PRIVACY POLICY OF PLOOM.RS WEBSITE AND OTHER ACTIVITIES REGARDING THE PRESENTATION AND SALE OF PLOOM PRODUCTS
Effective as of May 8, 2024
1. General notes
JT INTERNATIONAL AKCIONARSKO DRUŠTVO SENTA, with its registered seat at Subotički put 25, Senta, Republic of Serbia, registration number: 08052441, tax ID number: 101102656 (“We” or “JTI”), a member of the JTI group of companies (“JTI Group”), respects your privacy. This notice will help you understand our privacy policies, and we kindly ask you to read it thoroughly.
In terms of the applicable laws of the Republic of Serbia, this Privacy Policy represents comprehensive information regarding the processing of personal data related to the presentation and sale of Ploom brand products, specifically an electronic device for heating non-burning tobacco product, as well as related components, accessories, or additional equipment (“Products”). Accordingly, this Privacy Policy applies to data collected in interaction with individuals through the website www.ploom.rs (“Website”), as well as through mail, email, telephone, and other available means outside the Website (e.g., at the point of sale).
The presentation and sale of Products are intended and permitted exclusively for individuals within the territory of the Republic of Serbia who are at least 18 years old, considering the nature of the Products and related regulatory and company restrictions in this regard. Therefore, please read our Terms of Use (of the Website) and General Terms (of sale of the Products). Besides the Website, our Products are presented and sold at other locations, so the Privacy Policy, as mentioned above, also applies to the collection and processing of personal data occurring in that manner (outside the Website).
If you do not agree with any rule of our Privacy Policy, please refrain from using the Website or providing us with your personal data in any way (via the Website or otherwise).
JTI may occasionally modify and improve this Privacy Policy, in which case it will ensure that the updated version is available on the Website, clearly indicating the date of application. We encourage you to check if there have been any changes to the Privacy Policy since your last visit and, if so, familiarize yourself with the content of the new policy. If you do not agree with the new rules, please refrain from using the Website and providing your data in any way. Regarding data for which you previously gave consent for processing, you have the right to withdraw your consent (more information in section 11 of this Privacy Policy).
You can access the current Privacy Policy text through a shortcut at the bottom of the Website whenever you have internet access. By continuing to use the Website, we will consider that you have read and understood the current Privacy Policy and agree to all its rules.
The provisions of the Republic of Serbia, specifically the Law on Personal Data Protection (Official Gazette RS No. 87/2018) (“LPDP”) and related sub-legal acts, apply to this Privacy Policy and its potential amendments and supplements.
2. Data controller, joint controllers, and Data Protection Officer of the data controller
The data controller for your data is:
| Business name: | JT INTERNATIONAL AKCIONARSKO DRUŠTVO SENTA |
| Address: | Subotički put 25, 24400 Senta, Republic of Serbia |
| Company number: | 08052441 |
| Tax ID number: | 101102656 |
| Email: | [email protected] |
| Phone: | +381112050300 |
If you have any questions or concerns regarding your data that we hold, or to exercise your rights under section 11 of this Privacy Policy, please contact our Data Protection Officer:
| Business name: | Advokat Ivana Ružičić |
| Email: | [email protected] |
| Phone: | +381114208020 +381114208021 |
Regarding certain data, i.e., processing necessary for the conclusion and execution of contracts for the sale of Products through the electronic (online) store available on the Website (“E-store”), and handling of stated complaints regarding non-conformity of Products purchased through this method, JTI acts as a joint controller with another legal entity that operates the E-store. This legal entity is MERCATA VT DOO NOVI SAD, with its registered seat at Temerinska 102, Novi Sad, Republic of Serbia, registration number: 08762023, tax ID number: 101695403, contact phone: +381 21 310 3300, email address: [email protected] (“MERCATA VT”).
