Privacy Policy

This Privacy Policy explains how PLASTOPEX collects, uses, stores, shares and protects personal data when you visit the website, submit an enquiry or quotation request, request a consultation, use a product configurator, subscribe to updates, communicate with the Plastiša digital assistant or contact us through another available channel.

We process personal data in accordance with the Serbian Law on Personal Data Protection and, where applicable, the European Union General Data Protection Regulation, known as the GDPR.

1. Data controller

The controller of your personal data is:

Društvo za proizvodnju trgovinu i usluge PLASTOPEX DOO OSEČINA
Short business name: PLASTOPEX DOO
Registered address: Pere Jovanovića - Komirićanca 50, 14253 Osečina, Republic of Serbia
Company registration number: 21431893
Tax identification number: 111142066
Director and legal representative: Uroš Jančić
Email: info@plastopex.com
Telephone: +381 69 723 200

For privacy questions, requests or complaints, contact info@plastopex.com and use the subject line “Personal Data Request”.

This contact address is PLASTOPEX’s contact point for privacy matters. Its publication does not by itself mean that PLASTOPEX has formally appointed a Data Protection Officer unless such an appointment is separately announced.

2. Who this policy applies to

This Policy applies to personal data relating to:

• website visitors;
• existing and prospective customers;
• users of contact and quotation forms;
• product configurator users;
• persons requesting a consultation;
• Plastiša users;
• newsletter subscribers;
• representatives and contact persons of business customers and partners;
• suppliers, contractors and other business contacts;
• persons contacting us through email, telephone, WhatsApp, social media or another channel.

Information relating solely to a legal entity is not personal data. A person’s name, business email address, direct telephone number, job function and other identifying information are personal data.

3. Personal data we may collect

3.1. Contact, quotation and consultation information

When you submit an enquiry, quotation request, delivery request or consultation request, we may process:

• first and last name;
• company or organisation;
• business function or job title;
• email address;
• telephone number;
• country, town, municipality, address or project location;
• location or map information you voluntarily provide;
• preferred contact method and time;
• selected product or product category;
• intended product use;
• dimensions, volume, capacity and other technical requirements;
• information about site access, delivery, unloading and installation;
• intended timeline or indicative budget, when voluntarily provided;
• message content;
• photographs, drawings, sketches, technical specifications and attachments;
• communication history with the PLASTOPEX team;
• other information you voluntarily provide about your project.

Fields marked as mandatory are required to process your request. Without them, we may be unable to respond or prepare a suitable quotation.

3.2. Product configurator data

When you use a configurator, we may process:

• selected product category and type;
• dimensions, volume and capacity;
• material, shape, colour, equipment and optional components;
• intended purpose and expected operating conditions;
• delivery or installation location;
• technical notes;
• configuration result;
• session identifier;
• contact details where you request the result or a quotation.

The configurator result may be connected to your enquiry and stored in Payload CMS.

3.3. Plastiša data

When you use Plastiša, we may process:

• your questions;
• AI-generated answers;
• conversation history;
• selected language;
• project, product, dimension, capacity and location information;
• your name, email and telephone number where voluntarily submitted;
• photographs, drawings, documents and other attachments;
• conversation or session identifier;
• date and time;
• feedback about response quality;
• technical and security information;
• whether the conversation was escalated to a person or converted into a quotation request.

Do not submit passwords, payment card information, banking credentials, national identification numbers, health or biometric data, criminal-offence data, third-party trade secrets or other sensitive information that is not necessary for your enquiry.

3.4. Newsletter data

When you subscribe to the newsletter, we may process:

• email address;
• name, where requested;
• selected language;
• subscription date and time;
• subscription source;
• evidence of consent;
• the version of the notice and Privacy Policy in effect when consent was given;
• subscription and unsubscribe status;
• message deliverability information;
• email opens and clicks, only where such measurement has been enabled on an appropriate legal basis.

The newsletter is used for occasional product information, project updates, company news, useful content and promotional offers.

Subscription is not required to use other parts of the website.

3.5. Technical and security information

We may automatically process:

• IP address;
• browser type and version;
• device type and operating system;
• approximate location derived from the IP address;
• access date and time;
• pages visited and technical events;
• referring page;
• session identifiers;
• cookie preference records;
• error logs;
• anti-spam and security signals;
• information required to detect bots, misuse and unauthorised access.

