PRIVACY POLICY

1. Data Controller

The controller of the personal data collected and processed through the Art Studio DADA website is:

SAMOSTALNA ZANATSKA RADNJA ZA UMETNIČKE PREDMETE DADA DJORDJE MASNIKOVIC PR BEOGRAD (VOŽDOVAC)
Company Registration Number: 54555075
Address: Borivoja Stevanovića 53, Belgrade, Serbia
Email: info@artstudiodada.com
Telephone: +381 64 110 5380

Hereinafter referred to as “DADA” or the “Data Controller.”

DADA respects the right to privacy and is committed to protecting the personal data of its website visitors, customers and other individuals who communicate with DADA through its website.

This Privacy Policy explains what personal data DADA collects, the purposes for which it processes such data, how the data is protected, how long it is retained and what rights individuals have in relation to their personal data.

2. What Data Do We Collect?

Depending on how you use the Art Studio DADA website, we may collect the following personal data:

2.1. Data Collected When Making a Purchase

When you place an order, we may collect the information necessary to process and fulfil the order, including:

First and last name;

Delivery address;

Email address;

Telephone number;

Information required for issuing an invoice;

Information about the products ordered and the contents of the order.

2.2. Data You Provide When Communicating with Us

If you contact us through a contact form, email, telephone or other communication channels, we may process the information you provide, including:

First and last name;

Email address;

Telephone number;

The content of your message or request;

Other information you voluntarily provide when communicating with us.

2.3. Newsletter and Promotional Communications

If you subscribe to our newsletter or consent to receiving promotional messages, we may collect and use:

Email address;

Name, if provided.

2.4. Technical Data

When you use the website, certain technical data may be collected automatically, depending on the settings and technologies used. This may include:

IP address;

Browser and device information;

Information about how the website is used;

Information collected through cookies and similar technologies.

DADA collects only the data necessary for a specific processing purpose and endeavours to ensure that the processing is proportionate and limited to what is necessary.

3. For What Purposes Do We Use Your Data?

DADA processes personal data only to the extent necessary to achieve a specific and legitimate purpose. Personal data may be processed for the following purposes:

3.1. Processing and Fulfilment of Orders

Data is used to receive, confirm, process and fulfil orders, as well as to communicate with customers regarding the products they have ordered.

3.2. Product Delivery

Data is used to arrange and complete delivery, including transferring the information necessary for delivery to the selected delivery service provider.

3.3. Issuing Invoices and Complying with Legal Obligations

Data is processed to issue invoices, maintain legally required records and fulfil other obligations arising for DADA under applicable laws and regulations.

3.4. Communication with Users

Data is used to respond to users’ questions, messages and requests, and to communicate regarding products, orders, complaints, refunds and other user requests.

3.5. Newsletter and Promotional Communications

Where a user has given consent, their email address may be used to send newsletters and information about new artworks and products, special offers, benefits and other promotional content from Art Studio DADA.

Users may withdraw their consent to receive promotional messages at any time.

3.6. Website Security and Improvement

Certain data may be processed to ensure the secure and proper functioning of the website, prevent misuse, identify technical issues, and analyse and improve the website’s content, functionality and user experience, in accordance with applicable laws and regulations.

4. Legal Basis for Processing

DADA processes personal data on the basis of one or more legal grounds provided for under applicable laws and regulations, depending on the purpose for which the data is processed.

4.1. Performance of a Contract

Data necessary to process and fulfil an order is processed for the purpose of entering into and performing a contract for the purchase of products, or taking steps at the user’s request prior to entering into a contract.

This includes, among other things, processing data required to receive and process orders, communicate with customers, issue invoices and arrange delivery.

4.2. Compliance with Legal Obligations

DADA processes certain personal data where such processing is necessary to comply with legal obligations, including obligations arising under accounting, tax, consumer protection and other applicable laws and regulations.

4.3. Consent

Where required by law, DADA processes personal data on the basis of the user’s consent.

Consent may relate, in particular, to receiving newsletters and promotional messages, as well as to certain types of cookies and similar technologies where consent is required for their use.

