Privacy Policy

INTRODUCTION

As a socially responsible company, FINSPOT DOO BEOGRAD-Stari Grad (“Finspot”) conducts its business in accordance with all applicable regulations. In carrying out its activities, Finspot respects all rights and obligations related to personal data protection as prescribed by the Law on Personal Data Protection (“Official Gazette of RS”, No. 87/2018) (“Law”), bylaws, adopted standards, and international regulations applicable to Finspot’s activities.The purpose of this privacy notice is to fulfill Finspot’s obligations under the Law and to inform individuals about the purposes of personal data processing, legal grounds for personal data processing, rights of data subjects, and other issues related to personal data protection.Finspot provides its services through a platform located on the website app.finspot.rs (“Platform”).

1. Data Controller

Finspot is a company engaged in factoring, with its registered office at Makedonska Street no. 19/7, Belgrade, Republic of Serbia, registered in the register of business entities of the Business Registers Agency under registration number 21624152, email address for receiving electronic mail [email protected]. In carrying out its activities, Finspot processes personal data and, as a data controller determining the purpose and manner of processing, Finspot fulfills all obligations and respects all provisions and principles contained in the Law, other laws and bylaws, in accordance with achieved standards in the field of personal data protection.Finspot processes personal data in a correct and clear manner, whereby personal data is collected and processed for precisely and narrowly defined purposes, processing only personal data necessary for achieving the exclusive purpose for which it is collected and processed, and such collected data is kept only if necessary for achieving the purpose of processing, if required by special regulations and only in accordance with and to the extent determined by positive regulations.Finspot takes measures to ensure that personal data is accurate while providing the right to correct or delete inaccurate personal data. Finspot takes care of the security of personal data by implementing measures to protect data from loss, destruction, damage, as well as unauthorized access to data or illegal data processing by taking all necessary measures and respecting legal obligations and achieved standards in the field of personal data protection.

2. Types of Personal Data and From Whom They Are Collected

In order to conduct its business in accordance with laws and the interests of our service users, Finspot, in addition to other data, processes personal data including: name and surname, residential or temporary address, place and date of birth, personal identification number (JMBG), while not processing special categories of personal data from Article 17 of the Law, email address and contact phone number (data necessary for contact and communication), data on the user account on the Platform including the password for accessing the user account, characteristics of the device and browser through which you access the Platform, IP address data.We collect personal data directly from the data subjects or from third parties. If we have not collected personal data from the data subject, we will inform the data subject about the processing no later than 30 days from the day the personal data was collected in this way or no later than the first communication, if the personal data is used for communication with the data subject, unless the data subject is already aware of this or if notification would be impossible or would involve a disproportionate use of time and resources or when the collection of data is expressly prescribed by law.

3. Purpose of Processing and Legal Basis for Personal Data Processing

Finspot processes personal data in order to respond to inquiries from persons interested in the services provided by Finspot, to carry out actions before concluding contracts with potential users of our services, as well as to fulfill obligations and provide services in accordance with concluded contracts and laws. In addition, we process personal data for the purpose of conducting our marketing activities, when we fulfill our obligations in accordance with laws, as well as to improve our business and products, and prevent fraud and money laundering.

3.1. Processing of Personal Data for Taking Actions Before Concluding a Contract and Executing a Contract

When you decide to use the services provided by Finspot, you need to register on the Platform and confirm it in accordance with the procedure available on the Platform to create a user account. On that occasion, you need to provide us with the following personal data: name and surname, email address, contact phone number. During the creation of the user account, you will receive a unique password for accessing the user account, which personal data we also process.The above personal data is needed to evaluate the possibility of concluding a factoring agreement and contacting for the conclusion of a factoring agreement, whereby Finspot also uses all other publicly available data such as data from the Business Registers Agency or the National Bank of Serbia. We process this personal data in order to take actions necessary to fulfill the conditions for Finspot to offer the conclusion of a factoring agreement in accordance with our business policy, at the request of a person who wants services provided by Finspot. If you do not provide us with the requested data, we will not be able to perform the necessary analyses and we will not be able to provide the requested services.Entering into a business relationship with Finspot is done by concluding a factoring agreement. The above personal data is needed to fulfill obligations from such a contractual relationship and if you do not provide it, Finspot will not be able to enter into a business relationship, nor to fulfill its obligations arising from such a business relationship.

3.2. Processing of Personal Data for Marketing Purposes

From time to time, Finspot wants to inform its existing and potential users through various means of communication, such as email, phone or text messages, about its products, new services and the like, so in order to achieve this purpose, Finspot processes personal data such as name and surname, email address or phone number. To achieve this purpose, Finspot processes personal data only and exclusively based on the consent of the data subject.At any time, the given consent can be revoked by sending an email to [email protected]. The change resulting from the withdrawal of consent will be implemented within 1 day from the day of the submitted request due to technical requirements that need to be met in order for the change to be made.

