on Personal Data Protection (legitimate interest). Our and simultaneously your (legitimate) interest for such data processing arises from the need to respond to your questions, if necessary to solve existing problems, and thus ensure your satisfaction as our customer or as a user of our website.

If you participate in one of our surveys, such participation is voluntary. For anonymous surveys, we do not store data that allows us to conclude who the survey participant is. we only store the date and time of your participation. Any personal data you have given us via the survey is considered voluntarily given and we store it in accordance with the provisions of the Law on Personal Data Protection. Please do not enter names or similar data into free fields that would allow us to conclude who it is about, whether it is you or other persons. In case you have given consent for conducting a survey, the legal basis for data processing is based on your consent in accordance with Article 12, paragraph 1, point 1) of the Law on Personal Data Protection. In that case, you have the right to revoke your consent at any time. Withdrawal of consent does not affect the permissibility of processing carried out based on consent before the withdrawal. Details on data processing regarding surveys are regulated by the data protection rules of each individual survey.

Recipients / categories of recipients: Generally, we do not transfer data to third parties. Exceptionally, the data will be processed by our partners (processors) on our order. All our partners are chosen very carefully and are contractually bound to keep personal data confidential, in accordance with Article 45 of the Law on Personal Data Protection.

Additionally, in some cases, there is a need to forward your inquiries to other contractual partners (e.g., suppliers for inquiries regarding certain products) so they can process them. In those cases, the inquiry is previously anonymized so that the identity cannot be determined. If in a specific case there is a need to transfer your personal data, we will inform you beforehand and ask for your consent.

The results of our surveys are generally used only for our needs. We generally do not forward that data to third parties unless you have given us explicit consent for that.

Retention period / criteria for determining the retention period: All personal data provided when asking a question (suggestion, praise, or criticism) through this website or by email is deleted or anonymized at the latest within 90 days after providing the final answer. Experience has shown us that usually after 90 days, follow-up questions regarding our answer no longer appear.

DATA PROCESSING FOR ADVERTISING PURPOSES

Purpose of data processing / legal bases: With your consent, we record your behavior as a user of our website and newsletter. Monitoring user behavior primarily involves data on the sections where you stayed and which links you used. In this way, we create personalized user profiles with your personal data and/or with the data of your email address to possibly better adapt our addressing in the form of newsletters, on-site advertisements, and printed materials to your personal interests, and thereby improve our offer.

The legal basis for the aforementioned data processing is Article 12, paragraph 1, point 6) of the Law on Personal Data Protection (legitimate interest) or Article 12, paragraph 1, point 1) of the Law on Personal Data Protection (consent). Processing customer data for our advertising purposes or for the advertising needs of third parties is considered a justified interest.

Right to object: At any time and completely free of charge, you can file an objection to data processing for the aforementioned purposes through any communication channel. After you file an objection, we will no longer process your data, whereby the objection does not affect the processing carried out based on consent before the objection. For this purpose, it is sufficient to send an email or a letter by post to our contact address.

Recipients / categories of recipients: Generally, we do not forward this data to third parties.

Retention period / criteria for determining the retention period: If you revoke your consent for individual advertising or do not agree with certain promotional activities, we will delete your data from the appropriate mailing list. If you file an objection, your contact address will be blocked for further data processing for advertising purposes. We note that in exceptional cases, even after receiving your objection, some shipments of promotional material may occur. This is technically conditioned by the time needed to prepare the promotional material and does not mean that we do not respect your objection. Thank you for your understanding.

DATA PROCESSING FOR NEWSLETTER SUBSCRIPTION

Purpose of data processing / legal basis: You have the option to sign up for our newsletter on our website. If you have agreed to receive our newsletter, we use your email address and possibly your name to send information about products, promotions, sweepstakes/contests, news, and store offers. We store and process this data for the purpose of sending the newsletter.

