1. GENERAL DATA AND DATA ON THE DATA PROCESSING OFFICER

Please carefully read the Privacy Policy. By using the Valuator platform, you agree to the Privacy Policy and confirm that you have read, and understood the terms under which we process your personal data and accepted the Privacy Policy.

The data processing officer for personal data when using our platform is Valuator Ltd. Belgrade, located at Veljka Dugosevica 54, Belgrade, registration number: 21729540, VAT: 112737776 (hereinafter referred to as "Valuator" or “We").

Valuator respects and protects the privacy of each person (natural persons - users of the platform, potential users, or other persons), hereinafter referred to as "person" or "you", whose personal data is collected and processed (hereinafter referred to as "personal data"). The collection, processing, and storage of personal data by Valuator are carried out in accordance with the Law on Personal Data Protection (Official Gazette of the Republic of Serbia No. 87/2018) (hereinafter referred to as "the Law”).

As we are aware that privacy is important to you and in order to protect the privacy of the person whose personal data we collect, we have adopted and published this Privacy Policy, which defines which personal data we collect, how, and for what purpose we process them, how we protect them, how long we keep them, and finally, what are your rights in relation to your personal data. In this regard, the Privacy Policy presents our practice in relation to the collection of personal data, whether we collect them directly from you, from third parties, during your visit to our platform, through your written or oral communication with us, or from other sources. In any case, if you have any questions or doubts, feel free to contact us at any time at the email address: dpo@valuator.rs

2. BASIC CONCEPTS

"Personal data" refers to any information related to a physical person whose identity is determined or determinable, directly or indirectly, particularly by reference to a name, identification number, location data, an electronic identifier, or one or more physical, physiological, genetic, mental, economic, cultural, or social identifiers;

"Processing of personal data" refers to any action or set of actions performed with personal data or sets of personal data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

"Controller" refers to a physical or legal person, or public authority, who alone or jointly with others determines the purposes and means of the processing of personal data;

"Processor" refers to a physical or legal person, or public authority, who processes personal data on behalf of the controller;

"Recipient" refers to a physical or legal person, or public authority, to whom personal data is disclosed, whether or not the third party, except for authorities which may receive data in the framework of a particular investigation under the rules laid down by the legislation on the protection of personal data;

"Consent" of the data subject refers to any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which he or she, by a statement or by clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

"Personal data breach" refers to a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed;

"Sensitive data" refers to data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, or data concerning a natural person's sex life or sexual orientation.

We do not collect your sensitive data unless you make it available to us voluntarily or if we are required to do so by applicable laws.

"Personal data of children" refers to individuals under the age of 15.

We do not collect the personal data of children.

3. PRINCIPLES FOR PROCESSING PERSONAL DATA

Please note that we always, when collecting, processing, and storing your personal data, act in the following manner:

Personal data will be processed legally, fairly, and transparently in relation to the person to whom the data relates ("lawfulness, fairness and transparency”);
Personal data will be collected for the specific purposes outlined in this Privacy Policy, which are explicit, legitimate, and lawful and will not be further processed in a way that is not in accordance with those purposes ("purpose limitation”);
Personal data will be adequate, relevant, and limited to what is necessary in relation to the purpose for which they are processed ("data minimization”);
Personal data will be accurate and, where necessary, kept up to date. To this end, we will take all reasonable measures to ensure that inaccurate personal data is erased or rectified without delay (“accuracy”), we kindly ask you to always inform us of any changes to your personal data;
Personal data will be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the data are processed ("storage limitation”);
Personal data will be processed in a manner that ensures appropriate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical, organizational, and personnel measures ("integrity and confidentiality”).

4. PERSONAL DATA COLLECTED AND PROCESSED BY VALUATOR

The personal data we collect, process, and store are as follows:

name and surname;
email address;
mobile phone number/landline number;
other personal data mentioned in the Cookies Policy available on the Platform.

5. METHOD OF COLLECTION OF PERSONAL DATA

Personal data is collected directly from you, as the person to whom the data relates, or by other individuals.

Direct collection of personal data from the person to whom the data relates:

during the registration of your account on our platform

To register your account, it is necessary for you to fill out the Registration Form, which is available on our platform. The personal data we process in this case are: name and surname, contact telephone number, email address, and other personal data specified in the Cookies Policy available on the Platform.

