Definitions and Interpretation

Personal data means any information relating to an identified or identifiable individual ('data subject'); an identifiable individual is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that individual;

Data about the subject refers to either an identified individual or an identifiable individual whose personal data the data data processes.

Processing of personal data is any operation or set of operations performed, whether automated or non-automated, with personal data or sets of personal data, such as collection, recording, sorting, grouping, structuring, storage, refinement or modification, retrieval, review, use, disclosure by transfer or delivery, duplication, dissemination or otherwise making available, comparison, restriction, deletion, or destruction;

Automated processing of personal data – processing of personal data using computer technologies.

The collected data is used in a manner that allows the identification of website users, in accordance with the Law on Personal Data Protection of the Republic of Serbia, the General Data Protection Regulation of the European Union (GDPR), the European Union e-Privacy Regulation (EU ePR), and other relevant legal sources in the field of personal data protection;

Consent of the data subject is any freely given, specific, informed, and unambiguous expression of the individual's wishes, by which that individual, through a statement or clear affirmative action, agrees to the processing of personal data relating to them. An individual who has consented to the collection and processing of personal data may withdraw their consent at any time and without explanation, which as a legal consequence results in the termination of the user status on the MR. SHU RENTAL website and cessation of any further data collection by the individual who has withdrawn consent.

Processor is a natural or legal person, or public authority, which alone or jointly with others determines the purposes and means of the processing.

Data processor is a natural or legal person, or public authority, which processes an individual's information on behalf of the controller.

Recipient is a natural or legal person, or public authority, to whom personal data has been disclosed, whether a third party or not, unless this is a public authority which, in accordance with the law, receives personal data in the context of an investigation of a specific case and processes that data in accordance with data protection rules relating to the purposes of processing;

Third party is a natural or legal person, or public authority, who is not the data subject, controller, or processor, as well as a person authorized to process personal data under the direct supervision of the controller or processor.

'Cookie' is a small text file that is placed on your computer or device when you visit certain parts of our website and/or use certain functions of our website. Information about the cookies used by our website is set out in Part 11 below; and 'cookie law' refers to the relevant parts of the law on privacy and electronic communications (EU Directive on Electronic Communications) of 2003.

Website user is any natural or legal person who accesses or registers an account on the website.

What does this policy cover?

This Privacy Policy applies to your use of our website and the use of the services of Mr. Shu Rental d.o.o. Beograd by the User in accordance with the terms of use. Our website may contain links to other websites. Please note that we do not control how your data is collected, stored, or used by other websites, and we advise you to review the privacy policy of any such website before providing them with any data.

What are personal data?

Personal data is defined by the Law on Personal Data Protection ('Official Gazette of the Republic of Serbia' No. 87/2018) and the General Data Protection Regulation (EU Regulation 2016/679) ('GDPR') as any information relating to an identified or identifiable individual ('data subject'); an identifiable individual is one who can be identified directly or indirectly, in particular by reference to such identifiers as a name, identification number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that individual.

Simply put, personal data is any information about you that allows you to be identified. Personal data includes obvious information such as your name and contact information, but also less obvious information such as identification numbers, electronic location data, and other online identifiers.

Anonymous information, which we are unable to link to you, does not qualify as personal data.

What are your rights?

By law, you have the following rights, which we will always respect:

Right to be informed about our collection and use of your personal data. This Privacy Policy should tell you everything you need to know, but you can always contact us to find out more or ask questions using the details provided in Section 13.

Right to access the personal data that we hold about you. Section 10 will tell you how to do this.

Right to correct your personal data if any of the personal data we hold about you is inaccurate or incomplete. You have the right to request that we correct the personal data we hold. In any case, please note that by actively providing us with access to personal data through any process, you guarantee that they are true and accurate and take responsibility for informing us of any changes or modifications to the data. You are responsible for any losses or damage to the Platform or to any third party responsible for the Platform resulting from reporting incorrect, inaccurate, or incomplete data in registration forms. Remember that, as a general rule, you must provide us with only your data, not the data of third parties, except to the extent otherwise permitted in this Privacy and Cookie Policy. For changes to your data, you can contact us using the details provided in Section 13 to find out more.

