Privacy Policy

Privacy notice

Information on the rights of natural persons regarding the processing of their personal data

Introduction
Chapter I – The controller
Chapter II – The processor
Chapter III – Ensuring lawful processing
Chapter IV – Processing the data of website visitors – notice on the use of cookies
Chapter V – Rights of the data subject

Introduction

Under the Law on Personal Data Protection of the Republic of Serbia (Official Gazette of the RS, No. 87/2018, hereinafter: the Law), which is aligned with the General Data Protection Regulation of the European Union 2016/679 (GDPR, hereinafter: the Regulation), the controller must provide the data subject with all necessary information on the processing of personal data in a concise, clear, transparent, intelligible and easily accessible form, and must enable the data subject to exercise their rights.

With this notice we fulfil the obligations set out in the above regulations. The notice is published on the website of the Company and is also sent to the data subject upon request.

Chapter I – The controller

The issuer of this notice and the controller of the data:

Name: Laszlo Burany PR Rasadnik Park Plants Tornjoš
Registered office: Veliki Šor 63, 24352 Tornjoš, Serbia
Company registration number: 66105776
Tax ID (PIB): 112441855
Represented by: Laszlo Burany
Phone: +381 64 666 1622
E-mail: [email protected]
Website: www.parkplants.rs

(hereinafter: the Company)

Chapter II – The processor

A processor is a natural or legal person or public authority that processes personal data on behalf of the controller. Engaging a processor does not require the prior consent of the data subject, but the data subject must be informed of it. Accordingly, we provide the following information:

IT service provider of the Company

To operate and manage its website, the Company uses a processor providing IT services (hosting and web shop development), which, within these services and in accordance with the contract between the parties, processes the personal data entered on the website by storing it on its server.

Name: ErdSoft doo
Registered office: Somborski put 33a, 24000 Subotica, Serbia
Company registration number: 21354619
Tax ID (PIB): 110478829
Represented by: Daniel Erdudac
Phone: +381 60 44 60 555
E-mail: [email protected]
Website: erdsoft.com

Chapter III – Ensuring lawful processing

1. Processing based on the consent of the data subject

(1) Where the Company processes data on the basis of consent, it requests the consent of the data subject using a form whose content is defined in its internal data processing rules.

(2) Consent is also given when the user ticks the box requesting consent to data processing on the website of the Company, makes the relevant technical settings when using information society services, or makes any other statement or act clearly indicating agreement to the intended processing of their personal data. Silence, pre-ticked boxes or inactivity do not constitute consent.

(3) Consent covers all processing activities carried out for the same purpose or purposes. Where processing has several purposes, consent must be given for all of them.

(4) If the data subject gives consent in a written declaration that also concerns other matters (e.g. a purchase or a service contract), the request for consent must be presented in a manner clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration that infringes the regulations is not binding.

(5) The Company may not make the conclusion or performance of a contract conditional on consent to the processing of personal data that is not necessary for the performance of that contract.

(6) Withdrawing consent must be as easy as giving it.

(7) Where personal data was recorded with the consent of the data subject, the controller may, unless the law provides otherwise, process the recorded data without separate consent in order to comply with its legal obligations, including after the consent has been withdrawn.

(8) The website does not knowingly collect data of minors under 16. If we become aware that such data has been stored, it is deleted without delay.

2. Processing based on legal obligations

(1) Where processing is based on a legal obligation, the scope of the data, the purpose of processing, the retention period and the recipients are determined by the applicable regulations.

(2) Such processing does not depend on the consent of the data subject, as it is required by law. Before the data is collected, the data subject must be informed that providing the data is mandatory, and of all relevant facts about the processing: its purpose and legal basis, who carries it out, its duration, that it is carried out in accordance with the law, and who may access the data. The information must also cover the rights of the data subject and how to exercise them. In the case of mandatory processing, the information may also be provided by referring to the legal provisions containing the above information.

3. Facilitating the rights of the data subject

In all processing activities the Company is obliged to ensure that the data subject can exercise their rights.

Chapter IV – Processing the data of website visitors – notice on the use of cookies

1. Website visitors must be informed about the use of cookies, and their consent must be requested for all cookies except those that are technically necessary.

2. General information about cookies

2.1. A cookie is a piece of data that the visited website sends to the browser of the visitor for storage and that the same website can read later. Cookies may be valid until the browser is closed or for a longer period. The browser sends this data to the server with every subsequent request.

2.2. The purpose of cookies is to mark and identify the user (e.g. when entering the website) and to treat the user accordingly on subsequent visits. The risk is that the user is not always aware of being identified by cookies, which allows the website owner or other providers whose content is embedded in the website (e.g. Facebook, Google Analytics) to track the user. When tracking takes place, a profile of the user is created, and in such cases the content of the cookie is considered personal data.

