Personal Data Processing Policy
This policy explains what personal data CPA MEDIA DOO collects through mongeza.com, why it collects it, on what legal basis, for how long it keeps it, and what the person the data relates to can do about it.
1. General provisions
1.1.
The controller of the data described here is CPA MEDIA DOO, the operator of the Mongeza service at mongeza.com (the Operator).
1.2.
This policy covers data collected through the Site, through the user account and through correspondence with info@mongeza.com.
1.3.
The Operator processes data lawfully and collects no more of it than the purposes listed below require.
1.4.
Questions about this policy and requests concerning data are sent to info@mongeza.com.
2. Categories of data processed
2.1.
Identification data: first and last name, date of birth, and the number of the identity document the User enters.
2.2.
Contact data: mobile number, email address and city of residence.
2.3.
Request data: the amount and the term requested, and the answers given in the form.
2.4.
Payment data: the fact, amount, date and status of a charge, the masked card number and the payment token supplied by the payment provider. The Operator neither receives nor stores the full card number, the expiry date or the security code.
2.5.
Technical data: IP address, information about the device and the browser, the pages visited, and the advertising labels of the link the visitor arrived through.
3. Purposes of processing
3.1.
Providing the Service: matching a request against Partner criteria, forwarding it to the Partners it fits, running the user account and delivering the results.
3.2.
Taking the subscription fee and handling refund requests and chargebacks.
3.3.
Answering claims and correspondence, and keeping evidence of what was agreed and what was paid.
3.4.
Preventing fraud and unauthorised use of cards and of the Site.
3.5.
Sending marketing messages, and only where separate consent has been given under the marketing communications.
4. Legal bases
4.1.
The consent of the data subject, given under the consent to data processing and capable of being withdrawn at any time.
4.2.
Performance of the contract concluded under the User Agreement, including taking payment for the Service.
4.3.
Compliance with obligations that the law places on the Operator, including accounting duties and duties to counter fraud.
4.4.
The Operator’s legitimate interest in defending claims and in keeping the Service secure, where that interest does not override the rights of the data subject.
5. Who the data is passed to
5.1.
Partners: identification, contact and request data are passed only to those Partners whose criteria the request meets, and only so that they may assess it and respond.
5.2.
A Partner that receives data becomes an independent controller of it and answers for its own processing. From that point its own policy applies to what it does.
5.3.
The payment provider: payment data, so that charges can be taken and returned.
5.4.
Communication providers: the mobile number and the content of a message, so that notifications and one-time codes can be delivered.
5.5.
Hosting, storage and analytics providers acting on the Operator’s instructions under written terms that confine them to those instructions.
5.6.
Public authorities, where a request is made in the form the law requires. Data is not sold and is not passed to anyone outside this list.
6. Cross-border transfer
6.1.
The Operator is established outside the United Arab Emirates, so data collected through the Site is transferred across borders as an ordinary part of providing the Service.
6.2.
Recipients located in other countries receive data only for the purposes listed above and under contractual terms requiring protection comparable to the protection described here.
6.3.
By accepting the consent to data processing the data subject is informed of that transfer and agrees to it.
7. Retention and deletion
7.1.
Data is kept for 5 years from the day consent was given, unless it is deleted earlier.
7.2.
Data is deleted earlier where consent is withdrawn and no other legal basis for keeping it remains.
7.3.
Data the law obliges the Operator to keep, records of payments in particular, is kept for the period the law prescribes even after consent is withdrawn, and is used for nothing else.
7.4.
When the retention period ends, the data is deleted or irreversibly anonymised.
8. Security of processing
8.1.
Access to data inside the Operator is limited to the staff who need it for their work, and such access is logged.
8.2.
Data travels between the browser and the Site over an encrypted connection.
8.3.
Card details are handled by the payment provider and not by the Operator, on the terms of the Payment Security Policy.
8.4.
If a breach occurs that is likely to affect the rights of data subjects, the Operator notifies the supervisory authority and the people affected as the law of the Republic of Serbia requires.
9. Rights of the data subject
9.1.
To be told whether data about them is being processed and to receive a copy of that data.
9.2.
To have inaccurate data corrected and incomplete data completed.
9.3.
To have data deleted where no basis for keeping it remains.
9.4.
To object to processing, and to ask for processing to be restricted while the objection is examined.
9.5.
To withdraw consent at any time by writing to info@mongeza.com from the address given at registration. Withdrawal does not affect processing carried out before it.
9.6.
To receive their data in a structured, commonly used electronic format.
9.7.
To complain to the competent supervisory authority for the protection of personal data, and to bring proceedings in court.
10. Handling requests and changes to this policy
10.1.
A request concerning any of the rights above is sent to info@mongeza.com and is answered within 10 days.
10.2.
The Operator may ask for information confirming the identity of the person making the request, and asks for nothing beyond that.
10.3.
The current version of this policy is published at mongeza.com. A new version applies from the day it appears there.
Operator details
- Legal name
- CPA MEDIA DOO
- Jurisdiction
- Republic of Serbia
- Registration number
- 21838381
- Tax number
- 113282629
- Registered address
- Dubljanska 5a, Beograd, Serbia
- Director
- Rostislav Ringer
- Bank
- Raiffeisen banka a.d. Beograd
- IBAN
- RS35265100000069362811
- SWIFT
- RZBSRSBG
- info@mongeza.com