privacy-policy-en

PRIVACY POLICY

In accordance with the provisions of the Law on Personal Data Protection (“Official Gazette of RS”, No. 87/2018) (hereinafter: the Law), DOO PIONIR INTERNACIONAL BEOGRAD (hereinafter: the Company/Data Controller) informs you about the purpose and legal basis for the collection and processing of your personal data, the types of data we process, data recipients, how they are stored, as well as your rights regarding processing and how you exercise them.

The subject of this Policy are data about participants in games of chance, visitors to the internet presentation, our business partners and their representatives and employees, as well as visitors to the Company’s profiles on social and professional networks. The subject of this Policy are not data about job applicants at the Company nor about Company employees, as these categories of persons are separately informed about the conditions for collecting and processing their personal data.

1. Definitions of Key Terms

For a better understanding of this Policy, we use the following definitions:

• Personal Data – means any information relating to an identified or identifiable natural person, directly or indirectly.
• Processing of Personal Data – means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means.
• Usage Data – is data collected automatically either through the use of the internet presentation or the website infrastructure (for example, the duration of a page visit).
• Cookies – are small files stored on your device (computer or mobile device).

2. Data Controller Information

The identity and contact details of the Data Controller are:

• Name: DOO PIONIR INTERNACIONAL BEOGRAD
• Registered Office Address: Bulevar Mihajla Pupina 6/22, Novi Beograd, Beograd
• Registration Number: 08350167
• Email: dpo@pionirdoo.rs
• Phone Number: + 381 21 661 5395

3. Data Protection Officer Information

The contact details of the Data Protection Officer are:

• Email: dpo@pionirdoo.rs
• Phone Number: + 381 64 8298137

4. Purpose and Legal Basis for the Intended Processing of Personal Data

The Company collects and processes your personal data for the following purposes and on the basis of the following legal grounds:

4.1. Purposes of Processing

• For participants in games of chance:
  • Organizing games of chance and conducting the Company’s activities.
  • Monitoring players’ needs and activities to increase the Company’s competitiveness.
  • Informing players about promotional and other Company activities, for the purpose of Company advertising.
  • Awarding prizes.
  • Fulfilling the Company’s legal obligations.
  • Ensuring the security of people, property, and the information system.
• For business partners and other persons:
  • Receiving your request and considering the fulfillment of conditions for concluding a cooperation agreement with the Company.
  • Preparation and conclusion of agreements, as well as preparation of proposals for amendments and supplements to concluded agreements.
  • Fulfilling contractual and legal obligations regarding the concluded agreement and undertaking activities for the purpose of establishing business cooperation.
  • Calculating debts and issuing invoices
  • .Collecting our receivables and settling our payables.
  • Conducting court, out-of-court, administrative, and other proceedings before state authorities, arbitrations, and third parties.
  • Internal reporting for the Company and the Gauselmann group of companies to which the Company belongs.
  • Organizing celebrations, seminars, and other events and undertaking other activities to ensure loyalty of business partners.
• For visitors to the Company’s internet presentation:
  • Enabling the operation and maintenance of the presentation.
  • Notifying about changes to our presentation.
  • Enabling participation in interactive functions of the website, should you choose to do so.
  • Providing customer support.
  • Producing analysis and obtaining significant information to improve website performance.
  • Monitoring the use of our presentation.
  • Detecting, preventing, and resolving technical issues.
  • Delivering information, special offers, and data about other products, services, and events we offer, similar to those you already use or have shown interest in, if you have given consent for direct advertising.
  • Using remarketing services (e.g., Google Ads, Bing Ads) for advertising on other entities’ internet presentations, based on previous visits to our website. For this purpose, we use cookies for informing and optimizing and publish ads based on previous visits to our presentation. You can disable these options and learn more about them at the following links:
    • Google Ads (AdWords) http://www.google.com/settings/ads https://tools.google.com/dlpage/gaoptout https://policies.google.com/privacy?hl=en
    • Bing Ads Remarketing https://advertise.bingads.microsoft.com/en-us/resources/policies/personalized-ads https://privacy.microsoft.com/en-us/PrivacyStatement
  • For participants in promotional activities (street surveys, quizzes):
    • Recording and publishing video content on social networks (e.g.,
    • YouTube channel…) for promotional purposes, based on your consent.

