Privacy Policy and Personal Data Protection

In the following data protection information, we inform you about the processing of personal data by Grosbasket d.o.o., a company dealing in sports trading and services (later referred as "Grosbasket" and/or "controller"), in accordance with the General Data Protection Regulation and applicable personal data protection laws.

Controller Information:

Name: GROSBASKET d.o.o.

Address: Ukmarjeva ulica 6, 2000 Ljubljana

Tax Number: SI 50277669

Registration Number: 6646077000

Bank Account: SI56 2900 0006 2226 112

Phone: +386(0)59-344-580

Email: [email protected]

1. General

We commit to protecting the confidentiality of your personal data in accordance with the law. We will do everything necessary to protect you from any violations and abuses. The personal data of users is an area to which we pay extraordinary care and attention, recognizing the sensitive nature of this area.

2. Implementation of Privacy Policy

All our employees, full-time or part-time, who have access to user data are trained on their obligation to protect personal information and user privacy. They are required to comply with all regulations regarding data confidentiality.

For companies with access to personal data, we have established Non-Disclosure Agreements (NDAs) to ensure the secure processing and protection of this data.

We limit access to personal data and the amount we process to the minimum required to provide you with the best possible service. Our commitment to protecting your personal and other data extends beyond the termination of your relationship with us. To ensure the highest level of security for your personal information, we have implemented a comprehensive Personal Data Protection Policy, which includes a record of all processing activities.

3. Types of Collected Data and Data Collection Purpose

Every visit to the Grosbasket website, every purchase process, registration process, participation in contests and promotions, newsletter subscriptions, and in the case of loyalty club membership, requires the provision of personal data, the provision of which is voluntary. We also require data necessary for the realization of the mutual contract for the purchase process, participation in contests, in the case of loyalty club membership, and in other relevant contractual relationships. Every visit to our website results in information being sent from your device's web browser to our website/application server and temporarily stored in so-called log files. The stored data records contain the following data, which are kept until automatic deletion: date and time of access, name of the accessed page, IP address of the device sending the request, referer URL (the source URL from which you were directed to our website), the amount of data transferred, loading time, and information about the product and version of the web browsers used as well as the name of your access provider. By submitting personal data and giving consent, you agree that we collect, use, and store them. We will use them exclusively for the purposes stated at the time of consent. Your personal data will be protected against misuse, unauthorized access, loss, disclosure, alteration, or destruction. Below we describe the types of personal data we collect, ways of their use and protection, and how you can contact us. For the purposes of providing the services we offer, we collect, manage, process, and store the following user data.

Data Processing upon Conclusion of a Sales Contract (upon placing an order or purchase)

In the case of a purchase on our website, we will process data necessary for identification and for the conclusion, execution, or cancellation of the contract. These include:

• Name and surname;
• Delivery address;
• Postal code and city;
• Country of residence;
• Email address (username);
• Phone number;
• Payment details;
• Company name or legal entity name and tax number (if the user is a legal entity)

In addition to the data mentioned above, we also store cookies and other identification data necessary for execution. These data are required for order fulfilment, such as providing delivery services and issuing invoices. An order confirmation will be sent to the email address provided by you at the time of purchase. Data in anonymized summary form may be utilized for statistical analysis purposes.

In the event of concluding a sales contract through our website, it is necessary to provide your payment details to payment service providers authorized by us to process payments. Your delivery address data will be forwarded to our authorized delivery partners, to whom we may also provide your email address and phone number if necessary to ensure the delivery of goods in accordance with your preferences. They will contact you before delivery if required to coordinate delivery details.

The basis for collecting personal data is the contract (the basis for submitting optional data for contract realization is personal consent), as without the prior provision of required data, it is not feasible to fulfil all rights and obligations stipulated in the contract. Acceptance of the General Terms and Conditions and Privacy Policy is a prerequisite for making a purchase, as without these, mutual contract fulfilment and compliance with legal requirements in the realm of online purchases are not attainable.
Following order placement, the individual receives an order acceptance confirmation at the email address provided to the controller when completing the electronic purchase form.
The controller may utilize the data for statistical analysis purposes in anonymized summary form.