The content of the newsletter includes promotions (offers, sales, sweepstakes, etc.) as well as products found on www.reformerconcept.rs

With your consent, we record your behavior as a user of our website www.reformerconcept.rs and newsletter. Evaluation of user behavior involves primarily data on the sections you stay in and the links you use there. In this way, we create personalized user profiles with your personal data and/or with the data of your email address to enable the creation of advertising offers by GEM STRATEGY in the form of newsletters and printed material, tailored to your personal interest and thereby improve our offer.

The legal basis for processing data when sending the newsletter is your consent in accordance with Article 12, paragraph 1, point 1) of the Law on Personal Data Protection.

To ensure that no error occurred when entering the email address, we use the so-called double-opt-in procedure. When you enter an email address in the registration field, we will forward a confirmation link to it. Only when you click on this confirmation will your email address be entered into our mailing list.

You can revoke your consent for receiving the newsletter or creating personalized user profiles at any time. Withdrawal of consent does not affect the permissibility of processing carried out based on consent before the withdrawal. You can do this by, for example, unsubscribing from the newsletter list on our website. You have an unsubscribe link at the end of each newsletter. If you revoke consent, we will delete your data.

Recipients / categories of recipients: If we have engaged external partners to send the newsletter, they are bound by a contract in accordance with Article 45 of the Law on Personal Data Protection. Any further disclosure of data to third parties is excluded.

Retention period / criteria for determining the retention period: If you revoke your consent for our newsletter, we will delete your data from the appropriate mailing list for sending the newsletter.

PROCESSING DATA OF BUSINESS PARTNERS

The following notes regarding data processing apply to you if you have contacted us, if you are conducting negotiations with us aiming to conclude a contract and/or have already concluded a contract with us and if personal data are processed in connection with that. Which data are processed in an individual case depends primarily on the agreed services. For this reason, not all parts of this section will be relevant to you.

How do we collect your data and what categories of data do we process?

We generally collect data directly from you.

However, we can also collect data from other companies, state bodies, or third parties, e.g., credit bureau, tax administration, etc. In addition, we can collect personal data through our reporting systems about possible violations of the law or internal guidelines.

The following personal data may be processed: personal details (e.g., first and last name, address and other contact details, date and place of birth, as well as citizenship), identification and authentication data (e.g., excerpt from the business register, ID card data, signature sample), data related to our business relationship (e.g., payment data, order data), creditworthiness data, company structure and ownership structure data, photos and video recordings (e.g., during delivery of goods), as well as other data similar to the above categories of data.

Purpose and legal basis of data processing

Processing for the purpose of fulfilling contractual obligations (Article 12, paragraph 1, point 2) of the Law on Personal Data Protection)

Data is processed for the preparation of concluding a contract, which precedes the contractual relationship, as well as for the purpose of fulfilling obligations after concluding the contract.

Processing for the purpose of fulfilling legal obligations (Article 12, paragraph 1, point 3) of the Law on Personal Data Protection)

The purpose of data processing arises, depending on the individual case, from legal regulations. Thus, for example, data is processed for the purpose of fulfilling documentation storage obligations and in connection with identification, e.g., based on regulations for preventing money laundering, based on tax control and reporting, and processing data within inquiries from state bodies.

Processing for the purpose of fulfilling legitimate interests (Article 12, paragraph 1, point 6) of the Law on Personal Data Protection)

The need may arise to process personal data you have made available within frameworks that go beyond the initial fulfillment of the contract. Our legitimate interests for such processing are the selection of an appropriate business partner, fulfillment of legal requirements, removal of liability claims, access control, clarification of possible violations, prevention of criminal acts, and processing of damages that occurred based on the contractual relationship.

In the case of concluding a contract, for the purpose of fulfilling the aforementioned legitimate interests, in individual cases, we collect data on your creditworthiness through a credit bureau. We process creditworthiness data obtained from the credit bureau for the purpose of checking your credit capacity. The credit bureau stores data obtained from, for example, banks or companies. This data primarily includes surname, first name, date of birth, addresses, and information on payment history. You can obtain information about stored data relating to you directly from the credit bureau.

