Privacy Notice

Dear Visitors,

At NALA D.O.O., we value your privacy and are committed to protecting your personal information. Due to the nature of our business and the services we provide, it is necessary for us to collect and process certain personal data from our customers and visitors to our website.

To ensure the security of your personal information, we have implemented appropriate technical, organizational, and administrative measures designed to protect your data against unauthorized access, misuse, alteration, loss, or disclosure.

All personal data is collected, processed, and stored in accordance with the Law on Personal Data Protection of the Republic of Serbia (“Official Gazette of the Republic of Serbia”, No. 87/2018) and all other applicable laws governing the protection of personal data.

We process your personal information responsibly and transparently. Your data is used only for legitimate and lawful purposes and will never be disclosed to third parties unless required or permitted by applicable law.

Before creating an account or placing an order, we encourage you to read this Privacy Policy carefully. By using this website, registering an account, or completing a purchase, you confirm that you have read, understood, and accepted this Privacy Policy.

As the controller of your personal data, we are required to inform you about the purposes for which your information is collected, the legal basis for processing, your rights, and our obligations under applicable data protection legislation.

We determine the purposes and methods of processing your personal data and ensure that all processing activities are carried out in accordance with applicable legal requirements while maintaining an appropriate level of security.

Data Controller

The controller responsible for processing your personal data is NALA D.O.O., with its registered office at Kosovska 26, 21000 Novi Sad, Republic of Serbia. The company is registered under company registration number 22182048 and tax identification number (PIB) 115601159. The legal representative of the company and the person responsible for personal data processing is Aleksandar Atanacković. If you have any questions regarding this Privacy Policy or the processing of your personal data, you may contact us at office@nala.rs.

Legal Basis for Processing Personal Data

We process personal data only when there is a lawful basis for doing so in accordance with applicable legislation.

Where required, we process your personal information based on your consent. Before collecting any personal data, we clearly explain what information is required, why it is needed, and how it will be used. You may withdraw your consent at any time. Such withdrawal will not affect the legality of any processing carried out before your consent was withdrawn, but we will discontinue any future processing that relied solely on that consent.

We also process personal data when it is necessary for the performance of a contract or in order to take steps at your request before entering into a contract. This includes processing information required to create and manage your customer account, process and deliver your orders, communicate with you regarding your purchases, provide customer support, respond to inquiries and complaints, and fulfil our contractual obligations.

In certain situations, we process personal data because we are legally required to do so under applicable laws and regulations. Processing may also be necessary to protect your vital interests or those of another individual, or where it is required for reasons of public interest or the exercise of official authority.

In addition, we may process your personal information where doing so is necessary for our legitimate business interests, provided those interests do not override your rights and freedoms. Such legitimate interests include improving our products and services, analysing customer preferences, enhancing website functionality, conducting market research, improving communication with customers, and providing a more personalised shopping experience.

Personal Data We Collect

Depending on how you use our website and services, we may collect identification information such as your full name, billing or delivery address, telephone number, email address, preferred language, country or market from which you access our website, and, where legally required, your personal identification number for tax or refund purposes.

We may also collect payment and transaction information, including payment card details when card payments are used, purchase history, order information, and records relating to completed transactions.

In addition, we may collect technical and website usage information, including your approximate geographic location, device identifiers, browsing behaviour, advertising identifiers, demographic information, website usage statistics, pages visited, navigation patterns, and purchase history.

Microsoft Clarity

To improve the quality, functionality, and overall user experience of our website, we use Microsoft Clarity, a website analytics service that helps us understand how visitors interact with our website.

Microsoft Clarity collects technical and behavioural information, including clicks, scrolling activity, navigation paths, and the amount of time visitors spend on individual pages. The information collected is anonymised wherever possible and is not used to directly identify individual users.

All information collected through Microsoft Clarity is processed in accordance with applicable personal data protection legislation. Additional information about Microsoft’s data processing practices can be found in the Microsoft Privacy Statement.

How We Use Your Personal Data

The personal information we collect enables us to provide our services efficiently and improve your overall shopping experience. We use your data to process and deliver your orders, communicate with you regarding purchases, respond to inquiries and complaints, process returns and refunds, provide available payment methods, personalise website content, recommend products that may be relevant to your interests, administer promotions and special offers, improve our products and services, analyse customer preferences and purchasing trends, conduct customer satisfaction surveys and market research, and send marketing communications where you have provided your consent.

International Transfer of Personal Data

As a general rule, your personal data is processed within the Republic of Serbia. If, in exceptional circumstances, it becomes necessary to transfer your personal data to another country or to an international organization, such transfer will only take place where an adequate level of personal data protection is ensured in accordance with applicable legislation.

An adequate level of protection is considered to exist where the receiving country or international organization provides safeguards equivalent to those required under Serbian data protection laws, including countries that are parties to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data or countries that have been recognized by the European Union as providing an adequate level of protection.

Retention of Personal Data

We retain your personal data only for as long as it is necessary to fulfil the purposes for which it was collected or for the period required by applicable law.

Personal information provided during account registration is stored for as long as your user account remains active and for up to six months after the account has been permanently deactivated.

Information relating to purchases and transactions is retained for the period necessary to complete your order, process payments, handle returns or complaints, and comply with our legal and accounting obligations.

Information you provide when contacting us with questions, requests, or complaints is retained only for as long as necessary to resolve your inquiry and maintain appropriate records.

Where personal data is processed for marketing purposes based on your consent, it will be retained until you withdraw your consent or request that such processing cease.

Technical information collected through your interaction with our website, including browsing behaviour, IP address, device information, purchase analysis, and similar analytical data, is generally retained for a maximum period of twenty-four months unless a longer retention period is required by law.

Once the applicable retention period expires, your personal data is securely deleted or permanently anonymised so that it can no longer be linked to you.

Your Rights

In accordance with the applicable personal data protection legislation, you have the right to request access to your personal data and obtain information about how it is being processed. You may also request the correction of inaccurate or incomplete information, the deletion of your personal data where legal conditions are met, or the restriction of processing in situations provided for by law.

You have the right to object to certain types of processing and, where applicable, to receive your personal data in a structured, commonly used, and machine-readable format so that it can be transferred to another data controller.

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent will not affect the legality of any processing carried out before the withdrawal.

If you believe that your personal data has been processed contrary to applicable legislation, you have the right to file a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia.

You also have the right to request information regarding the source of your personal data where such information was not obtained directly from you, including whether it originated from publicly available sources.

Processing of Children’s Personal Data

Our website and services are not intended for children under the age of fifteen, and we do not knowingly collect or process personal data relating to children younger than fifteen years of age.

In accordance with applicable legislation, individuals who are fifteen years of age or older may independently provide consent for the processing of their personal data when using information society services.

Contact Us

If you have any questions regarding this Privacy Policy, wish to exercise your rights, or would like to submit a request or complaint concerning the processing of your personal data, you may contact us using the details below.

NALA D.O.O.

Kosovska 26
21000 Novi Sad
Republic of Serbia

Email: office@nala.rs

To protect your privacy and prevent unauthorized disclosure of personal information, we may request additional information or a copy of a valid identification document before responding to requests relating to your personal data. This verification process helps ensure that personal information is disclosed only to the individual to whom it relates or to a person legally authorized to act on their behalf.