PRIVACY POLICY OF THE WEBSITE ME.PLOOM.COM AND OTHER ACTIVITIES RELATED TO THE PROMOTION AND SALE OF PLOOM PRODUCTS

Effective from June 12, 2024

1. General notes

JT INTERNATIONAL AKCIONARSKO DRUŠTVO SENTA, with registered seat at the address Subotički put 25, Senta, Republic of Serbia, company number: 08052441, tax ID number: 101102656 (“We” or “JTI”), a member of JTI group of companies (“JTI Group”), respects your privacy. This notice will help you understand our privacy policies, and we kindly ask you to read it thoroughly.

In accordance with applicable regulations, this Privacy Policy represents comprehensive information regarding the processing of personal data concerning the presentation and sale of products under the Ploom brand, specifically electronic devices for heating non-burning tobacco products, as well as associated components and accessories (“Products”).

This Privacy Policy applies to data collected in interactions with individuals conducted through this website www.me.ploom.com (“Website”), as well as through mail, email, telephone, and other available means outside the Website (for example, at points of sale of the Products).

The presentation and sale of Products are intended and permitted exclusively for individuals located in Montenegro who are at least 18 years old, considering the nature of the Products, as well as regulatory and company restrictions. Accordingly, please read our Terms and Conditions of Use of the Website. Given that our Products are also presented outside the Website and sold at appropriate points of sale, the Privacy Policy also applies to the collection and processing of personal data occurring in that manner (outside the Website).

If you do not agree with any rule of our Privacy Policy, please refrain from using the Website or providing us with your personal data in any way (via the Website or otherwise).

To protect your privacy, JTI applies appropriate technical, organizational, and personnel measures and continually works to improve them to ensure that your data is treated in accordance with applicable regulations and your consent (when required by law). In this regard, JTI may occasionally change and improve this Privacy Policy, in which case it will ensure that the updated version is available on the Website, with a clearly indicated start date of application. We invite you to check whether the Privacy Policy has been updated since your last visit to the Website and, if so, to familiarize yourself with the content of the new one. If you do not agree with the new rules, please refrain from using the Website and providing your data in any way, and regarding the data for which you previously consented to their processing, you can exercise the right to withdraw consent (for more information, see section 11 of the Privacy Policy).

You can access the text of the current Privacy Policy via a shortcut in the footer of the Website whenever you have internet access. By continuing to use the Website, we will consider that you have read and understood the current Privacy Policy and that you agree to all its rules.

This Privacy Policy and any amendments and supplements thereto are governed by the laws of Montenegro, specifically the Law on Personal Data Protection (Official Gazette of Montenegro no. 79/2008, 70/2009, 44/2012 and 22/2017) (“LPDP”) and accompanying by-laws.

2. Information on data controller and representative for Montenegro

In this section, you can find information about the identity and contact details of the data controller, i.e., the legal entity responsible for managing your data, as well as the contact information of the representative for Montenegro.

Below are the details of the representative for Montenegro:

3. Who do we collect data from?

We may collect your personal data in several ways:

• Directly from you, when you provide us with your data. For example, when you contact us through the Website or at a point of sale, or via mail, email, or telephone, and leave your contact information for us to respond to your inquiry or request; or
• Automatically, when using the Website. In this case, we (or our partners, i.e., third parties on our behalf) use technologies such as cookies. For more information on how we use cookies, please read section 5 of this Privacy Policy.

4. Data we process, how we use it, and on what basis

JTI collects data that is appropriate, essential, and limited to what is necessary for a specific processing purpose.

We use or may use your data for achieving multiple purposes that are predetermined. Each processing action we undertake has an appropriate legal basis as prescribed by the LPDP.

The data we directly collect may be compared and combined with data we collect automatically, allowing anonymous data (such as frequency of visiting specific content on the Website) to become personal data (for example, how often you visit specific content on the Website). This enables us to provide you with a personalized experience when visiting the Website.

