DATA PROCESSING NOTIFICATION RELATED TO BUSINESS PARTNERS (CUSTOMERS, SUPPLIERS, CONTRACTORS, SUBCONTRACTORS, VISITORS) AND THEIR EMPLOYEES

For the purpose of conclusion, i.e., the performance of a contract or realization of pre-contract obligations, (such as, e.g.: delivery and acceptance of an offer), both in the process of sale and purchase of goods and services and in the process of establishing other types of cooperation with you as our customer, supplier, service provider, contractor, subcontractor, visitor or associate, processing of personal data concerning you and which you, as a business partner, have  submitted to us, is based on the activities for the conclusion and / or performance of the contract in which you are a contracting party or an employed person in the capacity of an authorized representative of our business partner, and it is performed at your request.

The Purpose of Collecting and Processing Personal Data

We process the personal data of business partners and/or their employees and of potential business partners for the following purposes:

Business Communication: when you contact us or interact with us, e.g. by e-mail or by a certain application or contact form on our website and when you address us with a specific request we shall process the data you have provided to us in order to contact you and act upon your request, or in order to carry out certain activities necessary prior to the conclusion of a contract or the establishing of another form of cooperation;

Execution of contractual and legal obligations: to the extent necessary, personal data shall be processed for the purpose of fulfilling contractual obligations and realization of our rights (related to the delivery of goods, receipt of goods, performance of works, resolution of claims, and other requests, sending notifications) and for the purpose of  fulfilling legal obligations related to the keeping and storing business records, financial statements, and other accounting documents and records, of fulfilling obligations in compliance with tax regulations, for the purpose of internal or financial audit, for the purpose of reporting to state authorities in accordance with the valid regulations, for the purpose of controlling and / or responding to requests from the state authorities.

Quality control and improvement: we can ask for you for feedback on your satisfaction with our products or the services rendered by our employees.

Realization of legal requests we have towards you or the defense from your requests. We may also use your personal information to realize our rights towards you, or to defend against your requests arising out of or in connection with our business relationship.

Types of Personal Data We Collect

We collect only those personal data which are necessary to us for the realization of the stated purposes. Depending on the circumstances, that can include the following data:

Personal contact data such as: name and last name, address, electronic mail, phone number;

Data on business contacts such as: addresses of business entities, business electronic addresses and phone number;

Personal data such as: gender, date of birth and unique personal identification number, the takeover and photocopying of your documents (not for all persons, and not all the stated data),

Information on payment such as: the number of bank account and of request for compensation of costs and payments and similar for the purpose of a contract execution;

Information on the function you perform such as: jobs you do, a department, seat and competencies, in case you appear in the function of a person authorized for the signing of a contract or its execution, and other personal data which are necessary for us for the execution of our contractual obligations.

Data can be used only by the persons who have been engaged with the controller on the jobs systematized within the organizational units under whose competence is the establishment of business cooperation with business partners and who have special authorizations and access to these data, as well as the persons who make decisions on business cooperation.

Processing Sensitive Personal Data

We shall perform the processing of certain personal data which are considered as sensitive, in cases prescribed by the valid laws (such as: the occurrence of an incident for the purpose of provision of the necessary medical or other assistance, as well as in the procedure of conducting activities regarding risk and liability insurance), out of the reasons which are strictly related to the proper execution of obligations we have, in the manner and to the extent it is prescribed by the valid laws.

The Sources We Collect Personal Data From

We can collect your personal data from the following sources:

Directly from you (through forms, e-mail, phone, a cell phone, personally through a conversation with you);

From other persons (e.g. persons who are employed or in some other manner engaged by your employer with whom we have a concluded contract). In such cases, we trust that the persons who provide us with your personal data or give instructions for their processing are also authorized for that, and that they have given you all the necessary notifications, that is, obtained your approval if it is necessary;

From publicly accessible sources (e.g. the Business Registers Agency, the Real Estate Cadaster, and other publicly accessible information).

In case when you give us personal data of other persons, it is your responsibility to ensure that the person whose information you have provided to us is aware of that and that he/she accepts the manner we use those personal data.

Data Retention Period

HBIS GROUP Serbia keeps all your personal data until the expiration of the statutory retention period, that is, until the expiration of deadline necessary for the execution of the contract or until there is a legitimate interest for that, that is, a valid consent or assent. HBIS GROUP Serbia shall not keep your personal data any longer than it is necessary and legal, because it shall process them exclusively for the purposes for which it has collected the stated data.