The Company may process your data for other purposes if the conditions prescribed by law, contract, or your consent are met. When personal data is processed for a purpose different from that for which it was collected, before further processing, when required by Law, the Company will provide you with all information about that other purpose and all information mentioned in this Policy.

4.2. Legal Basis for Processing

• Contract – processing is necessary for the performance of a contract to which you are party with the Company or for taking steps at your request prior to entering into a contract.
• Legal Obligation – processing is necessary for compliance with a legal obligation to which the Data Controller is subject, e.g., from the Law on Prevention of Money Laundering and Terrorist Financing, the Law on Games of Chance, as well as other valid regulations of the Republic of Serbia.
• Consent – processing is carried out based on your consent for one or more specific purposes. Examples include consent to data collection when using an internet presentation, consent for direct advertising, or verbal consent to participate in video recording (e.g., street surveys, quizzes) which is recorded on the recording itself. You have the right to withdraw consent at any time, which will not affect the lawfulness of processing based on consent before its withdrawal.
• Legitimate Interest – processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data, especially if the data subject is a child.

5. Types of Personal Data Collected and Processed

The Company collects and processes the following categories of personal data, depending on the purpose of processing and the category of persons:

• Data collected for the purpose of preventing money laundering and terrorist financing:
  • Name and surname.
  • Date and place of birth.
  • Residence or domicile.
  • JMBG (Unique Master Citizen Number).
  • Type and number of personal document; name of issuer, date and place of issue.
  • Purpose and nature of the business relationship, as well as information on the client’s activity and business operations.
  • Information on political exposure.
  • Date and time of transaction execution; amount and method of transaction.
  • Data and information on the origin of assets that are or will be the subject of a business relationship or transaction.
  • Information on the existence of reasons for suspicion of money laundering or terrorist financing.
  • Data on the entire assets of officials (from publicly available and other sources, as well as directly from the client). In addition, the Company is obliged to regularly monitor business operations and verify the compliance of client activities with the nature of the business relationship and the usual scope and type of client business.
• Player data:
  • Data necessary for making deposits and withdrawals (payment card and personal document data, contact details, account number, and business bank details).
  • Data on the use of Company services, visits, games played, deposits and withdrawals, and gaming habits, preferences, and needs, as well as customer interest in Company products and services.
  • Special categories of personal data, such as data on problematic gaming habits indicating gambling addiction.
• Winner data:
  • Name and surname, residential address, ID card number, and JMBG.
• Contact data for marketing:
  • Contact data (email address, phone number) for the purpose of delivering marketing or promotional materials and other information about the Company’s activities, products, and services, if you have given consent.
• Website Usage Data and Cookies:
  • Information on how the internet presentation is accessed and used (e.g., IP address, browser type and version, presentation pages visited, time and date of visit, time spent on those pages, unique device identifiers, number of clicks, and other diagnostic data).
  • Website visit statistics (https://www.merkurxtip.rs/) which may contain IP address, type of internet visitor, domain names, access time, internet pages from which access was made, and similar data.
  • Cookies:
    • Strictly Necessary Cookies – enable access and navigation through the website and the use of its features.
    • Functionality Cookies – enable the use of the presentation and services in accordance with the decisions you make (e.g., remembering username and how the page is used).
    • Analytical Cookies – enable the Company and third parties to collect aggregated data for statistical purposes on how visitors use the internet presentation (do not contain personal data).
    • Social Media Cookies (Facebook, Twitter, etc.) – enable tracking of social media users when they visit our website, use our services, or share content from our presentation.
  • “Web beacons” (or “tracking pixels”) in emails, which serve to confirm the opening of email messages and clicks on links or advertisements.