Users may withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

4.4. Legitimate Interests

DADA may process certain data where processing is necessary for the purposes of DADA’s legitimate interests, except where such interests are overridden by the interests or fundamental rights and freedoms of the individual concerned.

Legitimate interests may include, for example, protecting the website and information systems, preventing misuse, ensuring business security, and establishing, exercising or defending legal claims.

5. Who May We Share Your Data With?

DADA may make personal data available to third parties only where necessary to achieve a specific processing purpose, fulfil an order, provide a particular service, comply with legal obligations or protect DADA’s legitimate interests.

Depending on the specific purpose, data may be disclosed to the following categories of recipients:

5.1. Delivery Service Providers

For the delivery of ordered products, the information necessary to complete the delivery may be provided to BEXEXPRESS, the selected courier service provider.

This may include, in particular, the recipient’s first and last name, delivery address, telephone number and other information necessary to deliver the shipment successfully.

5.2. Banks and Payment Service Providers

Depending on the payment method selected, data required to process a transaction may be processed by banks and other authorised payment service providers.

DADA does not collect or store complete payment card details where card payments are processed through an external payment service provider.

5.3. IT, Hosting and Technical Service Providers

Data may be made available to providers of website hosting, website maintenance, technical support, information system security and other IT services, to the extent necessary for the proper and secure functioning of the website and DADA’s business operations.

5.4. Newsletter and Electronic Communication Service Providers

If a user subscribes to the newsletter or consents to receiving promotional messages, their data may be processed through an engaged electronic communication service provider, including Klaviyo, which DADA may use for newsletters and promotional communications.

5.5. Analytics and Marketing Service Providers

If DADA uses analytics, advertising and digital campaign performance measurement tools, certain data may be processed by the relevant service providers, including Google and Meta, in accordance with applicable laws and the settings governing cookies and other tracking technologies.

5.6. Accounting, Legal and Other Professional Service Providers

Data may be made available to accounting firms, legal advisers and other professional service providers where necessary to comply with legal obligations, conduct business operations or exercise and protect DADA’s rights and legitimate interests.

5.7. Competent Authorities

DADA may disclose personal data to courts, government authorities, inspection bodies and other authorised institutions where such disclosure is required by law or is necessary to establish, exercise or defend legal rights and interests.

5.8. Data Protection by Engaged Processors

Where DADA engages another entity to process personal data on its behalf, such processing will be governed by an appropriate agreement or other legally binding instrument, in accordance with applicable personal data protection laws. The processor may process data only for the agreed purpose and in accordance with DADA’s appropriate instructions.

6. Transfers of Data Outside Serbia

In connection with the use of certain information technology, technical, communication, marketing and other services engaged by DADA, personal data may be transferred to and processed outside the territory of the Republic of Serbia.

Such transfers may relate, among other things, to data processed through electronic communication service providers, hosting providers, cloud infrastructure, analytics, digital advertising and other information services.

DADA will transfer personal data outside the Republic of Serbia only where the conditions prescribed by applicable personal data protection laws and regulations have been met.

Depending on the country or international organisation to which the data is transferred, the transfer may be based on an adequacy decision or appropriate safeguards, including standard contractual clauses or other legally permitted protection mechanisms.

Where data is transferred through external service providers that process data outside the Republic of Serbia, DADA will take appropriate measures to ensure a level of data protection consistent with applicable laws and regulations.

Information about specific data recipients and the countries to which data may be transferred may depend on the service providers used and their technical and organisational arrangements.

7. How Long Do We Retain Your Data?

DADA retains personal data only for as long as necessary to fulfil the purpose for which it was collected or for the periods prescribed by applicable laws and regulations.

The retention period depends on the type of data, the purpose of processing and DADA’s legal obligations.

7.1. Order-Related Data

Data relating to orders, purchases and communication with customers is retained for the period necessary to fulfil the order, enable customers to exercise their rights, resolve any complaints and protect DADA’s legal interests.

After the period during which retention is necessary has expired, the data is deleted, anonymised or its retention is restricted, unless there is a legal obligation to retain it for a longer period.

