Privacy policy

Last updated: 5 October 2026.

1. Introduction

This Privacy Policy aims to inform you of the manner in which Pavle Zindović PR izvođačka umetnost White City Soul Beograd (hereinafter: "we", "our" or the "Controller") collects, uses, discloses and protects your personal data when you use our Online Store shop.whitecitysoul.rs (hereinafter: the "Services").

As the Controller of your personal data, we are committed to protecting your privacy and we ensure that all personal data are processed lawfully, fairly and transparently, in accordance with the Personal Data Protection Act of the Republic of Serbia (the "ZZPL").

Please read this Privacy Policy carefully in order to understand our practices regarding your personal data.

2. Identity and contact details of the Controller

The Controller of your personal data is:
Pavle Zindović PR izvođačka umetnost White City Soul Beograd
Company registration number: 68256739
Tax identification number (PIB): 115299485
Address: Mišarska 7, 11118 Beograd, Serbia
Email: whitecitysoul@gmail.com
Phone: +381 63 1057021

3. Data Protection Officer (DPO)

In view of the nature of our business as an online store, the scope of data processing and the regular and systematic monitoring of a large number of data subjects, we consider that we are obliged to designate a Data Protection Officer, in accordance with Article 56(2)(2) of the ZZPL.

The contact details of the Data Protection Officer are:
Pavle Zindović
Email: whitecitysoul@gmail.com
Phone: +381 63 1057021

Our Data Protection Officer is responsible for informing and advising the Controller and its employees of their obligations under the ZZPL, monitoring compliance with the ZZPL, cooperating with the Commissioner for Information of Public Importance and Personal Data Protection, and acting as the contact point for data subjects and the Commissioner on issues relating to the processing of personal data.

4. Types of personal data that we process

We collect and process the following categories of personal data:

  • Contact and delivery data: Name and surname, delivery address, phone number and email address. These data are collected when you order products or register on our Online Store.
  • Order data: The products that you order, return or cancel, order history, the amount and the method of payment (cash on delivery). Please note that we do not process payment card data.
  • Customer account data (if you open one): Login data (username, password) and account settings.
  • Communication data: All information that you provide to us by email, in complaints or in statements of withdrawal from the contract, including the current (bank) account number for a refund.
  • Technical and usage data: IP address, browser and device type, and the manner in which you use our Services. These data are collected through cookies and similar technologies.
  • Note on special categories of data: We do not collect or process special categories of personal data (such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, sex life or sexual orientation) through our Services.

5. Purposes and legal basis of data processing

We process your personal data exclusively for the following purposes and on the basis of the stated legal grounds, in accordance with Article 12 of the ZZPL:

  • Purpose: Conclusion and performance of the sales contract.
    Legal basis: The processing is necessary for the performance of a contract with the data subject or in order to take steps at the request of the data subject prior to entering into a contract (Article 12(1)(2) of the ZZPL). This includes receiving and delivering the order, processing the payment (cash on delivery), processing a withdrawal from the contract, refunds, handling complaints and communicating with you in connection with your order.
  • Purpose: Compliance with legal obligations.
    Legal basis: The processing is necessary for compliance with the legal obligations of the Controller (Article 12(1)(3) of the ZZPL). This includes issuing fiscal receipts, keeping business books, keeping records of complaints and responding to requests from the competent authorities.
  • Purpose: Security of the Services and fraud prevention.
    Legal basis: The processing is necessary for the purposes of the legitimate interests of the Controller (Article 12(1)(6) of the ZZPL). Our legitimate interest is the protection of the integrity of our Services and protection against unauthorised access, misuse and fraud, which is essential for the security of our business and for the protection of both our interests and the interests of our users. We consider that this interest overrides the potential risks to the rights and freedoms of the data subjects.
  • Purpose: Sending marketing messages.
    Legal basis: The consent of the data subject (Article 12(1)(1) of the ZZPL). We send marketing messages only with your explicit consent. You have the right to withdraw your consent at any time through the unsubscribe link in the email or by sending a request to whitecitysoul@gmail.com. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
  • Purpose: Use of cookies that are not necessary for the operation of the Services.
    Legal basis: The consent of the data subject (Article 12(1)(1) of the ZZPL). For cookies that are not strictly necessary for the functioning of the Services (e.g. analytics cookies), we ask for your consent before placing them.

