PRIVACY AND DATA PROTECTION POLICY
NOTICE ON THE PROCESSING OF PERSONAL DATA
Your privacy and protection of your data is important to us, therefore company BDS PROPERTIES DOO BEOGRAD („Company“, „BDS“ or „we“), complying with our responsibilities as the data controller regarding you as the person from whom data relating to you is collected, and at the time of collecting it, hereby provides you with the following information, all in accordance with the Law on Personal Data Protection (“Official Gazette RoS” no. 87/2018, the „Law“).
This Privacy and Data Protection Policy (“Policy”) applies to the natural person, and personal data is any data through which we can directly or indirectly identify you. All your personal data is treated as strictly confidential, and the Company and/or our trusted partners protect it adequately.
Please read carefully this Policy. In the event you do not agree to our data processing, please do not provide us with your personal data.
SUBJECT OF THIS POLICY
This Policy applies to the processing of your personal data when you:
use our webpage – https://www.tempoplus.rs („Website“) or you communicate with the Company via this Website. Please note that the processing of personal data may be connected to other activities that you perform directly related to the use of this Website;
use our user accounts on social media: (1) on Instagram user account: tempoplusretailpark, (2) on Facebook user account: Tempo Plus Retail Park, or you communicate with the Company via these user accounts;
participate in our promotions, i.e. marketing activities (e.g. signing up for the newsletter);
participate in surveys and advertising research related to the Website;
participate in our events organized in our retail parks.
THE DATA CONTROLLER DETAILS
The data controller responsible for the processing of your personal data is:
Name: BDS PROPERTIES DOO BEOGRAD
Address: Djordja Stanojevica br.35, Novi Beograd
Registration number: 21441295
TIN: 111203292
In the event of any questions or requests regarding the protection of your personal data, you can contact us via e-mail address: zaštitapodataka@bdsproperties.rs, or in a written form on the above-mentioned registered address.
PERSONAL DATA PROCESSED, PURPOSES AND LEGAL BASIS OF PERSONAL DATA PROCESSING
Personal data of the Website users: When you visit Website the browser you use on your device will automatically, and without your activity, send the following data to the server of our Website: the IP address of the device from which the request was sent and which has access to the Internet, the date and time of access, the name and URL of the downloaded file, the Internet page/application from which it is accessed (referrer URL), the browser you use and, if necessary, the operating system of a computer that supports the Internet, and the name of your provider.
The server temporarily saves the above stated data in a log file and for the following purposes: ensuring the undisturbed connection, ensuring the comfortable use of our Website and evaluating the security and stability of the system. The data is stored temporarily during the visit to the Website and then is automatically deleted.
The legal base for processing your data is Article 12 paragraph 1 point 6) of the Law (legitimate interest), arising from the aforementioned purpose of data processing.
Personal data of the social media users – The Company process your personal data on their social media accounts in accordance with this Policy in order to inform users about the work of retail parks and Company, promotions, important information, news, then for the purpose of interacting with social media users, as well as for the purpose of answering questions, praises and criticism and for the purpose of communicating with visitors of retail parks.
Personal data processing is performed for the purpose of communication, i.e. for interaction and improving relations with users.
The legal base for processing your data is Article 12 paragraph 1 point 6) of the Law (legitimate interest).
Please note that we have limited influence on the processing of personal data by the operators of social network platforms (e.g. member administration and information sharing), nor do we have information on all the personal data processed by operators.
Please note that, where we can influence and adjust parameters for personal data processing, we will make all measures at our disposal so that the operator of the social network platform acts in accordance with data protection. However, the operator’s data processing cannot be influenced in many places, and we do not have complete knowledge of the data being processed. The platform operator manages the entire IT infrastructure of the service, adheres to its own data protection rules and has a special user relationship with you (if you are a registered user of social media). Furthermore, the operator is solely responsible for all personal data on your user profile, which we are unable to access.
You may find more detailed information about personal data processing on social media and about possibilities of objection in this respect in data protection rules of the social media operators. Data that you have entered on our social media accounts, such as e.g. comments, videos, pictures, likes, public notices, etc. are published by the platform operator, and at no time do we process them for any other purpose than intended. We also process your data for the purpose of communicating with you.
Advertising and other activities: For realization of marketing purposes, personal data will be processed solely with your consent (e.g. in the event you signed up for a newsletter, and other). In the event you gave consent to receive the newsletter via e-mail, SMS, Viber, and/or to receive other marketing material with information on active promotions and offers in retail parks, we use the following personal data: your identification data (name and surname), contact data (e-mail address, i.e. phone number), your consent, the date and time of giving it, withdrawal of consent.
We process and keep the above-mentioned personal data for the purpose of sending the marketing activities, sending newsletters and/or other marketing material, including promotions (offers, promotions, etc.).
When sending advertising messages, newsletters and/or other advertising material, the legal base for personal data processing is your consent in accordance with Article 12 paragraph 1 item 1) of the Law.