7.2. Accounting and Tax Data

Data contained in invoices, accounting documents and business records is retained for the periods prescribed by accounting, tax and other relevant laws and regulations.

Retention periods vary depending on the type of documentation. For example, certain accounting documents must be retained for at least five years, while longer retention periods apply to certain business books and financial statements.

7.3. Communication Data

Data contained in communications conducted by email, contact form, telephone or other channels is retained for as long as necessary to respond to a request, complete the communication or resolve the specific matter.

Where communication constitutes documentation relevant to exercising or defending DADA’s legal rights and interests, it may be retained for a longer period in accordance with applicable laws and regulations.

7.4. Newsletter and Promotional Communications

Data used to send newsletters and promotional messages is retained until the user withdraws their consent or unsubscribes from the mailing list, unless another legal basis exists for further retention.

Following unsubscribing, DADA will remove the data from the active promotional mailing list, except for information that may be retained to the extent necessary to record the unsubscribe request or prevent further unwanted messages.

7.5. Technical Data and Cookies

Data collected through cookies, analytics tools and similar technologies is retained according to the purpose for which it was collected, the settings of the technologies used and the retention periods applied by the relevant service providers.

More detailed information about individual types of cookies and their retention periods will be provided in the Cookie Policy or in the relevant settings on the website.

7.6. Deletion of Data

Once the period during which data retention is necessary has expired, DADA will delete, destroy, anonymise or otherwise remove the data from active processing, unless a legal obligation or another legal basis requires further retention.

8. User Rights

Individuals whose personal data is processed have rights under applicable personal data protection laws and regulations. Depending on the circumstances and the legal basis for processing, users may exercise the following rights:

8.1. Right of Access

Users have the right to request confirmation from DADA as to whether their personal data is being processed, as well as access to that data and information about the purpose of processing, the categories of data, the recipients of the data and the retention period.

Users also have the right to request a copy of the personal data being processed about them.

8.2. Right to Rectification and Completion

Users have the right to request the rectification of inaccurate personal data and the completion of incomplete data.

8.3. Right to Erasure

Users have the right to request the erasure of their personal data where the legal requirements for erasure are met, particularly where the data is no longer necessary for the purpose for which it was collected or where consent has been withdrawn and no other legal basis for processing exists.

This right may be restricted where DADA is legally required to retain certain data or where another legal ground for continued retention applies.

8.4. Right to Restriction of Processing

Users have the right to request restriction of the processing of their personal data in the circumstances provided for by law, for example where they contest the accuracy of the data or consider the processing unlawful but do not request its erasure.

8.5. Right to Data Portability

Where the legal requirements are met, users have the right to receive the personal data they have provided to DADA in a structured, commonly used and machine-readable format and to transmit that data to another controller.

8.6. Right to Object

Users have the right to object to the processing of their personal data in the circumstances provided for by law.

In particular, users have the right to object at any time to the processing of their data for direct marketing purposes, including profiling related to direct marketing. In such cases, the data may no longer be processed for direct marketing purposes.

8.7. Right to Withdraw Consent

Where processing is based on the user’s consent, the user has the right to withdraw that consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

8.8. Right to Lodge a Complaint with the Commissioner

If users believe that their personal data has been processed in breach of applicable laws and regulations, they have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection.

9. How Can You Exercise Your Rights?

Users may exercise their rights relating to the processing of personal data by submitting a request to DADA.

9.1. How to Submit a Request

A request may be submitted:

By email to info@artstudiodada.com;

In writing to the following address:

SAMOSTALNA ZANATSKA RADNJA ZA UMETNIČKE PREDMETE DADA DJORDJE MASNIKOVIC PR BEOGRAD (VOŽDOVAC)
Borivoja Stevanovića 53
Belgrade, Serbia

A request may be submitted in any format; no specific form is required.

9.2. Contents of the Request

To enable efficient processing, users should include the following information in their request:

First and last name;

Contact details to which they wish to receive a response;

A description of the request or the right they wish to exercise;

Where necessary, additional information that may help DADA identify the relevant personal data.