3.6. Information from other platforms

When you contact us through WhatsApp, Facebook, Instagram, LinkedIn, Google services or another platform, we may receive information you submit through that service.

Those platforms may separately process your data under their own privacy policies. PLASTOPEX does not control all independent processing performed by those providers.

The website may display publicly available reviews, including the reviewer’s name, profile image and review text. Opening the source content takes you to a third-party platform.

4. How we collect personal data

We may collect personal data:

• directly from you;
• through contact and quotation forms;
• through delivery request forms;
• through consultation forms;
• through product configurators;
• through Plastiša;
• through the newsletter form;
• through email, telephone or WhatsApp;
• through cookies and similar technologies;
• from technical, analytics and security providers;
• from your employer or business partner where you are named as a contact;
• from public business sources where this is lawful and relevant to B2B communication.

5. Purposes and legal bases

5.1. Enquiries and quotations

We process information to:

• understand your requirements;
• answer questions;
• recommend a relevant product;
• assess technical feasibility;
• check delivery, unloading or installation possibilities;
• prepare a quotation;
• arrange a consultation;
• continue project-related communication.

The legal basis is taking steps at your request before entering into a contract, performing a contract or our legitimate interest in communicating with prospective and existing business partners.

5.2. Business relationship and contract performance

Where an offer is accepted or a contract is concluded, we may use data for:

• manufacture;
• technical coordination;
• transport, delivery, unloading and installation;
• invoicing and payment;
• warranty and complaint records;
• service and support;
• accounting, tax and other legal obligations.

The legal bases are contract performance and compliance with legal obligations.

5.3. Product configurators

Configurator data is used to:

• present relevant options;
• temporarily retain progress;
• generate a result;
• allow you to submit the result or a quotation request;
• help our team understand technical requirements efficiently.

The legal basis is providing a feature you requested, taking pre-contractual steps and our legitimate interest in processing requirements efficiently.

5.4. Plastiša operation and improvement

Conversation data may be used to:

• generate a response;
• identify relevant product information;
• maintain conversation context;
• prepare an enquiry summary;
• escalate the request to a PLASTOPEX representative;
• prevent misuse;
• investigate technical problems;
• assess response quality;
• improve security and user experience.

The legal basis is providing the service you expressly requested, taking steps before a potential contract and our legitimate interests in support quality, improvement and security.

Where consent is required for an additional purpose, it will be requested separately.

5.5. Newsletter and direct marketing

We send newsletters and promotional communications on the basis of your consent.

You may withdraw consent at any time by:

• using the unsubscribe option in a message; or
• contacting info@plastopex.com.

Withdrawal does not affect processing carried out before consent was withdrawn.

After unsubscribe, we may retain a minimal suppression record to prevent further unwanted messages.

5.6. Analytics and website improvement

Where you accept analytics cookies, information may be used to:

• measure visits;
• understand website use;
• detect technical issues;
• evaluate content performance;
• improve navigation and user experience.

The legal basis for non-essential analytics technologies is consent.

5.7. Advertising and campaign measurement

Where marketing tags are enabled, they may operate only after marketing consent.

They may be used for:

• campaign measurement;
• attribution of an enquiry to a campaign;
• advertising frequency control;
• aggregated audience creation;
• delivery of more relevant advertising.

We do not use this information to make decisions producing legal or similarly significant effects.

5.8. Security, legal obligations and legal claims

We may process information to:

• protect the website, database and users;
• detect bots, fraud and misuse;
• maintain security records;
• respond to incidents;
• comply with legal obligations;
• respond to competent authorities;
• establish, exercise or defend legal claims.

The legal basis is legitimate interest and, where applicable, a legal obligation.

6. Payload CMS and email processing

Information submitted through contact forms, quotation requests, configurators, consultation requests, newsletter forms and Plastiša may be stored in the Payload CMS database.

Payload CMS is used to manage content, contacts, business enquiries, newsletter subscriptions and relevant communications.

A form submission may both:

• be stored in Payload CMS; and
• generate an email notification or copy for authorised PLASTOPEX personnel.

Administrative access is limited to authorised persons who need the information for their assigned work.

7. Processing through the direct OpenAI API

Plastiša uses the direct OpenAI API to generate responses and process user requests. Different models available through OpenAI may be used, and the selected model may change for quality, safety, availability or technical-improvement reasons.

To generate a response, the following information may be submitted to the OpenAI API:

• the user’s question;
• earlier messages required for context;
• product or project information entered by the user;
• a document, photograph or other attachment submitted by the user;
• relevant information from the PLASTOPEX knowledge base;
• technical information required for secure operation.

