Dunav Gold Explore the range

Legal documents

Privacy Policy

Information about the data we process and your rights.

Download the document

This Privacy Policy supplements the personal data protection section of the General Terms of Business and provides users of Dunav Gold’s services with clear and precise information on the data processed, the purposes of processing, how data is obtained and all other information concerning the exercise of data subjects’ rights, in accordance with the Personal Data Protection Act (Official Gazette of the Republic of Serbia, No. 87/2018).

The Policy governs the processing of personal data of Website visitors and registered users (hereinafter: Users), buyers (hereinafter: Buyers), and individuals acting as their representatives, payers or recipients collecting goods at Locations under the Company’s General Terms of Business (hereinafter: the Terms).

The controller is DUNAV GOLD DOO BEOGRAD – VRAČAR, Hadži Ruvimova 2, Belgrade – Vračar, company registration number: 21082074, tax identification number (PIB): 108858764 (hereinafter: the Company). The Company processes personal data in accordance with the Personal Data Protection Act of the Republic of Serbia.

Website: www.dunavgold.rs

DATA PROCESSED BY THE COMPANY AND DATA SOURCES

Depending on how the Website is used and the particular purchase, the Company processes:

  • Contact and account information: first and last name, email, telephone number, login details, saved information and favourite products, where the User uses an account.
  • Purchase information: Order contents and number, price, time of ordering and acceptance of the Terms, payment method and status, selected Location, collection of goods, invoices, refunds and correspondence.
  • Payment information: payer’s name, bank and account number, amount, date, payment reference and evidence of an executed transfer, to the extent required to match a payment and make a refund. The Company does not request online banking passwords, card CVC codes or information on unrelated transactions.
  • Identification information: first and last name, address and JMBG, or the corresponding identification number for a foreign national, where required for statutory records of investment gold transactions. The Company processes information on the type, number and validity of identity documents, date of birth, authorisation, beneficial owner and source of funds where required by applicable regulations and the particular verification procedure. The Company retains a copy of an identity document only with an appropriate legal basis and does not collect biometric data from its electronic chip.
  • Enquiry and complaint information: the content of communications, proof of purchase, description of the defect, the request and details of its resolution. The User or Buyer provides information and documentation relevant to the particular enquiry or complaint.
  • Technical information: IP address, access time, browser and device information, and logs of errors and security events, to the extent processed by Website systems. Data from non-essential cookies is processed in accordance with the “Cookies and promotional messages” section.

The Company obtains data primarily directly from the User, Buyer or other data subject, including information supplied through the Website. It also obtains payment information from the bank and collection information from authorised persons at the selected Location. The Buyer may provide details of a representative, payer or recipient, while the Company may independently obtain information from official records and registers. Where it obtains data indirectly, the Company provides the data subject with the required information within the statutory period in accordance with applicable regulations, except where an exception prohibits such notification.

PURPOSES AND LEGAL BASES FOR PROCESSING

  • Processing for performance of a contract (ordering, contract and user account)

The Company processes information required for handling Orders, communication, conclusion and performance of the contract, payment, collection and refunds in order to take steps at the data subject’s request before conclusion of a contract and to perform a contract with that person, where processing is necessary for performance of the contract with the Buyer. The same legal basis applies to an account opened at the User’s request; registration is not a condition of purchase.

  • Processing required by law (the controller’s legal obligations)

The Company processes information required to execute transactions, maintain tax and accounting records, keep records of investment gold transactions and handle complaints in order to meet its legal obligations. The Company verifies identity, beneficial ownership and the source of funds and provides information to competent authorities when and to the extent required by anti-money laundering and counter-terrorist financing regulations and other relevant regulations.

  • The Company’s legitimate interests

For Website and account security, prevention of misuse, responses to general enquiries and the establishment or defence of legal claims, the Company processes necessary information on the basis of legitimate interests, after assessing that the data subject’s rights and interests do not override the Company’s interests. It also processes information about business contacts who are not parties to the contract on this basis, except where processing is mandatory under applicable regulations.

  • Consent

If the Company offers promotional messages or uses non-essential analytics or advertising cookies, processing is based on the User’s or Buyer’s separate, freely given consent. Purchasing, registering or accepting the General Terms does not constitute such consent. Consent may be withdrawn at any time without affecting the lawfulness of previous processing, and is not a condition of purchase.

