PLOOM PRIVACY POLICY
Effective as of November 3, 2025
1. Definitions and introductory remarks
We respect Your privacy and are committed to protecting Your personal data. Please read the information below carefully to understand how we collect, use, and protect your personal data.
The terms used in this Privacy Policy have the following meanings:
| We or JTI | meaning the company JT INTERNATIONAL AKCIONARSKO DRUŠTVO SENTA |
| JTI Group | meaning the group of JTI companies to which JTI belongs |
| Ploom device | meaning the electronic device for heating a non-combustible tobacco product under the Ploom brand |
| Products | meaning the products from the JTI Group portfolio, including the Ploom device and related accessories |
| Website | meaning the content available at the domain www.ploom.rs, the use of which is subject to the Terms of Use |
| Ploom App | meaning a mobile application designed to connect with the Ploom Device |
| E-store | meaning the online store available on the Website, which is operated by our partner MERCATA VT DOO NOVI SAD, in accordance with the General Terms of Sale |
| Ploom Club | meaning the loyalty program conducted by JTI with its partners, in accordance with the General Terms of Participation in the Ploom Club program |
| LPDP | meaning the applicable Law on Personal Data Protection of the Republic of Serbia |
This Privacy Policy presents a notice on personal data processing, explaining how We and our partners collect and use information about You when interacting, in connection with the Products, through both online and offline channels. This may include, for example, when You visit the Website, use the Ploom App, purchase Products through the E-store, create a user account, use the benefits of the Ploom Club, wish to learn more about the Products, receive promotional or educational content from us, participate in market research, or contact us for customer support or any other reason.
Our Products, as well as all related content, activities, and services, are intended for adults residing in the Republic of Serbia who consume tobacco or related products
We may from time to time amend and improve this Privacy Policy, in which case the updated version will be made available on the Website and, where appropriate, in other locations, clearly indicating the date on which it takes effect. In certain cases, We may also notify You by email. If You do not agree with the new rules, please refrain from sharing Your personal data with us or our partners in any manner. As for data you have previously consented to be processed, You may exercise Your right to withdraw consent (see Section 12 of this Privacy Policy for more information).
This Privacy Policy, as well as any amendments or supplements thereto, is governed by the laws of the Republic of Serbia, namely the LPDP and its accompanying bylaws.
2. Data controller, joint controllers, and Data Protection Officer
| Business name: | JT INTERNATIONAL AKCIONARSKO DRUŠTVO SENTA |
| Address: | Subotički put 25, 24400 Senta, Srbija |
| Reg. number: | 08052441 |
| Email: | [email protected] |
| Phone: | +381 11 20 50 300 |
| Business name: | MERCATA VT DOO NOVI SAD |
| Address: | Temerinska 102, Novi Sad, Srbija |
| Reg. number: | 08762023 |
| Email: | [email protected] |
| Phone: | +381 21 310 33 00 |
| Business name: | Advokat Ivana Ružičić |
| Email: | [email protected] |
| Phone: | +381 11 420 80 20 |
3. From whom do We collect data?
We may collect Your personal data in several ways.
| Directly from You, when You provide Your data to us. | For example, when You create Your user account, either independently or with the assistance of sales or other staff; when You purchase Products in the E-store; when You subscribe to receive promotional content; or when You contact us by mail, email, or phone; |
| Indirectly from You, through services and platforms to which You have given consent to share Your data with us or with their partners. | For example, when You agree that Your data be shared with us through a form on the social network Instagram because You wish to be contacted by our team for information about the Products; or when You agree that Your data be shared through online shopping and delivery services (such as Wolt) for the purpose of registering in the Ploom Club and receiving benefits when purchasing Products; |
| Automatically, when using the Website and the Ploom App. | In this case, we (or our partners, on our behalf) use technologies such as cookies. Please refer to Section 5 of this Privacy Policy for more information on how we use cookies. |
4. Data We process, how We use it, and on what legal basis
JTI collects data that is adequate, relevant, and limited to what is necessary for the specific purpose of processing. We use, or may use, Your data to achieve several predefined purposes. Each processing activity We carry out is based on appropriate legal ground prescribed by the provisions of the LPDP.