Namely, according to the agreement concluded between JTI and MERCATA VT, and their obligations and responsibilities stipulated therein, MERCATA VT is considered the seller of Products within the meaning of applicable regulations, especially the provisions of the Law on Consumer Protection (Official Gazette RS No. 88/2021). Accordingly, by a specific agreement between the Controller and MERCATA VT regarding personal data protection, they are jointly considered data controllers within the meaning of the LPDP provisions. In this regard, we inform you that:
- as previously mentioned, the Controller and MERCATA VT are considered joint controllers regarding the following personal data:
- data necessary for the conclusion and execution of contracts: name and surname; age (information that the person is 18+ years old); delivery address; email address; phone number; data for obtaining sales incentives related to Campaigns (e.g., the number of points affecting the calculation of the retail price of Products); and
- data necessary for handling complaints regarding non-conformity of Products purchased through the E-store: name and surname; age (information that the person is 18+ years old); email address; phone number; product delivery address; purchase details (date and product);
- the Controller and MERCATA VT are individually, i.e., independently responsible for compliance with the LPDP provisions and other regulations governing the relevant matter, i.e., each of them bears full responsibility solely and exclusively for their own activities, actions, and omissions regarding personal data they are considered joint controllers for, i.e., their processing, which particularly includes, but is not limited to, taking data protection measures;
- the Controller and MERCATA VT have appointed a common contact person for the data subjects, responsible for communicating with them regarding the provision of prescribed information about processing and exercising their rights regarding the processing of personal data they are considered joint controllers for, as well as for communicating with competent authorities regarding the processing of personal data, whom you can contact:
- via phone at +381112050300; or
- via email at [email protected].
3. From whom do we collect data?
We may collect your personal data in several ways:
- Directly from you when you provide us with your information. For example, when you contact us through the Website or at another sales point, or via mail, email, or phone, and leave your contact details for us to respond to your inquiry or request; and/or
- Automatically when using the Website. In this case, we (or our partners, i.e., third parties, on our behalf) use technologies such as cookies. Please read more information about how we use cookies in section 5 of this Privacy Policy.
4. Data we process, how we use it, and on what basis
JTI collects data that is appropriate, relevant, and limited to what is necessary for the specific purpose of processing. We use or may use your data to achieve multiple pre-defined purposes. Each processing action we take has an appropriate legal basis as prescribed by the LPDP provisions.
We may compare and combine data directly collected from you with data we collect automatically. This means that data collected as anonymous (e.g., frequency of visiting specific content on the Website) may become personal data (e.g., how often you visit specific content on the Website). This allows us to provide you with a personalized experience when visiting the Website.
Additionally, we may anonymize certain data for statistical and analytical purposes, where individual data subjects cannot be directly or indirectly identified. For example, we may obtain data about the percentage of users who visited specific content on the Website and use these trends to change and improve the content.
Please note that the Website is purposefully created to achieve its purpose through interaction with you and insight into your activities on it and/or the data we directly collect from you or automatically when you use the Website. Therefore, in order to offer you relevant content, interest you in additional content, strengthen our relationship with you, or involve you in our loyalty programs and reward you accordingly, it is necessary for us to know which content categories interest you, whether you have visited certain content, and similar details.
JTI processes or may process some or all of the data listed here. JTI continually works on the development of the Website and improving available services, which may result in processing certain data, listed below, starting at a later time as the Website functionalities expand or the scope of data we process increases. In such cases, we will amend this Privacy Policy and inform you accordingly, in accordance with the LPDP. Also, the extent of data we process depends, for example, on how you use the Website or your cookie settings.
For better clarity and understanding, information regarding your personal data that may be subject to processing, as well as the purposes and legal basis for processing, are divided into two main categories:
- personal data that may be subject to processing related to the use of the Website; and
- personal data that may be subject to processing related to your activities outside the Website.
4.1. Personal data that may be subject to processing related to the use of the Website:
You can use the Website as:
- visitor (without registration);
- registered user (with a created account); and
- product buyer through the E-store (who is also a registered user).