Obligation to provide data: Providing the order data is necessary for the conclusion and performance of the sales contract. Without these data we are unable to process and deliver your order. In this sense, providing these data is a contractual obligation.

Automated decision-making and profiling: We do not make decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you.

6. Sources of personal data

We collect your personal data from the following sources:

  • Directly from you: When you place an order, open a customer account, contact us (e.g. by email or phone) or fill in forms on our Online Store.
  • Automatically, from your device: When you use the Services, we collect technical and usage data through cookies and similar technologies.
  • From our data processors: From service providers (such as Shopify), when they process data on our behalf.

7. Recipients of personal data

We disclose your personal data to the following categories of recipients:

  • Data processors: Third parties that process data on our behalf and according to our instructions, and with which we have concluded appropriate data processing agreements in accordance with Article 45 of the ZZPL. These are:
    • Shopify International Limited (Ireland): Provides hosting services for the Online Store and processing of data on orders, payments and customer accounts. Shopify acts as our processor.
    • Courier service providers: Companies that deliver orders (e.g. Post Express, D Express, BEX), to which your name and surname, address, phone number and the amount to be collected (if payment is cash on delivery) are provided.
  • Email service providers (e.g. Google): When you send us emails, Google may process your data on our behalf.
  • Persons who keep our business books: Accounting agencies or professionals who process data in order to fulfil the legal obligations of the Controller.
  • Competent authorities: We may disclose your data to the competent state authorities (e.g. the tax administration, courts, the Commissioner) when required by law or for the purpose of fulfilling legal obligations.

We do not sell, rent or trade your personal data to third parties.

8. Transfer of personal data outside the Republic of Serbia

We transfer your personal data outside the territory of the Republic of Serbia under the following conditions:

  • Ireland: Shopify International Limited has its registered office in Ireland. Ireland is a member state of the European Union and is considered a country that ensures an adequate level of protection of personal data within the meaning of Article 64(2) of the ZZPL. Therefore, the transfer of data to Ireland takes place without additional restrictions.
  • Other countries (e.g. the United States of America, Canada): Shopify and its sub-processors, as well as our email service provider (Google), may process data in other countries that may not ensure an adequate level of protection within the meaning of Article 64 of the ZZPL (e.g. the United States of America). In such cases, the Controller ensures the application of appropriate safeguards in accordance with Article 65 of the ZZPL, in particular through standard contractual clauses (Standard Contractual Clauses - SCCs) drawn up by the Commissioner or the European Commission. These clauses provide guarantees that your data will be protected at a level that is in accordance with the ZZPL.
  • Further information on the standard contractual clauses that Shopify applies can be found at privacy.shopify.com.
  • Further information on the safeguards that Google applies to transfers of data outside the European Economic Area and Switzerland can be found in the Google Cloud data processing terms (Google Cloud Data Processing Terms).

9. Retention period of personal data

We retain your personal data only for as long as is necessary to achieve the purposes for which they were collected, that is, for as long as there is a legal basis for the processing, and in accordance with Article 23(2)(1) of the ZZPL. After that period expires, the data are deleted or anonymised.

  • Order data and financial data: Retained for the duration of the contractual relationship and for the periods prescribed by the accounting laws and tax regulations of the Republic of Serbia (e.g. 10 years for accounting documentation), as well as for the purposes of resolving any complaints and exercising legal claims, in accordance with the consumer protection law.
  • Marketing data: Retained until you withdraw your consent. After the withdrawal, the data are immediately deleted from or anonymised in the marketing databases.
  • Customer account data: Retained while your customer account is active. If you close your account, the data are deleted, except those that we are legally obliged to retain.
  • Technical and usage data: Retained in accordance with the cookie policies, usually for a shorter period, unless they are necessary for fraud prevention and security.

When there is neither a purpose nor a legal obligation to retain the data, the data are deleted or made anonymous in a manner that prevents your identification.