| DATA | PURPOSE OF PROCESSING | LEGAL BASIS FOR PROCESSING |
|---|---|---|
| Age (data indicating that you are 18+ years old), country of residence (Republic of Serbia) | Implementation of the Terms of Use and enabling access to the Website and the Ploom App, as their content is intended exclusively for adults residing in the Republic of Serbia | Our legitimate interest in ensuring compliance with the Terms of Use, as well as implementing our corporate social responsibility policy in the territory where We operate |
| First name, last name, date of birth, email address, phone number | Creation of a user account through which Products can be purchased in the E-store, participation in the Ploom Club, and access to other features offered to registered users | Your consent |
| First name, last name, delivery address, email address, phone number | Completion of orders through the E-store, purchase, and delivery of Products | Taking actions at Your request prior to entering into an agreement and performing the agreement concluded with You |
| Data necessary for exercising rights and benefits related to our campaigns and those of our partners, particularly within the Ploom Club (e.g., first name, last name, phone number, number of points collected that affect the calculation of the retail price of the Products) | Provision of benefits related to the purchase of Products | Our and our partners’ legitimate interest in influencing business performance through loyalty programs and by granting benefits to consumers |
| First name, last name, delivery address, email address, phone number | Delivery of gifts to Ploom Club members | Our legitimate interest in developing relationships with members of the loyalty program and providing services, benefits, and advantages in accordance with the rules of the loyalty program |
| First name, last name, email address, phone number, user account details (where applicable), information about purchased Products | Educational communication with Product buyers, sending informational materials via electronic and/or SMS messages and/or phone calls regarding Product functionalities, optimal use, and similar topics | Your consent |
| First name, last name, email address, phone number, user account details (where applicable), information about purchased Products | Marketing communication with individuals who have created a user account, sending promotional materials via electronic and/or SMS messages and/or phone calls about activities, new offers, and benefits related to the Products and our service | Your consent |
| Unique smart device identifier, device type, operating system and app version, network connection data including mobile operator and IP address | Sending technical push notifications from the Ploom App to users’ Android devices (e.g., Ploom device battery status) | through the Ploom App, services related to the use of the Ploom Device that the user has requested by installing the Ploom App on their smart device |
| Unique smart device identifier, device type, network connection data including mobile operator and IP address, information about user interaction with notifications (e.g., whether a notification was read) | Sending marketing push notifications from the Ploom App to users’ Android devices (e.g., updates, promotions, and benefits) | Your consent |
| First name, last name, email address, phone number, user account details (where applicable), audio recording of voice or conversation | Managing our customer support service, responding to user inquiries and requests, and improving the operation of our customer support service | Our legitimate interest in responding to questions and requests, providing support and assistance related to the Products and our services, ensuring the application of the General Terms of Sale and Ploom Club rules, as well as maintaining an appropriate level of communication with users to build trust and strengthen relationships with them |
| First name, last name, email address | Sending invitations and reminders to register Product customers to participate in market research (e.g., by completing questionnaires) | Our legitimate interest in conducting market research to monitor defined indicators among registered customers, so that We can plan and create our marketing and sales strategies based on the results of such research |
| First name, last name, data from questionnaires used in market research (including age, gender, status as a tobacco or related product user, user habits, tendencies, and preferences) | Conducting market research, developing our Products and services, analysing user habits and satisfaction, identifying areas for improvement in Products and user experience, and creating marketing and sales strategies based on research results | Your consent |
| First name, last name, email address | Delivery of gift vouchers for participation in market research | Our legitimate interest in motivating and rewarding participants in our market research activities |
| First name, last name, Product pickup address, email address, phone number, information about completed purchase (date and Product) | Receiving and resolving complaints regarding Products purchased through the E-store | Compliance with our legal obligations |
| User activity data on the Website collected through cookies | Enabling the functionality of the Website, developing a general content strategy based on user preferences to improve user experience and enhance our Products and services | Your consent |
| First name, last name, email address, phone number (where applicable) | Communicating with You and responding to Your questions and requests submitted through the contact form on the Website | Our legitimate interest in responding to questions and requests from interested individuals and/or Product users, providing necessary information about the Products, and thereby establishing and maintaining relationships with these individuals and understanding their interests |
| First name, last name, address, email address, phone number | Responding to Your questions and requests regarding personal data protection | Compliance with our legal obligations |
| First name, last name, address, email address, phone number | Fulfilling obligations toward governmental and other authorities when We are required to disclose the data We process | Compliance with our legal obligations |
| First name, last name, address, email address, phone number | Lawful protection of our interests, including conducting proceedings to protect those interests, as well as preventing and/or mitigating potential damage to JTI | Our legitimate interest in protecting our company by lawful means |
| First name, last name, email address | Notifying registered users about amendments to this Privacy Policy | Our legitimate interest in informing data subjects about the rules We apply regarding data processing, in some cases also for the purpose of complying with our legal obligations |
4.1 Consent for personal data processing
We process certain data based on Your consent. You can provide valid consent for processing in several ways: by checking a box on the Website, enabling cookies through the so-called cookie banner (by moving the slider from inactive to active status), by giving Your oral or written statement, or through a clear affirmative action — or even a combination of these methods.