Submission of Personal Data Through a Contact Form or Another Channel

Grosbasket offers several methods for contacting us: email, phone, and an online contact form. Regardless of the chosen method, we utilize the personal data you voluntarily provide solely to establish contact and address your inquiry.

When submitting a comment through the online form, your consent allows us to collect your name, surname, email address, message content, and optional phone number. This information is used to provide a prompt and effective response to your question.

Registration or Creation of a User Account in the Online Store

To provide you with the greatest possible convenience, we offer permanent storage of your personal data in a password-protected account. For creating a user account, we need:

• Name and surname;
• Email address;
• Password in encrypted form.

The creation of a customer account is voluntary, and you may access and modify your data at any time within your customer account. Furthermore, you have the option to deactivate your account at your discretion; simply notify us via the email address [email protected]. Prior login is necessary to access order details within your account. Upon product purchase, registered users receive a link to their provided email address, enabling them to track the status of their orders.

Personal data collected via the registration form is based on personal consent and contract; without prior registration, fulfillment of all contractual rights and obligations is not feasible. Acceptance of the General Terms and Conditions and Privacy Policy is a prerequisite for registration, as it is essential for mutual contract fulfillment and compliance with legal requirements pertaining to online purchases. Your personal data should be handled confidentially, and access should not be granted to third parties. User accounts remain logged in even after leaving our website unless you actively log out.
Additionally, due to registration-based purchases, the controller may gather indirect data resulting from purchases, including:

• Home address;
• Postal code and city;
• Country;
• Phone number;
• Payment details.

Subscription to Electronic Newsletters or Email Advertising

On our website, we also offer the possibility to subscribe to newsletters. To reduce the possibility of fraud, we use Google's reCAPTCHA v3 tool. For successful subscription, we require the following data:

• Name and surname;
• Email address.

In case of subscription to electronic newsletters, we will use your email address to inform you about news, promotions, discounts, and our events.
The collection of personal data is based on individual consent, whereby the individual provides their email address to the controller for the purpose of receiving e-newsletters. By subscribing to our newsletter, you authorize the export, storage, and processing of data in a marketing automation tool, enabling us to send electronic newsletters. The export, storage, and processing of data in the marketing automation tool facilitate continuous monitoring of your activities on www.grosbasket.com, enabling aggregated and anonymized analyses of website usage and content. The controller may utilize individual data for analysis, online advertising, and content marketing purposes. All personal data are exclusively used for service provision, anonymized analysis, and operational optimization, and are not publicly accessible unless expressly permitted by the user with specific consent for such purposes.

In addition to subscribing to electronic newsletters, the website visitor also agrees to consent to receive personalized offers and notifications, which is valid until revoked. This consent includes the use of data for direct marketing and retargeting on digital advertising platforms (such as Meta ads and Google ads), with the purpose of:

• Presenting the entire Grosbasket offer,
• Exporting and processing data in digital advertising tools (using email to prepare anonymized segments of users, in which case the email cannot be attributed to a specific individual),
• Processing data with pseudonymization (so that it cannot be attributed to a specific individual).

This consent is optional and requires the user's explicit consent.
The commercial messages you will receive via email will contain the following components:

• Clearly and unequivocally marked as commercial;
• The sender will be clearly identifiable;
• Promotions, promotions, and other marketing techniques will be marked as such, as well as the conditions for participation in them clearly defined;
• A clear method of unsubscribing from receiving advertising messages will be presented;
• The provider will explicitly respect the user's wish not to receive advertising messages.

Right to Withdraw
You can always revoke your consent by simply clicking the unsubscribe button at the end of each promotional email.

Enrolment in the Grosbasket Loyalty Club – MVP Club
Membership in the MVP Club and obtaining an MVP club (online) benefits card requires the submission of the following data:

• Name and surname,
• Residential address,
• Date of birth,
• Postal code,
• Email address,
• Phone number.