Right to be deleted from the platform, or the right to require us to delete or otherwise remove any of your personal data that we hold. Please contact us using the details in Part 13 to find out more.

Right to restrict (i.e. prevent) the processing of your personal data. This means that you may ask us to cancel or restrict the processing of your personal data, which means that in some cases you can ask us to temporarily suspend data processing or store it longer than necessary.

Right to object to the use of your personal data for certain purposes. If the processing of your data is based on our legitimate interests, you also have the right to object to the processing of your data.

Right to data portability. This means that if you have provided us with personal data directly, we use it with your consent or for the performance of a contract, and that data is processed by automated means, you can request a copy of that personal data to reuse it with another service or business entity in many cases.

Rights related to automated decision making and profiling. The individual whose data is concerned has the right not to be subject to a decision based solely on automated processing, including profiling, if that decision produces legal effects concerning the individual or significantly affects their position. The preceding provision does not apply if the decision: is necessary for entering into or performance of a contract between the individual whose data is concerned and the controller; is based on the law, provided that appropriate safeguards for the rights, freedoms, and legitimate interests of the individual whose data is concerned are provided by that law; is based on the explicit consent of the individual whose data is concerned. Decision-making based solely on automated processing conducted by competent authorities for specific purposes, including profiling, is prohibited if such a decision could produce harmful legal effects concerning or significantly affect the position of the individual whose data is concerned, unless the decision-making is based on the law and appropriate safeguards for the rights and freedoms of the individual whose data is concerned are provided by that law, including at least the right to ensure the participation of the individual under the control of the controller in decision-making.

All other rights, provided for by legislative acts in the field of personal data protection. The person to whom the data relates may exercise their rights by sending a request to our email address: Service@vroom.rs. MR. SHU RENTAL will provide you with all necessary additional information to fulfill these requests and will assist you in accordance with the conditions and procedures prescribed by the applicable Law on Personal Data Protection. We will respond to your request as soon as possible and no later than 30 days from the date of receipt. In case of complexity or a large number of requests, we may need additional time to respond. This period may not exceed 90 days, and we will inform you separately. The competent authority for personal data protection in the Republic of Serbia is the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia, an autonomous and independent state authority established by law and responsible for supervising the implementation of the Law on Personal Data Protection and other data-related laws. If you have grounds to complain about our use of your personal data, you have the right to lodge a complaint with the Commissioner for Access to Information of Public Importance and Personal Data Protection. You can contact the authorized body by email at office@poverenik.rs, or at: Bulevar kralja Aleksandra 15, 11000 Belgrade, Republic of Serbia.

What data do we collect?

The necessary standards we apply.

Depending on your use of our website, we may collect some or all of the following personal and non-personal data (see also Section 11 regarding our use of cookies and similar technologies):

Identification data (first name, last name, patronymic, gender, date and place of birth; citizenship and passport data - number, issue date, expiry date; photograph of a user not entitled to order verification; information from an identity card or other identification document; taxpayer identification number; residential address or registered office / address for legal entities as users; registered data from the competent register of business entities for legal entities as users.)

Phone number;

Email address;

Credit card number;

Current account number;

Driver's license data for the required category;

Any other information directly or indirectly related to the website user that is necessary to achieve the purposes of this policy, that is, necessary to identify the user, as well as to conclude and/or execute any agreements/contracts concluded with clients/customers;

Any other data from any other document that the website user independently enters and submits through their registered order, which will be considered as consent given for the processing of such data.

The Controller may also request from the website user a copy of an identity document and any other documents necessary for work within the territory of the Republic of Serbia, as well as other additional information which, in the Controller’s opinion, will be necessary and sufficient for identifying such a user, as well as for the conclusion and/or execution of any agreements/contracts concluded by the User with clients/customers, and will help prevent abuse and violation of the rights of third parties, including the Controller’s clients/customers. For information security purposes, the Controller may create publicly available sources of personal data of website users, including catalogs and address books. Such publicly available sources of personal data may include, with the consent of the data subject (owner) of the personal data, their surname, first name, date and place of birth, occupation, contact phone number, and email address. Information about the subject may be excluded from publicly available sources of personal data at any time at their request. When the user uses the services, the following information about the end user may be received and processed by MR. SHU RENTAL:

- 'Technical Information': This refers to technical details related to the end-user's mobile device or computer, such as browser type, device type and model, processor, system language, memory, OS version, Wi-Fi status, timestamp and zone, device motion parameters, and operator.