Who has access to your data?

Within our company, access to the data you have made available to us is given only to those sectors for which it is necessary for fulfilling contractual or legal obligations or for the purpose of fulfilling legitimate interests. within the contractual relationship, we also engage other service providers who may obtain access to your personal data. Compliance with regulations on personal data protection is ensured by contract in these cases.

How long do we store your data?

We store personal data as long as necessary to fulfill the aforementioned purposes. In doing so, we take care of legal storage obligations, for example, the legal period of 5 years in accordance with the Law on Accounting.

Are you obliged to provide us with your data?

Within our business relationship, you are obliged to provide us with those personal data necessary for starting, conducting, and concluding the contractual relationship and for fulfilling the obligations associated with that, as well as for whose collection we have a legal obligation or have a right based on legitimate interests. without these data, as a rule, we will not be able to start a business relationship with you.

What rights do you have as a data subject?

You have the right to receive information about your data we process upon request and free of charge. Additionally, in accordance with legal conditions, you have the right to correction and deletion of your data, the right to data portability, as well as the right to restriction of processing. If we process your personal data based on consent, you have the right to revoke that consent at any time. Withdrawal of consent does not affect the permissibility of processing carried out based on consent before the withdrawal. In the mentioned cases, please contact us in writing or by email at the address of our data protection officer listed below. Additionally, if you do not agree with the processing of your personal data, you have the option to file a complaint with the state body (Commissioner for Information of Public Importance and Personal Data Protection).

Responsible person (controller)

The responsible person for processing your data, i.e., the data controller, is GEM STRATEGY DOO, Kralja Petra Prvog 334/k, Mladenovac, Serbia, MB: 20083263, PIB: 104086837, Phone: +381 60 07 07 507, E-mail: shop@reformerconcept.rs. Our personal data protection officer is also at your disposal at the following address: GEM STRATEGY DOO, Kralja Petra Prvog 334/k, Mladenovac, Serbia.

DATA PROCESSING ON SOCIAL NETWORKS

The operator of the respective social network platform is partly responsible for processing your data. additionally, in some cases, we are also the platform operator and in that sense, there is joint responsibility in accordance with Article 43 of the Law. GEM STRATEGY manages the following social network pages:

• Facebook: Facebook page link
• Instagram: Instagram page link

1. Operator's responsibility

We have only limited influence on data processing by social network platform operators (e.g., member administration and information sharing). Where we can influence and set parameters for processing your data so that the social network platform operator acts in accordance with data protection, we take all measures at our disposal. However, in many places we cannot influence the operator's data processing, nor do we know exactly which data the operator processes.

The platform operator manages the entire IT infrastructure of the service, adheres to its own data protection rules, and has a separate user relationship with you (if you are a registered user of social network services). Additionally, the operator is solely responsible for all questions regarding your user profile data, to which we as a company have no access.

More detailed information on data processing by social network platform operators and on objection possibilities can be found in their data protection rules:

• Facebook: https://www.facebook.com/privacy/explanatios
• Instagram: https://help.instagram.com/519522125107875

2. Our responsibility

a) Purpose / legal basis of data processing:

On our social network pages, we process your data for the purpose of informing consumers about offers, products, services, promotions, sweepstakes, important information, company news, for interaction with social network visitors as well as for providing answers to questions, praise, and criticism.

We reserve the right to delete content if necessary. Additionally, we will share your data or content on our page if it represents a function of the social network platform. we also process your data for the purpose of communicating with you.

The legal basis for processing your data is Article 12 paragraph 1 point 6 of the Law (legitimate interest). Data processing is carried out in the interest of realizing our public relations and communication.

The operator cannot influence the processing of your data carried out by GEM STRATEGY for communication with consumers.