Indirect data resulting from the use of the MVP Club card include: mobile phone number, country of residence, gender, and details of purchases made with the membership card, such as the date, value, and invoice number of the purchase, as well as the quantity of products, payment method, purchasing store, salesperson, and cash register identifier. Additionally, details of purchased products, such as the type, EAN code, product group, size, colour, and brand, along with details of claimed benefits, are collected. These data enable members to access benefits, while the controller also processes them for analysis and statistical purposes, aiding internal business processes like evaluating the success of sales programs and planning new products and services.

Participation in a Contest or Promotion:
When signing up for contests organized by Grosbasket, the data provided during registration are used to execute the contest agreement, including notifying winners about their prize and, if necessary, advertising our offers and/or those of our partners in the contest. Mandatory data for contest participation include:

• Name and surname,
• E-mail address.

Further details can be found in the relevant participation conditions for each contest. Generally, we request participants' names and email addresses to inform them of any victories via email or our Instagram account.
Each participant must provide personal data to be notified in case of victory, with names and surnames being publicly announced in some instances. Additionally, we may request further information as needed to execute the promotion, contest, or survey, in accordance with the law, contractual agreements, and obligations related to income tax and other legal requirements, particularly in the realm of tax legislation.

Additionally, we collect:

• Other data that users voluntarily enter into surveys;
• Other data that users voluntarily add later in their profile;
• Communication with individual customers.

We do not take responsibility for the accuracy, completeness, and timeliness of the data entered by users.

4. Your Rights Based on Given Consents

An individual has the right to request the personal data controller to permanently or temporarily cease using their personal data for the previously mentioned purposes at any time. Such a request can be directed to the email address [email protected], clearly specifying which consents they wish to revoke. The revocation becomes effective from the moment of revocation onwards.

Furthermore, you have the following rights:

• The right to access your personal data that have been collected in connection with you, whereby the controller may use all reasonable means to verify the identity of the individual, whose personal data are involved, especially in the case of online services and online identifiers.
• The right to rectification of inaccurate data collected in connection with you, whereby the controller may use all reasonable means to verify the identity of the individual, whose personal data are involved, especially in the case of online services and online identifiers.
• The right to "be forgotten," i.e., the deletion of all data if the conditions from Article 17 of the General Data Protection Regulation are met.
• The right to cease using personal data for direct marketing purposes, including profiling.
• The right to be informed about corrections, deletions, or restrictions of processing when the right to rectification, forgetting, and restriction has been exercised, except if this proves impossible or involves a disproportionate effort.
• The right to data portability from one controller to another, when processing is based on consent or contract, or when processing is carried out by automated means.
• The right to refuse automated individual decision-making, including profiling.
• The right to be notified about a personal data breach.
• The right to lodge a complaint against the controller of personal data with the supervisory authority if you believe that the processing of your personal data violates the General Data Protection Regulation and legislation in the field of personal data protection.

If you wish to change your personal data or want us to permanently or temporarily cease using them for the purposes for which they were provided or collected, send us an email to [email protected] or to the address Grosbasket d.o.o., Ukmarjeva ulica 6, 1000 Ljubljana. You also have the option to delete all data in your user account.

5. Right to Object

An individual has the right to be explicitly, clearly, and separately informed about the right to object, no later than at the first communication with them. If the individual agrees with the privacy policy, it is understood that they have been notified regarding this communication.

An individual, whose personal data are processed, has the right, based on reasons related to their particular situation, to object at any time to the processing of personal data necessary for tasks carried out in the public interest or in the exercise of official authority vested in the controller. This also applies to data necessary for the legitimate interests pursued by the provider or a third party, including profiling based on such provisions. The provider must cease processing personal data unless compelling legitimate grounds for the processing are demonstrated, which override the interests, rights, and freedoms of the individual, or for the establishment, exercise, or defense of legal claims.

In cases where personal data are processed for direct marketing purposes, the individual has the right to object to the processing of personal data concerning them for such marketing, including profiling related to such direct marketing. Upon objection, the personal data shall no longer be processed for such purposes.