The useo of afore mentioned data is regulated in Details in the Cookie Policy.

• Data on clients, potential clients, legal representatives, proxies, and authorized persons:
  • Name, surname, contact details, and position in the company or relationship with the client.
  • Data from concluded contracts and accompanying documentation, on all products and services you use with the Company, on data contained in invoices.
• Data on former Company employees:
  • Data that the Company, in accordance with applicable regulations, is obliged to keep permanently for the purpose of realizing rights arising from mandatory social and pension insurance.
• Data collected by video surveillance and identification:
  • Data collected during identification upon entry into Company premises.
  • Security camera recordings in certain Company premises for the purpose of protecting people and property.
• Data from judicial and other proceedings:
  • Data you or your proxy provided during the procedure, as well as data related to proceedings initiated by the Company against clients or other persons.
• Other data:
  • Data you provided in direct contact with employees or other engaged persons in the Company, orally or in writing.
• Data collected during promotional activities (street surveys and quizzes):
  • Video and audio recording (likeness and voice), as well as answers given during participation, recorded with your verbal consent.

The Company does not collect data about minors. In activities such as recording public surveys and quizzes, the Company takes measures to verify adulthood (e.g., by asking an elimination question about age) to ensure that minors’ data is not collected. If you are a parent or guardian of a minor and have knowledge that your child has provided us with personal data, please inform us. Upon learning of the collection of personal data of minors without parental consent, we will take all necessary measures to remove such data from our servers.

6. Information on the Existence of a Legitimate Interest for Processing

The Company may perform data processing activities for the purpose of realizing its legitimate interests or the interests of a third party, unless those interests are overridden by the interests or fundamental rights and freedoms of the data subject that require personal data protection, especially if the data subject is a minor.

Examples of such processing are:

• Processing for the purpose of ensuring the security of people, property, and the information system (e.g., video surveillance, access control to Company premises and systems).
• Collection of receivables.
• Internal reporting.
• Improving the performance of the Company’s internet presentation.

7. Information on the Recipient, or Group of Recipients, of Personal Data

Recipients of your data may be:

• Employees and engaged persons by the Company or members of the Gauselmann group, specifically a limited number of persons who require your data to perform their work tasks.
• Persons to whom the Company has entrusted the performance of certain processing actions and activities (Processors), based on a concluded agreement and the guarantees of these persons that they apply appropriate technical, organizational, and personnel measures that ensure data protection. Examples: specialized agencies for archiving documentation or maintaining the internet presentation.
• Authorized state bodies and other authorized persons upon request, in cases provided by applicable regulations (courts, prosecution, police, enforcement officers, public notaries, Gambling Administration, Administration for the Prevention of Money Laundering). Security camera recordings may be provided exclusively upon request from the police, courts, and prosecution. Transactions of 15,000 Euros and more are reported to the Administration for the Prevention of Money Laundering.
• Lawyers and debt collection agencies in the event of debt collection or the initiation of judicial, extrajudicial, administrative, and other proceedings, if permitted by applicable regulations.
• Assignees of receivables in the event of assignment of receivables that the Company has against you, provided that the prescribed protection of your data is ensured.
• Companies providing services for the maintenance, monitoring, and analysis of internet presentation usage, e.g., Google Analytics (https://policies.google.com/privacy?hl=en).

8. Information on the Intention to Transfer Personal Data to Another Country or International Organization

The Company may transfer personal data:

• To members of the Gauselmann group whose registered offices are in the Republic of Serbia and the European Union. The transfer is made on the basis of an adequate level of protection, as the members of the Gauselmann group are based in countries whose territories, or one or more sectors of specific activities in those countries, and international organizations are considered to ensure an adequate level of protection, as adopted by the Government of the Republic of Serbia.
• To Processors to whom the Company provides data (e.g., external archivists) for the purpose of performing their tasks, who may need to transfer personal data to another country (e.g., the country of the parent company’s registered office) for which the Government of the Republic of Serbia has determined that it ensures an adequate level of personal data protection.