4.1.1. Personal data of Website visitors that are or may be subject to processing:
| Data | Purpose of processing | Legal basis of processing |
| Age (data indicating that you are 18+ years old), country of residence (Republic of Serbia) | Compliance with the Terms of Use of the Website, as its content is intended exclusively for adult individuals residing in the territory of the Republic of Serbia | Our legitimate interest in ensuring compliance with the Terms of Use of the Website and implementing our social responsibility policy in the territory where we operate |
| First name, last name, email address | Communication with you - responding to your questions and requests sent to us via the Website, i.e., the contact form available on it | Our legitimate interest in responding to inquiries and requests from interested individuals and/or users of the Products |
| Data on user activities on the Website collected through cookies | Enabling the functioning of the Website, creating a general strategy for its content in line with user preferences to improve user experience and enhance the Website, our Products, and services | Your consent |
4.1.2. Personal data of registered users of the Website that are or may be subject to processing:
| Data | Purpose of processing | Legal basis of processing |
| Age (data indicating that you are 18+ years old), country of residence (Republic of Serbia) | Compliance with the Terms of Use of the Website, as its content is intended exclusively for adult individuals residing in the territory of the Republic of Serbia | Our legitimate interest in ensuring compliance with the Terms of Use of the Website and implementing our social responsibility policy in the territory where we operate |
| First name, last name, date of birth, email address, phone number, password | Creating your account on the Website and accessing the account | Your consent |
| First name, last name, email address | Communication with you - responding to your questions and requests sent to us via the Website, i.e., the contact form available on it | Our legitimate interest in responding to inquiries and requests from interested individuals and/or users of the Products |
| Data on user activities on the Website collected through cookies | Enabling the functioning of the Website, creating a general strategy for its content in line with user preferences to improve user experience and enhance the Website, our Products, and services | Your consent |
| First name, last name, email address, or phone number | Sending marketing notifications, i.e., newsletters or electronic or SMS messages, at the user's choice and with the option to unsubscribe at any time, regarding various activities, news, and benefits related to our Products | Your consent |
| First name, last name, delivery address, email address, phone number | Delivery of prizes and promotional gifts to Ploom Club members | Your consent |
4.1.2.1. Data on so-called Leads, who are or may be subject to processing:
Regarding registration, i.e., creating a user account, we highlight that a specific type of registration is possible and available on the website www.discoverploom.rs which is related to the Website, i.e., the Products advertised and sold through it (“Lead Registration Website”).
Adult individuals from the territory of the Republic of Serbia interested in the Ploom electronic device for heating non-combustible tobacco product (“Device”), i.e., individuals considering purchasing the Device and wanting more information about it, can create a user account, i.e., register on the Lead Registration Website. Leads’ user accounts are used to receive free content related to the Device, and the Controller will contact them for marketing purposes.
In addition to the Lead Registration Website, lead registration is also possible at sales points, specifically at our partner's sales points (ManpowerGroup Serbia, i.e., “MPS”) and third parties.
Regarding Leads, the Controller will process, or may process, the data specified in the Personal Data Processing Notice available on the Lead Registration Website or highlighted at MPS’s or third-party sales points. Therefore, please carefully read the information contained in these notices.
If you use the aforementioned account to purchase Products through the E-store, please refer to the following, i.e., section 4.1.3. Privacy Policy.
4.1.3. Personal data of Product buyers through the E-store that are or may be subject to processing:
| Data | Purpose of processing | Legal basis of processing |
| Age (data indicating that you are 18+ years old), country of residence (Republic of Serbia) | Verifying compliance with prescribed conditions applicable to the sale of electronic devices for heating tobacco products Compliance with the Terms of Use of the Website, as its content is intended exclusively for adult individuals residing in the territory of the Republic of Serbia |
Compliance with legal obligations (prohibition of selling electronic devices for heating tobacco products to minors, in accordance with Article 71, point 11 of the Tobacco Act). Our legitimate interest in ensuring compliance with the Terms of Use of the Website and implementing our social responsibility policy in the territory where we operate. |
| First name, last name, date of birth, email address, mobile phone number, password | Creating your account on the Website and accessing the account | Your consent |
| First name, last name, shipping address, email address, phone number | Conclusion and execution of sales contracts for Products from the E-store | Execution of a contract with the data subject or taking pre-contractual measures at the data subject's request |
| First name, last name, address for product pickup, email address, phone number, purchase data (date and Product) | Receipt and resolution of complaints regarding Products purchased through the E-store | Compliance with legal obligations |
| First name, last name, email address | Communication with you - responding to your questions and requests sent to us via the Website, i.e., the contact form available on it | Our legitimate interest in responding to questions and requests from Product customers |
| Data on user activities on the Website collected through cookies | Enabling the functioning of the Website, creating a general strategy for its content in line with user preferences to improve user experience and enhance the Website, our Products, and services | Your consent |
| First name, last name, email address or phone number | Sending marketing notifications, i.e., newsletters or electronic or SMS messages, at the user's choice and with the option to unsubscribe at any time, regarding various activities, novelties, and benefits related to Products, including usage instructions and similar information | Your consent |
First name, last name, email address, phone number Voice recording, i.e., conducted conversation |
Managing our customer service (customer care), i.e., responding to questions and requests from customers or users of our Products, to address any difficulties and/or uncertainties regarding the Products, including filing complaints about the Products, to enable customers to exercise their rights in this regard Improving the performance of our customer service. |
Our legitimate interest in responding to questions and requests from our customers, i.e., users, and providing them with support and assistance in case of difficulties and/or uncertainties regarding the use of Products, as well as ensuring compliance with the General Terms Our legitimate interest in ensuring an appropriate manner and level of communication with customers, i.e., users of our Products, to establish a relationship of trust and strengthen relationships with users |
| First name, last name, shipping address, email address, phone number | Delivery of rewards and promotional gifts to Ploom Club members | Your consent |
| Data for exercising rights to various benefits and incentives related to the Controller's and its partners' campaigns, especially within the Ploom Club (e.g., first name, last name, phone number, points earned affecting the calculation of the retail price of Products) | Providing benefits and incentives related to the purchase of Products | The legitimate interest of the Controller and its partners to influence business outcomes, i.e., the success of our operations, through loyalty programs, i.e., by granting various benefits and incentives to consumers |
4.2. Personal data that may be subject to processing related to your activities outside the Website:
When it comes to your activities outside the Website, there may be processing of personal data of:
- Leads registered at the point of sale;
- buyers of Products at the point of sale.
