Privacy policy

1. Personal data controller

The controller of personal data processed through the Website is BLING BLING DOOEL Skopje, registered office at Kej 13-ti Noemvri, GTC, floor 1, unit 5-D.E. 461, Centar, 1000 Skopje, company registration number (ЕМБС) 7481578, tax number (ЕДБ) 4080021595347, contact email: [email protected].

This Privacy Policy has been prepared in accordance with the Law on Personal Data Protection (Official Gazette of RNM nos. 42/2020 and 294/2021), which is aligned with Regulation (EU) 2016/679 (GDPR), and explains what personal data we collect, for what purposes, to whom we disclose it, and what rights data subjects have.

Data Protection Officer (DPO)

The Company has appointed a Data Protection Officer, who is the first point of contact for all questions related to the processing of personal data and the exercise of the data subject rights described in this Policy.

Name: Nadica Gjorgjioski

Email: [email protected]

2. What personal data we collect

· Identification data: name and surname, delivery and/or billing address;

· Contact data: email, phone number;

· Order data: order contents, purchase history, preferences;

· Financial data: payment-related data (for card payments, card data is processed exclusively by the CaSys/Stopanska Banka AD Skopje payment service; the Trader does not store the card number or CVV code);

· Technical data: IP address, device and browser type, cookie data, in accordance with the Cookie Policy;

· Communication data: content of questions/complaints submitted by email or contact form.

3. Purposes and legal basis for processing

· Purpose: Processing and fulfilling orders (concluding and performing a contract). Legal basis: Performance of a contract (Art. 6(1)(b) GDPR)

· Purpose: Issuing invoices/receipts and keeping accounting records. Legal basis: Legal obligation (tax and accounting regulations)

· Purpose: Answering questions and handling complaints. Legal basis: Performance of a contract / legitimate interest

· Purpose: Sending newsletters and promotional messages (email marketing). Legal basis: Consent of the data subject (may be withdrawn at any time)

· Purpose: Website usage analytics (Google Analytics). Legal basis: Consent of the data subject

· Purpose: Showing personalised ads (Facebook Pixel, Google Ads). Legal basis: Consent of the data subject

· Purpose: Fraud prevention and Website security. Legal basis: Legitimate interest of the Trader

4. Recipients of personal data

Personal data may be disclosed to the following categories of processors and recipients, only to the extent necessary for the stated purposes:

· Courier services (various, depending on destination and availability) – for delivering ordered products within the Republic of North Macedonia;

· CaSys/Stopanska Banka AD Skopje payment service – for processing online card payments;

· Accounting firm/certified accountant – for bookkeeping;

· Website hosting and maintenance providers;

· Google LLC (Google Analytics, Google Ads) and Meta Platforms Ireland Ltd. (Facebook Pixel) – only after consent has been given for the relevant cookies;

· Competent public authorities – where required by law (e.g. Public Revenue Office, courts, inspection bodies).

The Trader does not sell or rent personal data to third parties for their own independent marketing purposes.

5. Transfer of data outside the Republic of North Macedonia

Through the use of the external service providers listed in section 4 (Google, Meta), certain data may be transferred to and processed on servers outside the Republic of North Macedonia and the European Union. Such transfers are made only to processors that ensure an adequate level of personal data protection (e.g. through standard contractual clauses approved under the GDPR).

6. Retention period

Personal data is kept only as long as necessary to fulfil the purposes set out in this Policy:

· Order and invoice data – in accordance with the statutory retention periods for accounting records (as a rule, at least 10 years);

· Consent-based user/marketing data – until consent is withdrawn or at most 3 years from the last activity;

· Analytics data from cookies – in accordance with the periods stated in the Cookie Policy.

7. Rights of the data subject

In accordance with the Law on Personal Data Protection and the GDPR, every person whose personal data is processed has the right to:

· Access their own personal data;

· Rectification of inaccurate or incomplete data;

· Erasure of data ("right to be forgotten"), where applicable;

· Restriction of processing;

· Data portability;

· Object to processing based on legitimate interest or direct marketing;

· Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;

· Lodge a complaint with the Personal Data Protection Agency (AZLP), ul. "Pelagoniska" bb, 1000 Skopje, www.azlp.mk, if the data subject believes their rights have been violated.

Requests to exercise these rights are submitted to the Data Protection Officer at [email protected], and the Trader responds within the statutory deadline (as a rule, within 30 days at the latest).

8. Data security

The Trader takes appropriate technical and organisational measures (access control, encryption of data in transit for payments via a certified payment processor, regular system updates) to protect personal data from unauthorised access, loss, misuse or destruction.

9. Minors

The Website is not intended for persons under 15 years of age. The Trader does not knowingly collect personal data from minors without the consent of a parent/guardian, in accordance with the Law on Personal Data Protection.

10. Changes to this Policy

The Trader reserves the right to update this Privacy Policy periodically. Any change is published on the Website with the date of the last change indicated.

11. Contact

For all questions related to personal data protection, data subjects can contact the Data Protection Officer at [email protected]