PLASTOPEX is the controller of personal data collected through Plastiša. OpenAI processes relevant data on behalf of PLASTOPEX as the API service provider, under the applicable business terms, data processing terms and authorised subprocessors.

By default, OpenAI does not use content submitted by business customers through the API to train or improve its foundation models unless the OpenAI account holder expressly opts in to such sharing.

Under the default API data controls, OpenAI may retain certain inputs, outputs and related metadata for up to 30 days for abuse prevention, security and service delivery, unless:

• a different approved retention control applies;
• a specific API feature requires application-state storage;
• longer retention is legally required;
• longer retention is reasonably necessary to protect the service or a third party.

Eligible organisations may, subject to OpenAI approval and supported features, use controls such as Zero Data Retention or Modified Abuse Monitoring. PLASTOPEX will not claim that such a control is active unless it has actually been approved and technically enabled.

Information stored by PLASTOPEX in its own Payload CMS database is subject to the retention periods in this Policy and is separate from any temporary technical retention by OpenAI.

OpenAI may process information to:

• perform the API request;
• generate the response;
• prevent and detect abuse;
• protect system security;
• provide technical support;
• comply with legal obligations.

Processing by OpenAI may involve an international transfer of data, including processing in the United States or other countries in which OpenAI and its authorised providers operate. Appropriate contractual and other legally required safeguards are applied to such transfers.

Important Plastiša limitations:

• Plastiša is an automated information assistant.
• A response may be inaccurate, incomplete or out of date.
• A response is not a binding quotation.
• A response is not a final price or delivery commitment.
• A response is not an engineering design or structural calculation.
• A response is not confirmation of chemical compatibility.
• A response is not a legal, safety or professional assessment.
• A response is not a guarantee of suitability for a particular project.

Important technical, commercial and safety information must be confirmed by an authorised PLASTOPEX representative.

8. Cookies and third-party services

The website may use:

• necessary cookies and local or session storage;
• a form-protection service for bots and spam;
• maps loaded following a user action;
• analytics services only where enabled and accepted;
• a tag-management system;
• aggregate search-visibility reporting;
• video or social content where embedded;
• marketing tags only where enabled with consent;
• technical identifiers used by Plastiša and product configurators.

Further information is provided in the Cookie Policy.

You may change your choices through “Cookie settings” on the website.

9. Recipients

Personal data may be made available to:

• authorised PLASTOPEX personnel and contractors;
• hosting and infrastructure providers;
• website and Payload CMS administrators;
• database providers;
• email or SMTP providers;
• OpenAI and its authorised subprocessors for API and AI services;
• map, form-protection, analytics and marketing providers where you use the relevant feature or provide consent;
• security, maintenance and technical-support providers;
• accountants, lawyers, insurers and professional advisers;
• carriers, installers and business partners where necessary for a project;
• public authorities and courts where disclosure is legally required or necessary to protect rights.

Where a recipient processes data on our behalf, we seek to restrict the processing to documented instructions and appropriate safeguards.

PLASTOPEX does not sell personal data.

10. International transfers

PLASTOPEX is established in Serbia. Certain service providers may process information in the European Economic Area, the United States or other countries.

Where international-transfer rules apply, we use an appropriate mechanism such as:

• an adequacy decision;
• standard contractual clauses;
• contractual and technical supplementary measures;
• a transfer-risk assessment;
• another mechanism permitted by applicable law.

11. Retention

We retain personal data only for as long as required for the relevant purpose, unless a longer period is required or permitted by law.

Our normal operational periods are:

• enquiries and quotation requests not resulting in a contract: up to 24 months after the last substantive communication;
• configurator results connected to an enquiry: up to 24 months after the last communication;
• abandoned configurator sessions: up to 30 days;
• Plastiša conversations not converted into an enquiry: up to 12 months after the last activity;
• Plastiša conversations converted into an enquiry or quotation: according to the relevant business-enquiry period;
• consultation requests: up to 24 months after the last communication;
• newsletter subscriber data: until unsubscribe or withdrawal of consent;
• minimal unsubscribe records: for as long as reasonably necessary to prevent further unwanted messages and demonstrate compliance;
• general application and technical logs: normally up to 90 days;
• security logs connected to an incident: until the investigation and relevant claim periods have ended;
• cookie consent records: up to 12 months or until consent is renewed;
• contractual, accounting and tax documentation: for the periods required by applicable law;
• warranty, complaint and dispute records: until completion and expiry of applicable limitation periods.