4.2.1. Personal data that may be subject to processing regarding Leads registered at the point of sale:
See section 4.1.2.1. of the Privacy Policy.
4.2.2. Personal data that may be subject to processing regarding customers of Products at the point of sale:
| Data | Purpose of processing | Legal basis of processing |
| Name, surname, email address, phone number, purchase details (place and date of purchase, Product) | Managing customer service to respond to customer inquiries and complaints regarding the Product, and enabling customers to exercise their related rights |
Our legitimate interest in ensuring compliance with the General Terms |
| Name, surname, date of birth, email address, phone number | Registration or creation of a user account for receiving marketing communications, i.e., newsletters, electronic or SMS messages, at the user's choice with the ability to unsubscribe at any time, regarding various activities, updates, and benefits related to the Product, including product usage instructions and similar information, as well as for availing benefits and incentives related to the Controller's and its partners' campaigns | Your consent |
First name, last name, email address, phone number Voice recording, i.e., conducted conversation |
Managing our customer service (customer care), i.e., responding to questions and requests from customers or users of our Products, to address any difficulties and/or uncertainties regarding the Products, including filing complaints about the Products, to enable customers to exercise their rights in this regard Improving the performance of our customer service. |
Our legitimate interest in responding to questions and requests from our customers, i.e., users, and providing them with support and assistance in case of difficulties and/or uncertainties regarding the use of Products, as well as ensuring compliance with the General Terms Our legitimate interest in ensuring an appropriate manner and level of communication with customers, i.e., users of our Products, to establish a relationship of trust and strengthen relationships with users |
| Name, surname, delivery address, email address, phone number | Delivery of rewards and promotional gifts to Ploom Club members | Your consent |
| Data for availing benefits and incentives related to the Controller's and its partners' campaigns, especially within the Ploom Club (e.g., name, surname, phone number, points earned affecting the retail price calculation of the Product) | Providing benefits and incentives related to purchasing the Product | Legitimate interest of the Controller and its partners to influence the results or success of our business through a loyalty program by granting various benefits and incentives to consumers |
4.3. Personal data that may be subject to processing regarding any of the previously mentioned categories of individuals:
| Data | Purpose of processing | Legal basis of processing |
| Name, surname, contact information | Responding to your inquiries and requests regarding Products |
Our legitimate interest in providing all necessary information regarding the products to interested parties, understanding interests, and establishing and nurturing relationships with our customers or users |
| Name, surname, contact information | Responding to your inquiries and requests regarding personal data protection | Compliance with our legal obligations |
| Name, surname, contact information | Fulfilling obligations towards governmental and other authorities when we are required to disclose processed data | Compliance with our legal obligations |
| Name, surname, contact information | Legally protecting our interests, including conducting proceedings to protect these interests, prevent and/or limit damage that may occur for JTI | Our legitimate interest in lawfully protecting our company |
| Name, surname, email address | Notifying about changes to the Privacy Policy | Our legitimate interest in properly informing individuals about our data processing rules, sometimes also to comply with our legal obligations |
4.4. Consent for personal data processing
In accordance with the previous sections of this Privacy Policy section 4, certain data is processed based on your consent. You can provide valid consent for processing in several ways: by checking specific boxes on the website, by enabling certain cookies on the cookie banner on the website (by moving the slider from inactive to active status), by your oral or written statement or clear affirmative action, and even by a combination of some of these methods.