Additionally, we may anonymize certain data and use it for statistical and analytical purposes, without the possibility of identifying individual persons to whom the data pertains directly or indirectly. For example, we may obtain data about the percentage of users who visited specific content on the Website and, based on these trends, modify and improve the content.

Keep in mind that the Website is purposefully designed to achieve its goals through interaction with you and insight into your activities on the Website and/or the data we collect directly from you or automatically when you use the Website. Therefore, in order to offer you relevant content or to interest you in additional content, i.e., to strengthen our relationship with you or to involve you in our loyalty programs and reward you accordingly, it is necessary for us to know which categories of content interest you, whether you have visited certain content, etc.

JTI processes or may process some or all of the data listed here. JTI continually works on the development of the Website and improvement of available services, which may result in the processing of certain data listed below starting at a later time as the Website functionalities increase, or the scope of data we process may expand, in which case we will amend this Privacy Policy and notify you accordingly, in accordance with the LPDP. Additionally, the extent of data we process depends, for example, on how you use the Website or what your cookie settings are.

For better clarity or understanding, information regarding your personal data that may be subject to processing, as well as the purposes and legal basis of such processing, are divided into two main categories:

• personal data that may be subject to processing in connection with the use of the Website; and
• personal data that may be subject to processing in connection with your activities outside the Website.

4.1. Personal data that may be subject to processing in connection with the use of the Website (click to expand for more information):

You can use the Website as:

• visitor (without registration); and
• registered user (with created account).

4.1.1. Personal data of Website visitors that are or may be subject to processing (click to expand for more information):

4.1.2. Personal data of registered users of the Website that are or may be subject to processing (click to expand for more information):

4.1.2.1. Data on so-called Leads, who are or may be subject to processing:

Regarding registration, i.e., creating a user account, we highlight that a specific type of registration is possible and available on the website www.discoverploom.me, which is related to the Website, i.e., the Products presented through it (“Lead Registration Website”).

Adult individuals from the territory of Montenegro interested in the Ploom electronic device for heating non-combustible tobacco product (“Device”), i.e., individuals considering purchasing the Device and wanting more information about it, can create a user account, i.e., register on the Lead Registration Website. Leads’ user accounts are used to receive free content related to the Device, and the Controller will contact them for marketing purposes.

In addition to the Lead Registration Website, Lead registration is also possible at sales points.

Regarding Leads, the Controller will process, or may process, the data specified in the Personal Data Processing Notice available on the Lead Registration Website or highlighted at sales points. Therefore, please carefully read the information contained in these notices.

4.2. Personal data that may be subject to processing regarding your activities outside the Website (click to expand for more information):

When it comes to your activities outside the Website, there may be processing of personal data of:

• Leads registered at the point of sale;
• buyers of Products at the point of sale.

4.2.1. Personal data that may be subject to processing regarding Leads registered at the point of sale (click to expand for more information):

See section 4.1.2.1. of the Privacy Policy.

4.2.2. Personal data that may be subject to processing regarding customers of Products at the point of sale (click to expand for more information):

4.3. Personal data subject to processing regarding any of the previously mentioned categories of individuals (click to expand for more information):

Detailed information about the data automatically collected through cookies can be found in section 5 of this Privacy Policy.

If there is a subsequent need to process your data for another purpose that is different from the one for which the data was collected, JTI will provide you with information about that other purpose, as well as any other relevant information in accordance with the LPDP, before commencing further processing.

4.4. Consent for personal data processing

In accordance with the preceding sections of this section 4 of the Privacy Policy, we process certain data based on your consent. You can provide valid consent for processing in several ways: by ticking certain boxes on the Website, enabling certain cookies on the cookie banner on the Website (by moving the slider from inactive to active status), by your verbal or written statement, or by a clear affirmative action, including a combination of some of the mentioned methods.

For example, when creating a user account at the point of sale, you may give verbal consent to the person collecting data on our behalf to receive an SMS message containing a unique code on your mobile phone, and by providing that code to the person, you confirm that you consent to the processing of your data for specific marketing or other purposes based on consent, with such processing previously presented to you through notice displayed at the point of sale.