As we have already mentioned, in those places where the social network platform operator provides us with the opportunity, we take care to set up our pages in accordance with data protection.

b) Recipients / categories of recipients:

Data you entered on our social network pages, such as comments, video recordings, images, likes, public announcements, etc., are published by the platform operator, and we do not process them for any other purpose than intended at any time. we reserve the right to delete illegal content if necessary. This is the case, for example, in case of offensive or illegal posts, hate comments, comments (explicitly sexual content), or attachments (e.g., images or video recordings) which, among other things, violate copyrights, personal rights, represent a criminal offense, or violate the ethical principles of GEM STRATEGY.

We will eventually share your content on our page if it represents a function of the social network platform. we also process your data for the purpose of communicating with you. If you send us an inquiry via a social network, we can direct you to other, secure ways of communication that guarantee confidentiality. Please note that you always have the option to send us confidential inquiries via the email address listed in the general information or via the contact form.

We generally do not forward your data that you send us confidentially (e.g., private messages, correspondence, or email) to third parties. In exceptional cases, our external partners to whom we entrust certain tasks to bring the services we provide to the highest level may have access to your data. In that case, these are processors who use the data on our order. All our partners are chosen very carefully and are contractually bound to keep personal data confidential in accordance with Article 45 of the Law.

Also, there may be a need to forward part of your confidential inquiries to contractual partners (e.g., suppliers for inquiries regarding specific products) for processing your inquiry. However, in those cases, the inquiry is previously anonymized so that a third party cannot associate them with you in any way. If in an individual case the forwarding of your personal data is necessary, we will inform you beforehand and ask for your consent.

c) Retention period / criteria for determining the retention period:

All personal data provided with your inquiry (questions, suggestions, praise, or criticism) are deleted or safely anonymized at the latest within 90 days after we give you a final answer. We store your data for 90 days because in individual cases it may happen that you, as a consumer, contact us again regarding the answer to the same question and in that case, we must have the opportunity to build on previous correspondence. Experience has shown us that, as a rule, after 90 days, follow-up questions regarding our answers no longer appear.

All public posts you have placed on the page will be permanently available, unless we delete them when updating a specific topic or due to a legal violation, violation of our guidelines, or if you delete the post yourself.

We have no possibility to influence the deletion of your data by the operator itself. In that case, the data protection rules of the specific operator apply.

d) Sweepstakes (Giveaways)

Purpose / legal basis of data processing:

You have the opportunity to participate in various sweepstakes on our page, through our newsletter, on our social networks, or on the website www.reformerconcept.rs. Unless otherwise specified in a specific sweepstake, or if you have not given us another explicit consent, we will process personal data provided within participation in the sweepstake exclusively for the purpose of realizing the sweepstake (e.g., drawing/determining winners, notifying winners, sending prizes, and if needed, anonymous announcement of winners). If you use your full first and last name on a social network or are recognizable via photos on your profile, we cannot exclude your identification by other users.

The legal basis for processing your data within sweepstakes is generally Article 12 paragraph 1 point 2) (execution of contract) of the Law. in case of giving consent within the sweepstake, the legal basis for data processing is consent in accordance with Article 12 paragraph 1 point 1) of the Law. in that case, you have the right to revoke consent at any time. Withdrawal of consent does not affect the permissibility of processing carried out based on consent before the withdrawal.

Recipients / categories of recipients:

We forward data to third parties only when necessary for the realization of the sweepstake, i.e., for sending the prize (e.g., sending the prize by the sweepstake sponsor or forwarding data to a logistics company) or if you have given us explicit consent for that. Please note that in some cases participation in a sweepstake is possible on pages with public access (e.g., on a message board or via comments), so other users can publicly see the fact of your participation through your interaction with us. In such cases, others on the social network may also have knowledge of your prize. If you use your full first and last name on a social network or are recognizable via photos on your profile, we cannot exclude your identification by other users.

