Personal Data Protection Policy

Era Auto Personal Data Protection and Privacy Notice

Era Auto d.o.o (“Company” or “Era Auto”), as the data controller, is committed to protecting the privacy of its visitors. In accordance with the Personal Data Protection Law No. 6698 ("Law"), personal data of our visitors will be recorded, classified, stored, updated, and processed within the framework of the processing conditions specified in the Law. In cases where permitted by law, the data may be shared with third parties to the extent allowed.

This Privacy Notice has been prepared in accordance with the current legislation, primarily the Law, as well as the regulations, communiqués, decisions, and guidelines published by the Board. If there are changes to the Law or other relevant regulations after the publication of this Visitor Privacy Notice, the provisions and rules that have been amended will apply. All communiqués, decisions, and guidelines issued by the Board are followed by our Company, and the rules foreseen in this Privacy Notice are kept up to date.

DATA SUBJECTS

Data subjects under this Privacy Notice are all individuals who visit the Company's premises.

DATA CONTROLLER AND REPRESENTATIVE IDENTIFICATION

Under the Law, your personal data will be collected and processed by Era Auto d.o.o, as the data controller, to the extent specified below.

For inquiries regarding the processing of your personal data, you can contact the Era Auto Representative at [email protected].

PURPOSES OF PROCESSING PERSONAL DATA, METHODS OF COLLECTION, LEGAL GROUNDS

Era Auto may record, store, update, share with third parties, classify, and process your personal data in accordance with the conditions specified under Article 5 of the Law, titled "Conditions for Processing Personal Data."

The personal data collected via the channels and methods mentioned in this Privacy Notice will be processed by the Company for the following purposes:

Identity Information

Personal Data Processed	Purpose of Processing Personal Data
Name, Surname	Physical Security, Ensuring the Safety of Movable Property and Resources, Ensuring the Security of Data Controller Operations, Creating and Monitoring Visitor Records, Conducting Archiving and Storage Activities, Managing Information Security Processes, Ensuring Compliance with Legislation, Communicating with Authorized Persons, Organizations, and Institutions

Legal Grounds for Processing Personal Data Your personal data is processed based on the following legal grounds stated in Article 5 of the Law:

Explicitly provided for by laws,
Required for the data controller to fulfill a legal obligation,
Necessary for the legitimate interests of the data controller, as long as it does not infringe on the rights and freedoms of the data subject.

Methods of Collecting Personal Data The personal data mentioned above is collected through printed and electronic forms, as well as electronic systems.

Communication Information

Personal Data Processed	Purpose of Processing Personal Data
Employer Name/Title, Mobile Number, Email Address	Conducting Communication Activities, Ensuring Physical Security, Ensuring the Safety of Movable Property and Resources, Ensuring the Security of Data Controller Operations, Creating and Monitoring Visitor Records, Managing Information Security Processes, Ensuring Compliance with Legislation, Communicating with Authorized Persons, Organizations, and Institutions

Legal Grounds for Processing Personal Data Your personal data is processed based on the following legal grounds:

Explicitly provided for by laws,
Required for the data controller to fulfill a legal obligation,
Necessary for the legitimate interests of the data controller, as long as it does not infringe on the rights and freedoms of the data subject.

Methods of Collecting Personal Data The personal data mentioned above is collected through printed and electronic forms, as well as electronic systems.

Physical Security Information

Personal Data Processed	Purpose of Processing Personal Data
Entry/Exit Records, Security Camera Recordings	Ensuring Physical Security, Ensuring the Safety of Movable Property and Resources, Ensuring the Security of Data Controller Operations, Creating and Monitoring Visitor Records, Communicating with Authorized Persons, Organizations, and Institutions

Legal Grounds for Processing Personal Data Your personal data is processed based on the following legal grounds:

Necessary for the data controller to fulfill a legal obligation,
Necessary for the legitimate interests of the data controller, as long as it does not infringe on the rights and freedoms of the data subject.

Methods of Collecting Personal Data The personal data mentioned above is collected through printed and electronic forms, as well as security camera recordings.

Transaction Security Information

Personal Data Processed	Purpose of Processing Personal Data
Exit IP, Arrival IP, Log Records, Website Name, Date/Time, User Traffic Information, User Experience Metrics, Port Number, MAC Address	Managing Information Security Processes, Ensuring Compliance with Legislation, Communicating with Authorized Persons, Organizations, and Institutions, Ensuring the Security of Data Controller Operations, Creating and Monitoring Visitor Records

Legal Grounds for Processing Personal Data Your personal data is processed based on the following legal grounds:

Necessary for the establishment, use, and protection of a right,
Necessary for the legitimate interests of the data controller, as long as it does not infringe on the rights and freedoms of the data subject.

Methods of Collecting Personal Data The personal data mentioned above is collected through electronic systems.

Health Information

Personal Data Processed	Purpose of Processing Personal Data
Temperature Measurement Result	Ensuring Occupational Health and Safety, Ensuring Compliance with Legislation

Legal Grounds for Processing Personal Data Your personal data is processed based on the legal grounds of explicit consent.

Methods of Collecting Personal Data The personal data mentioned above is collected via a temperature measurement device.

TRANSFER OF PERSONAL DATA

Personal data of data subjects is shared with the shareholders/partners of the Company for internal audit purposes, with authorized public institutions and organizations to the extent required by relevant legislation, and with information technology service providers.

RIGHTS UNDER THE LAW

As personal data owners, you can make requests regarding your rights through the procedures outlined in the Personal Data Protection and Processing Policy and the Data Subject Application Form published on https://www.filamingo.ba, or by sending a written request with the required information through the registered electronic mail (KEP), secure electronic signature, mobile signature, or the email address previously provided by you and registered in the Era Auto system.

Upon verification of your identity, Era Auto will respond to your request within 30 days at the latest, free of charge. However, if the process requires additional costs, the applicable fee according to the tariff determined by the Personal Data Protection Authority will be charged.

Personal data owners have the following rights:

To learn whether their personal data is processed,
To request information about their personal data if it has been processed,
To learn the purpose of processing personal data and whether it is used in accordance with the purpose,
To know third parties to whom their personal data has been transferred, both domestically and internationally,
To request the correction of personal data if it is incorrect or incomplete, and request the notification of this correction to third parties to whom the data has been transferred,
To request the deletion or destruction of personal data if the reasons for processing no longer exist, and request the notification of this deletion or destruction to third parties to whom the data has been transferred,
To object to any result derived solely from automated processing of personal data that produces an unfavorable consequence for the individual,
To request compensation for any damage incurred due to unlawful processing of personal data.

Era Auto d.o.o ensures that if there is any discrepancy between the current Personal Data Protection and Privacy Notice and changes in the legislation, the provisions of the legislation will take precedence.