Privacy policy E-way d.o.o. (hereinafter referred to as "the Company", "we") is part of the leading global online food ordering and delivery network, and the owner of the Littlebag web and mobile service. We take seriously your personal data protection, so we want to ensure that you feel secure every time you visit littlebag.eu. Below we will inform you about the information we collect during your visit in our website and mobile application and will explain how we use and process this information. If our website contains links to other sites, our privacy policy does not apply to those sites. Acceptance of this Privacy Policy means acceptance of processing your personal information by E-way d.o.o. in accordance with the Personal Data Protection Act and according to the purposes we describe below. Please take some time to read this Policy carefully. Data Controller The data controller is the main responsible part for the processing of your personal data and determines the processing means and purpose. In this case, the data controller is: E-way d.o.o. Braće Nedića 17/15 11104 Vračar Beograd Serbia Contact number: 063 / 245-430 Email: support@littlebag.eu If you oppose to E-way d.o.o. collecting, processing or using your personal information in accordance with the Law on Personal Data Protection, you can send a request to stop processing your personal data at support@littlebag.eu. This may limit your ability to use our service. Your rights You have the right to be informed about your personal data processed by E-way d.o.o. without charge. You have also the following rights: Right to Access - The right to access your data as well as information about how it is processed. Right to Rectification - The right to request your personal information to be modified. Right to Erasure - The right to request your personal information to be deleted. Right to Restriction of Processing - The Right to Demand Restriction of Processing of Personal Data. Right to Data Portability - The right to transfer personal data in a machine-readable format. Right to Object - The right to withdraw consent as well as objection to the processing of personal data. Automated decision making - The right not to be subject to decisions based solely on automated processing. Right of complaint - You can submit your complaint to the supervisory authority responsible for E-way d.o.o. If you wish to exercise any of these rights, you can contact us at: support@littlebag.eu The responsible supervisory authority for E-way d.o.o. is: Commissioner for Information of Public Importance and Personal Data Protection King Alexander Boulevard 15 Belgrade 11120, Serbia email: office@poverenik.rs When, why and how we collect your information In order to successfully perform our services and obligations to you, we must collect, process and sometimes share your personal information. In the table below you can see what personal data we need and for what purpose. You can also see under which conditions we share your information with third parties. Personal information is information that can be used, directly or indirectly, to identify you, such as your name, address, telephone number, date of birth, location information or email address. Please share with us only the information we really need. Since we want to provide you with a clear view, we present you an analytical explanation in table form. We believe that in such way we provide you with all information in a transparent, understandable and easily accessible-way, in a clear and plain language. The table below contains information we collect about your personal data. Since there are different types of data, we've grouped them into categories to make it easier for you to read. The personal information we use when you visit our site When you open our website to be inspired by your next order but do not register, we collect the following information: Data categories Explanation Connection data Page Visit Time, Date, Page Retention Time, Source, Proper IP Address, Other Process Information. We collect this information solely to display the web service. For data processing, we use only the necessary data that we process in accordance with the law, minimizing the scope of data to the basic. The personal information we collect when you visit our site and register When collecting your personal information, we want to collect as little information as possible. We are guided by the "less is better" policy, and all the information we collect has a strict and clearly defined purpose. In case you not only want to visit our web service but wish to log in and see your previous orders, we will collect the following personal information: Data categories Explanation Account Information Username, user ID, password Connection data time, date and duration of page usage, source, appropriate IP address, other process information Communication information comments, ratings, response to comments, communication made on our service Other information information you voluntarily share with us using our web service or application, but also information obtained from social networks or other public databases (e.g., user ID from other platforms) If you share with us another person's personal information, you must have the prior consent of that person. You are obliged to inform the persons whose information you share about the processing of personal data that complies with our Privacy Policy. The personal information we collect when you visit our site, register and submit your order If you want to try everything we offer, you will need to log in with your user account. The data collected depends on the information you share with us. In order to successfully process your order, you will need to complete the "required fields" provided for basic information. Without this information, we cannot process your order. You do not have to fill out the fields that are not required. However, if you choose to share such information with us, you will help us improve our service. The basic information we collect is as follows: Data categories Explanation User account information (required for delivery service) name, company (optional), address, telephone