You may withdraw your consent for receiving newsletters/advertising materials at any moment. Processing carried out on the basis of consent before withdrawal will not be affected by the withdrawal. Unsubscribing from the newsletter list on our website can be done to achieve this. You may find the newsletter unsubscribed link at the end of each newsletter, and you may unsubscribe from Viber or SMS directly through the Viber application or SMS message, if you have given your consent for this type of notification. In the event of consent withdrawal, we will delete your personal data. Please note that we may engage external partners in order to perform these services (sending newsletters/Viber/SMS) and thus your personal data may be transferred to those people (data on e-mail address and the phone number).
Surveys, market research and other internal analysis – We may use the data in order to communicate with you in the process of carrying out customer satisfaction surveys regarding the Website for the purpose of analysis, quality improvement and service development, such as: identification data, contact information (phone number and email address), data related to your opinion on our services and your expectations from a provider of such services, your feedback about the campaigns we run.
In the event you want to participate in one of our surveys/questionnaires, such participation is voluntary. With anonymous surveys, we do not store personal data that allows us to conclude who the survey participant is. We only store the date and time of your participation. We consider any personal data that you have given us via the survey as a voluntarily given, and we store it in accordance with the provisions of the Law.
In the event you gave us consent for participation in one of our surveys, the legal base for personal data processing is your consent in accordance with Article 12 paragraph 1 item 1) of the Law.
In this event, you may withdraw your consent at any time. Processing carried out on the basis of consent before withdrawal will not be affected by the withdrawal.
By providing personal data, the user of the Website understands and agrees with the fact that the security, integrity and privacy of his personal data cannot be 100% guaranteed, even though the Company continuously takes all optimal measures to protect them.
Other personal data provided by user: We process those personal data provided voluntarily from you when visiting Website/social media user accounts, as well as personal data resulting from our communications, which may include the following personal data: identification data (name and surname) and contact information (phone number and e-mail address).
We process your personal data in accordance with the established purpose, and so to respond to your inquiry based on your interest and provide you with the required information in more detail.
The legal base for processing your data is Article 12 paragraph 1 point 6) of the Law (legitimate interest).
Our and at the same time your (legitimate) interest in this personal data processing is the need to answer your questions, or if it is necessary to solve existing problems to ensure your satisfaction as a user of our Website/social media user accounts.
Personal data on people participating in our events: We may process your personal data when you decide to participate in one of our events. The personal data we may process are your identification data (name and surname, identity-related data, photos, videos), contact information, information related to participation in the event (your specific request).
Data processing is carried out for the purpose of organizing our events, including the approval of access to the event, preparation of relevant necessary documents/materials related to the event, communication of all relevant information related to the event, promotion of the event.
The legal base for processing your data is Article 12 paragraph 1 point 6) of the Law (legitimate interest).
Our (legitimate) interest in this personal data processing is the need to organize the event and communicate all relevant information about the event towards you, the event organization, to provide appropriate documentation/materials or some other resources to the participants, to ensure the safety of persons and property.
We may use your images (photo/video), your feedback or some other data related to the promotion of our events (for example, your interests, your opinions about the event, etc.).
The legal base for processing your photos/videos is your consent in accordance with Article 12 paragraph 1 point 1) of the Law.
In this event, you may withdraw your consent at any time. Processing carried out on the basis of consent before withdrawal will not be affected by the withdrawal.
In the event you do not want to appear in the photos/videos of the event, you have the option to contact the photographer directly.
DISCLOSURE OF PERSONAL DATA
We consider your personal data confidential, therefore we protect it in accordance with legal requirements and best practice. Within our Company, only those organizational units, i.e. those employees who need personal data to fulfill the purpose for which the data were collected, have access to the data. We will process your personal data ourselves, while third parties have the right to access and process your personal data solely in the following events:
Our reliable partners, i.e. legal entities with whom we cooperate in business and who help us in regular business, such as people who develop and maintain IT solutions and platforms, servers, as well as persons who provide you with services on behalf of the Company, e.g. for marketing purposes. In this event, those legal entities process your personal data exclusively for our needs. These service providers, in accordance with the concluded agreements, are obliged to use the personal data entrusted to them exclusively in accordance with our instructions, and strictly for the purpose we have determined, with the obligation to adequately protect your personal data and to keep it confidential;
Entities with whom we have business cooperation e.g. tax advisors, accountants, insurance companies, lawyers and other consultants, when we evaluate it is necessary to protect our certain legitimate interests. In this event, those entities process your personal data exclusively for our needs;
Competent authorities monitor the legality of business, and actions, as well as other legal entities when it is necessary to perform some of our legal duties, e.g. auditors. In this event, those legal entities process your personal data for the purpose assigned to them by law;
Other parties in connection with business transactions such as e.g. sale and purchase of the company/part of the company, reorganization, merger, joint venture or any other type of disposal of our company or property. In addition, there may be a need to forward part of your query to our contractual partners (e.g. tenants, etc.), for the purpose of its processing. However, in those events, the query is previously anonymized, so that a third party cannot relate them to you. If in an individual event the transfer of your personal data is necessary, we will inform you beforehand and ask for your consent. Third parties are limited in their ability to use your personal data for any purpose other than those specified and are obliged to protect and process your personal data in accordance with legal, regulatory and contractual obligations. All legal entities with whom we cooperate have been selected carefully and, when required by law, they are contractually obligated to keep personal data confidential, in accordance with Article 45 of the Law.