10. Your rights regarding the protection of personal data

As a data subject, you have the following rights under the ZZPL:

  • Right of access to data (Article 26 of the ZZPL): You have the right to obtain confirmation as to whether we process your personal data, as well as access to those data and to information on the purpose of the processing, the types of data, the recipients, the retention period and your rights.
  • Right to rectification of inaccurate data (Article 29 of the ZZPL): You have the right to request that your inaccurate personal data be rectified without undue delay, and that incomplete data be completed.
  • Right to erasure of data ("right to be forgotten") (Article 30 of the ZZPL): You have the right to have your personal data erased if they are no longer necessary for the purpose for which they were collected, if you withdraw your consent, if the data have been processed unlawfully or if a legal obligation so requires.
  • Right to restriction of processing (Article 31 of the ZZPL): You have the right to request the restriction of the processing of your data in certain cases (e.g. contesting the accuracy of the data, unlawful processing, filing a legal claim).
  • Right to data portability (Article 36 of the ZZPL): You have the right to receive your personal data, which you have previously provided to us, in a structured, commonly used and machine-readable format, as well as the right to transmit them to another controller, provided that the processing is carried out by automated means and is based on consent or a contract.
  • Right to object to processing (Article 37 of the ZZPL): You have the right to object at any time to the processing of your personal data that is based on legitimate interest, including profiling, as well as to processing for direct marketing purposes. If you object to processing for direct marketing purposes, we will no longer process your data for those purposes.
  • Right to withdraw consent: If the processing is based on your consent, you have the right to withdraw that consent at any time. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

How to exercise your rights: You can exercise your rights by submitting a request to the email address whitecitysoul@gmail.com or by post to the address Mišarska 7, 11118 Beograd. We will respond to your request within 30 days of the date of receipt of the request. In complex cases or in the case of a large number of requests, the time limit for a response may be extended by a maximum of 60 days, of which we will inform you in a timely manner. Before processing the request, we may verify your identity in order to protect your data.

Right to lodge a complaint with the Commissioner: If you consider that the processing of your personal data has been carried out contrary to the provisions of the ZZPL, you have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (the Commissioner). Contact details of the Commissioner:
Bulevar kralja Aleksandra 15, 11120 Beograd
Email: office@poverenik.rs
Web: www.poverenik.rs

Right to judicial protection: In addition to the right to lodge a complaint with the Commissioner, you have the right to judicial protection before the competent court of the Republic of Serbia if you consider that, contrary to the ZZPL, a right prescribed by that law has been violated by the processing of your personal data (Article 84 of the ZZPL).

11. Cookies

Our Online Store uses cookies and similar technologies. Cookies are small text files that are stored on your device when you visit our website.

  • Necessary cookies: These cookies are technically necessary for the operation of the Services (e.g. for the functioning of the shopping cart, the checkout process and security functions). Your consent is not required for these cookies.
  • Non-necessary cookies: For other types of cookies, such as analytics cookies (which help us understand how you use our Services and improve them) and marketing cookies (for displaying relevant advertisements), we ask for your consent. You can give or withdraw your consent to cookies through our cookie banner when visiting the site or by adjusting the settings in your web browser.
  • More information on the cookies that Shopify uses can be found at shopify.com/legal/cookies.

More about cookies can also be found in our Cookie Policy.

12. Security of personal data

We apply appropriate technical, organisational and personnel protection measures in order to ensure the security of your personal data and to prevent unauthorised access to, loss, destruction or damage of the data. These measures include, among other things, the use of encryption, control of access to data, regular security checks and staff training. Despite our efforts, no system of data transmission over the internet or of electronic storage can be completely secure. For this reason, do not send us sensitive data through channels that are not protected. In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay, in accordance with Article 53 of the ZZPL.

13. Children

Our Services are not intended for persons under the age of 15. We do not knowingly collect personal data from persons under the age of 15. If we learn that we have collected personal data from a person under the age of 15 without the consent of a parent or guardian, we will take steps to delete those data. A person who has reached the age of 15 may independently give consent to the processing of data in connection with the use of information society services, in accordance with Article 16(1) of the ZZPL.

14. Third-party websites

Our Services may contain links to third-party websites (e.g. social networks). We are not responsible for the privacy policies or the content of those websites. We recommend that you read the privacy policy of every website that you visit.

15. Changes to the Privacy Policy

We may amend this Privacy Policy from time to time in order to align it with changes in legislation or in our data processing practices. The amended Privacy Policy will be published on this page, with a new date of last update. We advise you to review this page regularly in order to stay informed of any changes.

16. Contact

For any questions regarding this Privacy Policy or the processing of your personal data, please contact us:
Pavle Zindović PR izvođačka umetnost White City Soul Beograd
Address: Mišarska 7, 11118 Beograd, Serbia
Phone: +381 63 1057021, Email: whitecitysoul@gmail.com