number and / or email address, date of birth Account Information username, user ID, password, user membership level Communication information comments, ratings or comments, email communication Connection information time, date and duration of site use, source, appropriate IP address, other process information Device information Device ID, operating system, and corresponding version or other device identifiers, geolocation data Order information ordering history Other information information you voluntarily share with us using our site, app, etc. Purpose and legal basis defined We only collect your personal information when necessary. Collection of personal information is required in order for us to provide you with our services. We collect and process data in accordance with Serbian Data Protection law. Consent of the data subject, legal obligations and legitimate interest are the legal bases on which we process our users’ personal data. You can find out the purpose and legal basis of data processing in the table below: What is the purpose Why we process data for this purpose The ordering and delivery process Your personal information is also processed during the ordering process. When you submit your order, depending on whether you are a registered user or a guest of the web service (if applicable), your account information is processed. We send the order to the store and then verify that the food delivery has been successfully completed. Categories of personal information: Account information Connection data Communication information Device information Order information Other information Legal basis: In order to secure your food delivery and to contact our partner stores, we need to have your personal details (contract fulfillment). Security and fraud prevention We want to offer you the best user experience and that’s why we believe that our relationship is important. However not every visitor is benevolent. To protect our platform and avoid potential risks, we must collect personally identifiable information that helps us identify potential threats. We also keep your information secure. Categories of personal information: Access information Connection data Legal basis: We are legally obliged to protect your information (in accordance with legal obligation) and protect our company (legitimate interest). Further processing of data according to legitimate interest Data processing based on legitimate interest is particularly important for our company for network and information security purposes as well as for direct marketing. We use your personal information according to our legitimate interest, provided that we do not compromise your rights and freedoms. In order to align our interests with your rights, we have introduced customized controls. The data processing described below is subject to a four-step test to ensure your rights and freedoms. As part of a four-step test, it is first verified that the data collected (1st personal data test) are personal data. It is then tested whether the purpose is lawful (2nd purpose test) and whether the personal data that will be collected are in accordance with the principles of data collection (3rd necessity test). At the very end, we also test the balance of interest (4th Balance Test). If we consider that we can protect your information from any risk, we will process it on the legal basis of legitimate interest. Processing on the basis of legitimate interest Explanation Advertising We will send you offers via vouchers, discounts and promotions, as well as questionnaires in order to improve our service via e-mail. You can always object to processing your information for advertising purposes. If you would like us to stop sending you offers or you want additional information, you can email us at: support@littlebag.eu. Email marketing Our goal is to prevent generic newsletter and uncontrolled marketing actions. That is the reason why we choose models tailored to your interests and contact you only when we believe you might like specific information. If you would like to stop processing your information for advertising purposes or you want additional information, you can email us at: support@littlebag.eu. Comments In case of a negative comment addressed to a store, related to the quality of food / delivery service, certain information (username and telephone number) is provided to partners (stores), aiming to resolve the complaint addressed to the store. The partner (store) processes the data based on the legitimate interest. Metrics In order to improve our own service, we collect various metrics that cannot be connected to you or your profile. This information helps us improve your advertising experience. Merger and acquisition, change of owner If a merger with another company occurs or our company is acquired by another company, we will transfer your information to that company. Of course, we will ask the company to harmonize the processing of your information with the Data Protection Law. Other information If you voluntarily choose to share non-mandatory information with us, you are helping us improve our service. This is information that you provide us when you visit our website or mobile application but also through other sources such as social networks or other public databases (e.g. user ID on other platforms) Quality assessment In order to offer you the best user experience, we regularly measure the success rate of marketing methods as well as the potential causes of failed marketing activities. When do we delete your information? We delete your personal information, according to the Serbian Data Protection Law, as soon as their purpose is fulfilled. Depending on the purpose of the data processing, different data deletion rules apply. The information collected also indicates the deletion rule. When the retention period expires, the stored data will be deleted. You can request us to delete your personal information by sending us an e-mail. If you do not request the deletion of your information, we will delete it ten years after its collection. We will delete your account if it remains inactive for more than ten years. We will firstly notify you about