- 'Technical Identifiers': This refers to various unique identifiers that typically identify a computer, device, browser, or application. For example, an IP address (which may also provide general location information), user agent, IDFA (Identifier for Advertisers), Android ID (on Android devices), Google Advertiser ID, user ID issued by the user, and other similar unique identifiers.

How do we obtain and use your personal data?

Purpose and legal basis of data processing.

If you decide to become a registered user on our Platform, we must process your information in order to identify you as a platform user and grant you access to the various functions and services available to you as a registered user. You can cancel your registered user account by contacting customer support. We hereby inform you that the information we collect about your activity through various platform channels will remain associated with your account in order to provide unified access to all information. The possible legal basis for data processing that we may rely on may be:

- Consent – the website user to whom the processed data relates gives consent for one or more specific processing purposes;

- Contract - Processing is necessary for the performance of a contract concluded with the website user to whom the data relates or for taking steps at the request of the individual to whom the data relates before entering into a contract;

- Legal obligation of the controller: processing is necessary for compliance with the legal obligations imposed on the controller;

- for the purposes of the legitimate interests pursued by the controller or a third party.

The main reason we process your data is to fulfill the agreement you enter into when you register with us and use our services or features. Your personal data may be used for the following purpose:

Enabling and managing your access to our website;

Full operation and facilitation of the use of the MR. SHU RENTAL website;

Personalizing and customizing your experience on our website;

Improving and developing our website;

Providing you with our services;

Concluding and/or performing any agreement with website users;

Personalizing and customizing our services for you;

Sending information by email and/or post where you have opted in.

With your permission and/or where permitted by law, we may also use your personal data for marketing purposes, which may include contacting you by phone and text messages, social networks, chatbots, e-mail and/or mail with information, news, and offers about our products and/or services. You will not receive unlawful marketing or spam. We always make every effort to fully protect your rights and comply with our obligations under the Law on Personal Data Protection, GDPR, and the Privacy and Electronic Communications Regulations (EU Directive) of 2003, and you will always have the option to unsubscribe as indicated below.

In addition to your rights outlined in Section 4, when you provide personal information through our website, you may have the opportunity to limit our use of your personal information. Specifically, we endeavor to provide you with reliable control over the use of your data for direct marketing purposes (including the ability to prevent receiving emails, messages and notifications from us, which you can do by unsubscribing using the links we have provided in our emails, unsubscribing by sending a notification to our email address Service@vroom.rs , by sending an SMS message with the text 'STOP', and/or by using the option in your account settings). For some processing purposes, we process your personal data based on your consent to the processing of personal data with prior notification of all relevant aspects of the processing. It is important to know that you can withdraw your consent at any time and without explanation, resulting in the termination of further processing

We believe we have a legitimate interest in linking your account with data about your activities collected through various channels on the Platform. We believe that we have a legitimate interest in providing answers to requests or consultations that you have made through various existing communication channels. We believe that processing this data is also beneficial for you to the extent that it allows us to provide you with adequate assistance and respond to your inquiries. In order to show you personalized information, we believe that we have a legitimate interest in carrying out profiling based on the information we have about you (for example, your search history, choices) and the personal data you have provided, such as age or language, given that we believe that processing this type of data is also beneficial for you because it allows us to improve user interaction and provide access to information according to your choices.

How long will we keep your personal data?

We will not store your personal data for longer than necessary,taking into account the reasons for which it was first collected or until the withdrawal of the consent given for storage and processing. Therefore, your personal information will be stored as long as the company has lawful grounds for keeping such records. The data is then deleted except in exceptional cases prescribed by law or when the deletion of the data may lead to the obstruction of the investigation, discovery or prosecution in criminal proceedings, as well as to the prevention of claims in civil disputes. In certain cases, personal data may be stored for a longer period of time, for the purpose of fulfilling legal obligations (for example, for security purposes), the Law on Accounting, etc., or for establishing, exercising, or defending legal claims in accordance with applicable laws and regulations.

