Data protection policy

We hereby inform you about the processing of your personal data and your rights under the Law on the Protection of Personal Data ("Službeni glasnik RS" br. 87/2018).

The responsibility for data processing lies with the company Autokomerc Logsitika doo.

In order to achieve the processing purposes defined below, we process personal data that the client directly submitted at the time of submitting his/her request and other personal data that the client voluntarily submitted to us or that we already have within the current business relationship. Such data can theoretically be classified into the following categories:

identification data: last name, first name, gender, ID number, ID card series and number, date and place of birth, citizenship, nationality, etc.

Contact information: residential address/postal address, email address, landline number, mobile number, etc.

Contract data related to products and services purchased from Autokomerc Logistika doo

Data on professional reputation: data on the level of education, profession, occupation, name of employer, nature of own activity, public position held by the person, political exposure (if such a case is involved);

Data on financial standing: income, individual employment contract number, pension file number;

Data on family status: civil status, number of minor children, type of apartment

Banking data: account number (IBAN), transaction details and/or history, card number

Vehicle identification and/or usage data: license number, chassis series, location, GPS data, etc.

In certain situations, with regard to the fulfillment of the scope of processing resulting from the client's request, the personal data we process, in addition to his/her personal data, may also refer to the following categories of data subjects: clients' ordering parties and/or legal or conventional representatives, client's contact persons, clients' proxies or beneficiaries, co-debtors, guarantors, real owners or family members, beneficiaries of the client's insurance policy, beneficiaries of the client's payment operations. Their personal data is taken from the documentation for the beginning and/or execution of the contractual relationship with the client, and Autokomerc doo does not have the practical possibility to provide direct notification of such persons about the processing of their personal data. In that case, the client is obliged to inform the respective data subjects about the processing and the scope, i.e. the purpose of the processing of their personal data, related to him/her.

In the submitted documents, please do not make available to us categories of data of a special nature, such as, for example, data on membership in labor unions, data on your political opinions or religious beliefs, data on your state of health, etc.

Legal basis for data processing

For the purpose of concluding or executing a contract or for the realization of pre-contractual formalities, such as, for example: issuing an offer, purchasing a vehicle, using the services of our service, etc. In that case, the processing is based on the execution of the contract in which you are a contracting party and/or the necessary formalities in terms of the conclusion of the given contract, at your request.

We are under a legal obligation to process and store your data in accordance with the requirements to know our customers by applying all measures to identify the customer, as well as the ability of the customer as a beneficial owner and/or politically exposed party. We also have a legal obligation to keep special documentation to inform clients in accordance with the law on prevention and control of money laundering and financing of terrorism.

Your data is also processed and stored in order to fulfill the legal obligation to maintain documentation and storage: for the purpose of managing finances and accounting, in accordance with tax legislation; for the purpose of internal audit or financial audit; for the purpose of reporting to authorities according to current regulations; for the purpose of control and/or response to the requests of authorities, data security in systems and documents, as well as physical security in our premises.

In order to fulfill the purposes, i.e. the scope of processing per item, your data is sent to our service providers, who act as processors, and act strictly according to the documented instructions they received from us.

Depending on the case, your data may also be forwarded to the following recipients/categories of recipients, in order to fulfill our legal obligations, pursue legitimate interests in connection with the collection of claims or exercise and defend our rights and interests or if we have your consent:

To the Ministry of Finance - Tax Administration - Why: Legal obligation;

To the recipients of your payments, the Recipient's banks, SWIFT - Why: To execute payment instructions and fulfill legal obligations regarding the automatic execution of interbank commercial payments:

To insurance companies - Why: to be able to issue insurance policies;

Autokomerc Logstika doo, in the Republic of Serbia - Why: Obligations of reporting and internal audit;

Judicial authorities, i.e. courts, the prosecution, as well as the police, the Municipal Police, JP Putevi Srbije in case of unpaid tolls on the highway and other competent holders of public authority - Why: If it is necessary to defend and realize any legal rights and interests or to fulfill legal obligations.

We store your data only for the duration and as long as it is necessary to achieve the aforementioned scope of processing or if there is a legal obligation to do so. For data processing that requires your consent, the data will be processed and stored until the date of withdrawal of consent.

If we have concluded a contract with you (on purchase, lease or other contract in the field of our business), we will respect the legal obligations to store relevant data and documentation, as follows:

• I) Personal data of employees are kept for 10 years after the end of the contractual relationship;
• II) Personal data of our clients contained in all supporting documents accompanying registrations and financial accounting are stored in the company archives for 10 years from the date of the end of the financial year in which the accompanying documentation was prepared in accordance with the internal rules for keeping accounting documents.