Retention period / criteria for determining the retention period:

After the sweepstake ends and the winners are announced, participants' personal data are deleted except for the data on winners that we are legally obliged to store when organizing a sweepstake. In case the prize is a product with a guarantee, winner data is stored during the legal right to a guarantee so that a repair or replacement can be ordered if necessary in case of a defect. When participating in a sweepstake on a social network (e.g., via a post or comment), we have no possibility to influence the deletion of your data by the operator. In that case, the operator's data protection rules apply.

e) Sending newsletters

Purpose / legal basis of data processing:

You can also sign up for our newsletter via a social network. If you have given consent for receiving our newsletter, we will process only the data of your email address and if needed your name to send you (if possible individual) information about products, promotions, sweepstakes, and news from the store offer as well as about customer satisfaction surveys. we store and process this data for the purpose of sending the newsletter. Newsletter contents include product offers, promotional discounts, sweepstakes, etc.

With your consent, we will record your behavior as a user of our page collected on www.reformerconcept.rs as well as on our newsletter. Evaluation of user behavior primarily includes the categories you navigate in on the respective page i.e. newsletter and which links you call up there. On that occasion, personalized user profiles are created linked to your personality and/or email address, so that the marketing addressing (primarily in the form of newsletters, advertising banners, and printed advertising) is as directed as possible to your personal interests and so that the advertising offer is improved.

The legal basis for the aforementioned processing of your data is your consent in accordance with Article 12 paragraph 1 point 1) of the Law.

To ensure no error occurred during email address entry, we have set up the so-called Double-Opt-In procedure: after you enter your email address in the registration field, we send you a confirmation link. Only when you click on that link is your email address entered into our mailing list.

You can revoke your consent for receiving newsletters, participating in customer satisfaction surveys, and creating personalized user profiles at any time. You can find the unsubscribe link in this text or at the end of each newsletter. By unsubscribing, we consider that you have revoked your consent for creating your personalized user profile and receiving the newsletter. we then delete your user data. Revocation does not affect the permissibility of processing carried out based on consent before the revocation.

Recipients / categories of recipients:

If external partners - data processors are engaged for sending newsletters, they are bound by a contract in accordance with Article 45 of the Law.

Retention period / criteria for determining the retention period:

If you revoke your consent for receiving our newsletter, your email address will be blocked for newsletter reception. Your data will be deleted from the appropriate mailing lists six months after that. When registering on one of the social networks, we have no possibility to influence the deletion of your data by the operator. In that case, the specific operator's data protection rules apply.

3. Joint Responsibility, Art. 43 of the Law on Personal Data Protection

There is partly a relationship with the social network operator in accordance with Art. 45 of the Law (joint responsibility):

For the web tracking methods that the social network platform operator enables, the operator and we are jointly responsible. Web tracking can thereby occur independently of whether you are logged into or registered on the social network platform. As we have already mentioned, unfortunately we can only limitedly influence the operator's web tracking methods, for example, we cannot disable them.

The legal basis for web tracking methods is Article 12 paragraph 1 point 6) of the Law (legitimate interest). A justified and legitimate interest consists in optimizing the social network platform and the specific fan page.

Other information on recipients, i.e., categories of recipients, as well as the retention period, i.e., criteria for determining the retention period, can be found in the platform operators' data protection rules. we have no influence on those rules.

Possibility for exercising your right regarding prevention of these web tracking methods can be found in the operator's data protection rules listed in point 2. On this issue, you can contact the platform operators via the operator's contact details listed in their rules.

Regarding the statistics that the social network platform operator makes available to us, we can only conditionally influence them and prevent them. But, we take care that no additional optional statistics are provided to us.

From all of the above, please be aware of the fact that it is not possible to exclude the possibility that the social network platform operator uses data from your profile as well as data on your behavior to, for example, assess your habits, personal relationships, tendencies, etc. GEM STRATEGY has no influence on the processing or forwarding of your data by the social network operator.