The Company clearly identifies personal data that must be collected. Failure to provide information necessary for an Order or mandatory Buyer identification may prevent conclusion or performance of the contract; providing information for optional features and marketing is voluntary and based on the User’s or Buyer’s consent.

DATA RECIPIENTS

Data is accessed by authorised employees and persons engaged by the Company who need it to perform their work duties and/or contractual obligations, and may be provided to the following groups of recipients:

  • providers of hosting, Website maintenance, business software and electronic communications;
  • authorised persons at the selected Location, for identification and handover of goods, limited to the minimum necessary information;
  • banks, accountants and legal advisers where required for payment, statutory records or protection of the rights and interests of the Company and/or Users;
  • the Tax Administration, the Administration for the Prevention of Money Laundering, courts and other competent authorities where there is a legal basis for disclosure.

Persons processing data on behalf of the Company act on its instructions and under an appropriate agreement governing the outsourcing of personal data processing. Banks and other persons processing data for their own purposes determined by law or internal policies have independent obligations as controllers. Business cooperation or membership of the same network of entities connected with the controller does not permit unrestricted sharing of personal data. The Company does not use information from identity documents for marketing purposes.

RETENTION PERIODS

The Company retains data according to its purpose and the following rules:

  • Account information – while the account is active or until a request to close it; information on completed purchases and statutory records is retained separately on the relevant basis.
  • Orders and contractual documentation – during performance of the contract and subsequently only for as long as necessary for records required by applicable regulations, the exercise of the Buyer’s rights and legal claims, according to applicable limitation periods.
  • Tax documentation and records of investment gold transactions – until expiry of the limitation period for assessing and collecting VAT, in accordance with Articles 36b and 47 of the VAT Act; accounting documents and books according to the periods prescribed for the particular type of documentation.
  • Documentation obtained under the Law on the Prevention of Money Laundering and Terrorist Financing, where that law applies – five years after termination of the business relationship or execution of the transaction, in accordance with Article 95 of that Law, with extensions only under statutory conditions.
  • Complaint records – at least two years after submission of the complaint, and longer only where another legal obligation or a specific legal claim exists, in accordance with Article 63 of the Consumer Protection Act.
  • General enquiries — 12 months after the enquiry is closed and communication about it has ended. This does not include complaints, contractual documentation or information subject to a specific statutory retention requirement.
  • Unaccepted Orders without payment — 90 days after the Order is finally closed. This period does not apply to accepted Orders, issued pro forma invoices, payments or records retained on another basis.
  • Routine technical logs — 30 days after the record is created; information isolated for a specific security incident, dispute or legal obligation is retained only for as long as necessary for that purpose.
  • Marketing information – until withdrawal of consent or the end of that purpose; limited evidence of consent and unsubscribe requests may be retained for as long as necessary to demonstrate the lawfulness of previous personal data processing and the consent withdrawal procedure. Cookie retention periods are set out in the “Cookies and promotional messages” section.

Where proceedings are ongoing, necessary documentation is retained until they have been finally concluded and the outcome enforced, within the limits of the law. Specific erasure rules, particularly for anti-money laundering documentation, take precedence. After the relevant period expires, the Company deletes or irreversibly anonymises the data, including backup copies according to the established retention cycle.

TRANSFERS TO OTHER COUNTRIES AND INTERNATIONAL ORGANISATIONS

The Company protects data through technical and organisational measures appropriate to the risk, including access restrictions and confidentiality obligations for persons it engages. In the event of a legally relevant data breach, the Company notifies the Commissioner and affected individuals under the conditions and within the periods prescribed by Articles 52 and 53 of the Personal Data Protection Act.

Transfers outside the Republic of Serbia may take place only where statutory conditions are met, the required safeguards are in place and the User, Buyer or other data subject is appropriately informed.

The Company does not currently transfer personal data to other countries or international organisations within the meaning of Chapter V of the Personal Data Protection Act.

COOKIES AND PROMOTIONAL MESSAGES

The Website uses cookies for the basket, account login and remembering your selected language. These are first-party cookies set on the Website domain by Dunav Gold using WordPress, WooCommerce, Polylang and Transliterator.

