Privacy policy

This privacy policy explains what personal data the PAMPERO online store collects, for what purposes it is processed, with whom it is shared and what rights you have in relation to your data. Processing is carried out in accordance with the Personal Data Protection Act of the Republic of Serbia (ZZPL).

We process data only to the extent necessary to sell and deliver goods and to meet our legal obligations. We do not sell your data and we do not use it for marketing without your consent.

The Serbian version of this policy is the authoritative text; this English version is provided for convenience.

The controller of your personal data is PAMPERO DOO BEOGRAD, Vojvode Petka 14, 11118 Belgrade, Republic of Serbia. Tax ID (PIB): 100218114. Company registration number: 06329748.

For any question concerning the processing of personal data you can reach us by email at office@pampero.rs or by phone at +381 11 329 00 75, weekdays 09:00-17:00 and Saturdays 09:00-14:00.

When you place an order we collect the data needed to process and deliver it: your first and last name, delivery address, email address and phone number, together with the order itself (items ordered, amount, payment method and status). When you contact us through the contact form or by email, we collect the data you provide: your name, email address and the content of your message.

Orders can be placed without a customer account, so we do not keep customer accounts. We do not collect data that is not needed for the purposes described here.

We do not collect, process or store payment card data. When card payments become available, they will take place exclusively on the bank's secure page; the card number and other card details will be entered directly with the bank and will never reach the store's servers.

We process data on the following legal bases provided by the ZZPL: performance of the sales contract, processing your order, collecting payment, arranging delivery and communicating with you about the order, including handling complaints and withdrawal requests; compliance with legal obligations, keeping accounting and tax records of issued invoices and sales; and legitimate interest, preventing fraud and abuse, keeping the site secure and maintaining technical (security) logs.

Replying to enquiries sent through the contact form is based on our legitimate interest in responding to the message you sent us. We do not use your data for automated decision-making or profiling.

Delivery and contact details (name, address, phone number, email address) are necessary for the conclusion and performance of the contract; without them your order cannot be processed. The order note and phone number in the contact form are optional.

For the security of the site, our hosting automatically records technical access logs (IP address, browser type, page address, time), which are kept for no longer than 30 days. To prevent form abuse, we keep a pseudonymised (hashed) IP address alongside each order or message.

We pass your data to third parties only where necessary to fulfil your order or to comply with a legal obligation: to the courier service, your name, address and phone number, for delivery; and to providers of hosting and technical support services, to the extent necessary for the technical operation of the store, under contractual confidentiality obligations.

We may disclose data to competent public authorities where required to do so by law. We never sell, rent or hand over personal data to third parties for marketing purposes.

For the operation of the store we use the following processors, with whom we have data processing agreements:

• Google Cloud EMEA Limited (Ireland) and related Google group entities — site and database hosting; data is stored in a data centre in Frankfurt (Federal Republic of Germany), which is regarded as a country providing an adequate level of personal data protection. If Google accesses data for maintenance or technical support purposes from countries not on the adequate-protection list, the transfer is made with appropriate safeguards in accordance with standard contractual clauses.

• Our email service provider in the Republic of Serbia — email hosting through which order confirmations are sent and correspondence is received.

• The courier service delivering your parcel, Republic of Serbia — parcel delivery (name, address, phone number, cash-on-delivery amount).

Aside from the above, we do not transfer data to other countries.

We do not send promotional messages or newsletters without your prior consent. If we introduce a newsletter or other promotional communications in the future, signing up will be voluntary and you will be able to withdraw your consent at any time, simply and free of charge.

We keep order records and issued invoices for the periods prescribed by the accounting and tax regulations of the Republic of Serbia, as a rule ten years from the end of the business year to which they relate. Complaint records are kept for the periods prescribed by the Consumer Protection Act.

Messages sent through the contact form or by email are kept only for as long as needed to reply and for any follow-up, and no longer than one year after the correspondence has ended, unless longer retention is necessary to establish or defend legal claims. Once the retention period expires, data is deleted or anonymised.

Under the ZZPL you have the right to request from us: access to your data and information about its processing; rectification of inaccurate or completion of incomplete data; erasure of data where there is no longer a basis for processing; restriction of processing; portability of the data you have provided to us; and the right to object to processing based on legitimate interest.

You can submit a request by email to office@pampero.rs or in writing to our registered address. We respond without undue delay and within the deadlines prescribed by the ZZPL. Exercising your rights is free of charge, except in the cases of manifestly unfounded or excessive requests provided for by law.

If you believe your personal data is being processed unlawfully, you have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia (www.poverenik.rs). We would appreciate it if you contacted us first at office@pampero.rs so that we can try to resolve the matter directly.

The site uses no analytics or advertising cookies from third parties and does not load content from external servers. We use only the cookies and local storage items necessary for the store to function, which do not require your consent:

• `pampero_csrf` (in production: `__Host-pampero_csrf`) — a security cookie that protects order submission from abuse; it expires when the browser is closed.

• `pampero_order_token_…` — allows you to open the confirmation page for your order after placing it; it expires after 24 hours.

• `pampero.cart.v1` (local storage) — the contents of your cart (item codes and quantities), with no personal data.

• `pampero.theme` (local storage) — your chosen display theme, only if you change it yourself.

You can delete these items in your browser settings; your cart and theme preference will be lost if you do.

We apply technical and organisational security measures appropriate to the risk of processing: all traffic between your browser and the site is encrypted with TLS (HTTPS), access to order data is limited to authorised staff who need it for their work, and access to the administrative part of the system is controlled and logged. We review and improve these measures regularly.

We may amend this privacy policy to reflect changes in regulations or in the way we process data. The current version is always published on this page. We will make reasonable efforts to highlight any material changes that affect your rights.