3.3. Processing of Personal Data to Fulfill Legal Obligations

Finspot, as a company engaged in factoring, has numerous legal obligations towards bodies and organizations that it must fulfill in order to operate in accordance with applicable regulations. In order to fulfill these obligations, Finspot processes personal data for the consistent application of laws and regulations governing the prevention of money laundering and terrorist financing, responding to requests from state bodies, implementing mandatory procedures for preventing fraud in business operations and the like. In order to fulfill this purpose, Finspot may process personal data.

3.4. Processing of Personal Data Based on the Legitimate Interest of Finspot or a Third Party

Finspot processes personal data when it is necessary in order to achieve the legitimate interests of Finspot or a third party and only when such legitimate interest outweighs the interests, rights and freedoms of the data subject.Personal data is processed based on the legitimate interest of Finspot or a third party when it is necessary for:

improving business processes and developing new and existing services,
protecting business,
preventing fraudulent actions,
ensuring data security,
responding to inquiries via the contact form on the Platform,
fulfilling requests in proceedings before competent authorities

4. Recipients of Personal Data

In its operations, Finspot, in order to achieve the purposes of processing, as well as due to fulfilling its contractual and legal obligations, shares personal data with various recipients and processors. Processors and recipients of personal data may be:

employees of Finspot,
entities providing accounting services,
auditors,
lawyers,
state bodies and organizations when it is a legal obligation,
third parties providing services to Finspot in the field of fraud prevention analysis,

Persons receiving personal data receive personal data under the conditions of prescribed organizational and technical measures and procedures and are bound by confidentiality and data protection agreements except when such obligation arises from mandatory legal provisions.

5. Automated Decision-Making

In its operations, Finspot uses advanced IT solutions and tools for making decisions regarding the establishment of contractual relationships with users and the execution of obligations from them, and accordingly applies automated decision-making that relates to users of services who are legal entities and entrepreneurs, using data on the operations of users and potential users of services, so accordingly there are no consequences of such processing for the data subject.

6. Transfer of Personal Data Outside the Republic of Serbia

Finspot transfers personal data it processes to countries for which it has been determined that they provide an adequate level of protection in accordance with the regulations of the Republic of Serbia and decisions of competent authorities.

7. Rights of Individuals Regarding Personal Data

In accordance with the provisions of the Law, data subjects have numerous rights and Finspot will enable each such person to exercise the rights they have in accordance with the Law upon request.

7.1 Right of Access

A natural person who believes that Finspot processes their personal data has the right to request information on whether we process their personal data, access to that data, as well as the following information about:
a) the purpose of processing
b) types of personal data being processed
c) recipient or types of recipients to whom personal data has been or will be disclosed, especially recipients in other countries or international organizations
d) the envisaged period of storage of personal data, or if that is not possible, the criteria for determining that period
e) the existence of the right to request from Finspot correction or deletion of their personal data, the right to restrict processing and the right to object to processing
f) the right to file a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (“Commissioner”)
g) available information on the source of personal data, if personal data was not collected from the person using this right of access
h) the existence of an automated decision-making process, including profiling referred to in Article 38, paragraphs 1 and 4 of the Law, and, at least in those cases, meaningful information about the logic used, as well as the significance and expected consequences of such processing for the data subjectIf personal data is transferred to another country or international organization, the person using this right of access has the right to be informed about appropriate safeguards relating to the transfer, in accordance with Article 65 of the Law.

7.2. Right to Rectification of Personal Data

A natural person whose personal data we process has the right to request from Finspot that their inaccurate personal data be corrected without undue delay. Depending on the purpose of processing, the data subject has the right to supplement their incomplete personal data, which includes providing an additional statement.In case of correction of personal data, we will notify all recipients to whom personal data has been disclosed about any correction, unless this is impossible or requires excessive use of time and resources.We will inform the person using this right of correction, at their request, of all recipients of their personal data.

7.3. Right to Erasure of Personal Data

A natural person whose personal data we process has the right to request that their personal data be erased by Finspot.We will erase such personal data without undue delay in the following situations:
a) personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
b) the person using this right to erasure has revoked the consent on which the processing was based, in accordance with Article 12, paragraph 1, item 1) or Article 17, paragraph 2, item 1) of the Law, and there is no other legal basis for processing;
c) the person using this Right to erasure has objected to the processing in accordance with: c.1) Article 37, paragraph 1 of the Law, and there is no other legal basis for processing that overrides the legitimate interest, right or freedom of the data subject, c.2) Article 37, paragraph 2 of the Law;
d) personal data has been unlawfully processed
e) personal data must be erased in order to fulfill Finspot’s legal obligations
f) personal data was collected in connection with the use of information society services referred to in Article 16, paragraph 1 of the Law.If Finspot has publicly disclosed personal data that needs to be erased in accordance with this right to erasure, Finspot will take all reasonable measures, including technical measures, in accordance with available technologies and the possibility of bearing the costs of their use, in order to inform other controllers processing this data that the person using this right to erasure has submitted a request for erasure of all copies of this data and referrals, or electronic links to this data.We will notify all recipients to whom personal data has been disclosed about any erasure, unless this is impossible or requires excessive use of time and resources.We will inform the person using this right to erasure, at their request, of all recipients of their personal data.