Any temporary OpenAI API retention is described in the section concerning the direct OpenAI API and is separate from PLASTOPEX’s own retention periods.

After expiry, information is deleted, anonymised or removed from active use.

Backups may retain information for a limited additional period until the regular overwrite cycle, subject to restricted access.

12. Whether you must provide data

Providing information is generally voluntary.

However, without certain information we may be unable to:

• answer an enquiry;
• prepare a quotation;
• calculate a suitable configuration;
• check delivery feasibility;
• arrange a consultation;
• contact you;
• perform a contract.

Mandatory fields are limited to information reasonably required for the relevant feature.

13. Automated decision-making

We do not make decisions producing legal or similarly significant effects solely by automated means.

Plastiša may automatically suggest a product category or prepare an enquiry summary, but a binding quotation, price, technical solution or project decision is confirmed by an authorised person.

Analytics and advertising services, where enabled with consent, may place devices or users into aggregated interest segments. Such profiling is not used to set a price automatically, reject an enquiry or assess creditworthiness.

14. Your rights

Depending on the circumstances and applicable law, you may request:

• confirmation of whether we process your data;
• access and a copy;
• correction of inaccurate data;
• completion of incomplete data;
• deletion;
• restriction of processing;
• data portability;
• objection to legitimate-interest processing;
• objection to direct marketing;
• withdrawal of consent;
• information about international transfers;
• human intervention where automated decision-making applies;
• the right to lodge a complaint.

These rights are not absolute. We may retain information where required by law, contract or the need to establish, exercise or defend a legal claim.

15. Exercising your rights

Send your request to:

info@plastopex.com
Subject: Personal Data Request

Please provide:

• your name;
• the contact detail you previously used;
• the right you wish to exercise;
• the relevant form, communication or information.

We may request proportionate additional information to confirm your identity.

We will respond without undue delay and within the period required by applicable law, generally within 30 days. The period may be extended for complex requests, in which case you will be informed.

Requests are normally free of charge. Where a request is manifestly unfounded, excessive or repetitive, we may respond as permitted by law.

16. Complaints

For processing governed by Serbian law, you may complain to:

Commissioner for Information of Public Importance and Personal Data Protection
Bulevar kralja Aleksandra 15
11120 Belgrade
Republic of Serbia
Email: office@poverenik.rs
Telephone: +381 11 3408 900

Where the GDPR applies, you may also complain to the competent supervisory authority in the European Economic Area country where you live, work or believe an infringement occurred.

17. Children

The website and products are not directed at children, and we do not knowingly seek to collect children’s personal data.

Where we learn that a child’s data has been collected without an appropriate legal basis, we will take reasonable steps to delete it.

18. Security

We use technical and organisational safeguards appropriate to the nature and risk of processing, including, where applicable:

• protection of data in transit;
• access controls;
• user roles and least-privilege access;
• administrator authentication;
• protection of credentials and secrets;
• input validation;
• bot and spam protection;
• backups;
• technical logging;
• software updates;
• confidentiality obligations;
• incident-response procedures;
• retention and deletion controls.

No system is entirely risk-free, and absolute security cannot be guaranteed.

Where a personal data breach occurs, we will comply with applicable notification requirements.

19. Information about other people

Where you submit another person’s personal data, you confirm that you have an appropriate basis to do so and, where necessary, have informed that person of this Policy.

Do not submit documents, photographs or drawings containing unnecessary third-party personal data.

20. External content and platforms

The website may contain links to or content from map, social-media, video, review and other service providers.

When you open external content or authorise it to load, the relevant provider may independently collect information under its own privacy terms.

PLASTOPEX is not responsible for independent processing performed by third parties.

21. Changes to this policy

We may update this Policy to reflect:

• new website functions;
• new service providers;
• changes in technology;
• changes in processing purposes;
• changes in law;
• new regulatory guidance;
• improvements in transparency.

The revised version will display a new update date.

Where a change materially affects your rights, we will provide additional notice or request renewed consent where required.

22. Contact

For questions, requests or complaints regarding this Policy:

PLASTOPEX DOO
Pere Jovanovića - Komirićanca 50
14253 Osečina
Republic of Serbia
Email: info@plastopex.com
Telephone: +381 69 723 200