9. Additional Information That May Be Necessary to Ensure Fair and Transparent Data Processing

9.1. Personal Data Retention Period

Collected data is stored in paper and electronic form, in the Company’s business premises, as well as with third parties with whom the Company has concluded agreements on documentation archiving, ensuring data security and protection.

• Data and documentation related to the prevention of money laundering and terrorist financing – kept for at least ten years from the date of termination of the business relationship, i.e., the executed transaction.
• Certain data on former Company employees – in accordance with applicable regulations must be kept permanently for the purpose of realizing rights arising from mandatory social and pension insurance.
• General retention – after the expiration of prescribed data retention periods, the Company may keep your data for a maximum of one additional year, within which period it is obliged to delete/anonymize such data and destroy the documentation.
• Security camera recordings – kept for at least 30 days, and a maximum of 6 months. Exceptionally, security camera recordings may be kept longer – for as long as necessary for conducting legal proceedings related to actions recorded by video surveillance.
• Data on visitors to the internet presentation, profiles on social and professional networks – kept only for as long as necessary to achieve the purpose of processing. Usage data is kept for internal analysis for a shorter period, up to 3 years, except when such data is used to enhance the security or improve the functionality of our internet presentation or when we are legally obliged to keep it for a longer period.
• Video and audio recording (likeness and voice) – up to 2 years.
• Longer retention for procedural needs – Data and documentation may be kept longer than the specified periods for the purpose of conducting judicial, extrajudicial, administrative, and other proceedings before state bodies, arbitrations, and third parties, regardless of whether the procedure was initiated by you, the Company, or third parties, and for the protection of the legitimate interests of the Company or third parties.

Information about the retention periods for specific documentation and personal data can be obtained free of charge by submitting a request to the Company as described later in this Policy.

9.2. Your Rights Regarding Personal Data Processing and How to Exercise Them

As a data subject, you have the following rights:

• Right of access – the right to request from the Data Controller information on whether your data is being processed, access to that data, and delivery of a copy in the manner you request, which is feasible for the Company (in paper and electronic form), with the charging of necessary costs for additional copies, as well as to be informed about all processing activities and data contained in this Policy.
• Right to rectification and completion – the right to request from the Data Controller the rectification or completion of your personal data if the data in the Company’s possession is inaccurate or incomplete.
• Right to erasure (right to be forgotten) – the right to request from the Data Controller the erasure of your data under the conditions prescribed by the Law, especially if there is no legal basis or purpose for processing or if it is a legal obligation of the Company. The Company may refuse to erase data if the conditions prescribed by the Law are met for such refusal.
• Right to restriction of processing – the right to request from the Data Controller the restriction of processing under the conditions and in the manner prescribed by the Law (during the period of assessing the validity of an objection, in case of disputing the accuracy of data, unlawful processing, and absence of a purpose for processing). In such a case, the data may be further processed only with your consent, unless it is for their storage or for the purpose of establishing, exercising, or defending legal claims or for the protection of the rights of other natural or legal persons or for reasons of important public interest.
• Obligation to notify recipients – the Company is obliged to notify all recipients to whom personal data has been disclosed of any rectification or erasure of personal data or restriction of their processing, unless this proves impossible or involves disproportionate effort. The Company is obliged to inform you, at your request, about all recipients of the data.
• Right to data portability – the right to data portability in a structured, commonly used, and machine-readable format to you or directly to another controller, under the conditions prescribed by the Law.
• Right to object – the right to object to processing if the processing is carried out solely on the basis of performing tasks in the public interest or exercising powers prescribed by law to the Company or solely for the purpose of pursuing the legitimate interests of the Company or a third party. The Company is obliged to cease processing the data of the person who has objected, unless it has demonstrated compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject or are related to the establishment, exercise, or defense of legal claims.
• Right to object to direct marketing – You have the right to object at any time to the processing of your personal data for direct marketing purposes, including profiling to the extent that it is related to such direct marketing, in which case your data shall no longer be processed for such purposes.
• Right to withdraw consent – the right to withdraw consent at any time, whereby the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. In specific cases, such as withdrawing consent for participation in video content (e.g., street surveys and quizzes published on YouTube channel), your data will be protected by technical measures such as blurring faces and removing audio, without deleting the entire content.
• Right to lodge a complaint with the Commissioner – the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection, in accordance with Article 82 of the Law, if you consider that the processing of your data has been carried out contrary to the provisions of the Law. Lodging a complaint with the Commissioner does not affect your right to initiate other administrative or judicial protection procedures.