For example, when creating a user account at a point of sale, You may give oral consent to the person collecting data on our behalf, so that You can receive SMS message containing a unique code. By providing the code to that person, You confirm that You consent to the processing of Your data for the purposes based on consent, as previously explained to You through the notice displayed at the point of sale.
For more information about Your rights and the option to withdraw consent, please carefully read Section 12 of this Privacy Policy.
4.2 Entering phone numbers into the “Do Not Call” Register at RATEL
In the Republic of Serbia, a so-called “Do Not Call” Register has been established as a unified record of telephone numbers of consumers who do not wish to receive calls and/or messages for the purpose of promotion and/or telephone sales.
The consumer’s consent for direct marketing, given before or after registration in the “Do Not Call” Register, remains valid until the consent is withdrawn in accordance with the LPDP.
If You have given us consent to process Your data, the prior or subsequent registration of Your phone number in the “Do Not Call” Register will not affect the validity of Your consent, and We will remain authorized to process that data until You notify us of the withdrawal of Your consent in accordance with the LPDP.
5. Cookies
The Website uses cookies to ensure the best user experience. They allow us, for example, to display content appropriately on each of Your devices or browsers through which You access it, or to tailor the content to Your interests. The information collected in this way may, in some cases, constitute personal data, but not necessarily.
Cookies are simple text files stored in a web browser or on a device. Their primary purpose is to enable the website to “recognize” the user upon their next visit. In that case, the website uses the data stored in the cookie to automatically retrieve information about the user’s previous activity on the site. Cookies cannot access data stored on devices, but they can collect information about online activities.
Cookies are not harmful to the device and should not be confused with viruses. They do not contain viruses or other malware (malicious software).
Cookies may contain different types of information and serve various purposes. If You do not enable cookies or if You disable cookies that You have previously allowed, this may reduce the functionality of the Website. Any settings You disable must also be disabled separately on each of Your other devices or browsers.
Information about cookies can also be found in the pop-up banner available when opening the Website. At any time, You can manage the use of cookies by selecting the appropriate settings in Your web browser.
5.1 Strictly necessary cookies
These cookies are necessary for the proper functioning of the Website and the Ploom App and cannot be disabled in our systems. They are usually activated only in response to Your actions that constitute a request for certain services, such as setting Your privacy preferences, logging into Your account, or filling out forms. You can set Your browser to block or alert You about these cookies, but some parts of the Website and the Ploom App will then not function properly. These cookies do not store personal information. Some of these cookies are persistent, while others are session cookies.
5.2 Performance cookies
These cookies help us understand how users interact with our Website, allowing us to continuously tailor them to user preferences. Based on these cookies, We obtain information such as the number of visits, which pages are most and least visited, which content users access, in what order, and so on. This information is collected through a third party, in an aggregated form, and is therefore anonymous. If You do not allow us to use these cookies, We will not be able to monitor the use and performance of the Website in the described way. Some of these cookies are persistent, while others are session cookies.
5.3 Functional cookies
These cookies enable the Website to provide optimal functionality and personalization to users. They may be set by us or by third parties providing services related to the Website. If You do not allow the use of these cookies, some or all the services may not function properly. These are session cookies.
5.4. Targeting cookies
These cookies are generally third-party cookies, meaning they are placed on the Website by partner companies, such as Google, which use them to build a profile of visitors’ interests and display relevant advertisements on other websites. They generally do not store personal data but operate by uniquely identifying Your browser and device. If You do not allow the use of these cookies, You will experience less targeted advertising, meaning You will see less relevant ads. These are persistent cookies. .