For example, when creating an account at the point of sale, you can give oral consent to the person collecting data on our behalf, in order to receive an email or SMS message containing a link to create a user password or a unique code on your mobile phone. By creating the password or communicating that code to the person, you confirm that you consent to the processing of your data for specific purposes based on consent, and this processing has been previously presented to you through the notice displayed at the point of sale.
For more information about your rights and the possibility of withdrawing consent, please carefully read section 11 of the Privacy Policy.
4.5. Entering phone numbers into the “Do Not Call” Register at RATEL
Recently in the Republic of Serbia, the so-called “Do Not Call” Register was established as a unique record of consumer telephone numbers who do not wish to receive calls and/or messages related to promotions and/or sales by phone.
In this regard, we note that a consumer's consent for direct marketing given before or after registration in the “Do Not Call” Register remains valid until revoked in accordance with the LPDP.
In other words, if you have given consent for processing your data in accordance with this Privacy Policy, the previous or subsequent registration of your phone number in the “Do Not Call” Register will not affect the validity of your consent, and we will be authorized to process your data until you revoke your consent in accordance with the LPDP.
5. Cookies
The Website uses cookies to provide you with the best user experience. They allow us to, for example, display Website content correctly on each of your devices or web browsers through which you access it, or to customize the content we place on the Website according to your interests. The information collected in this way may sometimes be personal data but may not necessarily be.
Cookies are simple text files stored in the user's web browser or on their device. The purpose of cookies is primarily to allow the website to “recognize” the user when they access it next time. In that situation, the website uses the data stored in the cookie to automatically obtain information about the user's previous activities on the website. Cookies cannot access your data stored on devices, but they can collect data about your online activities.
Cookies are not harmful to the user or their device and should not be confused with viruses. Cookies do not contain viruses or other malware (malicious software).
Depending on how long they are retained in the user's web browser, we distinguish between session cookies (which are retained only during a specific browsing session and are automatically deleted after it ends, serving to allow you access to specific content) or persistent cookies (which “remember” information for the next website visits, are retained for a longer or shorter period until you manually delete them or until they expire according to the specified duration).
According to their ownership, there are first-party cookies (cookies set by JTI as the owner of the website you are browsing) and third-party cookies (cookies set by our selected partner companies that provide us with various services, e.g., analytical because they collect and process certain data about website usage and provide us with information in anonymized form, or enable related content to be displayed on their websites or other locations on the Internet).
Cookies may contain various information and be used for different purposes. When the Website allows you to choose or disable certain cookies and you opt for that option, it may reduce the functionality of the Website. Also, keep in mind that you will need to disable the settings you have chosen on each other device or web browser separately.
The Website uses the following types of cookies:
5.1. Strictly necessary cookies:
These cookies are essential for the operation of the Website and its proper display on the user's device. They are used to enable your login to access your account on the Website. You cannot disable these cookies due to their importance for the Website's functionality. If you set your web browser to block these cookies, some parts of the Website may not function correctly.
You can review the strictly necessary cookies used by the Website in the table below:
| Cookie name | Storage period | Description |
| JSESSIONID | Session | This cookie's purpose is to identify a user session on the website. When a user visits the website, this cookie is created to identify a unique user session during their visit. This allows the server to link requests to the corresponding user session and maintain session state while the user browses the website. |
| _GRECAPTCHA | Persistent | This cookie enables the activation of the reCAPTCHA service, designed to protect websites from spam software and abuse by „non-human“ visitors (helps distinguish human users from bots). |
| ApplicationGatewayAffinityCORS | Session | The function of this cookie is to maintain a session on Windows Azure Application Gateway, even on cross-origin requests. It is used to maintain user session on Windows Azure Application Gateway, even when requests are sent from other websites (cross-origin requests). This ensures that user traffic is directed to the appropriate server and maintains session state during certain activities on the website. |
| OptanonConsent | Persistent | The purpose of this cookie is to store information about the user's consent for using cookies. It stores information about whether the user has given consent for the use of specific categories of cookies on the website. This allows website owners to adjust cookie settings according to user preferences and privacy policies. |
| ApplicationGatewayAffinity | Session | The role of this cookie is to maintain user session on Windows Azure Application Gateway. Similar to ApplicationGatewayAffinityCORS, this cookie is used to maintain user session on Windows Azure Application Gateway. This allows the user to be assigned the same server during certain parts of the website visit, ensuring continuity in browsing experience. |
| OptanonAlertBoxClosed | Persistent | This cookie is used in the context of cookie consent solutions, such as OneTrust or similar. It is activated when website visitors see a cookie notice or notification and close it. The function of this cookie is to remember that the user has closed the cookie notice or notification. This way, the website knows that the user has already seen the notice and does not show the same message again during each visit. This improves user experience by avoiding unnecessary repetition of notifications. |
5.2. Performance Cookies:
These cookies help us understand how users use our Website, allowing us to constantly tailor it to user preferences. Based on these cookies, we gather information about the number of visits, which pages of the Website are most and least visited, what content users access on the Website, in what order, and similar information. We collect this information from a third party in an aggregated form, making the data anonymous. If you do not allow us to use these cookies, we will not be able to track website usage and its performance in the described manner.
