Privacy Policy

1. Who processes your data

The data controller is Probotanic d.o.o., Vučićev prolaz 20a, 11000 Belgrade, Serbia, Tax ID (PIB) 112295056 (hereinafter: “Probotanic”, “we”).

For any questions about your data: [email protected], tel. 011 3807 535.

This policy applies to the website probotanic.com in all languages (Serbian, English, Slovenian), to the online shop, the Probotanic Club and the emails we send. We process data in accordance with the Law on Personal Data Protection of the Republic of Serbia and, for visitors from the European Union, also in accordance with the General Data Protection Regulation (GDPR).

2. What data we process, why and for how long

2.1 Purchases and delivery

• Data: first and last name, delivery address, phone number, email address, order contents and value, payment method, order notes.
• Purpose: receiving, processing, delivering and charging for your order, complaints and returns.
• Legal basis: performance of the purchase contract; keeping invoices and accounting records is a legal obligation.
• Retention: for the duration of our relationship with you; accounting records for the period required by law (up to 10 years).
• You enter your payment card details directly on the bank’s page (Banca Intesa); we do not see or store them.

2.2 Customer account and Probotanic Club

• Data: email address, password (stored encrypted), name, addresses, phone number, date of birth if you provide it, purchase history, points balance and membership tier (Bronza (Bronze), Silver, Gold, VIP, Dijamant (Diamond)).
• Purpose: managing your account, Club discounts and benefits, earning and redeeming points, referrals to friends, birthday greetings.
• Legal basis: performance of a contract (Probotanic Club terms).
• Your membership tier is determined automatically based on the value of your purchases in the last 12 months. It only affects the level of your discounts and benefits and has no legal consequences for you.
• Retention: for as long as you have an account. You can delete your account yourself on the My Account page or by writing to us; deleting your account deletes your data, except data we are required to keep by law (invoices).
• When you register, we send you an email to confirm your email address. Administrative messages relating to your account, orders and points (confirmations, password changes, order notifications) are always sent, as they are necessary for the service.

2.3 Newsletter and email offers

• Club members: we send you news, tips and special discounts only if you have chosen to receive them by ticking the box “I want to receive news, tips and special offers from the Probotanic Club.” when registering or later in your account settings. Legal basis: consent.
• Customers: as a customer, we may occasionally send you offers for similar products and reminders (e.g. when it is time for a new pack). We inform you of this when you make a purchase. Legal basis: legitimate interest, with the right to unsubscribe at any time.
• We tailor the content of our emails to your purchases and membership tier (segmentation), so that you receive offers that are useful to you.
• Unsubscribing: the “Unsubscribe” link in every email, or My Account → Notification settings. Unsubscribing takes effect immediately for all marketing emails.
• Retention: until you unsubscribe. We keep a record of your unsubscribe permanently, so that we do not send you messages again.
• We measure whether an email has been opened and which link was clicked, so that we can send fewer and better messages.

2.4 Questions to our expert advisers

• Registered members can ask our expert advisers a question (medicine, aromatherapy). A question may contain health data.
• Legal basis: your explicit consent, which you give by submitting the question.
• We may publish the question and answer on the website, but without your email address, name or any information by which you could be identified.
• Retention: for as long as you have an account or until you request deletion.

2.5 Ana — chat assistant

• Ana is a chatbot based on artificial intelligence. She answers on the basis of information from the probotanic.com website and is not a substitute for medical advice, diagnosis or treatment.
• The chat loads only when you click the chat button. The content of the conversation is processed by the Chatling service (see section 3).
• Please do not enter health data in the chat by which you could be identified (your name, or phone number together with a description of your condition, etc.).
• Legal basis: your request / consent (starting the chat).

2.6 Reviews, comments and contact forms

• After a purchase we may invite you by email to rate a product (legitimate interest; you can unsubscribe in the email). The name you entered is shown with your published review.
• Comments on the website: name, email address, IP address and browser data (to protect against spam comments). To display a profile picture, a hashed email address may be checked with the Gravatar service (Automattic).
• Contact and business (B2B) forms: the data you enter, used only to reply.
• Retention: comments and reviews for as long as they are published; form enquiries up to 2 years.

2.7 Statistics, advertising and cookies

• With your consent, we use Google Analytics (visitor statistics), Google Ads and the Meta (Facebook/Instagram) pixel (ad measurement and display) and similar technologies.
• If you consent to marketing cookies, we also send purchase data (e.g. order value) to Meta and Google from our server, for more accurate ad measurement.
• Details: Cookie Policy. You can change your choice via the “Cookie settings” link at the bottom of every page.

2.8 Web notifications (push)

• If you allow them in your browser, we send notifications about news and your order via the PushAlert service. Legal basis: consent. They can be turned off in your browser settings.

2.9 Website security

• The server automatically logs the IP address, time and page accessed, and protection systems check requests to protect against attacks and bots.
• Legal basis: legitimate interest (security). Retention: up to 90 days, except in the event of a security incident.

3. Who we share data with

We do not sell data. We share it only with service providers that process it on our behalf and only to the extent necessary for their service:

We also share data with public authorities where required by law.

For data that Meta collects via the pixel on our website, Probotanic and Meta are joint controllers for the collection itself; Meta is responsible for any further processing in accordance with its own privacy policy.

4. Transfers of data outside Serbia and the EU

Some providers (Google, Meta, Cloudflare, Chatling, PushAlert) may process data outside Serbia and the EU. We transfer data only to countries that have been recognised as providing an adequate level of protection (e.g. EU countries, Canada, US companies certified under the EU–US Data Privacy Framework) or with Standard Contractual Clauses as a safeguard.

5. Your rights

You have the right to:

• obtain information about, and a copy of, the data we hold about you;
• request the correction of inaccurate data;
• request the erasure of your data (“right to be forgotten”);
• request the restriction of processing;
• object to processing based on legitimate interest, and to receiving marketing messages at any time;
• receive your data in a readable electronic format (portability);
• withdraw your consent at any time, without affecting earlier processing.

Send your request to [email protected] or call 011 3807 535. We respond within 30 days at the latest. For your protection, we may ask you to send your request from the email address linked to your account.

If you believe your rights have been infringed, you may lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (www.poverenik.rs). Visitors from the EU may also contact the supervisory authority in their own country (in Slovenia: the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec, www.ip-rs.si)).

6. Data security

Data is stored on a protected server in the EU with an encrypted connection (HTTPS), restricted access and regular backups. We store passwords only in encrypted form. No system on the internet is completely secure, so please keep your password safe and do not use it on other websites.

7. Children

The website is not intended for persons under the age of 15 and we do not knowingly collect their data. If we learn that we have collected it, we delete it.

8. Cookies

The website uses cookies. Necessary cookies are always active; analytics, functional and marketing cookies are used only with your consent. Full details, with a list of cookies: Cookie Policy.

9. Changes to this policy

We update this policy when we change the way we process data. The date of the last update is shown at the top of the page. We notify Club members of significant changes by email.