Name, surname, contact telephone number, and email address, as personal data, that is necessary to disclose for the purposes of registering your account on our platform are necessary and we will use them exclusively for the purposes of account registration and establishing communication, while the same data - email address can also be used for the purposes of sending notifications about the latest products, discounts, and promotions, if you allow us to, which of course, is not mandatory.

The purpose for which we process necessary personal data, in this case, is the registration of your account on the platform, which ultimately allows you to use the Valuator platform for procurement management in your company.

The purpose for which we process the above data as optional is to send notifications about offers, news, additional information, current events, events, promotions that we organize, loyalty programs, etc. In this case, if you agree to disclose personal data that is not necessary, it will be considered that you have given us your consent for the processing of personal data for the aforementioned purposes.

Necessary personal data is stored in our database until the end of your account's activity on the Valuator platform, while optional personal data is stored until the revocation of your consent or until the end of your account's activity on the Valuator platform. All personal and optional data is deleted after deactivating your account on the Valuator platform or after submitting a request for deletion of personal and optional data from the Valuator platform.
upon subscribing to the newsletter

Upon subscribing to the newsletter, you give us consent to collect and process your email address (your personal data) for the purpose of sending newsletters.

The purpose of processing this personal data is to send notifications about offers, news, additional information, current events, events and promotions that we organize, loyalty programs, etc.

This personal data is stored in our database until you revoke your consent. You can revoke your consent at any time by revoking your consent within the email we sent you, which allows you to revoke your consent (uncheck the checkbox).
upon contacting our employees

When you contact our employees (by phone, email, or through social networks) for answers to various inquiries, you give Valuator consent to collect your following personal data: name and surname, email address, mobile phone number/landline number, and other personal data specified in our Cookie Policy available on the Platform.

The purpose of processing this personal data is to establish communication with you to provide answers to your inquiries.

This personal data is stored in our database until you revoke your consent or submit a request to delete personal data from the Valuator platform.
upon visiting our Platform

Upon visiting our Platform, in certain cases, we collect and process your personal data through cookies. On the other hand, there are cookies that do not collect your personal data. To learn more about this, please visit our Cookie Policy.

Personal data provided by other individuals

There are cases when you provide us with personal data of third parties, i.e. when we do not collect personal data from the person to whom the data relates:
1. upon registering potential suppliers on your account
  
  As a registered user of the Valuator platform, you will enter certain personal data related to your business partners, or suppliers, which are: name and surname, contact phone number, email address, and other personal data listed in the Cookie Policy available on the Platform for the person responsible for procurement at your supplier. In this case, we will consider that you are authorized by the person to whom the data relates for such action, or that you have consent for such action, and in no case do we assume responsibility for the processing of third-party personal data. The purpose for which we process personal data, in this case, is to enable the use of the Valuator platform for procurement management in the agreed-upon time frame.
2. Social login
  
  It may happen that you reveal your personal data to LinkedIn, Facebook, or Google, according to the terms of use and privacy policies of these third parties, and that these third parties transfer personal data to the new controller, Valuator, in a structured, commonly used and electronically readable form. Since the transfer came from third parties, according to their terms of use and privacy policies, we will consider that you have given consent to these third parties to transfer personal data to us. Furthermore, from the moment we receive data from these third parties, we will consider ourselves the controller and we will be solely responsible for the further processing of personal data.
  
  The personal data that is transferred to us by Facebook and Google, according to their terms of use and privacy policies, is the following: email address.
  
  The purpose for which we process this personal data is to register your account on the platform.
  
  The personal data will be kept in our database until you revoke your consent, and if you do not revoke your consent, it will be deleted after five years from your last activity on your account.

6. PURPOSE OF COLLECTION AND PROCESSING OF PERSONAL DATA

The purpose of collecting personal data is:

To conclude and implement the contract for the use of the Valuator platform for public procurement management;
To comply with the legal obligations of the company, i.e. to implement your legal rights;
To register your account on our platform;
To respond to your inquiries or various requests;
To improve the functioning of our platform and our services;
To send notifications about special and personalized offers, news, updates, news and events we organize, promotions, loyalty programs, participation in contests;
Other purposes defined in the Cookie Policy.