7.4. Right to Restriction of Processing of Personal Data

A natural person whose personal data we process has the right to request that the processing of their personal data be restricted by Finspot if one of the following conditions is met:
a) the person using this right to restriction of processing disputes the accuracy of personal data, for a period that allows Finspot to verify the accuracy of personal data,
b) the processing is unlawful, and the person using this right to restriction of processing opposes the erasure of personal data and instead requests restriction of its use,
c) Finspot no longer needs personal data for the purposes of processing, but the person using this right to restriction of processing has requested it for the purpose of submitting, exercising or defending a legal claim,
d) the person using this right to restriction of processing has objected to processing in accordance with Article 37, paragraph 1 of the Law, and the assessment of whether the legal basis for processing by the controller overrides the interests of that person is ongoing.In case of exercising this right to restriction of processing, Finspot will further process such personal data only on the basis of consent of the person using this right to restriction of processing, except for its storage or for the purpose of submitting, exercising or defending a legal claim or for the protection of rights of other natural or legal persons or due to important public interests.We will notify all recipients to whom personal data has been disclosed about any restriction of processing, unless this is impossible or requires excessive use of time and resources.We will inform the person using this right to restriction, at their request, of all recipients of their personal data.

7.5. Right to Data Portability

A natural person whose personal data we process has the right, in accordance with the Law, to receive back from Finspot their personal data previously provided to Finspot in a structured, commonly used and machine-readable format and has the right to transfer this data to another controller without hindrance from Finspot, if the following conditions are simultaneously met:
a) the processing is based on consent in accordance with Article 12, paragraph 1, item 1) or Article 17, paragraph 2, item 1) of the Law or on the basis of a contract, in accordance with Article 12, paragraph 1, item 2) of the Law
b) the processing is carried out by automated means.The right to portability includes the right of the person to have their personal data directly transferred to another controller by Finspot, if technically feasible.

7.6. Right to Object

If a natural person whose personal data we process considers it justified in relation to the special situation in which they find themselves, such person has the right to object to Finspot at any time regarding the processing of their personal data, which is carried out in accordance with Article 12, paragraph 1, item 6 of the Law, including profiling based on those provisions. Finspot will cease processing the data of the person who submitted this objection, unless it presents to such person that there are legal reasons for processing that override the interests, rights or freedoms of the person who submitted the objection or are related to the submission, exercise or defense of a legal claim.A natural person whose personal data we process has the right to object at any time to the processing of their personal data for direct marketing purposes, including profiling, to the extent that it is related to direct marketing, and then we will not further process personal data for these purposes.

7.7. Right to Notification in Case of Breach

If there is a breach of personal data that we process, Finspot will, if the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, notify the person to whom such personal data relates without undue delay, whereby such notification will include at least the name and contact details of the data protection officer at Finspot or information on another way to obtain information about the breach, a description of the possible consequences of the breach, a description of the measures we have taken or whose taking has been proposed in connection with the breach, including measures taken to mitigate harmful consequences.

7.8. Right to File a Complaint

A natural person whose personal data we process has the right to file a complaint with the Commissioner in accordance with the Law.

8. Period of Retention of Collected Personal Data

Finspot retains personal data as long as there is a purpose for which that data is processed. Generally, we keep personal data for the duration of the business relationship regarding the provision of our services. We keep certain personal data even after the termination of the business relationship to fulfill legal obligations that Finspot has in accordance with regulations. Personal data that we process exclusively on the basis of consent is processed in accordance with the purpose for which it was collected and as long as the consent of the data subject is not withdrawn.

9. Contact Details of the Controller

Regarding the exercise of your rights in accordance with the Law, you can contact Finspot in writing at the address Makedonska no. 19/7, 11000 Belgrade, Republic of Serbia, via email at [email protected] or by phone at +381 064/612-00-14.

10. Data Protection Officer

Finspot has appointed a data protection officer in accordance with the Law. The appointed data protection officer is Ognjen Kurtić.To exercise their rights, data subjects can contact both Finspot and the data protection officer at Finspot in one of the following ways:

In writing by sending correspondence to the address ul. Makedonska no. 19/7, 11000 Belgrade
By email by sending an electronic message to the email address [email protected]
By calling the phone number +381 064/612-00-14

11. Amendments of the Privacy Policy

Finspot may from time to time amend and/or supplement this privacy notice, which can be found on the Platform.