Controller

The controller responsible for the processing of personal data of Website users (hereinafter: Users) is:

Tesoro d.o.o. Bijeljina
Production, Trade and Services Company

Agrotržni centar, Lamela B, Unit No. 15
76000 Bijeljina
Registration No.: 01878107
Tax ID No.: 4400384850009
Email: tesoro@psfashion.ba

Types of Personal Data

Tesoro d.o.o. Bijeljina processes the personal data provided by Users when visiting the Website. Depending on the purpose of the intended processing, the personal data collected may include:

• first and last name;
• email address;
• password;
• residential address;
• date of birth;
• gender;
• occupation;
• purchase-related information (including payment details, purchased products, orders, product returns, etc.); and
• contact information (landline or mobile phone number).

As a general rule, Tesoro d.o.o. Bijeljina collects only the personal data that Users voluntarily provide and that are necessary for the specific purpose of processing.

An exception may apply to data collected through cookies and other tracking technologies, as explained in more detail in the Cookie Notice, available here.

Purpose of Processing Personal Data

Tesoro d.o.o. Bijeljina collects and processes personal data for the following purposes:

• managing registered user accounts;
• performing sales contracts;
• handling customer requests (including product exchanges, withdrawal from a sales contract, and product complaints);
• sending newsletters (periodic SMS, Viber, and email communications) to users who have opted in to receive information related to their interests;
• providing information about products from the Tesoro d.o.o. Bijeljina product range;
• personalising the user experience;
• improving the Website and tailoring its content to users' needs;
• conducting promotions, competitions, surveys, and other Website-related activities;
• responding to users' inquiries, questions, and other requests; and
• improving the services provided by Tesoro d.o.o. Bijeljina.

Any User who provides Tesoro d.o.o. Bijeljina with the personal data of third parties warrants that such third parties have been informed that their personal data will be used and that they have consented to the purpose and manner of its processing.

Legal Basis for Processing Users' Personal Data

Depending on the purpose of collection and processing, the legal basis for processing Users' personal data may include:

• the User's consent;
• the performance of a contract or the provision of a requested service;
• compliance with legal obligations requiring the processing of personal data; and/or
• the legitimate interests of Tesoro d.o.o. Bijeljina.

Legitimate interests include processing necessary for managing and maintaining the contractual relationship, responding to specific requests, obtaining customer feedback to improve the Website and products, and carrying out general marketing activities, provided that such interests are not overridden by the User's interests, fundamental rights, and freedoms, or the rights and freedoms of the data subject, particularly where the data subject is a minor.

Tesoro d.o.o. Bijeljina considers its legitimate interests to include those situations in which a User interested in its products could reasonably expect the collection and processing of personal data in the ordinary course of business, as well as situations where processing is necessary without the User's explicit consent.

Tesoro d.o.o. Bijeljina will always seek to obtain the User's consent before processing personal data whenever possible and will rely on legitimate interests only where necessary and in the User's best interests.

Personal data such as first and last name, email address, password, residential address, date of birth, gender, occupation, and contact information (landline or mobile phone number), collected when creating a user account on the Website, are processed on the basis of the User's consent and/or the legitimate interests of Tesoro d.o.o. Bijeljina.

When creating an account on the Website, the processing of personal data is necessary for the management of the User's registration. In this context, Tesoro d.o.o. Bijeljina may, based on its legitimate interests, process the User's personal data on the grounds that, by registering or using the Website, the User has expressed an interest in future offers. Accordingly, Tesoro d.o.o. Bijeljina may retain a record of products in which the User has expressed an interest or which the User has purchased.

When purchasing products through the Website, creating a user account is required. For this purpose, Tesoro d.o.o. Bijeljina collects the following personal data: first and last name, email address, password, residential address, date of birth, gender, occupation, and contact information (landline or mobile phone number). The legal basis for processing these personal data is the performance of a contract, the fulfilment of contractual obligations, and the User's consent.

Personal data collected for the purpose of responding to Users' inquiries or requests, such as first and last name, email address, telephone number, and postal code, are processed on the basis of the User's consent whenever they contact Tesoro d.o.o. Bijeljina, in order to respond appropriately to their request.

Tesoro d.o.o. Bijeljina requests the User's consent before sending newsletters. If a User chooses to subscribe to newsletters, Tesoro d.o.o. Bijeljina collects personal data such as the User's email address and telephone number. Users may unsubscribe at any time by selecting the "Unsubscribe" option included in every newsletter. Once a User unsubscribes, Tesoro d.o.o. Bijeljina will no longer send such communications or process the User's personal data for this purpose.

Tesoro d.o.o. Bijeljina may retain the personal data of a User who has withdrawn their consent solely for the purpose of demonstrating that the processing carried out prior to the withdrawal of consent was lawful and in compliance with applicable legislation.

Retention Period for Personal Data

Tesoro d.o.o. Bijeljina stores and retains Users' personal data only for as long as necessary to fulfil the specific purpose of processing, namely:

• Personal data processed for the purpose of managing a User's Website account are retained for as long as the User remains registered on the Website.
• Personal data processed for the performance of a sales contract relating to products purchased by the User are retained for as long as necessary to complete the sale, including the time required to process requests for withdrawal from the sales contract or product exchanges, unless the User expressly requests the deletion of such data before the expiry of the applicable retention period, in which case the data will be pseudonymised.
• Personal data processed for handling product complaints are retained for as long as necessary to resolve the complaint.
• Where a User contacts Tesoro d.o.o. Bijeljina, the personal data provided are retained for the period necessary to process the inquiry or until the User requests their deletion.
• Personal data processed for the purpose of sending reminders, notifications, or direct marketing communications are retained until the User unsubscribes or withdraws their consent.
• Personal data collected through cookies are retained for as long as they serve their intended purpose.