Here is an overview of the performance cookies used by the Website:
| Cookie name | Storage period | Description |
| glide_user_session | Persistent | The purpose of this cookie is to maintain the user session in the LiveChat application. When a user uses the LiveChat application, this cookie is used to preserve the user session. This means that the user's session state will be maintained even when requests are load balanced from one server to another within the application. This allows continuity in communication and user experience during the use of LiveChat. |
| guest_session_identifier | Session | The role of this cookie is to manage the session of an unauthenticated user in the LiveChat application. Specifically, this cookie allows the LiveChat application to efficiently manage the session of users who are not authenticated. It preserves the session state for these users to ensure proper functioning of the application and interaction with unauthenticated visitors. |
| glide_user_route | Persistent | The purpose of this cookie is to define the server (or node) in the LiveChat cluster that will handle the user's request. When a user interacts with the LiveChat application, this cookie defines which server (or node) in the cluster will process the user's request. This enables consistency in request processing and optimizes application performance by directing user requests to the appropriate servers in the cluster. |
| glide_user | Persistent | This cookie is used to identify the user or preserve the user session within the LiveChat application. Specifically, when a user uses the LiveChat application, this cookie is used to restore the user session to avoid data loss or progress during interaction with the application. |
| _ga | Persistent | This cookie is used to track user interactions on the website for analytics purposes. The function of the cookie is to identify unique users of the website. When a user visits the website, this cookie assigns a unique identifier (ID) to them. This ID is used to track user sessions, count visits, and analyze user behavior on the website. This cookie is associated with the Google Universal Analytics service. Google Analytics uses this cookie to generate reports on visit statistics, such as the number of visitors, session duration, traffic sources, and other metrics that help website owners understand and optimize their online presence. |
5.3. Functional Cookies:
These cookies do not collect data that identifies the visitor. All information collected by these cookies is aggregated and therefore anonymous. They are used only to improve the functioning of the Website.
Below an overview of the functional cookies used by the Website:
| Cookie name | Storage period | Description |
| BIGipServerpool_jtigccqas | Session | This cookie is used to manage sessions on servers that are part of a server pool balanced by load balancing. The function of this cookie is to enable servers in the server pool to maintain session continuity with users. When load balancing is used, user requests are distributed to different servers in the server pool to optimize system availability and performance. The cookie helps maintain session state properly so that the user's request is always directed to the appropriate server that will continue the session where the user was. |
5.4. Targeting Cookies:
These cookies are typically third-party cookies, which means they are set by partner companies like Google and are used to create visitor interest profiles for displaying relevant ads on other websites. They usually do not store personal data but uniquely identify your web browser and device.
Here is an overview of the targeting cookies used by the Website:
| Cookie name | Storage period | Description |
| _gat* | Persistent | This cookie is used to control the request speed on the server when collecting data about visits to the website. This helps maintain server performance and proper functioning of Google Analytics visit analysis. |
| _gid | Persistent | The purpose of this cookie is to identify users and track their interactions on the website for Google Analytics analysis purposes. When a user visits a web page, this cookie assigns a unique identifier (ID) to them, which is used to track their interactions on the page. This allows Google Analytics to generate reports on user activities and visit statistics. |
| visitor_frequency | Persistent | The role of this cookie is to store information about the frequency of user visits to the website. In other words, the cookie is used to store information about how often a user visits the website. This can be useful for personalizing user experience or for analyzing visitor behavior on the website. |
You can also find information about cookies in the pop-up banner available when opening the Website, before making your cookie choices for this Website. You can manage cookie usage at any time by selecting the appropriate settings in your web browser.
6. Data we do not process
JTI does not collect or process special categories of personal data, such as data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, or membership in a trade union, genetic data, biometric data for the purpose of uniquely identifying a person, data concerning health or data concerning a person's sex life or sexual orientation, nor data relating to criminal convictions, offenses, and security measures, nor data concerning minors.