Do we share your personal data?

Transfer of personal data.

The international transfer of personal data to foreign countries may be carried out by MR. SHU RENTAL only with the consent of the data subject for the international transfer of their personal data. Before starting the international transfer of personal data, MR. SHU RENTAL is obliged to make sure that the foreign country to whose territory the transfer of personal data is carried out ensures adequate protection of the rights of personal data subjects.

For the purposes of service efficiency, and in the event of transferring data to third countries located outside the European Economic Area that do not provide the same level of data protection as the European Union and that may not be included in the list of countries ensuring an adequate level of data protection issued by the competent data protection authority in Serbia, we inform you that we transfer your data using appropriate safeguards so that your data is always safe, and for this purpose we use standard contractual clauses and other relevant additional measures.

You can review the content of such standard contractual clauses at the following linkhttps://ec.europa.eu/info/law/law-topic/data-protection/datatransfers-outside-eu/model-contracts-transfer-personal-data-third-countries_en.

If we sell or transfer our company or resources in whole or in part to another company, or if we undertake any other business actions as a result of a company reorganization, we may disclose your personal data to a person who will in the future take over that company or resources. In the event of such a sale or transfer, we will make reasonable efforts to instruct the recipient to use the personal information you provided in accordance with our privacy and cookie policy. In that case, we believe that we have a legitimate interest consisting of reorganizing the company structure. In addition, if you choose to use our platform in different markets (i.e. in different markets), if you create user accounts in different markets with the same email address, we may need to disclose or transfer information related to your account or activity to companies operating in those markets to the extent that they are directly involved in achieving some of the purposes described in Section 6. We believe this is necessary in accordance with our common interests and choices.

We may sometimes enter into agreements with certain third parties for data protection purposes. If any of your personal data is transferred to a third party, as described above, we will take steps to ensure that your personal data is processed safely, securely, and in accordance with your rights, our obligations, and the third party’s obligations under the law.

In some limited circumstances, we may be legally required to provide certain personal data, which may include yours, if we are involved in legal proceedings or complying with legal obligations, a court order, or instructions from a competent government authority.

Can you save information?

You may access certain parts of our website without providing any personal data. However, in order to use all functions, features, and services available on our website, you may be required to provide or allow the collection of certain data. You may limit our use of cookies. For more information, see Section 11.

How can you access your personal data?

In addition to the right to be removed/deleted, you can exercise the following rights at any time:

You may ask us to provide you with copies of the personal information we hold about you or information about the processing of such information. This is called a 'data subject access request'.

You may ask us to update and correct any outdated or inaccurate personal information we hold about you.

All data subject access requests must be made in writing and sent to the email address shown in Section 13.

There is usually no fee for making a data subject access request. If your request is 'manifestly unfounded or excessive' (for example, if you make repetitive requests), a fee may be charged to cover the administrative costs of responding.

We will respond to your data subject access request within 30 days of receipt. Normally, we aim to provide a full response, including a copy of your personal data, within that period. However, in some cases, especially if your request is more complex, it may take longer, up to a maximum of 90 days from the date of receipt of your request. You will be fully informed of our progress. If you wish to exercise any of these rights, please contact us as described in Section 13.

How do we use cookies?

Our website uses cookies and similar technologies that collect tracking data to distinguish you from other users. This helps us provide you with a good experience when accessing the websites and using the services. The cookies used on our website fall into the categories described below. You may use these descriptions to determine whether and how you want to interact with our websites and other online services:

Strictly Necessary Cookies: These cookies are necessary for navigation on the websites and for using certain functions. Without these strictly necessary cookies, the online services provided by the websites cannot be delivered. Therefore, it is not possible to opt out of the use of these cookies. In addition, the programming language used to create the websites uses session cookies, and their use cannot be avoided. They are deleted every time you close your browser. These cookies do not store any information about the visitor after the browser is closed.