the upcoming deletion via e-mail, sent to the e-mail address linked to your account in our service. Despite the request for data deletion, due to legal provisions we are obliged to keep some of them. In addition to our data deletion policies, there are also data retention periods, with which we must also comply. For example, tax related data must be kept for six to ten years, and in some cases even longer. Specific retention periods depend on local legal requirements. Who do we share your information with? In this section we want to inform you with whom and under which conditions we share your information. We aim to share your information with third parties in a transparent way. What third parties have access to your personal information? We will never share your information to unauthorized third parties. As we cooperate with certain providers as part of our business, we provide them with limited and strictly monitored access to your personal information. Before sending personal information to our partners for processing, each company will be individually reviewed. All recipients of personal data must meet the requirements of legal data protection and must, with valid evidence, prove the necessary level of protection of personal data. In the table below, we want to inform you transparently and clearly about all of our data third party recipients and the reasons for sharing your personal information: The recipient of the data Reasons External service providers Members of E-way d.o.o. communicate with external service providers. External service providers support our business activities by evaluating and improving our marketing campaigns, providing personalized advertising, providing IT solutions, and perform audits. Members of E-way d.o.o. We always try to use our resources efficiently, which in this context means that we encourage each other to improve data processing. Given that personally identifiable information is processed, we would like to inform you that certain employed external service providers may also have limited access to our database. We offer shared content and services which includes technical support for our systems. You will not receive newsletters or other promotional material from our partners. Lawyer and Public Authorities Unfortunately, it may happen that some of our users or service providers do not act fairly and may want to harm us. In such cases, we are not only obliged by law to provide personal information to the competent authorities, but it is also our legitimate interest to avoid harm and pursue a lawsuit. Metrics In order to continuously provide you with the best user experience, we regularly evaluate the success or potential causes of failed marketing measures. That is why we analyze, for example, whether our newsletters and the content itself are being opened. Other information Information you provide us voluntarily while using the Website, Application or related activities, but also from other sources such as social media or other (public) databases (e.g., user-ID of other platforms) Which countries do we transfer your information to? Some processors who may have access to your personal data are based in foreign countries, primarily in the EU, or are included in the member states of the Council of Europe Convention 108. Data transfer to these countries is based on the default level of appropriate personal data protection applicable to these countries, in accordance with the law. If individual processors are located outside the above-mentioned group of countries, the transmission of data would be possible only under the provisions of Article 65 of the LPPC which regulate transmission under appropriate safeguards. Cookie information Definition of cookies and what cookies we use To make visits to our website attractive and optimize the use of some features, we use so-called cookies. Cookies are small text files stored on your browser. Some cookies are deleted after the browser session expires, or after your browser closes (called session cookies). Other cookies remain on your devices and can be used to identify you the next time you visit our website (persistent cookies). Within your browser, you can enable the option to be informed about cookie settings and decide whether to accept or deny cookies in specific situations or every time you visit the website. Blocking cookies may limit the functionality of our website. What categories of cookies are there Necessary cookies are required because they allow you to navigate and use the website and its functions. Without these cookies, the functionality of the website cannot be guaranteed. The functionality of the website includes all actions on the website (e.g. text input) and even navigation on the website. Functional cookies allow the website to store information that has previously been entered (e.g. username, language or location) and improve the ability to provide a better quality of service. These cookies collect anonymous information and cannot track you on other websites. Performance cookies collect information about your use of the website - e.g. which pages of our website the user frequently visits and if he ever receives error messages on our web service. These cookies do not store user identity information. The information collected is summarized (grouped) and anonymous. These cookies are used solely for the purpose of improving the operation of the site and in order to offer a better user experience. Cookies for marketing purposes are used for targeted advertising tailored to the user and his / her interests. They are used to restrict ads and measure the effectiveness of advertising campaigns. They record your visit to the website. This information may be shared with third parties (such as advertisers) for the purpose of improving targeting marketing and advertising. Complaints about the use of cookies If you do not want E-way d.o.o. to save information about your visit to our website, you can opt out. If you do not want to use cookies you can turn this option off in your browser. If you delete cookies or use other search engines, you will need to turn them off again on each individual browser or device.