Dear users,

There are several situations in which we process your personal information within the business activity we perform. More information can be found below in the following text.

This Privacy Policy provides information on who is the Data Controller, who are the Data Recipients (persons who transmit data in accordance with the terms of contract and legal provisions), which Personal Data we collect and process when you use our VendMIND application, why we collect this data, how we use it, which persons/societies have access to the collected data, which organizational and technical measures we apply in order to protect your data, how long we use your data and what rights you have to protect the data (hereinafter: "Privacy Policy").

This notice i.e. the Privacy Policy is addressed to all persons to whom the data pertains (i.e. the Data Subjects) and who use the VendMIND application (hereinafter: "Application"). When installing and/or using the Application, you agree with this Privacy Policy and acknowledge that you have read, accepted and understood the terms under which we process Personal Data.



Meraxes is obliged to process Personal Data in accordance with the applicable regulations governing the protection of Personal Data as well as in accordance with the best practices in this field. Meraxes will respect and protect the privacy of each person – the user of the Application and/or potential users of the Application (hereinafter referred to as: "person"), whose personal data is collected and processed (hereinafter: "Personal Data").

Meraxes collects, processes and stores Personal Data in accordance with the applicable Law on Personal Data Protection and in compliance with this Privacy Policy.

In case of doubt regarding the protection of your Personal Data and exercise of rights, you may submit a written request, including the date and signature:

• - by mail, to the address: Bulevar Milutina Milankovića 11g, 11070 Novi Beograd, Serbia;
• - to the email address: support@vendmind.com.

"Personal Data" shall mean any information relating to an identified or identifiable natural person, directly or indirectly, in particular by reference to an identifier such as a name and an identification number, location data, an online identifier in electronic communication networks or to one and/or more characteristics of the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

"Processing of Personal Data" shall be any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, classification, grouping and/or structuring, storage, adaptation or alteration, disclosure, consultation, use, disclosure by transmission and/or by delivery, propagation, dissemination or otherwise making available, comparison, restriction, erasure or destruction;

"Controller" shall be the natural or legal person, and/or public authority which, independently or jointly with others, determines the purposes and means of the processing, i.e. Meraxes;

"Processor" shall be a natural or legal person, and/or a public authority which processes Personal Data on behalf of the Controller;

"Recipient" shall be a natural or legal person and/or a public authority to which the Personal Data is disclosed, irrespective of whether it is a third party or not, except where it is a case of the public authorities which receive Personal Data in the framework of a particular inquiry in compliance with the law and process such data in compliance with the rules on the protection of Personal Data which pertains to the purpose of the processing;

"Consent" of the Data Subject shall be each freely given, specific, informed and unambiguous expression of the will of such person, by which such person, by a statement or by clear affirmative action, provides consent to the processing of Personal Data relating to him or her;

"Personal Data Breach" shall be a breach of security of personal data leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to the personal data which is transmitted, stored or otherwise processed;

"Law" is the Law on Personal Data Protection (Official Gazette of the Republic of Serbia, No. 87/2018);

"Sensitive data" refers to data that reveals racial or ethnic origin, political opinion, religious or philosophical beliefs or union membership, as well as processing of genetic data, biometric data for the purpose of unique identification of a person, health data or data on sexual life or sexual orientation of a natural person. Meraxes does not collect Sensitive Data unless you voluntarily provide them to us, or unless we are obligated to do so by applicable regulations.



When collecting, processing and storing Personal Data, the following principles are observed and applied:

• Personal Data shall be processed lawfully, fairly and in a transparent manner in relation to the Data Subject;


• Personal Data shall be collected for explicit, justified and legitimate purposes, specifically defined in this Privacy Policy, and cannot be further processed in a manner that is incompatible with those purposes;


• Personal Data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;


• Personal Data shall be accurate and, where necessary, kept up to date. In case of a change in Personal Data, we kindly ask you to always inform us of the change;


• Personal Data shall be kept in a form which permits identification of persons only within the time limit that is necessary for the purposes for which the personal data is processed to be realized;


• Personal Data shall be processed in a manner that ensures appropriate security of the Personal Data, including protection against unauthorized or unlawful processing, as well as against accidental loss, destruction or damage, by using appropriate technical, organizational or staff-related measures.