Where there is a reasonable doubt regarding the identity of the person submitting the request, DADA may request additional information necessary to verify their identity, in accordance with applicable laws and regulations.

9.3. Response Time

DADA will respond to the user’s request without undue delay and no later than 30 days from the date of receipt of the request.

Where necessary due to the complexity or number of requests, this period may be extended by a further 60 days. DADA will inform the user of any extension and the reasons for it within 30 days of receiving the request.

9.4. If DADA Does Not Act on the Request

If DADA does not act on a request, the user will be informed of the reasons for this decision, as well as of their right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection or to pursue other legal remedies provided by law.

10. Cookies

The Art Studio DADA website uses cookies and similar technologies to ensure the proper functioning of the website, improve the user experience, analyse website usage and, where applicable, support digital advertising and promotional activities.

10.1. Strictly Necessary Cookies

Strictly necessary technical cookies enable the website to function properly and securely, including certain functionalities requested by the user.

These cookies are necessary for the operation of certain parts of the website and cannot be disabled through the consent management system, except through browser settings, which may affect website functionality.

10.2. Analytics Cookies

If DADA uses analytics tools such as Google Analytics, these cookies may be used to collect information about how the website is used, page visits and user behaviour, with the aim of improving website content, functionality and the user experience.

Analytics cookies that are not necessary for the functioning of the website will be activated in accordance with applicable laws and the user’s choices.

10.3. Marketing and Advertising Cookies

If DADA uses digital advertising tools, including Google Ads and Meta Pixel, these technologies may enable advertising performance measurement, the display of more relevant advertisements and, where applicable, remarketing to users who have previously visited the website.

Such cookies and technologies will not be activated before the appropriate user consent has been obtained, where consent is legally required.

10.4. Managing Consent

On their first visit to the website, users may be shown a cookie consent banner through which they can accept or reject categories of cookies for which consent is required.

Users may change or withdraw their consent for non-essential cookies at any time through the available cookie settings on the website.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

10.5. Third-Party Cookies

Certain website functionalities may use third-party services that place their own cookies or use similar technologies.

This may include providers of analytics, marketing, payment, communication and other digital services used by DADA on the website.

10.6. Browser Settings

Users may control, restrict or delete cookies through their browser settings.

Disabling strictly necessary cookies may affect the proper functioning of certain parts of the website.

11. Data Security

DADA implements appropriate technical, organisational and personnel measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking into account the nature and risks of the processing.

Depending on the type of processing and the systems used, security measures may include:

Access controls for personal data;

Restricting access to personal data to authorised individuals who need the data to perform their duties;

Implementing appropriate security measures for information systems and the website;

Protecting data during transmission and storage, where necessary;

Regularly updating and maintaining the systems used to process data;

Measures to prevent unauthorised access, loss or misuse of data;

Appropriate procedures for responding to security incidents.

DADA endeavours to ensure the ongoing confidentiality, integrity and availability of the data and systems used for processing, as well as the ability to restore timely access to data in the event of a technical or physical incident.

Individuals authorised to access personal data may process such data only within the scope of their authorisation and in accordance with DADA’s instructions, or where such processing is required by law.

In accordance with applicable laws and regulations, DADA will take appropriate measures in the event of a personal data breach, including notifying the competent authorities and, where necessary, informing the individuals concerned. Among other things, the law requires the Commissioner to be notified of a personal data breach that may pose a risk to the rights and freedoms of natural persons without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

12. Changes to This Privacy Policy

DADA may periodically amend or supplement this Privacy Policy to reflect changes in the way personal data is processed, the technologies used, DADA’s business operations or applicable laws and regulations.

The current version of the Privacy Policy will be published on the Art Studio DADA website and will apply from the date of publication, unless otherwise stated in the Policy itself.

Where significant changes may affect users’ rights or position, DADA will, where necessary, take appropriate measures to ensure that users are informed of the changes in a timely manner.

We recommend that users review this page periodically to remain informed about the current version of the Privacy Policy.

Last updated: 7 September 2026.