For more information about your rights and the possibility of withdrawing consent, please carefully read section 11 of the Privacy Policy.

5. Cookies

The Website uses cookies to provide you with the best user experience. They allow us to, for example, display Website content correctly on each of your devices or web browsers you use to access it, or to tailor the content we serve on the Website to your interests. Information collected in this way may sometimes include personal data, but not necessarily. Because JTI respects your privacy, in this section, we want to explain what cookies are and how we use them, and also to inform you that in certain cases, you can manage how we use cookies when it comes to your use of the Website. When this Website allows you to choose or disable certain cookies and you opt for that option, it may reduce the functionality of the Website. Also, keep in mind that the settings you choose to disable will need to be disabled on each other device or web browser separately.

Cookies are simple text files stored in the user's web browser or on their device. The main task of cookies is to allow the website to “recognize” the user when they access it next time. In that situation, the website uses the data stored in the cookie and automatically obtains information about the user's previous activities on the website. Cookies cannot access your data stored on devices, but they can collect data about your online activities.

Cookies are not harmful to the user or their device and should not be confused with viruses. Cookies do not contain viruses or other malware (malicious software).

Depending on how long they remain in the user's web browser, we distinguish between session cookies (they are retained only during a specific browsing session and are automatically deleted after it ends, and they serve to allow access to specific content) or permanent cookies (they “remember” information for the next visits to the website, they are retained for a longer or shorter period until you manually delete them or until they expire according to the specified duration, e.g., cookies that enable the website to “remember” login information in case of account creation or tracking cookies).

Based on their ownership, there are first-party cookies (cookies set by JTI as the owner of the website you are browsing) and third-party cookies (cookies set by our selected partner companies that provide us with various services, e.g., analytical cookies because they collect and process certain data about the usage of the website and provide us with information in anonymized form, or these cookies enable related content to be displayed to you on their websites or other locations on the Internet).

Cookies can contain different information and be used for different purposes. The Website uses the following types of cookies:

5.1. Strictly necessary cookies (click to expand for more information): 

These cookies are essential for the functioning of the Website and its proper display on the user's device. They are used to enable your login to access your account on the Website. You cannot disable these cookies due to their significance for the Website's operation. If you configure your web browser to block these cookies, there is a risk that certain parts of the Website will not function correctly.

An overview of the strictly necessary cookies used by the Website is provided in the table below:

5.2. Performance Cookies (click to expand for more information):

These cookies help us understand how users interact with our Website, allowing us to continuously tailor it to user preferences. Based on these cookies, we gather information about the number of visits, which pages of the Website are most and least visited, what content users access on the Website, in what order, and similar details. We collect this information through a third party, in an aggregated form, making the data anonymous. If you do not allow us to use these cookies, we will not be able to track the usage of the Website and its performance in the described manner.

An overview of the performance cookies used by the Website is provided in the table below:

5.3. Functional Cookies (click to expand for more information):

 These cookies do not collect data that identifies visitors. All information collected by these cookies is aggregated and therefore anonymous. They are used solely to improve the functioning of the Website.

An overview of the functional cookies used by the website can be found in the table below:

5.4. Targeting Cookies (click to expand for more information):

These cookies are typically third-party cookies, meaning they are set on the Website by partner companies such as Google. They are used to create profiles of visitors' interests for the purpose of displaying relevant advertisements on other websites. They usually do not store personal data but function by uniquely identifying your web browser and device.

An overview of the targeting cookies used by the Website can be found in the table below:

Information about cookies can also be found in the pop-up banner available when opening the Website before you make your cookie choices for the Website.

You can manage cookie usage at any time by selecting the appropriate settings in your web browser.

6. Data we do not process

JTI does not collect or process special categories of personal data, such as data related to racial or ethnic origin, political opinions, religious or philosophical beliefs, or membership in trade unions, data concerning health or sex life, or data relating to criminal offenses, imposed criminal and misdemeanor penalties, and security measures, nor data about minors.