The Personal Data we collect, process and store are:

• Identification data, such as name and last name, date of birth, and gender;
• Contact information, such as cellphone number and email address;
• UserIDs;
• Other information for which you give us permission or provide them to us voluntarily.

When registering and using the Application, Personal Data is collected and processed for the basic functioning of the Application, adaptation and personalization of the Application, such as displaying recommendations, for example.

The only information necessary for installation and registration of a profile, as well as for using the Application, is the cellphone number.

All other information is optional, which you may fill in or make available to us or give us consent, as an Application user. In this case, all data will be collected and processed in accordance with this Privacy Policy.

As intermediaries between you and companies whose products you purchase at the vending machine (hereinafter: "Vending operators") through the Application, we share certain Personal Data with Vending operators, i.e. the following data: userID, first and last name, and transaction of purchase of products at vending machines.

We will keep Personal Data for this purpose until you revoke consent, or until the need for data processing for the purpose of using the Application ceases.

Data on transactions performed at vending machines will be permanently stored without the possibility of erasure.

Personal Data shall be kept on the servers owned or leased by Meraxes. The Personal Data shared with the Vending operators shall be kept in the Vending operator’s database according to their Privacy Policies.

Request for erasure of the Personal Data shall be sent in the form of an email to support@vendmind.com. Within 7 (seven) days from the date of receipt of the request, the same shall be erased, except those whose erasure will not be possible for legislative, administrative, legal or administrative reasons.



The purpose of collecting and processing Personal Data:

• Use of VendMIND Application;


• execution of transactions at vending machines;


• compliance with legal obligations;


• registering your account on the Application;


• internal analysis (including statistical analyzes and reports);


• conducting surveys or other aspects of market research;


• improving the functioning of the Application and our services, i.e. improving and developing services;


• sending notifications within the Application;


• documenting your consent for processing;

Access to your data will only be granted to those natural and legal persons we work with for processing purposes, in which we are able to prove a legitimate basis, or a legal obligation to provide your data. Access to your data will be provided by the IT service providers (such as maintenance and development of the software and the Application), our related parties on the territory of the Republic of Serbia, employed by us, Vending operators whose goods you purchased through the Application or government authorities.

Meraxes will not make Personal Data available to other recipients or third persons, except in the cases stated in this Privacy Policy.



The Personal Data we process shall be kept as long as necessary in accordance with the legal obligations foreseen by the regulations governing our activity. Depending on the context in which we process Personal Data, the following rules shall apply when it comes to determining the retention period:

• - We will keep personal data until you revoke consent, or until the need to process the data for the purpose of using the Application ceases;
• - data on transactions performed at vending machines will be permanently stored without the possibility of erasure.

Request for erasure of the Personal Data shall be sent in the form of an email to the following address: support@vendmind.com. Within 7 (seven) days from the date of receipt of the request, Personal Data will be erased, except for those whose erasure will not be possible for legislative, administrative, legal or security reasons and reasons set forth in point 2 of the first paragraph of this Privacy Policy.

• Right to access: the Data Subject has the right to request information on whether Meraxes processes his or her data and the right to request access to that data. On the request of the Data Subject, Meraxes will provide information on the Personal Data that are being processed, as soon as possible, but not later than 15 (fifteen) days from the date of receipt of the request.
  
  Requests are exclusively processed electronically by sending the request to the email address support@vendmind.com.


• Right to rectify: the Data Subject has the right to request rectification, supplement, or erasure of their Personal Data and the right to object to data processing. The Data Subject has the right to have their Personal Data rectified without undue delay.