2.3. Types of cookies:

Technically necessary (session) cookies: without them the website cannot function. They identify the user during the visit, e.g. what has been placed in the cart. As a rule only the session identifier is stored, while other data is kept on the server, which is more secure.
Convenience cookies: they remember the choices of the user, e.g. the selected language or display mode.
Analytics and marketing cookies: they collect information about user behaviour, clicks and time spent on the website. They are usually set by third-party applications (e.g. Google Analytics, Meta (Facebook) Pixel) and are suitable for profiling visitors.

2.4. Accepting cookies is not mandatory. In your browser settings you can choose to reject all cookies automatically or to be notified when a website sends cookies. Instructions for cookie settings can be found on the support pages of Google Chrome, Mozilla Firefox, Microsoft Edge and Apple Safari. Please note that some functions of the website may not work properly without cookies.

3. Cookies used on the website of the Company and data generated during the visit

3.1. During a visit, the website may record the following data about the visitor or the device used: IP address, browser type, operating system characteristics (configured language), time of visit, pages, functions or services visited, and clicks. This data is kept for up to 90 days and is used primarily to investigate security incidents.

3.2. Technically necessary session cookies: the purpose of processing is the proper functioning of the website, so that visitors can browse it smoothly and use all its functions, including the cart and logging in to a user account. These cookies are deleted automatically at the end of the session or when the browser is closed. The legal basis for processing is the legitimate interest of the Company in operating the website and providing the service, in accordance with the Law and the Serbian Law on Electronic Commerce.

3.3. Convenience cookies: they remember the choices of the user. The legal basis for processing is the consent of the visitor, and the purpose is more efficient service, a better user experience and more convenient use of the website. The data is stored on the computer of the user, and the website only accesses it.

3.4. Analytics and marketing cookies: they collect data about user behaviour on the website (e.g. Google Analytics, Meta Pixel). The legal basis for processing is the consent of the data subject, and the purpose is to analyse website traffic and to display promotional offers.

Chapter V – Rights of the data subject

I. Rights of the data subject in brief:

Transparent information, communication and modalities for exercising rights
Right to information where personal data is collected from the data subject
Information to be provided where personal data has not been obtained from the data subject
Right of access
Right to rectification
Right to erasure (“right to be forgotten”)
Right to restriction of processing
Notification obligation regarding rectification, erasure or restriction of processing
Right to data portability
Right to object
Automated individual decision-making, including profiling
Restrictions
Communication of a personal data breach to the data subject
Right to lodge a complaint with the Commissioner
Right to judicial remedy against a decision of the Commissioner
Right to judicial remedy against the controller or processor

II. Rights of the data subject in detail:

1. Transparent information, communication and modalities for exercising rights

1.1. The controller takes appropriate measures to provide the data subject with all information relating to processing in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information is provided in writing or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject has been proven by other means.

1.2. The controller facilitates the exercise of the rights of the data subject.

1.3. The controller provides information on action taken on a request without undue delay and in any event within 30 days of receipt of the request. That period may be extended by a further 60 days where necessary, and the data subject is informed of any such extension within the original period.

1.4. If the controller does not take action on the request, it informs the data subject without delay and at the latest within 30 days of receipt of the request of the reasons, and of the possibility of lodging a complaint with the Commissioner and seeking a judicial remedy.

1.5. Information, communication and any actions taken are provided free of charge, except in cases where the regulations allow a fee to be charged.

2. Right to information where personal data is collected from the data subject

2.1. At the time when personal data is obtained, the controller provides the data subject with the following information:

the identity and contact details of the controller and, where applicable, of its representative;
the contact details of the data protection officer, where applicable;
the purposes of the processing and its legal basis;
where processing is based on legitimate interests, the legitimate interests pursued by the controller or by a third party;
the recipients or categories of recipients of the personal data, if any;
where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation.

2.2. To ensure fair and transparent processing, the controller also provides the following additional information:

the period for which the personal data will be stored or, if that is not possible, the criteria used to determine that period;
the existence of the right to request from the controller access to, rectification or erasure of personal data, restriction of processing, the right to object to processing, and the right to data portability;
where processing is based on consent, the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal;
the right to lodge a complaint with the Commissioner;
whether the provision of personal data is a statutory or contractual requirement or a requirement necessary to enter into a contract, whether the data subject is obliged to provide the data, and the possible consequences of failure to provide it;
the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

2.3. Where the controller intends to further process the personal data for a purpose other than that for which it was collected, it provides the data subject, prior to that further processing, with information on that other purpose and any other relevant information.

3. Information to be provided where personal data has not been obtained from the data subject

3.1. Where personal data has not been obtained from the data subject, the controller informs the data subject within a reasonable period, and at the latest within 30 days of obtaining the data, of the facts listed in point 2, the categories of personal data concerned and their source, including whether the data came from publicly accessible sources. If the data is to be used for communication with the data subject, this information is provided at the latest at the time of the first communication, and if disclosure to another recipient is envisaged, at the latest when the data is first disclosed.

3.2. In all other respects the rules of point 2 apply.

4. Right of access

4.1. The data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning them is being processed, and, where that is the case, access to the personal data and the information listed in points 2 and 3.

4.2. Where personal data is transferred to a third country or international organisation, the data subject has the right to be informed of the appropriate safeguards relating to the transfer.