Please do not disclose or send us this data.

7. Is data provision mandatory?

You are not obligated to provide us with your data; you do so voluntarily. For example, this will be the case when accessing your account and using our Website, or when contacting us and providing your contact information so that we can respond to your question or request.

We will always provide the option to unsubscribe from individual services we provide related to the use of the Website, such as sending newsletters, electronic and SMS messages. By doing so, you retain control over the way and extent of the use of your data. We invite you to read section 11 of this Privacy Policy carefully to learn about your other rights regarding processing.

Please note that in some cases, we may not be able to carry out our activities if you refuse to provide us with your data (for example, we will not be able to deliver rewards and promotional gifts to you as a member of the Ploom Club if you do not provide us with your address for delivery).

8. Recipients of personal data

Your data is primarily processed and used by JTI.

In some cases, it may be necessary to make your data available to third parties, i.e., recipients. These may be JTI Group members assisting us in responding to your questions or requests or our business partners helping us maintain the functionality of the website or providing us with analytical and other services.

Thus, your specific data (name, surname, date of birth, email address, phone number) will, upon your registration or creation of a user account at the point of sale, be made available to the partners with whom we have a contract, or who provides us with marketing, sales, and support services, including finding interested parties or potential customers, presenting products, and assisting in creating the said account or user experience.

We will ensure that your data is treated lawfully, and that third parties or data recipients handle it strictly in accordance with our instructions and these rules on personal data protection, as well as to apply appropriate technical, organizational and personnel measures for personal data protection by themselves. Regardless of which third parties or recipients your data is made available to, you have rights guaranteed to you by applicable laws, as outlined in section 11 of this Privacy Policy.

Additionally, there may be a legal obligation to make your data available to competent authorities (e.g., tax authorities, courts, etc.).

9. Transferring data abroad

We collect your data in Montenegro.

Considering that the controller is a business entity with registered seat in the territory of the Republic of Serbia, your data is subject to transfer to the Republic of Serbia. In this regard, please note that every transfer of personal data involves a certain level of risk of loss, damage, and compromise (unauthorized access) of such data. For this reason and given that the security of your data is very important to us, we take physical, technical, and electronic security measures to prevent accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access to personal data. You can read more about this in section 12 of this Privacy Policy.

Additionally, please be aware that using the Website, as well as disclosing or transmitting your data via mail, email, telephone, and other available methods outside the Website, implies your consent to the provisions of the Privacy Policy, including your consent to the transfer of personal data to the Republic of Serbia as stated here (within the meaning of Article 42, paragraph 1, item 2 of the LPDP); therefore, if you do not agree with this, please refrain from using the Website and do not provide us with your personal data in any other way.

Furthermore, the data we collect is stored on servers located in Geneva (Switzerland), which are owned and controlled by our affiliated legal entity JT International SA. In accordance with the policies of the JTI Group companies, a high level of technical and software protection of these servers is ensured. In this regard, please note that this involves the transfer of data to a country listed by the European Commission as having an adequate level of data protection (within the meaning of Article 42, paragraph 1, item 6 of the LPDP).

In addition to the above, and as previously mentioned, since other members of the JTI Group assist us in responding to your requests, establishing and maintaining relationships with our users or customers, some of your personal data (name, surname, email address, phone number) may be made available to individuals engaged by a JTI Group company based in Greece, as they are responsible for customer care activities (sending product usage instructions and similar information). Additionally, due to the technological solution used by the application and website through which registration is carried out, and the service provided by a company based in Lithuania, your data is transferred to this country. In this regard, please note that this involves the transfer of data to member states of the European Union (within the meaning of Article 42, paragraph 1, item 6 of the LPDP).

If it becomes necessary to make your data available to recipients in countries deemed not to provide an adequate level of data protection, we will ensure the application of appropriate protection measures in accordance with applicable regulations.