This general right to object applies to all processing purposes described in this data protection information, processed under the General Data Protection Regulation. The controller must immediately cease processing personal data unless compelling legitimate grounds for the processing are demonstrated, which override the interests, rights, and freedoms of the individual to whom the personal data relate, or for the establishment, exercise, or defense of legal claims.

Unlike the specific right to object to data processing for advertising purposes, we are obligated to fulfill such a general objection according to the General Data Protection Regulation only if significant reasons for it are provided by you (e.g., a potential risk to life or health).

6. Individual's Responsibility

The user themselves are also responsible for the protection of personal data by ensuring the security of their username and password and appropriate software (antivirus) protection of their computer.

7. Exceptional Disclosure of Data

Data collected and processed by the controller will be disclosed only if such an obligation is specified in the law or in good faith that such action is necessary for proceedings before courts or other state bodies and for the protection and realization of its legitimate interests.

8. Consent and Change of Privacy Policy Terms

By using the websites, the individual confirms that they accept and agree with the entire content of this privacy policy. Any change to our data protection policy will be published on the grosbasket.com website and will only take effect after being posted on this website.

9. Cookies and Web Beacons

Grosbasket utilizes cookies and web beacons to enhance your website experience and facilitate statistical analysis of site usage. These technologies are small files stored on your device.

Cookies: Cookies are temporary files that enable the website to recognize your computer during your browsing session. They do not contain viruses or malicious software. We use cookies to improve your experience by enabling features like shopping cart functionality and purchase tracking.

Session Cookies: These temporary cookies expire at the end of your browsing session and allow features like shopping cart visibility across multiple pages.

Persistent Cookies: These cookies remain on your device for a set period and activate upon each website visit.

Web Beacons: These small images, sometimes called "pixel tags," work in conjunction with cookies and help us analyse website traffic patterns.

Browser Controls

You can configure your browser to prevent cookies from being stored on your device. Most web browsers offer guidance in their help menus on how to:

• Disable new cookies
• Receive notifications when a new cookie is received
• Delete existing cookies
• Block all cookies

Please note: Disabling cookies may limit website functionality.

Meta Ads Manager

We also use retargeting technologies from external providers, such as the Pixel of Meta Ads Manager, formerly known as Facebook Ireland Limited. Retargeting allows us to target those users who have already shown interest in our store and our products with online ads on our partners' websites. For this purpose, a cookie is set, collecting data on interests under pseudonyms. Based on this information, ads for our offer will be displayed on our partners' websites according to your interests. No personal data are directly collected, and no user profile with personal data is linked to you.

Google Analytics

For the purpose of designing our pages based on needs and continuous optimization, we use Google Analytics, a web analytics service provided by Google Inc. (hereinafter referred to as Google).

Google Analytics uses so-called "cookies," text files stored on your computer, to analyze how you use the website. In this context, pseudonymized user profiles are created, and cookies are used. The information generated by the cookie about your use of this website includes:

• Type/version of the browser
• Used operating system
• Referrer URL (the previously visited page)
• Hostname of the accessing computer (IP address)
• Time of the server request

Your identification in this way does not lead to the deletion of your shopping cart, and we can remember your login via a specific device without requiring re-entry of the email address and password. At the same time, we can store information about which version of our web pages to display if multiple versions are available at that moment. Also, with their help, we determine whether you have given us consent in accordance with this document.

A consent refusal cookie is set upon arrival on the page, preventing the future collection of your data when visiting this website. The consent refusal cookie is valid only in this browser and only for our website and is stored on your device. If you delete the cookies in this browser, you must set the consent refusal cookie again.

Google Ads

Google Ads is an online advertising program by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"), which we use for remarketing purposes. With this feature, we can present ads based on their interests to users of our website on other websites within the Google display network. For this purpose, user interaction on our website is analyzed, for example, which offers interested the user, so that after visiting our website, targeted ads can also be displayed to the user on other websites. For this purpose, Google stores a cookie in the browsers of users who visit certain Google services or websites in the Google display network. This is used to record visits of these users and is used for clear identification of the web browser on a specific computer and not for the identification of a person, meaning personal data are not stored.