Tesoro d.o.o. Bijeljina may retain Users' personal data beyond the above-mentioned retention periods where necessary for the fulfilment of legal obligations, the protection of its legal rights (before courts or other competent authorities), compliance with applicable legislation, or for statistical and record-keeping purposes.

Tesoro d.o.o. Bijeljina will permanently delete all personal data that are no longer required for any of the lawful processing purposes described above from its storage systems.

Who Has Access to Users' Personal Data

Depending on the purpose of processing specified in this Privacy Policy, and only to the extent necessary to fulfil that purpose, Users' personal data may be accessed by employees of Tesoro d.o.o. Bijeljina, its external associates, and trusted third parties providing services related to its business operations, including:

• marketing agencies;
• IT service providers, including providers of hosting services, server infrastructure, platform support, database maintenance, software, and applications;
• companies providing product delivery services (postal operators and courier services); and
• customer support service providers.

All such recipients are required to conduct their business in compliance with the Law on Personal Data Protection and to implement appropriate technical, organisational, and personnel measures to safeguard Users' personal data.

Where Tesoro d.o.o. Bijeljina acts as the data controller and a third party processes personal data on its behalf as a data processor, the parties shall enter into a separate Data Processing Agreement governing all essential aspects of the processing of personal data. Such third parties are required to provide a level of protection for Users' personal data equivalent to that provided by Tesoro d.o.o. Bijeljina.

Users' personal data may also be disclosed to competent public authorities where Tesoro d.o.o. Bijeljina is required to do so by law, in accordance with applicable regulations, or where such disclosure is necessary to protect its rights and interests or the rights and interests of its customers.

Users' Rights Regarding the Personal Data We Process

Tesoro d.o.o. Bijeljina is committed to treating Users' personal data as confidential and ensuring that Users are able to exercise the rights granted to them under the Law on Personal Data Protection.

Users have the following rights regarding the processing of their personal data:

• Right of access – Users have the right to receive clear, transparent, and easily understandable information about the purposes of processing, the categories of personal data being processed, the recipients or categories of recipients to whom the personal data have been or will be disclosed, the envisaged retention period of the personal data, and to obtain a copy of the personal data being processed.
• Right to rectification and/or completion – Users have the right to request the correction of inaccurate or outdated personal data and the completion of incomplete personal data.
• Right to erasure – Users have the right to request the deletion of their personal data where such data are no longer necessary for the purposes for which they were processed or where Tesoro d.o.o. Bijeljina is no longer legally permitted to process them.
• Right to object and lodge a complaint – Users have the right to object to the processing of their personal data by submitting an objection directly to Tesoro d.o.o. Bijeljina or by lodging a complaint with the competent Personal Data Protection Authority.
• Right to restriction of processing – Users may request the restriction of the processing of their personal data at any time.
• Right to withdraw consent – Users may withdraw their consent to the processing of personal data based on consent at any time.
• Right to data portability – Users have the right to obtain their personal data from the records of Tesoro d.o.o. Bijeljina for the purpose of transferring them to another data controller.

To exercise any of the above rights (except for lodging a complaint with the competent authority), Users may:

• complete and submit the Request for the Exercise of Rights Related to the Processing of Personal Data through the Website or at any Tesoro d.o.o. Bijeljina retail store; or
• send the completed request, or a request in free form, by email to tesoro@psfashion.ba, or by post to:

Tesoro d.o.o. Bijeljina
Agrotržni centar, Lamela B, Unit No. 15
76000 Bijeljina
Bosnia and Herzegovina

Use of Cookies

Tesoro d.o.o. Bijeljina uses cookies whenever a User interacts with the Website.

Cookies are text files stored on the User's device (computer and/or mobile phone) during a visit to the Website. When the User revisits the Website, Tesoro d.o.o. Bijeljina retrieves the information stored in these cookies.

Tesoro d.o.o. Bijeljina uses cookies required for the proper functioning of the Website, as well as cookies provided by several third-party services. These cookies enable certain Website functionalities, facilitate access to content and its use through other online services, and support marketing activities.

For example, when Users browse, read, or download information from the Website, Tesoro d.o.o. Bijeljina may collect and store information such as the name of the web browser used to access the Website, the type of device, operating system, domain name, IP address, the date and time of access, the referring web pages, and other similar technical information.

Cookies provide Users with a better, more accessible, and more personalised browsing experience. They also enable Tesoro d.o.o. Bijeljina to analyse customer behaviour, monitor Website traffic, and improve its marketing activities.

Users may disable cookies at any time by choosing whether to allow their storage on their device. Cookie preferences can be managed through the settings of the User's web browser or by selecting the appropriate options when visiting the Website.

For more information about cookies, please refer to our Cookie Notice.

Acceptance of the Privacy Policy

Users are encouraged to read this Privacy Policy when accessing the Website.

By using the Website, Users acknowledge that they have read, understood, and accepted the terms of this Privacy Policy. If a User does not agree with these terms, they should refrain from using the Website.

Changes to the Privacy Policy

Tesoro d.o.o. Bijeljina reserves the right to amend this Privacy Policy at any time. The date of the latest revision will be indicated at the end of the Privacy Policy.

Users will not receive individual notifications of such changes. To remain informed about how their personal data are protected and to stay aware of any updates, Users are encouraged to review this Privacy Policy periodically.

Continued use of the Website following any amendments to this Privacy Policy constitutes acceptance of the revised Privacy Policy.

Contact

For any additional information or clarification regarding this Privacy Policy or the processing of personal data, Users may contact us by email at:

tesoro@psfashion.ba

Bijeljina, 29 March 2021

Tesoro d.o.o. Bijeljina