Introductory provisions
This Privacy Policy (hereinafter: "Policy") governs the processing of personal data of users of the website www.bagabond.com.mk (hereinafter: "Website").
The purpose of this Policy is to ensure transparent, fair and lawful operation, in accordance with the principles set out in Article 9 of the Law on Personal Data Protection, and to inform users about all aspects of the processing of their personal data and the rights they are entitled to.
By using this Website, you confirm that you have read and understood the provisions of this Policy.
Personal data controller
The controller of the personal data collections processed through this Website is the company (hereinafter: "Controller" or "We"):
- Legal entity name: FKS TREJD DOO Skopje
- Registered office: BANICA no. 22, SKOPJE - KISELA VODA, Republic of North Macedonia
- Company registration number (EMBS): 7693656
- Tax number (EDB): 4058023545996
- Contact email: shop@bagabond.com.mk
- Contact phone: +38922635110
The Controller is responsible for processing your personal data in accordance with the provisions of the Law on Personal Data Protection and other applicable regulations.
Definitions of terms
Pursuant to Article 4 of the Law on Personal Data Protection, certain terms used in this Policy have the following meaning:
- "Personal data": Any information relating to an identified or identifiable natural person.
- "Processing of personal data": Any operation or set of operations performed on personal data (collection, storage, use, disclosure, erasure…).
- "Data subject": A natural person (user, visitor, buyer) whose personal data is processed.
- "Consent": A freely given, specific, informed and unambiguous indication of the data subject's wishes regarding processing.
- "Recipient": A natural or legal person to whom the personal data is disclosed.
Purposes, legal basis and categories of personal data
We collect and process your personal data exclusively for predetermined, clear and legitimate purposes, based on applicable legal provisions. Processing is carried out on one of the legal bases set out in Article 10 of the Law on Personal Data Protection (LPDP).
1. For fulfilling orders and performing a contract of sale:
- Purpose: Processing your order, delivering the products, collecting payment and fully performing the obligations under the distance sales contract.
- Categories of personal data: Full name, delivery address, city, postal code, phone number, email address, transaction data.
- Legal basis: Processing is necessary for the performance of a contract (Article 10, paragraph (1), indent 2 of the LPDP).
2. For creating and managing a user account:
- Purpose: Enabling personalized access to the Website, easier order management, viewing purchase history and saving data for future orders.
- Categories of personal data: Full name, email address, password (encrypted), order history.
- Legal basis: Processing is necessary for the performance of a contract (Article 10, paragraph (1), indent 2 of the LPDP).
3. For direct marketing (sending news and promotions):
- Purpose: Informing you about new products, promotional offers, discounts and other marketing activities.
- Categories of personal data: Email address.
- Legal basis: Explicit consent (Article 10, paragraph (1), indent 1 and Article 96 of the LPDP).
4. For communication and customer support:
- Purpose: Responding to questions, requests or complaints submitted through the contact form, email or phone.
- Categories of personal data: Full name, email address, phone number and the content of your communication.
- Legal basis: Legitimate interest (Article 10, paragraph (1), indent 6 of the LPDP).
5. For fulfilling legal obligations:
- Purpose: Issuing fiscal receipts, invoices and keeping accounting and tax records.
- Categories of personal data: Data required for financial operations (first name, last name, address, transaction amount).
- Legal basis: Legal obligation (Article 10, paragraph (1), indent 3 of the LPDP).
6. For analyzing and improving the functionality of the Website:
- Purpose: Collecting anonymized data about visitor behavior to improve the experience.
- Categories of personal data: IP address (anonymized), browser type, operating system, time of visit (via cookies).
- Legal basis: Legitimate interest for necessary cookies and consent for analytics/marketing cookies.
Recipients of personal data and data transfers
Your data will not be shared, sold or disclosed to third parties, except when necessary or legally required.
Categories of recipients:
- Courier service providers
- Electronic payment processors
- Accounting services
- Email marketing platforms (e.g. Mailchimp)
- State authorities under legal obligation
If data is transferred to third countries, compliance with Articles 48-53 of the LPDP will be ensured.
