Privacy Policy

“Personal Data” means any data relating to a natural person whose identity is determined or determinable, directly or indirectly, particularly based on an identity marker, such as a name and identification number, location data, an identifier in electronic communication networks, or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity;

“Processing of Personal Data” means any operation or set of operations performed automatically or non-automatically on personal data or sets of personal data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction;

“Controller” means a natural or legal person, or public authority that, alone or jointly with others, determines the purposes and means of the processing;

“Processor” means a natural or legal person, or public authority that processes personal data on behalf of the controller;

“Recipient” means a natural or legal person, or public authority to whom personal data are disclosed, whether a third party or not, except for public authorities that, in accordance with the law, receive personal data in the context of a specific investigation and process this data in accordance with the rules on the protection of personal data relating to the purpose of processing;

“Consent” of the data subject means any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them;

“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed;

“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed;

The personal data that is collected, processed, and stored, depending on the purpose, includes:

• first and last name;
• residence address/delivery address (street and number, postal code, and city);
• year of birth (for the purpose of confirming adulthood in relation to the prohibition of sale, serving, and gifting of alcoholic beverages to persons under 18 years of age);
• email address;
• mobile phone number/landline phone number;
• current account number (in case of product return, when the refund is made to the current account);
• purchase data (purchased products, invoice amount, frequency of purchase);
• data from your correspondence with the seller.

Personal data is collected, processed, and stored for the following purposes:

• for registering an account on the platform;
• for confirming adulthood, in relation to the prohibition of sale, serving, and gifting of alcoholic beverages to persons under 18 years of age;
• for concluding and executing the sales contract during purchase, order processing, and delivery;
• for exercising rights: to withdraw from the contract and obtain a refund, to file a complaint, etc.;
• for providing responses to questions, requests, and complaints;
• for receiving promotional messages;
• for generating statistical reports on the use of the platform and the goods offered;

In accordance with the principle of lawfulness, we process personal data based on various legally prescribed grounds, such as the following:

-Consent

Personal data obtained based on your consent will be processed and stored in our database as long as the consent of the individual to whom the personal data relates exists, or until the possible withdrawal of consent. You can withdraw your consent for the collection, processing, and use of personal data at any time by sending an email request to: ateljevina@sapat.rs. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

-Performance of Contractual Obligations

BARIK collects personal data necessary for the conclusion and execution of the sales contract and the fulfillment of pre-contractual obligations.

-Fulfillment of Legal Obligations in accordance with the provisions of the Consumer Protection Law and the Law on Obligations, and other relevant positive legal regulations

To the extent that the processing of personal data is necessary for the fulfillment of BARIK’s legal obligations or obligations defined by various laws, the basis for processing personal data is the relevant legal regulation.

-Legitimate Interest

If the processing of Personal Data is necessary for the purpose of pursuing the legitimate interests of BARIK, namely for the purpose of preventing misuse on the platform and pursuing legal claims under the conditions provided by applicable regulations, BARIK processes certain personal data on the basis of legitimate interest (after conducting a balance of interests, BARIK has determined that its legitimate interest, in the case of protecting the platform from misuse and pursuing legal claims, outweighs the interests of the individuals whose personal data is subject to processing).

BARIK is authorized to forward personal data to its employees and personnel engaged on a work or contractual basis, affiliated companies, employees and personnel of affiliated legal entities engaged on a work or contractual basis, who must have access to and process personal data to perform their jobs, to public authorities, as well as to its collaborators and individuals who must have access to such data solely due to the nature of the work they perform.

Personal data may be transferred from the Republic of Serbia to other countries or international organizations only in accordance with the rules of the Law on Personal Data Protection (“Official Gazette of the RS”, No. 87/2018) and the General Data Protection Regulation (Regulation EU 2016/679).

The individual whose personal data is processed has the following rights:

• the right to true and complete information about the processing of their data;
• the right to access, view, and/or obtain a copy of the data relating to them;
• rights based on the performed review of the data (correction, supplementation, updating, deletion of data, as well as cessation and temporary suspension of processing);
• the right to the transfer of personal data to another controller, if technically feasible and if, according to the assessment, the necessary security standard for the transfer of personal data is ensured;
• the right to withdraw consent for the processing of their personal data;
• the right to object to the processing of their personal data;
• the right to lodge a complaint with the competent authority (The Commissioner for Information of Public Importance and Personal Data Protection);

Data that BARIK collects on the basis of the law as a legal basis must be stored for the period specified by the respective law or other positive regulation (two years from the day of exercising your legal rights or five years from the invoice issuance date).

Data that BARIK collects on the basis of a contractual relationship, BARIK will store for as long as you are a user of the platform or for five years from your last activity on our platform.

Data processed solely on the basis of your consent is stored until the consent is withdrawn or for five years from your last activity on our platform.

Data that BARIK processes on the basis of legitimate interest will be stored for two years from your last activity on our platform.

In the event that a personal data breach is likely to result in a high risk to the rights and freedoms of individuals, we are obliged to, without undue delay, inform the data subject about the breach that has occurred, all in accordance with the law.

In the event of a personal data breach that may result in a risk to the rights and freedoms of individuals, we are obliged to notify the Commissioner for Information of Public Importance and Personal Data Protection without undue delay, or if possible, within 72 hours of becoming aware of the breach.

The notification submitted to the competent authority contains all information in accordance with the law.

The data controller shall appropriately protect the personal data subject to processing from misuse, destruction, loss, unauthorized alteration, or access, and shall take all necessary technical, personnel, and organizational measures for data protection, in accordance with established standards and procedures, which are required to protect the data from loss, destruction, unauthorized access, alteration, publication, and any other misuse, as well as to establish the obligation of persons employed in processing to maintain the confidentiality of the data.

This Privacy Policy is available on our platform.

We reserve the right to change this Privacy Policy, in case of changes that significantly affect the processing of your personal data, for the purpose of monitoring changes in legislation and technical innovations. All changes will be posted and published on our platform and enter into force at the moment of publication. In this regard, we suggest that you periodically review our privacy policy. We will seek your consent for amendments to this privacy policy when required by the applicable Law on Personal Data Protection.

If you have any questions or requests regarding the processing of your personal data, please feel free to contact us at any time at the email address: ateljevina@sapat.rs