4.3. The controller provides a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs.

5. Right to rectification

5.1. The data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning them.

5.2. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of a supplementary statement.

6. Right to erasure (“right to be forgotten”)

6.1. The data subject has the right to obtain from the controller the erasure of personal data concerning them without undue delay, and the controller is obliged to erase the data without undue delay, where:

the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
the data subject withdraws the consent on which the processing is based and there is no other legal ground for the processing;
the data subject objects to the processing and there are no overriding legitimate grounds for the processing;
the personal data has been unlawfully processed;
the personal data has to be erased for compliance with a legal obligation of the controller;
the personal data has been collected in relation to the offer of information society services to a child.

6.2. The right to erasure does not apply to the extent that processing is necessary:

for exercising the right of freedom of expression and information;
for compliance with a legal obligation of the controller, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
for reasons of public interest in the area of public health;
for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, insofar as erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing;
for the establishment, exercise or defence of legal claims.

7. Right to restriction of processing

7.1. Where processing has been restricted, such personal data may, with the exception of storage, only be processed with the consent of the data subject, for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest.

7.2. The data subject has the right to obtain restriction of processing from the controller where:

the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify its accuracy;
the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of its use instead;
the controller no longer needs the personal data for the purposes of the processing, but it is required by the data subject for the establishment, exercise or defence of legal claims;
the data subject has objected to processing, pending the verification of whether the legitimate grounds of the controller override those of the data subject.

7.3. The controller informs the data subject before the restriction of processing is lifted.

8. Notification obligation regarding rectification, erasure or restriction of processing

The controller communicates any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data has been disclosed, unless this proves impossible or involves disproportionate effort. The controller informs the data subject about those recipients if the data subject requests it.

9. Right to data portability

9.1. The data subject has the right to receive the personal data concerning them, which they have provided to the controller, in a structured, commonly used and machine-readable format, and has the right to transmit that data to another controller without hindrance, where the processing is based on consent or on a contract and is carried out by automated means.

9.2. The data subject has the right to have the personal data transmitted directly from one controller to another, where technically feasible.

9.3. Exercising this right is without prejudice to the right to erasure and must not adversely affect the rights and freedoms of others.

10. Right to object

10.1. The data subject has the right to object at any time, on grounds relating to their particular situation, to processing of personal data concerning them that is based on the performance of a task carried out in the public interest or on the legitimate interests of the controller, including profiling. The controller then no longer processes the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

10.2. Where personal data is processed for direct marketing purposes, the data subject has the right to object at any time to processing of personal data concerning them for such marketing, which includes profiling to the extent that it is related to such direct marketing. In that case the personal data may no longer be processed for such purposes.

10.3. At the latest at the time of the first communication with the data subject, this right is explicitly brought to the attention of the data subject and presented clearly and separately from any other information.

11. Automated individual decision-making, including profiling

11.1. The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

11.2. This does not apply if the decision is necessary for entering into or performing a contract between the data subject and the controller, is authorised by law which also lays down suitable safeguards, or is based on the explicit consent of the data subject.

11.3. In the cases of entering into or performing a contract and of explicit consent, the controller ensures at least the right of the data subject to obtain human intervention, to express their point of view and to contest the decision.

12. Restrictions

The rights and obligations set out in this notice may be restricted by law, where such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society.

13. Communication of a personal data breach to the data subject

13.1. When a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller communicates the breach to the data subject without undue delay. The communication describes in clear and plain language the nature of the breach and contains at least: the name and contact details of the data protection officer or other contact point where more information can be obtained, the likely consequences of the breach, and the measures taken or proposed by the controller to address the breach, including, where appropriate, measures to mitigate its possible adverse effects.

13.2. Communication to the data subject is not required if the controller has implemented appropriate technical and organisational protection measures (e.g. encryption) that render the data unintelligible to any person not authorised to access it; if the controller has taken subsequent measures ensuring that the high risk is no longer likely to materialise; or if it would involve disproportionate effort, in which case a public communication or similar measure is used to inform the data subjects in an equally effective manner.

14. Right to lodge a complaint with the Commissioner

The data subject has the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia (Bulevar kralja Aleksandra 15, 11120 Belgrade, www.poverenik.rs) if they consider that the processing of their personal data infringes the Law. The Commissioner informs the complainant of the progress and outcome of the complaint, including the possibility of a judicial remedy.

15. Right to judicial remedy against a decision of the Commissioner

The data subject may initiate an administrative dispute before the competent court against a decision of the Commissioner. The same right applies if the Commissioner does not decide on the complaint or does not inform the data subject of its progress or outcome within the statutory period.

16. Right to judicial remedy against the controller or processor

Without prejudice to any other available remedy, including the right to lodge a complaint with the Commissioner, the data subject has the right to an effective judicial remedy if they consider that their rights under the Law have been infringed as a result of the processing of their personal data by the controller or processor in breach of the Law.

To exercise the rights described in this notice, please contact us at [email protected] or by phone at +381 64 666 1622.

Tornjoš, 20 October 2026