• III) within the framework of the defense and exercise of our legal rights, your data necessary for the exercise of these rights are stored in accordance with the general time limits.

Your data protection rights:

Right to revoke consent - The data subject has the right to revoke consent at any time. Revocation of consent does not affect the admissibility of processing that was carried out on the basis of consent before the revocation. Before giving consent, the person to whom the data refer must be informed about the right to revocation, as well as the effect of revocation. Withdrawing consent must be as simple as giving consent.

Right of access - The person to whom the data refers has the right to request information on whether his personal data is being processed, access to that data, as well as information on the purpose of the processing, on the types of personal data that are processed, on the recipient or types of recipients to whom the personal data has been disclosed or will be disclosed to them, on the anticipated period of storage of personal data, or if this is not possible, on the criteria for determining that period, on the existence of the right to request from the operator the correction or deletion of his personal data, the right to limitation of processing and the right to object to processing, on the right to submit a complaint to the Commissioner, and on the existence of an automated decision-making procedure, including profiling.

Right to deletion - The person to whom the data refers has the right to have his personal data deleted by the operator, who is obliged to delete the collected data without undue delay within the period stated above and in cases where the personal data are no longer necessary to achieve the purpose (execution of the employment contract) for which they were collected or otherwise processed.

Obligation to notify regarding correction or deletion of data, as well as restriction of processing - the operator is obliged to inform all recipients to whom personal data has been disclosed about any correction or deletion of personal data or restriction of their processing in accordance with the law, unless this is impossible or requires excessive expenditure of time and resources.

The right to restriction of processing - The person to whom the data refers has the right to have the processing of his personal data restricted by the operator if the person to whom the data refers disputes the accuracy of the personal data, within a period that allows the operator to check the accuracy of the personal data, if the processing is illegal, and the person to whom the data refers opposes the deletion of the personal data and instead of deletion requests the restriction of the use of the data, if the operator no longer needs the personal data to achieve the purpose of the processing, but the person to whom the data refers has requested them in for the purpose of submitting, realizing or defending a legal claim, if the person to whom the data refer has submitted an objection to the processing, and it is being assessed whether the legal basis for the processing by the controller outweighs the interests of that person.

The right to data portability - The person to whom the data refers has the right to receive his/her personal data previously submitted to the operator in a structured, commonly used and electronically readable form and has the right to transfer this data to another operator without interference, if the processing is based on consent or on the basis of a contract and if the processing is automated. This right also includes the right of a person to have his personal data directly transferred to another operator by the operator to whom this data was previously provided, if this is technically feasible.

The right to object - If he considers it justified in relation to his particular situation, the data subject has the right to object to the processing of his personal data at any time. The controller is obliged to stop processing the data of the person who filed the complaint, unless he has presented that there are legal reasons for the processing that prevail over the interests, rights or freedoms of the person to whom the data refer or are related to the submission, realization or defense of a legal claim. The data subject has the right to object at any time to the processing of his personal data that is processed for the purposes of direct advertising, including profiling, to the extent that it is related to direct advertising. If the data subject objects to the processing for the purposes of direct advertising, the personal data may not be further processed for such purposes.

Automated individual decision-making and profiling - The person to whom the data refers has the right not to apply to him a decision made solely on the basis of automated processing, including profiling, if that decision produces legal consequences for that person or that decision significantly affects his position. This right does not apply if the decision is necessary for the conclusion or execution of a contract between the data subject and the controller.

The right to complain to the Commissioner - The person to whom the data refer has the right to file a complaint

Commissioner for information of public importance and protection of personal data

street Bulevar kralja Aleksandra 15, 11120 Belgrade

Phone +381113408900, e-mail: office@poverenik.rs

if he believes that the processing of his personal data has been carried out contrary to the provisions of the Personal Data Protection Act. Filing a complaint to the Commissioner does not affect the right of this person to initiate other administrative or judicial protection procedures.

In order to fulfill the above requirements, we will be permitted to request additional information that is necessary to verify your identity. After your identification, we will respond to your request forwarded in terms of exercising the above-mentioned rights, within a maximum of one month from the date of receipt of the request.

To exercise the aforementioned rights, you can submit a written application (i) by email to the address:

Appointed person for the protection of personal data.

• Vlada Milošević
• vlada.milosevic@autokomerc.rs
• +381 63 353 171