Personal data retention period
(1) We keep your personal data only as long as necessary to fulfill the purposes for which it was collected, or within the periods prescribed by law.
(2) The criteria for determining the retention period are as follows:
- Data related to orders and financial transactions is kept in accordance with the periods prescribed by the Law on Tax Procedure and the Law on Accounting.
- User account data is kept as long as the user has an active account. Upon a request to delete the account, the data is deleted or anonymized, except for data that must be kept due to a legal obligation.
- Data collected on the basis of consent (e.g. for direct marketing) is kept until you withdraw your consent.
Retention periods
Order and invoice data → minimum 5 years (by law).
Newsletter data → as long as you have given consent.
Cookies → up to 12 months (or according to your browser settings).
Your rights as a data subject
In accordance with the LPDP, you have the following rights regarding the processing of your personal data:
- Right to transparency and information: The right to be informed in a clear and understandable way about all aspects of processing, as set out in this Policy (Articles 16, 17 and 18 of the LPDP).
- Right of access: The right to obtain confirmation as to whether your personal data is being processed and, if so, to access it and the information specified in Article 19 of the LPDP.
- Right to rectification: The right to request the correction of inaccurate or the completion of incomplete personal data without undue delay (Article 20 of the LPDP).
- Right to erasure ("right to be forgotten"): The right to request the erasure of your personal data under the conditions provided in Article 21 of the LPDP, for example if the data is no longer needed for the purposes for which it was collected or if you withdraw your consent.
- Right to restriction of processing: The right to request the restriction of the processing of your data in certain cases, such as when you contest the accuracy of the data.
- Right to data portability: The right to receive your personal data in a structured, commonly used and machine-readable format and to transfer it to another controller, under the conditions of Article 24 of the LPDP.
- Right to object: The right to object at any time to the processing of your personal data, especially when it is carried out for direct marketing purposes (Article 25 of the LPDP).
- Right to withdraw consent: If the processing is based on your consent, you have the right to withdraw it at any time. Withdrawal will not affect the lawfulness of processing carried out before the withdrawal (Article 11, paragraph (3) of the LPDP).
- Right regarding automated decision-making and profiling: The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you (Article 26 of the LPDP).
- Right to lodge a request with the Personal Data Protection Agency: If you believe that the processing of your personal data violates the provisions of the LPDP, you have the right to lodge a request with the Personal Data Protection Agency (Article 97 of the LPDP).
To exercise these rights, you can contact us using the details specified in Article 2 of this Policy.
Personal data security
We take appropriate technical and organizational measures to ensure a high level of security for your personal data and to protect it from accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, in accordance with Article 36 of the LPDP.
The measures include, but are not limited to:
- Use of SSL (Secure Socket Layer) technology to encrypt data in transit.
- Access control to the data, ensuring that only authorized persons have access to it for the performance of their work tasks.
- Regular updating of software systems and protection against malicious software.
- Procedures for handling personal data security breaches.
Cookie policy
1. The Website uses "cookies" – small text files stored on your device in order to enable and improve the functionality of the site and to analyze its traffic.
2. We use several types of cookies:
- Necessary cookies: required for the basic features of the Website to function (cart, checkout). No consent is required for them.
- Analytics cookies: help us understand how visitors use the Website by collecting anonymous data.
- Marketing cookies: used to display relevant ads and track the effectiveness of campaigns.
3. On your first visit to the Website, you will be informed about the use of cookies and asked for consent for analytics and marketing cookies. You can change your cookie settings at any time through your web browser.
Protecting the privacy of minors
Our Website is not intended for persons under 14 years of age. Pursuant to Article 12 of the LPDP, the processing of personal data of a child under 14 in relation to information society services is lawful only if consent is given or authorized by the holder of parental responsibility.
We do not knowingly collect personal data from persons under 14. If we learn that we have collected data from such a person without parental/guardian consent, we will immediately take the necessary steps to delete it.
Changes to the Privacy Policy
We reserve the right to change and update this Privacy Policy at any time, in order to comply with legal changes or changes in our operations.
Every change will be published on this page with an updated "Last modified" date. We encourage you to check this Policy regularly to stay informed about how we protect your data.