10. How long do we keep the data?

We keep your data only for as long as necessary to achieve the purpose for which the data was collected, after which we will securely remove them from our systems and delete them.

In accordance with the above:

• data about Website users who have created their user account on the Website, or whose user account was created at their request at another point of sale, i.e., by a partner agency through the appropriate application, are kept six months from the date of collection or until the user account is deleted or consent is revoked, whichever occurs first (if they do not become product buyers in the meantime);
• data about product buyers outside the Website, for whom a user account was created with their consent, are kept until consent is revoked;
• data about complainants, i.e., requests for rectification of Product non-conformities, are kept until the expiration of the statute of limitations for any consumer claims related to it;
• data about individuals who have consented to receive electronic newsletters, emails, or SMS regarding activities and content on the Website, or regarding various activities, novelties, and benefits related to our products, are kept until consent is revoked;
• data collected in response to consumer inquiries regarding products, or personal data protection, are kept for a maximum period of three months after the last communication with the consumer or the person to whom the data pertains;
• data related to benefits and incentives under the Operator's campaigns and its partners are kept for the duration of membership in the Ploom Club and two years thereafter.
• data collected by recording conversations with the customer care service are kept until the purpose for which they were collected is achieved, but no longer than three months from the date of collection.

Your data may be retained for a longer period if necessary to provide necessary information in case of any legal claims arising from your use of the Website and/or our products, as well as when required by regulations or in the case of cookies (more information about cookies can be found in Section 5 of this Privacy Policy).

11. Your rights regarding data processing

It's important for you to know that you have certain rights regarding the processing of personal data, which are guaranteed by the provisions of the LPDP and can be exercised under prescribed conditions.

Right to access - you have the right to request information about whether we process your personal data, as well as, if so, additional information regarding the processing, including information about the content of the data, the purpose, and the legal basis for processing.

Right to rectification and amendment, or deletion - you have the right to have incomplete data concerning you completed, as well as to have inaccurate data amended or deleted.

Right to erasure of data - in accordance with the above, you have the right to request the deletion of your data:

• if the data is inaccurate; and
• if their processing is not lawful.

Right to withdraw consent - if processing is based on your consent, you have the right to withdraw your consent at any time.

Right to lodge a complaint - you have the right to lodge a complaint with the competent supervisory authority in Montenegro. Below are their contact details:

• Agency for Personal Data Protection and Free Access to Information

Address: Bulevar revolucije 11, Podgorica, Montenegro

Email: [email protected], [email protected]

Phone: +382 20 634 894, +382 20 623 863.

If you wish to exercise the above-mentioned rights, you can contact us in the following ways:

• by mail - to the address:

JT INTERNATIONAL AKCIONARSKO DRUŠTVO SENTA

Subotički put 25

24400 Senta

Republic of Serbia;

• by email - at the email address:

[email protected];

• by phone - at the number:

+381112050300.

12. Security of your data

The security of your data is of utmost importance to us. Therefore, JTI implements physical, technical, and electronic measures to prevent accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access to personal data. These measures are directed towards individuals both outside and within our organization because access to your data is restricted only to those individuals whose duties necessitate such access and who are trained in the rules of personal data protection.

Unfortunately, there are no foolproof security systems, so we cannot guarantee that the security of the systems under our direct control will never be compromised. In the event of a breach of personal data, we will take all available measures and inform the competent authorities in accordance with regulations, as well as the individuals whose data is concerned, if possible.

13. Final provisions

To avoid doubt, all matters not expressly regulated by this Privacy Policy shall be governed by the laws of Montenegro, which law shall be applicable even in case of disputes concerning the Privacy Policy or the processing of personal data according to it, and such disputes shall be resolved before the competent court in Belgrade, Republic of Serbia, unless exclusive jurisdiction of the local court is prescribed by applicable law.

The Privacy Policy is drafted in Serbian and English languages, and in case of any discrepancies between the said versions, the Serbian language version shall prevail.