Personal Data processing

Personal Data Processing Notice

This Personal Data Processing Notice relates to the processing of personal data by the controller, “Galenika” a.d. Belgrade (hereinafter referred to as Galenika).

Galenika processes personal data of the following individuals: employees, professional associates, business partners, candidates applying for jobs at Galenika, individuals visiting the Galenika website and its official social media pages, as well as personal data of other individuals whom Galenika encounters in connection with its business activities.

Galenika processes personal data necessary for regular operations, depending on specific business needs, such as: name and surname, address, date and place of birth, personal identification number (JMBG), occupation and level of education, skills and work experience, performance evaluation data, knowledge of foreign languages, training, email address, phone number, bank account number, salary or compensation, bonus and other earnings, as well as other personal data that Galenika obtains within the scope of its registered activities.

Data Processing for Contractual Obligation Fulfillment

Galenika a.d. Beograd, Batjnički drum bb (hereinafter referred to as the Company) is the controller of personal data of individuals (employees/individuals engaged on other legal grounds/business partners), including data related to health status, which is collected and processed for the purpose of fulfilling obligations under contracts concluded for the purpose of conducting its registered activities. Data processing is carried out based on these contracts, and without the collection and processing of personal data, the Company cannot fulfill its contractual obligations related to the conduct of its registered activities. These data are stored permanently in the area of work, and in other areas as long as there is a basis for their processing, with the application of all appropriate technical and organizational data protection measures in accordance with the law and internal acts of the Company.

The Company shares personal data with: 1) its shareholders and employees who, by law and the nature of their work, must have access to such data, as well as third parties with whom the Company has signed contracts for the purpose of fulfilling obligations under contracts concluded for the purpose of conducting its registered activities; 2) authorized state bodies upon their request; 3) the authorized auditing firm the Company is obligated to hire in accordance with the Law; 4) business partners for the purpose of fulfilling concluded contracts.

Data transfers are carried out based on the adoption of appropriate protection measures in the form of standard contractual clauses, except for data transfers to authorized state bodies, which are made based on legal requirements.

Data Processing to Fulfill Legal Obligations

The Company processes personal data of individuals in order to fulfill legal obligations. Data processed for this purpose are stored for at least the period prescribed by law or as long as there is a basis for processing.

Data Processing for Marketing Purposes

The Company processes personal data of individuals, such as name and surname, phone number, email address, residential address, for the purpose of informing about promotions and offers of products and services, but only with prior consent. Data processed for the purpose of offering products and services and informing about promotional actions is stored for five years, or until consent is revoked, with the application of all appropriate technical and organizational data protection measures in accordance with the law and internal acts of the Company.

Rights of Data Subjects

In accordance with the Law on Personal Data Protection, individuals whose data are processed have the following rights:

Right to access
Right to rectification and completion
Right to erasure
Right to restrict processing
Right to data portability
Right to object (to processing)
Right not to be subject to automated decision-making
If personal data processing is carried out based on prior consent, such consent can be withdrawn at any time in accordance with the Law on Personal Data Protection. Withdrawing consent will not affect the lawfulness of processing based on consent before its withdrawal.

If you believe that the processing of your personal data has been carried out in violation of the provisions of the Law on Personal Data Protection, you have the right to file a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (email: [email protected]).

Responsible Person for Personal Data Protection:

Jovana Ristović Milovanović
+381 11 307 1094
[email protected]