7. LEGAL BASIS OF PERSONAL DATA PROCESSING

We process your personal data on the basis of various, legally prescribed, grounds, such as the following:

Your consent

Your personal data obtained on the basis of your consent will be processed and stored in our database, as long as there is your consent, or until the eventual withdrawal of your consent. You can revoke consent for the collection, processing, and use of your Personal data at any time by revoking consent within the email you received from us, which allows you to revoke consent (uncheck the check box), as well as through an electronic request to the email address dpo@valuator.rs

Please note that the revocation of consent does not affect the permissibility of the processing of personal data carried out on the basis of your consent prior to the revocation.
Performance of contractual obligations

The company collects personal data that is necessary for the conclusion and execution of the contract for the use of the Valuator platform for public procurement management.
Compliance with legal obligations under the provisions of the Consumer Protection Law and the Law on Obligations

To the extent that the processing of your personal data is necessary for the compliance with legal obligations of the company, or obligations defined by various laws, the basis for processing your personal data is the relevant legal regulation.
Legitimate interest

In some situations, we will have a legitimate interest in processing your data, such as when processing is necessary to prevent fraud or potential abuses.

8. DISCLOSURE AND THIRD PARTIES

We disclose and share personal data with certain recipients or third parties, such as our employees, marketing companies, communication services or market research or customer satisfaction companies, IT service providers, and government authorities. Additionally, in order to enable the functioning of the platform, in certain cases we engage other companies and individuals to perform tasks on our behalf and on our account (sending mail and email, providing marketing assistance, keeping records of couriers, and tracking shipments, Payment service providers) ... These third parties have access to the personal data necessary to perform the tasks for which they are engaged, but they must not use them for other purposes (if they use them for other purposes, they will be considered independent controllers).

The company will not make your personal data available to other recipients or third parties, except in the cases specified in this Privacy Policy.

9. DATA RETENTION PERIOD

Data that Valuator collects on the basis of the law as a legal basis, is obliged to keep for as long as the particular law or other positive regulation determines.

Data that Valuator collects on the basis of a contractual relationship, Valuator will keep until your last activity on our platform.

Data that is processed solely on the basis of your consent, will be kept until the withdrawal of consent or until your last activity on our platform.

10. RIGHTS OF INDIVIDUALS IN RELATION TO THE PROCESSING OF PERSONAL DATA

In addition to the rights already mentioned in this Privacy Policy, and other rights provided for by Law and other regulations in accordance with the Law, the person to whom the data on personality relates has the right:

to request information on whether Valutor processes his/her personal data and to request access to that data

At the request of the individual, we will provide information about the personal data of the individual that we process or our processors, in accordance with our instructions, about the purpose of processing personal data, the legal basis and duration of the processing, the name and address of the processor and its activities related to processing, the circumstances and impact of a personal data breach, and the measures taken to eliminate it, and, in case of data transfer, information about the legal basis of such transfer and the recipient.

We will provide a written statement to you in the shortest possible time, after you submit the request, but no later than 15 days from the date of receipt of the request, in a language that is easy to understand. The written statement will be provided free of charge, unless the request is obviously unfounded or excessive, especially if it is repeatedly submitted. In that case, we may charge necessary administrative costs for providing the written statement or processing the request or we may refuse to process the request.

We are obliged to provide the individual to whom the personal data relates, upon his/her request, with a copy of the personal data we process. We may require reimbursement of the necessary costs for creating additional copies that the individual requests. If the request for a copy is submitted electronically, the information is provided in the commonly used electronic form, unless the individual to whom the data relates has requested otherwise.
to request correction, addition, or deletion of his/her data and the right to object to data processing

The individual has the right to request that their inaccurate personal data be corrected without undue delay. Depending on the purpose of processing, the individual has the right to supplement their incomplete personal data, including by providing additional statements.

The individual has the right to request that their personal data be deleted by Valuator.