5.5 Social media cookies
These cookies are set by a range of social media services that We have added to the Website and the Ploom App to enable You to share our content with Your friends and communities. They can track Your browser across other websites You visit and build a profile of Your interests. This may influence the content and marketing messages You see on other websites You visit. If You do not allow the use of these cookies, You may not be able to use or view these content-sharing tools. These are persistent cookies.
6. Data We do not process
We do not collect or process special categories of personal data, uch as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership; genetic data; biometric data for the purpose of uniquely identifying an individual; data concerning health, sexual life, or sexual orientation; nor data related to criminal convictions, offenses, and security measures, or data about minors. Please do not disclose or send us such data.
If You are an Android smart device user, the Ploom App may offer You the option to access the application using facial recognition or fingerprint identification, like how You unlock Your device. It is important to note that this is a local function of Your smart device, and such data is never shared with us. JTI does not collect or process Your biometric data.
7. Use of anonymized data and artificial intelligence
We may use artificial intelligence (AI) technologies to analyse data for the purposes of quality improvement, training, and analytics. All data processed for these purposes is anonymized in accordance with applicable privacy laws, ensuring that no personally identifiable information (PII) is retained. The anonymization process involves removing or obscuring identifiers to prevent re-identification. Anonymized data may be used internally or shared with approved partners to improve service delivery and operational efficiency.
8. Is there an obligation to provide data?
You are not required to provide Your data, You do so on a voluntary basis. This will be the case, for example, when You create a user account, use the Website or the Ploom App, provide Your address for the delivery of Products purchased through the E-store, or contact us and share Your contact details so that We can respond to Your question or request.
Please note that in some cases, We may be unable to perform our activities if You choose not to provide certain data (e.g., You will not be able to become a Ploom Club member if You do not create a user account by entering Your data, or You will not be able to complete a Product order in the E-store if You do not provide a delivery address).
9. Recipients of personal data
Your data is primarily processed and used by JTI, and regarding the use of the E-store, by JTI and MERCATA VT.
In some cases, it may be necessary to make your data available to third parties, i.e., recipients. These may include members of the JTI Group that help us respond to Your questions or requests or assist us in carrying out our business activities and processes; or our partners, who help maintain the functionality of the Website and the Ploom App, databases, and tools We use; provide courier services related to the sale of Products; offer marketing services; or provide other services (such as market research or customer support).
We will ensure that Your data is handled lawfully and that data recipients process it strictly in accordance with our instructions and this Privacy Policy.
In some instances, there may be a legal obligation to make Your data available to competent authorities (e.g., the Tax Administration, courts, and similar institutions).
10. Transfer of data abroad
We primarily use Your data within the territory of the Republic of Serbia.
The data We collect is stored on servers located in Switzerlandwhich are controlled by a company that is a member of the JTI Group.
Customer support services are provided to us by a JTI Group company based in Greece, seither independently or through an external partner.
A partner company based in Lithuania manages the technological solutions used by some of our systems and databases.
The aforementioned countries are included on the List of countries, parts of their territories, or one or more sectors of specific activities in those countries and international organizations deemed to e onsure an adequate level of personal data protection (Decision of the Government of the Republic of Serbia, Official Gazette of RS No. 55/2019).
11. How long do We keep the data?
We retain Your data only for as long as is necessary to achieve the purpose for which it was collected, after which it will be safely removed from our systems and deleted. More information can be found in the table below.
| CATEGORIES OF DATA | DATA RETENTION PERIOD |
|---|---|
| Data related to Product customers’ user accounts | Until the deletion of the user account or withdrawal of consent (where applicable), whichever occurs first; |
| Data related to user accounts without any Product purchase informatio | 24 months from the date of collection, or until the deletion of the user account, or withdrawal of consent (where applicable), whichever occurs first; |
| Data collected during the process of creating a user account that was not completed | 72 hours from the time of collection; |
| Data on Product purchases made through the E-store | Until the fulfilment of rights and obligations arising from the sales contract, but no longer than two years from the date of delivery; |
| Data related to submitted complaints regarding Product non-conformity | Until the expiration of the limitation period for any potential claims arising therefrom; |
| Data collected for marketing purposes | Until withdrawal of consent;a |
| Data collected in connection with push notifications | Until the Ploom App is deleted from the user’s smart device, or until the selected options in the preference centre are changed, or until withdrawal of consent (where applicable), whichever occurs first; |
| Data collected for educational purposes | Six months from the date of purchase or registration of the Ploom device; |
| Data collected in connection with market research | Ten years from the time of collection, or until withdrawal of consent (where applicable), whichever occurs first; |
| Data collected in connection with customer support activities and through the contact form | Three months after the last communication with the data subject; |
| Data related to exercising rights to benefits | During membership in the Ploom Club and for two years thereafter; |
| Contact data | Three years after the last communication (exercise of rights related to data processing); until the deletion of the user account (notification about amendments to the Privacy Policy), or until the processing purpose is fulfilled. |
Your data may be retained for a longer period than the one stated here in the event of a legal claim that may arise from Your use of our Products, services, or benefits, as well as when required by law or in cases involving cookies (for more information about cookies, please refer to Section 5 of this Privacy Policy).