4. Your Rights

In accordance with Article 26 of the Law, you have the right to request information or details about the processing of your data free of charge.

Additionally, provided that the legal conditions are met, you have the right to correction (Article 29 of the Law), deletion (Article 30 of the Law) as well as the right to restriction of processing (Article 31 of the Law).

If the processing of your data is based on Article 12 paragraph 1 point 5 or 6 of the Law, you have the right to file an objection to data processing in accordance with Article 37 of the Law. If you file an objection, we will be obliged to stop processing your data, unless we show that there are legal reasons for data processing that outweigh the interests, rights, or freedoms of the persons to whom the data relate.

If you have provided your data to us yourself, in accordance with Article 36 of the Law you have the right to transfer that data to another controller. As a rule, on social networks, you can exercise that right only directly towards the social network operator, because only the operator has access to data from your profile.

If the processing of your data is based on your consent in accordance with Article 12, paragraph 1, point 1) of the Law, you have the right to revoke consent at any time. Withdrawal of consent does not affect the permissibility of processing carried out based on consent before the withdrawal.

To exercise the mentioned rights, as well as in case you have additional questions or complaints, please contact our personal data protection officer via the contact details listed in the following point of this text.

Additionally, in accordance with Article 82 of the Law, you have the right to file a complaint with the state body competent for personal data protection (Commissioner for Information of Public Importance and Personal Data Protection).

If you wish to exercise your rights regarding specific processing of your data, please contact us. we will then check your inquiry (e.g., request for information or objection) or we will, if necessary, forward it to the competent social network platform, if the subject of your request is data processing by the operator.

5. Contact of the personal data protection officer in GEM STRATEGY:

If you have any additional questions or concerns regarding the processing of your data, feel free to contact us, and we will do our best to help you.

For these purposes, the personal data protection officer in GEM STRATEGY is at your disposal and you can contact them in writing or via email: GEM STRATEGY DOO, Kralja Petra Prvog 334/k, Mladenovac, Serbia, Phone: +381 60 07 07 507, E-mail: shop@reformerconcept.rs.

YOUR RIGHTS

1. Overview

In addition to the right to revoke your consent, if legal conditions are met, you have the following rights:

• the right to information about your personal data we process, in accordance with Article 26 of the Law on Personal Data Protection,
• the right to correct incorrect or incomplete data, in accordance with Article 29 of the Law on Personal Data Protection,
• the right to delete your stored data, in accordance with Article 30 of the Law on Personal Data Protection,
• the right to restrict data processing, in accordance with Article 31 of the Law on Personal Data Protection,
• the right to data portability, in accordance with Article 36 of the Law on Personal Data Protection,
• the right to object, in accordance with Article 37 of the Law on Personal Data Protection.

2. Right to information in accordance with Article 26 of the Law on Personal Data Protection

In accordance with Article 26 of the Law on Personal Data Protection you have the right to request from us free of charge information on whether we process your personal data, access to those data, as well as information on:

• the purpose of processing;
• the types of personal data being processed;
• the recipients or types of recipients to whom the personal data have been disclosed or will be disclosed, specifically recipients in other countries or international organizations;
• the predicted retention period for personal data, or if that is not possible, the criteria for determining that period;
• the existence of the right to request from the controller ( GEM STRATEGY ) correction or deletion of personal data, the right to restrict processing and the right to object to processing; the right to file a complaint with a state body (Commissioner for Information of Public Importance and Personal Data Protection); the source of personal data (available information), if the personal data were not collected from the person to whom they relate (from you); the existence of an automated decision-making procedure, including profiling from Article 38 paragraph 1 and 4 of the Law on Personal Data Protection, and, at least in those cases, purposeful information about the logic used therein, as well as about the importance and expected consequences of such processing for the person to whom the data relate (for you).