We are obliged to delete personal data without undue delay if:
- the personal data is no longer necessary for the purpose for which it was collected or otherwise processed,
- the individual has withdrawn their consent on which the processing was based, and there is no other legal ground for the processing,
- the individual has objected to the processing,
- the personal data has been processed unlawfully,
- the personal data must be deleted in order to comply with a legal obligation,
- the personal data has been collected in relation to the use of information society services as defined by law
to submit a complaint to the Commissioner for Information of Public Importance and Personal Data Protection
the right to portability of personal data

The individual to whom the personal data relates has the right to receive personal data that they have previously provided to us in a structured, commonly used and machine-readable format and has the right to transmit those data to another controller without hindrance from us if the following conditions are met:
- the processing is based on consent or a contract;
- the processing is carried out by automated means.
the processing of personal data is restricted

Valuator may restrict the processing of personal data in the following cases:
- the individual disputes the accuracy of personal data, for a period enabling us to verify the accuracy of personal data;
- the processing is unlawful, and the individual opposes the erasure of personal data and requests the restriction of their use instead;
- we no longer need the personal data for the purposes of the processing, but the individual requires the data for the establishment, exercise or defence of legal claims;
- the individual has objected to processing pursuant to Article 37(1) of the Law, and it is being verified whether the legitimate grounds of the controller override those of the individual.
We are obliged to inform all recipients to whom personal data has been disclosed of any correction, amendment, or deletion of Personal Data or limitation of their processing in accordance with the Law or if the request would involve disproportionate effort and resources. We are obliged to inform the person to whom the data relates, upon their request, of all recipients.

If it is deemed justified in relation to the specific situation in which it finds itself, the person to whom the data relates has the right to object at any time to the processing of his/her personal data in accordance with the Law.

The person to whom the data relates has the right that a decision made solely on the basis of automated processing, including profiling, not be applied to him/her if that decision produces legal effects or significantly affects his/her position.

11. PROCEDURE IN CASE OF VIOLATION OF PERSONAL DATA

If a violation of personal data may result in a high risk to the rights and freedoms of the person, we are obliged to inform the person to whom the data relates of the violation that has occurred, without undue delay, and all in accordance with the Law.

In case of personal data violation that may result in a risk to the rights and freedoms of the person, Valuator is obliged to inform the Commissioner for Access to Public Information and Protection of Personal Data without undue delay, or if possible within 72 hours of becoming aware of the violation.

The notice sent to the competent authority contains all information in accordance with the Law.

12. TRANSFER OF PERSONAL DATA OUTSIDE THE TERRITORY OF THE REPUBLIC OF SERBIA

The transfer of personal data to another country or international organization without prior authorization can be carried out if it is established that the other country/international organization provides an appropriate level of protection of personal data. In this regard, the Decision on the list of countries, parts of their territory or one or more sectors of activities in these countries and international organizations in which it is considered that an appropriate level of protection of personal data is provided ("Official Gazette of the Republic of Serbia", No. 55/2019) (hereinafter: "Decision") establishes where it is considered that an appropriate level of protection of personal data is provided.

Companies that Valuator transfers personal data to use Cloudteh public cloud servers located in France, which have been determined by Decision to provide an appropriate level of protection for personal data, making the transfer free.

13. LINKS TO THIRD-PARTY WEBSITES AND SERVICES

Our platform may contain links to third-party websites and/or platforms (Banks, Electronic money institutions, Internet payment service providers, credit card organizations, etc.). Please note that we are not responsible for the collection, use, maintenance, sharing, or disclosure of data by third parties. If you provide information on third-party websites and use those websites, the privacy policies and terms of use of those third parties will apply. We recommend that you read the privacy policies of the websites you visit before submitting personal data.

By clicking on our sponsored ad on Facebook, LinkedIn, Google or Instagram, or another advertising platform, you accept the possibility that data about your visit to our platform may be processed by the aforementioned social networks if you have an account with them. To avoid this situation, we recommend that you log out of your user accounts on these social networks before clicking on the link on our platform to visit our platform on any of the aforementioned social networks.

14. CONFIDENTIALITY OF PERSONAL DATA AND TRANSPARENCY

Your personal data will be treated as confidential information and we will take appropriate necessary measures to protect them in accordance with the Law. Access to them will be available only to those individuals who, in view of the job they perform, need to be familiar with your personal data and only to the extent necessary for the performance of their jobs.

This Privacy Policy is available on our platform. If we decide to change our Privacy Policy, the changes will be posted and published on our platform.

If you have any questions or requests regarding the processing of your personal data, feel free to contact us at any time at email dpo@valuator.rs.

Your Valuator

Contact