Please do not disclose or send us this data.
7. Is there an obligation to provide data?
You are not obliged to provide us with your data; you do so voluntarily. This will, for example, be the case when you access your account and use our website, when you provide us with your address so that we can deliver the Product you purchased via the E-store, or when you contact us and provide your contact details so that we can respond to your question or request.
We will always provide the option to unsubscribe from certain services we provide in connection with the use of the website, such as sending newsletters or electronic and SMS messages. In this way, you retain control over how and to what extent your data is used, and we invite you to carefully read Section 11 of this Privacy Policy to learn about your other rights related to processing.
Please note that in some cases, we may not be able to carry out our activities if you refuse to provide us with your data (e.g., you will not be able to complete the product ordering process in the E-store if you do not provide us with your address or delivery address).
8. Recipients of personal data
Your data is primarily processed and used by JTI, and regarding the use of the E-store, by JTI and MERCATA VT.
In some cases, it may be necessary to make your data available to third parties, i.e., recipients. These can be:
- JTI Group members who help us respond to your questions or requests, or who assist us in carrying out our business activities and processes; or
- our business partners, who:
- help us maintain the functionality of the Website;
- provide product sales services (via the E-store and other sales points) and related services (e.g., certain data will be disclosed to a courier service with which MERCATA VT has a contract so that the products you purchased through the E-store can be delivered to you, or so that, in case of contract withdrawal or filing a complaint, the product can be retrieved from you);
- provide marketing services (finding individuals interested in the product, presenting the product, etc.); and
- provide other services (e.g., market research services, customer support, etc.).
In connection with the above, we will ensure that your data is handled lawfully and that third parties, i.e., data recipients, handle them solely in accordance with our instructions and these rules on personal data protection, as well as that they themselves apply appropriate technical, organizational, and personnel measures to protect personal data. Regardless of which third parties or recipients your data is made available to, you have rights guaranteed to you by the laws of the Republic of Serbia and listed in Section 11 of this Privacy Policy.
Also, there may be a legal obligation to make your data available to competent authorities (e.g., the Tax Administration, court, etc.).
9. Transfer of data abroad
We primarily use your data within the territory of the Republic of Serbia.
The data we collect is stored on servers located in Geneva, Switzerland, which are owned and controlled by our affiliated entity, JT International SA. In accordance with the policies of the JTI Group of companies, these servers are highly protected technically and with software.
Additionally, as mentioned earlier, certain members of the JTI Group assist us in responding to your requests, establishing and maintaining relationships with our users or customers, and generally in carrying out our business activities and processes. Thus, a member company of the JTI Group based in Greece, independently or through an external partner, provides customer care services to product users (customer service, responding to questions and requests regarding product use, etc.), which may involve the transfer of some of your personal data to these entities.
Furthermore, due to the technological solution used in the registration of leads and customers interested in receiving marketing communications (such as calls, SMS messages, and emails with product information, special offers, etc.), provided by a company based in Lithuania, there is a transfer of some of your data to that country.
Regarding the above, it is important to note that all three mentioned countries (Switzerland, Greece, and Lithuania) are on the List of countries, parts of their territories, or one or more sectors of specific activities in those countries and international organizations where an adequate level of data protection is considered to be ensured, as established by the Decision of the Government of the Republic of Serbia (Official Gazette of RS no. 55/2019).
If there is a need to make your data available to recipients in countries considered not to provide an adequate level of data protection, we will ensure an appropriate legal basis for such transfer, including the possible application of appropriate standard contractual clauses prepared by the competent supervisory authority or other suitable measures of protection, requiring the recipient to protect your data in accordance with the protection standards established by the regulations of the Republic of Serbia.
10. How Long Do We Keep Data?
We keep your data only for as long as necessary to achieve the purpose for which the data was collected, after which we will securely remove them from our systems and delete them.
In line with the above:
- data about Website users who have created their user account, or whose user account was created at their request at a sales point through the appropriate application, are kept for a period of six months from the date of collection or until the user account is deleted or consent is revoked, whichever occurs first (if they do not become product buyers in the meantime);
- data about product buyers through the E-store are kept until the rights and obligations under the sales contract are fully executed, but no more than two years from the date of delivery;
- data about product buyers outside the Website, for whom a user account was created with their consent, are kept until consent is revoked;
- data about individuals who submit requests for product non-conformity remedies are kept until the expiration of the statute of limitations for any related consumer claims;
- data about individuals who have consented to receive marketing communications, newsletters, or electronic or SMS messages about various product activities, novelties, benefits, including product usage instructions and similar information, are kept until consent is revoked;
- data collected in responding to consumer inquiries about products or personal data protection, including audio recordings of conversations with customer service, are kept for a maximum of three months after the last communication with the consumer or the person to whom the data relates;
- data related to benefits and incentives under the Operator's campaigns and its partners are kept for the duration of membership in the Ploom Club and two years thereafter.