If personal data is transferred to another country or international organization, you have the right to be informed about the appropriate protection measures relating to the transfer, in accordance with Article 65 of the Law on Personal Data Protection.

3. Right to correction in accordance with Article 29 of the Law on Personal Data Protection

You have the right to request that your incorrect personal data be corrected without unnecessary delay. depending on the purpose of processing, you have the right to supplement your incomplete personal data, which includes providing an additional statement.

4. Right to deletion in accordance with Article 30 of the Law on Personal Data Protection

You have the right to request that your personal data be deleted by us in the following cases:

• personal data are no longer necessary to achieve the purpose for which they were collected or otherwise processed;
• you have revoked consent on based on which the processing was carried out, in accordance with Article 12 paragraph 1 point 1) or Article 17 paragraph 2 point 1) of the Law on Personal Data Protection, and there is no other legal basis for processing;
• when you file an objection to processing in accordance with Article 37 paragraph 1 or 2 of the Law on Personal Data Protection, and there is no other legal basis for processing that outweighs the legitimate interest, right, or freedom of the person to whom the data relate;
• personal data have been processed unlawfully;
• personal data must be deleted to fulfill our legal obligations;
• personal data were collected in connection with the use of information society services from Article 16, paragraph 1 of the Law on Personal Data Protection.

If we have publicly released personal data, and if we are obliged to delete the data, we will take all reasonable measures, including technical measures, in accordance with available technologies and cost of their use, to inform other controllers processing those data that you have submitted a request to delete all copies of data and references, i.e., electronic links to those data.

5. Right to restrict processing in accordance with Article 31 of the Law on Personal Data Protection

You have the right to request that we restrict the processing of your personal data if one of the following cases is met:

• you dispute the accuracy of the personal data, within a period that allows us to verify the accuracy of the personal data;
• the processing is unlawful, and you oppose the deletion of the personal data and instead of deletion request the restriction of data use;
• the controller (us) no longer needs the personal data for achieving the purpose of processing, but you need them for the purpose of submitting, exercising, or defending a legal claim; or
• you have filed an objection to processing in accordance with Article 37, paragraph 1 of the Law on Personal Data Protection, and an assessment is ongoing whether the legal basis for processing by the controller (us) outweighs your interests.

6. Right to data portability in accordance with Article 36 of the Law on Personal Data Protection

You have the right to receive your personal data, which you previously provided to us, in a structured, commonly used, and electronically readable format and you have the right to transfer those data to another controller without interference from our side, if the following conditions are cumulatively met:

• processing is based on consent in accordance with Article 12 paragraph 1 point 1) or Article 17 paragraph 2, point 1) of the Law on Personal Data Protection or based on a contract, in accordance with Article 12 paragraph 1 point 2) of the same Law; processing is carried out automatically.

This right also includes the right for your personal data to be directly transferred to another controller directly from our side, provided that it is technically feasible.

7. Right to object in accordance with Article 37 of the Law on Personal Data Protection

Under the conditions from Article 37, paragraph 1 of the Law on Personal Data Protection, data processing may be subject to an objection for reasons depending on your specific situation.

The mentioned general right to object applies to all processing purposes described in these data protection rules processed based on Article 12 paragraph 1, point 6) of the Law on Personal Data Protection. Unlike the right to object to data processing for commercial purposes (see point 6), we are obliged under the Law on Personal Data Protection to apply such a general right to object only if the reasons for it are of great importance, for example, potential danger to life or health. additionally, you have the option to contact the state body competent for personal data protection or the data protection officer in GEM STRATEGY.

These personal data protection rules apply to the website www.reformerconcept.rs and to the processing of data by us as the data controller:

GEM STRATEGY DOO, Kralja Petra Prvog 334/k, Mladenovac, Serbia, MB: 20083263, PIB: 104086837, Phone: +381 60 07 07 507, E-mail: shop@reformerconcept.rs.