• Right to erasure: The Data Subject has the right to request the erasure of the Personal Data. They will exercise this right by sending a Request for erasure to the email address support@vendmind.com. In that case, within 7 (seven) days, we will delete all your Personal Data, except for those that we are obliged to retain for a certain period of time due to legislative, legal, administrative or security reasons, or that we are unable to delete.
  
  The erasure of the Personal Data may be required in the following cases:
  
  
  • the Personal Data are no longer necessary for the realization of the purpose for which it was collected or processed;
  
  
  • You withdraw your consent upon which the processing was based;
  
  
  • The Data Subject has filed a complaint to processing in compliance with the legal right to object;
  
  
  • the Personal Data has been unlawfully processed;
  
  
  • the Personal Data has to be erased with the aim of discharging the legal obligations of the Controller.


• Right to restriction of processing: The Data Subject shall have the right to request a restriction of processing of their Personal Data by Meraxes, if one of the following cases applies:
  
  
  • the accuracy of the Personal Data is contested by the Data Subject, for a period enabling the Controller to verify the accuracy of the personal data;
  • The processing is unlawful, and the Data Subject opposes the erasure of the Personal Data and requests the restriction of its use instead;
  • The Controller no longer needs the Personal Data for the realization of purposes of the processing, but the Data Subject requested it for the submission, exercise, or defense of a legal claim;
  • The Data Subject has submitted an objection to the processing pursuant to Article 37, paragraph 1 of the Law, and the verification of whether the legitimate grounds for processing by the controller override the interests of the data subject or not.
  
  
  For the purpose of exercising these rights, it is necessary to send the Request exclusively via electronic means to the email address support@vendmind.com.


• Right to data portability - the Data Subject shall have the right to receive the Personal Data concerning him or her from the Controller in a structured, commonly used and readable form and have the right to request the transfer of this data to another Controller. This right applies exclusively to the Personal Data that the Data Subject has personally provided to the Controller and only if the processing of Personal Data is carried out automatically, based on a contract or the Data Subject’s consent.


• Right to file a complaint - the Data Subject shall have the right to file a complaint if they believe that the processing of their Personal Data by the Controller has been conducted contrary to the provisions of the law. The complaint should be submitted to the Commissioner for Information of Public Importance and Personal Data Protection. he processing of information about his or her personality by the operator was


• Right to withdraw consent - the Data Subject shall have the right to withdraw consent to the processing of their Personal Data by the Controller at any given time if the processing is based on consent. The withdrawal of consent does not affect the lawfulness of the processing based on consent prior to its withdrawal.

The transfer of Personal Data to another country or international organization, without prior approval, may be carried out if it is determined that this other country/international organization provides an adequate level of Personal Data protection. In this regard, it has been determined by the Decision on the list of countries, parts of their territory or one or more sectors of certain activities in these countries and international organizations, where it is considered that an adequate level of protection of Personal Data is ensured (hereinafter: "Decision").

The business entity Meraxes performs transfers of Personal Data by using the cloud servers of Digital Ocean on the territory of the Federal Republic of Germany; for this country, in accordance with the Decision, it has been determined that it provides an adequate level of Personal Data protection, so the transfer is free.



Our Application may contain links to third-party websites (Vending operators, producers of soda, water or snacks, banks, etc.). Please note that we are not responsible for the collection, use, maintenance, sharing or disclosure of data by third parties. If you provide information on third-party websites and use them, the privacy policy and the terms of use of those third parties will be applicable in the specific case. We recommend that you read the privacy policy of the web pages you are visiting before sending your Personal Data.



Meraxes treats Personal Data as confidential information and will take all necessary measures to protect them.

This Privacy Policy is available on link www.vendmind.com/en/privacy-policy, and you can access it at any time. If we decide to change/update this Privacy Policy, the changes will be posted and published on the same link, i.e. the current version of the Privacy Policy version will always be available.