  • woocommerce_cart_hash and woocommerce_items_in_cart — WooCommerce; detect changes to the basket contents. Duration: the browser session.
  • wp_woocommerce_session_* — WooCommerce; links your browser to basket contents and shopping information on the server. Duration: up to two days for a guest or seven days for a logged-in user; continued use may renew this period.
  • pll_language — Polylang; remembers the selected Website language. Duration: up to one year.
  • wordpress_test_cookie — WordPress; checks whether the browser accepts cookies when logging in. Duration: the browser session.
  • wordpress_logged_in_* and wordpress_sec_* — WordPress; maintain secure account login and are set when you log in. A standard login lasts up to two days, or 14 days with “Remember me”; logging out ends the login.
  • rstr_test_* — Transliterator; technically distinguishes public and administrative requests for correct text display and processing. Duration: the browser session.
  • rstr_script — Transliterator; remembers Latin or Cyrillic script when a script choice is used. Duration: up to one year; this is separate from the SR/EN language choice.

WooCommerce also uses browser session and local storage to cache the basket display (wc_fragments_*, wc_cart_hash_* and wc_cart_created). Session records last until the tab is closed; the local basket hash has no separate expiry date and is replaced when the basket updates or removed when you clear Website data in the browser. These records support the basket rather than advertising tracking.

The * symbol denotes a variable part of a cookie name. Some cookies are set only when you use the relevant feature. Cookies may contain identifiers linked to information stored on the server; we do not use them to store your JMBG.

WooCommerce order attribution is disabled, so the Website does not set additional sbjs_* cookies for that purpose. The Website does not currently use Google Analytics or Meta Pixel. Social media links lead to separate websites governed by those providers’ policies.

You can view, delete or restrict cookies in your browser settings. Blocking basket or login cookies may prevent those features from working. If we introduce optional analytics or advertising cookies, we will update this overview and provide a separate choice before activating them; refusal will not be a condition of purchase.

A User or Buyer who subscribes to promotional messages can unsubscribe using the link in the message or by contacting info@dunavgold.rs. Notifications about an Order, payment, collection or complaint are business communications and do not depend on consent to promotional messages.

DATA SUBJECTS’ RIGHTS

  • Right of access:

Under the right of access, you may request the following information from the Controller concerning your personal data:

  • information about the types of personal data processed, the purposes of processing and retention periods;
  • information about the purposes of processing;
  • information about the envisaged retention period or, where this is not possible, the criteria used to determine it;
  • Right to rectification and completion:

You may use this right to request that inaccurate personal data be corrected or completed without undue delay.

  • Right to erasure of personal data:

You may exercise this right in the following cases:

  • if your personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
  • if you withdraw consent to processing and there is no other legal basis for processing;
  • if you object to processing in the public interest, for the exercise of the Controller’s statutory powers or for the pursuit of legitimate interests;
  • if you object to processing for direct marketing;
  • if the data has been processed unlawfully;
  • if personal data must be erased to comply with the Controller’s legal obligations;
  • if personal data has been collected in connection with the use of information society services.
  • Right to restriction of processing:

You may exercise this right in the following cases:

  • if you contest the accuracy of personal data, for a period enabling the Controller to verify its accuracy;
  • if processing is unlawful and you request restriction of use instead of erasure;
  • if the Controller no longer needs personal data for the purposes of processing but you require it to establish, exercise or defend a legal claim;
  • if you have objected to processing and an assessment is ongoing as to whether the Controller’s legal grounds override your interests.
  • Right to appeal:

For all questions, requests and objections, you may contact customer service at: info@dunavgold.rs

The authorised person for personal data protection is Dejan Radoičić.

The person responsible for personal data protection oversees processing to ensure compliance with the Act.

  • Right to lodge a complaint:

If the User believes that provisions of the Personal Data Protection Act have been breached, they have the right to lodge a complaint with the Commissioner for Information of Public Importance.

AUTOMATED DECISIONS, PROFILING AND MINORS

Automatically updating the market price and sending an Acknowledgement of Receipt do not in themselves constitute a decision based on profiling individuals. The Company does not make decisions based on automated processing of personal data or carry out profiling.

Purchasing is intended for adults under the Terms. The Company does not process or request minors’ personal data for registration and purchase. If it receives such data, it checks the legal basis for processing and deletes the data where there is no lawful reason to retain it.

VALIDITY OF THE PRIVACY POLICY

As the Company, acting as controller, may change the Privacy Policy, we recommend reviewing it regularly. If there are significant changes, we will inform you in good time by email, a notice on the Website or other communication methods, allowing appropriate time to consider the changes before they take effect. If you do not accept an amendment within the appropriate period, we may be unable to provide some or all products and services.

Publication date of this version: 21 October 2026. Effective date: 21 October 2026.

Privacy Policy for Dunav Gold Automation App