If you do not disable the use of third-party cookies and the sharing of your data with advertising and social networks under the Privacy Settings tab and click on any link on our websites (outside the warning box) after our warning or click on the "Understand" button, which is part of the warning, it is considered that you agree with the use of the mentioned cookies and sharing your data with advertising and social networks. You can withdraw your consent at any time by disabling this function under the Privacy Settings tab.

Here you can find which cookies we use. For a complete overview of all used cookies, click here (https://www.grosbasket.com/en/cookies).

10. Who Processes Your Personal Data and To Whom Is It Disclosed?

We process all described personal data as the controller. This means that we determine the purposes for which your personal data are collected and the means of processing and are responsible for its proper implementation. In this case, your data are forwarded to our partners to ensure payments, transport, and other matters related to your order. We also forward your data to our processors, who process them in accordance with our instructions.

With your consent, data can also be shared with advertising and social networks for the display of customized ads on other websites. In addition, your personal data are processed in tools of other business entities that we use for personal data processing. Among such legal entities are:

• Related to processing your order, our partners involved in order processing, as stated in the section "If you make a purchase with us":
• Partners managing payment systems for ensuring payments, especially in relation to credit cards:
• Braintree, part of PayPal – PayPal (Europe) S.à r.l. et Cie, S.C.A.
• Six Payment Services (Austria) GmbH, Marxergasse 1B, A-1030 Wien, Austria, ATU 15355906; Erste Card d.o.o., Dunajska cesta 129, 1000 Ljubljana, Slovenia
• SKB Banka, Ajdovščina 4, 1000 Ljubljana
• Nova Ljubljanska banka d.d., Ljubljana, Trg republike 2, 1000 Ljubljana
• Transport partners
• Pošta Slovenije d.o.o., Slomškov trg 10, 2500 Maribor, Slovenia
• DPD d.o.o., Brnčičeva ulica 31, Ljubljana, 1231 LJUBLJANA-ČRNUČE
• DHL Ekspres (Slovenia), d.o.o., Špruha 19, Trzin, 1236 Trzin
• The supplier of goods or service center of the respective manufacturer regarding complaints about ordered goods or services;
• Based on your consent, to advertising and social networks and other marketing tools that help us optimize the web and personalize content and offers:
• Google HQ (registration number: 368047), located at Gordon House, Barrow Street, Dublin 4, Ireland; the company's privacy policy is available here: https://policies.google.com/privacy?hl=en-US#intro
• Meta Platforms Ireland Limited, Merrion road, Dublin, D04 X2K5, CO Dublin, Ireland; the company's privacy policy is available here: https://www.facebook.com/privacy/policy/
• Cloud computing services providers and other technology and support suppliers:
• One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Irska
• GA SISTEMI d.o.o., Industrijska cesta 1G, Grosuplje, 1290 Grosuplje
• External communication processors, especially for communication via SMS messages and chatrooms:
• MS3 d.o.o., Ulica miru 21, 1000 Ljubljana – SMSapi
• Klaviyo Inc, 125 Summer Street, Boston, Massachusetts, USA
• Cartfox - DFVU d.o.o., Liparjeva cesta 6A, Mengeš, 1234 Mengeš
• DIGITALIST d.o.o., Ribčev Laz 45F, Ribčev Laz, 4265 Bohinjsko jezero
• To the supplier of recording and access systems for calls – T - 2 d.o.o., Verovškova ulica 64A, Ljubljana, 1000 Ljubljana

If you believe that there has been a violation of the provisions on the protection of your personal data, please inform us at our email address [email protected]. We will investigate the matter, take appropriate action, and respond to you in a reasonable time. If you have questions, problems, or comments regarding this privacy policy, we kindly ask you to inform us at the email address [email protected].

This personal data protection policy is effective from March 25, 2024.