Marketing Notifications

HBIS may also send notifications for the purpose of direct marketing.

We send such notifications only to those recipients who, considering the business relation with us, can justifiably expect a full receipt of such notifications, therefore, we have a legitimate interest for such a type of communication with you. We believe that our business partners can reasonably expect that we inform them about different events, certain novelties and/or changes and similar circumstances which might impact their business operation or they can be of some interest to them in another manner.

Also, we may contact you for the purpose of organizing entertainment and conducting certain events, surveys, market analyses and other promotional activities.

In no case shall we forward your personal data to third parties for advertising purposes or marketing needs without your assent.

Collecting Data Online

We collect only those personal data which you voluntarily give to us as visitors through the internet.

Visitors of Our Business Area

Security measures have been established in our business area, including video surveillance and access control systems for office buildings.

Notices have been displayed in visible places in our business area that the business area is under video surveillance. The recorded surveillance videos are kept in a secured place and they are accessed as needed (e.g. for the purpose of reviewing an incident that occurred). Videos are automatically deleted after a certain period of time, unless there is a different request by authorized persons (such as provision of evidence for the conducting of court and other proceedings in case of alienation of property, etc.)

The visitors and contractors check in at the “Protocol“ reception office, and the suppliers check in at the entrance gate. We keep records on all visits for a certain period of time and they are kept in a secured place and accessed as needed (e.g. for the purpose of reviewing an incident that occurred). We rely on our legitimate interest, which is to provide protection and safety of employees and of other persons in our business space.

If you have given your consent to us, you are entitled to withdraw that consent at any moment, for one or for all the previously stated processing, without stating the reason, by a written request.

Rights Related to the Protection of Your Personal Data:

Right to revoke assent – A person to whom the data refer is entitled to revoke assent at any moment. The revocation of assent does not affect the admissibility of processing which has been performed on the basis of the assent prior to the revocation. Prior to giving assent, a person to whom the data refer has to be informed about the right to revocation, as well as about the effect of the revocation. Revoking an assent has to be simple, as well as giving an assent.

Right to Access – A person to whom the data refer is entitled to request from the controller information about whether it processes its personal data and access to those data, that is, a review of those data, as well as the pieces of information regarding the purpose of processing, the types of personal data that are being processed, about the recipient or types of recipients to whom personal data have been disclosed or will be disclosed, about the stipulated  personal data retention period, or if that is not possible, about the criteria for the determination of that period, on the existence of a right to request from the controller a correction or erasure of its personal data, the right to restriction of processing and the right to a complaint on processing, the right to a copy, the right to file a complaint to the Commissioner, and about the existence of a procedure of automated decision making, including profiling.

The Right to Correction and Supplement – A person to whom the data refer has an unconditional right to a correction of incorrect and supplement of the incomplete personal data.

The Right to Erasure –   A person to whom the data refer has the right to request that his/her personal data be erased by the controller. The controller is obligated to delete the collected data without undue delay within the established time limit and in cases where personal data are no longer necessary for the realization of the purpose for which they have been collected or otherwise processed.

The Controller is obligated to notify all the recipients to whom personal data have been disclosed, of any correction or deletion of personal data or restriction of their processing in accordance with the law, unless this is impossible or requires excessive consumption of time and resources.

The Right to Processing Restriction – A person to whom the data refer is entitled to have its personal data processing restricted  by the controller if the person to whom the data refer disputes the accuracy of the personal data, within a deadline which enables the controller to check the accuracy of personal data, if the processing is illegal, and the person to whom data refer  opposes the erasure of the personal data and instead of erasure it demands the restriction of data usage, if the controller no longer needs personal data for the realization of the processing purpose, but the person to whom the data refer has requested them for the purpose of filing, realizing  or defending a legal request, if a person to whom data refer has filed an objection to be processed and the estimation about whether the legal basis for processing by the controller prevails over the interests of that person is ongoing.

The Right to Data Portability – – A person to whom the data refer is entitled to receive from the controller his/her data which he/she has previously delivered to the controller in a structured, usually used and electronically readable form and is entitled to transfer these data to another controller without obstructions by the controller to whom those data have been delivered, if the processing is based on the assent or on the basis of a contract and if the processing is performed in an automated manner. This right also includes the right of a person that his/her data are directly transferred to another controller by the controller to whom these data have been previously delivered, if that is technically feasible.