PERSONAL DATA TRANSFER TO OTHER COUNTRIES
In some events, we may disclose your personal data, i.e. transfer them to other countries in accordance with the Law. When we do this, we transfer your data to servers located in the EU or in a country that provides an adequate level of protection in accordance with the legislation of the Republic of Serbia. Access will be allowed only to a limited number of people, i.e. authorized people exclusively for maintaining the functionality of the server.
PERSONAL DATA PROTECTION
Some of the measures to protect personal data are:
Application of modern protection methods and access control to data sources containing personal data;
Access restriction to sensitive data, as well as restriction of user accounts that can have access to certain data by introducing a system of roles and authorizations that will ensure that only certain employees (who need access to personal data for the performance of their work) may have access to and process the relevant personal data;
Continuous monitoring of all resources (physical spaces where your personal data is stored) used to process personal data. The purpose of implementing the above measures is to prevent the risk of destruction, loss, alteration, unauthorized disclosure or access to your personal data.
We require the use of appropriate protection measures from third parties who have the right to access and process your personal data. All personal data is stored on our server in the Republic of Serbia. Please note that the above safeguards do not apply to information or data that you choose to share publicly through social media or messaging applications.
Please note that by accepting this Policy, you agree the Company cannot guarantee absolute safety, security, integrity and confidentiality of personal data, and if the Company has taken all available measures at the time, we will not be responsible for the loss/destruction/disclosure of personal data.
DATA RETENTION PERIOD
We plan to retain your personal data for as long as necessary to fulfill the intended purposes or legal obligations (if applicable).
Upon fulfillment of the purpose, i.e. upon termination of the retention period defined by law, personal data will be permanently deleted.
YOUR RIGHTS
If you choose to exercise one or more of your rights below, we have the right to verify your identity in order to protect your personal data. Your rights are accomplished for free. Exceptionally, if your request is clearly unfounded or excessive (e.g. you ask for personal data that you yourself own), especially if the same request is repeated frequently, we have the right to charge the necessary costs of processing your request or to refuse to process your request.
Please send all questions and requests related to your rights in written form to the address specified in the section – “THE DATA CONTROLLER DETAILS“.
We shall respond to your request without delay and no later than one month, except in the event the complexity of the individual request requires an extension of the specified period. In order to protect you as the personal data owner, you need to identify yourself in an appropriate manner as the applicant, so that it represents a guarantee to the Company that it provides personal data to its owner.
Right of access – You have the right to be informed about the fact if we are processing your personal data, the right to access to personal data, and the right to be informed of data processing in accordance with Article 26 of the Law.
The right to rectify incorrect data, amend, erase and restrict of processing personal data – You have the right to ask for rectification of your incorrect personal data, as well as the right to amend, erase or restrict the processing of your personal data.
The right to data portability – You have the right to receive and transmit your personal data.
The right to withdraw consent and oblivion – You have the right to withdraw consent for processing of your personal data, as well as to demand to permanently delete all personal data we have been processed upon your consent.
The right to object against the processing of your personal data – You have the right to object to the processing of your personal data or to object to our practice of personal data processing in general. You may submit your request by e-mail to the address specified in the section “The Data Controller Details”, with the title “Complaint against data processing” and explaining in the subject of the e-mail the reason for the complaint and your request.
The right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection – You have the right to lodge a complaint before the competent data protection authority – Commissioner for Information of Public Importance and Personal Data Protection (https://www.poverenik.rs/).
COOKIES
We use cookies and similar technologies to ensure that you get the most out of our Website, to collect information about how you use the Website and to track your online behavior. The type of information collected may include the origin of the Website visitor or email recipient, the type of browser, operating system and search engine used, and the duration of the visit to the Website or email message. For more information about how we use cookies and similar technologies and how you can control them, please see our Cookies Notice posted at the bottom of the Website.
LINKS TO OTHER SITES
The Website may contain links to third party websites. We do not assume responsibility for any control over these sites, relationship with these sites or approval of these sites and will not be liable for any damages resulting from the content of these sites. Links to other sites are provided only as a convenience, and we encourage you to read the Terms of Use and Privacy Statements of those third-party sites.
AMMENDMENTS TO THIS POLICY
The Company has the right to amend this Policy at any time. Each amendment will take effect from the date of publication on the Website or in another adequate manner. We suggest you regularly check the Policy section so that you can have the latest information.
In Belgrade, on date 07.03.2025.