9.2.1. How to Exercise Rights and Deadlines for Action

The Company is obliged to provide you with information on actions taken regarding a request for exercising rights without undue delay, and at the latest within 30 days from the date of receipt of the request. This period may be extended for another 60 days if necessary, taking into account the complexity and number of requests. The Company is obliged to inform you of any such extension and the reasons for the delay within 30 days of receipt of the request. If you submit a request electronically, the information will be provided to you electronically if possible, unless you request the information to be provided otherwise.

If the Company does not act on your request, it is obliged to inform you of the reasons for non-action without undue delay, and at the latest within 30 days from the date of receipt of the request, as well as of the right to lodge a complaint with the Commissioner, or a lawsuit with the court.

The Company generally provides information and acts on requests free of charge. If your request is manifestly unfounded or excessive, especially if it is repetitive, the

Company may charge a reasonable fee for administrative costs of providing information or acting on the request or refuse to act on the request.

You can submit an objection by sending a written objection to the email address dpo@pionirdoo.rs or by mail to the Company’s registered office address: Bulevar Mihajla Pupina 6/22 Novi Beograd.

9.3. Obligation to Provide Personal Data and Consequences of Refusal

• Necessary condition for establishing a business relationship: Providing certain personal data is a necessary condition for establishing a business relationship with the Company.
• Legal obligation (Law on Prevention of Money Laundering and Terrorist Financing): Based on the Law on Prevention of Money Laundering and Terrorist Financing, the Company is obliged to refuse an offer to establish a business relationship, as well as to execute a transaction if it cannot perform actions and measures for client due diligence and monitoring. If a business relationship has already been established, the Company is obliged to terminate it if it cannot collect the requested data.
• Access to internet presentation: You are not obliged to provide data to the Company when accessing the Company’s internet presentation, nor its profiles on social and professional networks. However, if you do not agree to provide data (e.g., by rejecting cookies), some functionalities of the website will not be available to you.

9.4. Information on Automated Decision-Making and Profiling

The Company does not perform profiling or automated decision-making that could have legal or similarly significant consequences for you.

9.5. Further Data Processing

If there is a need for further processing of data, the purpose of which is different from the purpose of processing in this Policy, you will be informed about it and all other relevant information before commencing further processing.

9.6. Method of Obtaining Your Personal Data

The Company obtains your data in the following ways:

• Directly from you: When you directly provide us with data in various interactions (e.g., application for participation in games, request for cooperation, filling out forms).
• From your legal representatives, proxies, employer.
• From publicly available sources: E.g., Business Registers Agency (APR), internet presentations of companies, associations, and organizations.
• By automatic collection: When you visit our internet presentation, some of your data is automatically collected via cookies and Usage data, as explained in more detail earlier in this Policy.
• From other legal entities: E.g., from legal entities through which you make payments for participation in the Company’s games of chance.
• Through recording for promotional purposes: When participating in public surveys and quizzes for the purpose of creating video content (e.g., for YouTube channel), with your verbal consent recorded on the footage.

9.7. Contact for Further Questions

To exercise your rights regarding the protection of your personal data, as well as to provide all necessary explanations in this regard, you can contact the Data Protection Officer by mail at the Company’s registered office address (Bulevar Mihajla Pupina 6/22 Novi Beograd), by phone at + 381 64/ 8298137, and by email at dpo@pionirdoo.rs.