1. Who is responsible for your data

The data controller for the website ymalko.me is:

OLUK CRNA GORA DOO trades as Ymalko Crna Gora and is part of Ymalko Group, which also operates through Ymalko sh.p.k. in Kosovo and Ymalko Albania sh.p.k. in Albania.

2. What data we process and why

• Enquiries and quote requests. When you use the contact form or write to us, we process your name, e-mail address, the content of your message and any other details you choose to give us, such as a phone number or company name. We use them to answer you and, if you ask for it, to prepare a quote.
• Phone and e-mail contact. If you call or e-mail us, we process your contact details and what you tell us, for the same purpose.
• Visiting the website. Our hosting provider's servers automatically record technical data such as your IP address, browser type and the time of your visit. We need this to deliver the website and keep it secure.
• Visit statistics. Only if you give your consent in the cookie banner do we measure how the website is used with Google Analytics (see section 5).

We do not use your data for advertising, we do not sell it, and we do not make automated decisions about you.

3. Legal bases

• Answering enquiries and preparing quotes: steps taken at your request before a possible contract, and our legitimate interest in replying to the messages we receive.
• Technical data and security: our legitimate interest in running a secure website.
• Visit statistics and cookies that are not strictly necessary: your consent, which you can withdraw at any time.
• Keeping records the law requires, for example accounting records: a legal obligation.

4. Cookies

Cookies are small files stored in your browser.

• Functional cookies are needed for the website to work, for example to remember your cookie choice or the products you have viewed. They cannot be switched off.
• Statistics cookies (Google Analytics, for example _ga) are set only after you click "Accept".
• Order attribution (WooCommerce): when you accept all cookies with "Accept", the site stores in your browser where your visit came from (for example a search engine, a link or a campaign), which page you opened first, when the visit started, how many pages you opened, how many times you have visited the site and your browser and device type. These cookies (sbjs_current, sbjs_current_add, sbjs_first, sbjs_first_add, sbjs_session, sbjs_udata, sbjs_migrations) do not contain your name and are not sent to third parties. They are used only if you place an order, and are deleted when you close your browser, except sbjs_session, which expires 30 minutes after the last page you open.

You can change or withdraw your choice at any time with the "Manage consent" button at the bottom of every page. Your choice is stored for up to 12 months.

5. Services from other providers

• Google Analytics 4 (Google Ireland Limited / Google LLC): loads only after your consent. Google Analytics 4 does not store IP addresses.
• Google Maps: the map is loaded from Google only when you click "Show map" or accept all cookies with "Accept". Google then receives your IP address and technical data.
• Fonts: the fonts are served from our own server, so no data is sent to a font provider.
• Hosting and e-mail: our hosting and e-mail providers process data on our behalf and only as we instruct them.

6. Who receives your data

• Ymalko Group staff who handle enquiries sent to info@ymalko.com and sales@ymalko.com. These mailboxes are shared across the group, so some staff may be based in Kosovo or Albania.
• The service providers named in section 5, only as far as needed.
• Public authorities, only where the law requires it.

7. Transfers outside Montenegro

Some of the recipients above are outside Montenegro: Ymalko Group companies in Kosovo and Albania, and Google, which may process data in the European Union and the United States. Where required, we rely on appropriate safeguards such as standard contractual clauses or, for Google, the EU-US Data Privacy Framework.

8. How long we keep data

• Enquiries: as long as needed to answer you and follow up. If an enquiry leads to a business relationship, we keep the related records for as long as accounting and tax law require.
• Server logs: only as long as needed for security and error analysis.
• Statistics: for the period set in Google Analytics, at most 14 months.
• Your cookie choice: up to 12 months.

9. Your rights

You have the right to access your data, to have it corrected or erased, to restrict its processing, to receive it in a portable format and to object to processing based on our legitimate interest. You can withdraw your consent at any time; this does not affect processing that took place before. To exercise your rights, write to us at info@ymalko.com.

10. Complaints

If you believe we are not handling your data lawfully, you can complain to the Agency for Personal Data Protection and Free Access to Information of Montenegro (www.azlp.me, azlp@azlp.me). If you live in the European Union, you can also complain to the data protection authority in your country. We would appreciate the chance to resolve your concern with you first.

11. Security

We protect data with technical and organisational measures, including encrypted connections (HTTPS) and restricted access.

12. Children

The website is intended for businesses and adults. We do not knowingly collect data from children.

13. Changes

We may update this policy. The current version is always published on this page, with the date of the last update at the top.