12. Your rights regarding data processing
It is important for You to know that You have certain rights regarding the processing of Your personal data, which are guaranteed by law and may be exercised under the conditions prescribed therein..
| Right of access | You have the right to request information on whether We process Your personal data, as well as access to such data. Upon Your request, We will provide You with a copy of the personal data We process. |
| Right to rectification and amendment | You have the right to have inaccurate data relating to You corrected without undue delay, as well as to have incomplete data completed, which may include providing an additional statement. |
| Right to erasure of data |
You have the right to request the erasure of Your data, in particular: (a) if the data are no longer necessary for the purposes for which they were collected or otherwise processed; (b) if You have withdrawn the consent on which the processing is based and there is no other legal ground for processing; (c) if You have objected to the processing in accordance with the law. |
| Right to withdraw consent | If the processing is based on Your consent, You have the right to withdraw that consent at any time, provided that the withdrawal does not affect the lawfulness of processing based on consent before its withdrawal. |
| Right to restrict processing |
You have the right to request the restriction of processing of Your data in the following cases: (a) if You contest the accuracy of the data, for a period enabling us to verify the accuracy of the personal data; (b) if the processing is unlawful and You oppose the erasure of the personal data and request the restriction of their use instead; (c) if We no longer need the personal data for the purposes of the processing, but You require them for the establishment, exercise, or defence of a legal claim; (d) if You have objected to processing carried out based on the controller’s legitimate interest, pending the verification of whether JTI’s legal grounds override Your interests. |
| Right to object | If You consider it justified based on Your particular situation, You have the right to object at any time to the processing of Your personal data carried out on the basis of the controller’s legitimate interest, including profiling based on those provisions. |
| Right to data portability | You have the right to receive the personal data You have previously provided to us in a structured, commonly used, and machine-readable format, and the right to transmit those data to another controller without hindrance, if the processing is based on consent or on a contract and is carried out by automated means. You also have the right to have the personal data transmitted directly from one controller to another, where technically feasible. |
| Right to lodge a complaint |
You have the right to lodge a complaint regarding the processing of Your personal data with the competent supervisory authority in the Republic of Serbia: Commissioner for Information of Public Importance and Personal Data Protection Address: Bulevar kralja Aleksandra 15, 11120 Beograd, Srbija Email: [email protected] Phone: +381 11 3408 900 |
If You wish to exercise any of the above rights, You may contact us in the following ways:
| By mail: | JT INTERNATIONAL AKCIONARSKO DRUŠTVO SENTA, Subotički put 25, 24400 Senta, Srbija |
| By email: | [email protected] |
| By phone: | +381 11 20 50 300 |
13. Security of Your data
We take the security of Your data very seriously. Therefore, We implement physical, technical, and electronic safeguards to prevent accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data. These measures apply both to persons outside our organization and within it, as access to data is limited only to those individuals whose duties require such access and who have been instructed on the rules of personal data protection.
Unfortunately, no security system is entirely impenetrable, and We cannot guarantee that the security of systems under our direct control will never be compromised. In the event of a personal data breach, We will take all available measures and notify the competent authorities in accordance with applicable regulations, as well as the individuals whose data is affected, where possible.
14. Final provisions
In the event of a dispute concerning this Privacy Policy or the processing of personal data based on it, the applicable laws of the Republic of Serbia shall apply, and the dispute shall be resolved before the court of competent jurisdiction in Belgrade, Serbia.
This Privacy Policy is drafted in both Serbian and English. In case of any discrepancy between the two versions, the Serbian version shall prevail.