Your data may be retained for a longer period if necessary to provide necessary information in case of any legal claims arising from your use of the website and/or our products, as well as when required by regulations or in the case of cookies (more information about cookies can be found in Section 5 of this Privacy Policy).
11. Your rights regarding data processing
It's important for you to know that you have certain rights regarding the processing of personal data that are guaranteed by law and can be exercised under specified conditions.
Right of Access - You have the right to request information about whether we are processing your personal data and to access that data. Upon your request, we will provide you with a copy of your processed data.
Right to Rectification and Amendment - You have the right to correct inaccurate data related to you without undue delay, as well as to supplement incomplete data, including providing an additional statement.
Right to Erasure of Data - You have the right to request the deletion of your data, especially:
(a) if he data is no longer necessary for the purpose for which it was collected or otherwise processed;
(b) if you have withdrawn your consent on which the processing was based, and there is no other legal basis for processing;
(c) if you have objected to processing in accordance with the law.
Right to Restrict Processing - You have the right to restrict the processing of your data if one of the following cases is met:
(a) if you dispute the accuracy of the data, for a period allowing us to verify the accuracy of personal data;
(a) if the processing is unlawful, and you oppose the erasure of personal data and request the restriction of data use instead;
(b) if we no longer need personal data for processing purposes, but you have requested them for the establishment, exercise, or defense of legal claims;
if you have objected to processing based on the legitimate interest of the controller, and an assessment is underway as to whether the legal basis for processing by JTI outweighs your interests.
Right to Object - If you believe it is justified in relation to your specific situation, you have the right to object at any time to the processing of your personal data based on the legitimate interest of the controller, including profiling based on these provisions.
Right to Data Portability - You have the right to receive personal data that you previously provided to us in a structured, commonly used, and machine-readable format, and the right to transfer this data to another controller without hindrance if processing is based on consent or a contract and is carried out by automated means. Also, you have the right for this data to be directly transferred to another controller if technically feasible.
Right to Withdraw Consent - If processing is based on your consent, you have the right to withdraw consent at any time, where withdrawal does not affect the lawfulness of processing based on consent before withdrawal.
Right to Lodge a Complaint - You have the right to lodge a complaint regarding the processing of your personal data with the competent supervisory authority in the Republic of Serbia. Below are its contact details:
- Commissioner for Information of Public Importance and Personal Data Protection
Address: Bulevar kralja Aleksandra 15, 11120 Belgrade, Republic of Serbia
Email: [email protected]
Phone: +381 11 3408 900
If you wish to exercise the above-mentioned rights, you can contact us in the following ways:
- by mail – at the address:
JT INTERNATIONAL AKCIONARSKO DRUŠTVO SENTA
Subotički put 25
24400 Senta
Republic of Serbia;
- by email - at the email address:
- by phone - at the number:
+381112050300.
12. Security of your data
The security of your data is very important to us. Therefore, JTI takes physical, technical, and electronic measures to protect against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access to personal data. These measures are directed at individuals both outside and within our organization because access to your data is limited only to those persons whose duties require such access and who are educated about data protection rules.
Unfortunately, there are no foolproof security systems, so we cannot guarantee that the security of the systems under our immediate control will never be compromised. In case of a personal data breach, we will take all available measures and inform the competent authorities in accordance with the regulations, as well as individuals whose data is concerned, if possible.
13. Final provisions
To avoid doubt, all matters not expressly regulated by this Privacy Policy will be governed by the laws of the Republic of Serbia, which law shall be applicable even in case of disputes regarding the Privacy Policy or data processing according to it, and such disputes shall be resolved before the competent court in Belgrade, Republic of Serbia.
The Privacy Policy is drafted in Serbian and English, and in case of any discrepancies between the mentioned versions, the Serbian language version shall prevail.
Are you over 18?
You must be 18 years old to enter this site.
Only existing adult smokers and users of vapes and other nicotine products in Serbia are permitted access to this
website and Ploom products. Ploom products are not smoking cessation aids or without risk and can be addictive.
See this page for more information.