Performance cookies: Our performance cookies collect anonymous information about how you use the website and its functions. For example, our cookies collect information about which pages on the website are visited most frequently.

Analytics cookies: websites may use other similar cookies for analytics. These cookies are used to collect information about how visitors use the website. The information is collected anonymously and used to report on the number of website visitors, where they came from, and which pages they visited. In addition, you may prevent the collection and use of Google data (cookies and IP addresses) by downloading and installing the browser plug-in available at https://tools.google.com/dlpage/gaoptout

Additional information can be found at http://www.google.com/analytics/terms/gb.html

(Google Analytics Terms of Service and Privacy).

In addition, you may prevent Google Analytics from collecting such data on behalf of MR. SHU RENTAL by clicking the following link: https://tools.google.com/dlpage/gaoptout

Functionality cookies: Functionality cookies are used to remember choices you make (for example, language settings, country location, or other online settings) and to collect anonymous information.

Our website may place and access certain first-party cookies on your computer or device. First-party cookies are those set directly by us and used only by us. We use cookies to facilitate and improve your experience with our website and to provide and improve our products and/or services. We have carefully selected these cookies and taken steps to ensure that your privacy and personal data are respected and protected at all times.

Before cookies are placed on your computer or device, a pop-up window will appear asking for your consent to set those cookies. By giving your consent to the placement of cookies, you allow us to provide you with the best possible experience and service. If you wish, you may refuse consent to the placement of cookies; however, certain features of our website may not function fully or as intended. Certain functions of our website rely on cookies to function, and these cookies are 'strictly necessary'. Your consent will not be requested for the placement of these cookies, but it is still important that you are aware of them. You may still block these cookies by changing your browser settings, but please note that our website may not work properly if you do so. We have taken care to ensure that your privacy is not compromised by allowing these cookies.

In addition to the controls we provide, you can enable or disable cookies in your web browser. Most web browsers also allow you to choose whether you want to disable all cookies or only third-party cookies. By default, most web browsers accept cookies, but this can be changed.

You may choose to delete cookies from your computer or device at any time; however, you may lose any information that allows you to access our website more quickly and efficiently, including, but not limited to, login and personalization settings. It is recommended that you regularly update your web browser and operating system and consult the help and guidance provided by the developer of your web browser and the manufacturer of your computer or device if you are unsure how to adjust your privacy settings.

Security

In order to protect your personal data, we always strive to apply the necessary standards of personal data protection and at all times apply all necessary technical, organizational, and personnel protection measures in accordance with the current personal data protection legislation, including, but not limited to: technical protection measures, organizational measures, and personnel protection measures relating to physical access to the place where your data is stored, information security measures for your data in accordance with applicable regulations, as well as other measures that are appropriate for processing and necessary to ensure the protection of certain personal data. Third parties processing data are also required to implement all necessary technical, organizational, and personnel measures.

All information provided by the client is stored on secure servers, and only authorized personnel have access to that information. We take reasonable precautions to prevent the loss, misuse, or alteration of your personal information. Our employees, contractors, and agents may be given access to your personal information that we collect, but their use will be limited to performing their duties in connection with facilitating your use of the services. Our employees, contractors, and agents who have access to your personal information are required to keep that information confidential and are not authorized to use it for any purpose other than those listed above or to address your requests.

Modification of this Privacy Policy

We may periodically change this privacy policy for various reasons, such as changes in legislation and regulation, changes in industry practice, technological developments, or if we change our business in a way that affects the protection of personal data.

Any changes will be immediately posted on our Site, and you will be deemed to have accepted the terms of the Privacy Policy upon your first use of our website after the changes. We encourage you to review this page regularly to stay up-to-date.

If changes to this Privacy Policy result in a reduction of your rights, we will ask for your explicit consent to continue using the MR. SHU RENTAL website.

How can you contact us?

Customer support.

To contact us regarding your personal data and data protection, including submitting a data access request, please contact our personal data protection team at: Service@vroom.rs

For any questions related to this Privacy Policy, or questions about the use of your personal information, you may contact us at: Service@vroom.rs

Privacy Policy Version

Privacy Policy version dated 26.09.2024.