Privacy
Policy

1.1

This Privacy Policy (hereinafter: "Policy") describes how the entrepreneur Anđelka Nikolić PR Trgovina putem pošte ili interneta CosmoPaw Beograd, with its registered office at Svetozara Radića 2, Belgrade-Savski Venac, registration number: 68545862, Tax Identification Number (PIB): 115674133 (hereinafter: "We", "Us", "Our" or "Controller"), as the data controller, collects, processes, uses, and protects your personal data when you use our website cosmo-paw.com (hereinafter: "Site") and purchase our products.

1.2

Protecting your privacy is our highest priority. All personal data processing activities are conducted in accordance with the applicable Law on Personal Data Protection ("Official Gazette of RS", No. 87/2018) (hereinafter: "LPDP"), the European Union's General Data Protection Regulation (GDPR), and other applicable regulations.

1.3

This Policy is an integral part of our General Terms of Use and Sale. By accepting the General Terms, you confirm that you are familiar with and agree to the provisions of this Policy.

1.4

For any questions regarding the processing of your personal data, you can contact us via email at: office@cosmo-paw.com.

When processing your personal data, we strictly adhere to the fundamental principles prescribed by Article 5 of the LPDP:

• Lawfulness, fairness, and transparency: We process data lawfully, fairly, and in a transparent manner in relation to you.
• Purpose limitation: We collect data for specified, explicit, and legitimate purposes and do not further process it in a manner that is incompatible with those purposes.
• Data minimisation: We process only data that is adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed.
• Accuracy: We take all reasonable steps to ensure that the data we process is accurate and, where necessary, kept up to date.
• Storage limitation: We keep data in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
• Integrity and confidentiality: We apply appropriate technical, organisational, and personnel measures to ensure an appropriate level of security of the data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage.

We collect and process different types of personal data depending on your interaction with our Site.

3.1

User account creation and management

• Types of data: Full name, email address, password (in an encrypted, hashed form).
• Purpose: To enable the creation and management of your user account, personalize your user experience, facilitate future purchases, and provide an overview of your order history.
• Legal basis: The processing is necessary for the performance of a contract for the provision of account registration services, in accordance with Article 12, paragraph 1, item 2) of the LPDP.

3.2

Order processing and fulfilment (purchase)

• Types of data: Full name, delivery address (street and number, city, postal code), phone number, email address, details of the ordered products and transaction amount.
• Purpose: To process and deliver your order, communicate with you regarding the order status, process payments, issue invoices, handle complaints, and manage withdrawal requests.
• Legal basis: The processing is necessary for the performance of a distance sales contract, in accordance with Article 12, paragraph 1, item 2) of the LPDP, and to comply with the Controller's legal obligations (e.g., issuing fiscal receipts, maintaining complaint records), in accordance with Article 12, paragraph 1, item 3) of the LPDP.

3.3

Sending marketing communications (newsletter)

• Types of data: Email address.
• Purpose: To send you information about new products, promotional offers, sales, discounts, and other marketing activities.
• Legal basis: Your explicit and unambiguous consent, in accordance with Article 12, paragraph 1, item 1) of the LPDP. You may withdraw your consent at any time by clicking the "unsubscribe" link provided in every newsletter or by sending a request to our contact email.

3.4

Communication and customer support

• Types of data: Name, email address, phone number (if you contact us by phone), and the content of your message/inquiry.
• Purpose: To respond to your questions, address your requests, provide customer support, and resolve any potential issues.
• Legal basis: Our legitimate interest to communicate effectively with existing and potential customers and to provide adequate support, in accordance with Article 12, paragraph 1, item 6) of the LPDP.

3.5

Data collected automatically (cookies)

• Types of data: IP address, browser type and version, operating system, usage data (pages visited, time spent, clicks), location data (at the city/region level).
• Purpose: To ensure the basic functionality of the Site, improve user experience, analyse traffic, enhance our services, and ensure system security.
• Legal basis: For necessary cookies required for the Site to function, the legal basis is our legitimate interest (Article 12, paragraph 1, item 6) of the LPDP). For all other cookies (analytical, statistical, marketing), the legal basis is your explicit consent (Article 12, paragraph 1, item 1) of the LPDP), which you provide via a clearly displayed cookie management banner on your first visit to the Site. See our Cookie Policy.

We treat your personal data as a business secret and do not sell or rent it to third parties. We may share your data only with trusted partners (who act as "processors" under the LPDP) who assist us in our business operations, and only to the extent necessary to achieve the processing purpose. All our processors are contractually obligated to protect your data, apply appropriate security measures, and use it exclusively in accordance with our instructions and the provisions of Article 45 of the LPDP.

The categories of recipients are:

• Courier services: For the delivery of your orders (we share name, surname, address, and phone number).
• Payment service providers: For processing payments. Please note that we do not collect, store, or have access to your payment card data; it is entered directly on the secure (encrypted) page of the payment service provider.
• IT service providers: Companies that provide us with hosting, Site maintenance, analytics, newsletter distribution, and technical support services.
• Government authorities: We may disclose data to competent government authorities (e.g., tax administration, market inspection, court, prosecutor's office) exclusively based on their legally founded and formal request.

Your data is primarily processed and stored on servers located in the Republic of Serbia or within the European Economic Area (EEA). If we exceptionally use service providers whose servers are located outside the EEA (e.g., for certain analytics or cloud services), we will ensure that such transfers are carried out with appropriate safeguards in accordance with Articles 64 and 65 of the LPDP. This most often involves concluding Standard Contractual Clauses approved by the European Commission and recognized by the Commissioner of the Republic of Serbia.

We retain your data only for as long as is necessary to fulfill the purpose for which it was collected, or as long as required by law, in accordance with the storage limitation principle (Article 5, paragraph 1, item 5) of the LPDP):

• Order and invoice data: Retained in accordance with the deadlines prescribed by tax and accounting regulations (as a rule, 5 or 10 years from the end of the business year).
• User account data: Retained as long as the account is active. If you request the deletion of your account, the data will be anonymized or deleted, except for data we are legally obliged to retain (e.g., data on previous orders).
• Newsletter data: Retained until you withdraw your consent. Upon withdrawal, your email address is permanently deleted from our marketing database.
• Communication data: Retained for as long as necessary to resolve your inquiry, and at most until the expiration of the general statute of limitations for initiating legal proceedings.

In accordance with the LPDP, you have the following rights regarding your personal data, which you can exercise by sending a request to the email address office@cosmo-paw.com:

• Right of access (Article 26 LPDP): The right to request information on whether we process your data, to gain access to that data, and to obtain a copy of the data we process.
• Right to rectification and completion (Article 29 LPDP): The right to request the correction of inaccurate or completion of incomplete personal data.
• Right to erasure ("right to be forgotten") (Article 30 LPDP): The right to request the deletion of your data if it is no longer necessary for the purpose of processing, if you have withdrawn the consent on which the processing was based, if you have objected to the processing, or if the data has been unlawfully processed.
• Right to restriction of processing (Article 31 LPDP): The right to request the restriction of processing if you contest the accuracy of the data, if the processing is unlawful and you oppose erasure, or if you have filed an objection to the processing.
• Right to data portability (Article 36 LPDP): The right to receive the data you have provided to us in a structured, commonly used, and machine-readable format and to transmit it to another controller, where the processing is based on consent or contract and is carried out by automated means.
• Right to object (Article 37 LPDP): The right to object to processing based on a legitimate interest, and an unconditional right to object to processing for direct marketing purposes.
• Right to withdraw consent: If processing is based on consent, you have the right to withdraw it at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
• Right to lodge a complaint with the Commissioner: The right to file a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (address: Bulevar kralja Aleksandra 15, Belgrade) if you believe that the processing of your personal data has been carried out contrary to the provisions of the LPDP.

We will respond to your request to exercise your rights without delay, and at the latest within 30 days of receiving the request. This period may be extended by an additional 60 days if necessary, of which we will inform you (Article 21 LPDP).

We implement all necessary and modern technical, organisational, and personnel security measures to protect your data from accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, in accordance with Article 50 of the LPDP. These measures include, but are not limited to, data encryption during transmission (SSL/TLS), access control, pseudonymisation where appropriate, and regular testing and assessment of the effectiveness of security measures.

Our Site and services are not intended for persons under the age of 15. We do not knowingly collect personal data from minors. In accordance with Article 16 of the LPDP, for processing in the context of using information society services (such as our Site), consent is valid if given by a person who is at least 15 years old. For persons under the age of 15, the consent of a parent or guardian is required. If we suspect that we are processing the data of a person under the age of 15 without appropriate consent, we will take steps to delete that data.

We reserve the right to update this Policy from time to time to align with changes in regulations or our business practices. Any changes will be published on this page with a new effective date. We recommend that you regularly review this page to stay informed of any changes and to always know what data we collect and how we use it.