Privacy Policy

Version 1.0 · Last updated: 10 April 2026

This Privacy Policy explains how Phoenix Pharma d.o.o. ("Phoenix Pharma", "we", "us" or "our") processes personal data when you visit our website phoenixpharmadoo.eu (the "Website") or contact us through it. We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") where applicable to us under Article 3(2) GDPR, and with the Montenegrin Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti).

1. Controller

The controller responsible for processing your personal data is:

Phoenix Pharma d.o.o.
Donji Zagarač bb
81410 Danilovgrad
Montenegro
Email: phoenixpharmadoo@proton.me
Phone: +381 61 354 0733

2. Data Protection Officer

We are not legally required to appoint a Data Protection Officer under Article 37 GDPR. For any questions about this Privacy Policy or the processing of your personal data, please contact us at phoenixpharmadoo@proton.me.

3. Representative in the Union (Art. 27 GDPR)

Phoenix Pharma d.o.o. is established outside the European Union. To the extent Article 27 GDPR applies to our processing, we will designate a representative in the Union and publish its contact details here. At present, our processing operations on this Website are considered occasional and low-risk within the meaning of Article 27(2)(a) GDPR. If this changes, we will update this section accordingly.

4. Categories of Personal Data We Process

4.1 Contact form

Our contact form does not transmit your input to our server. When you click "Send Message", your browser opens a pre-filled email addressed to phoenixpharmadoo@proton.me in your default email client. You remain in full control of the message and can review, edit or cancel it before sending. No personal data from the contact form is stored or processed on our web server.

Once you send the email, we process the following data that you voluntarily provide in the email in order to reply to your enquiry:

Full name
Email address (which is your email sender address)
Company name (optional)
The content of your message
Any metadata transmitted by your email client (e.g., date/time, mail server path, user-agent)

The email is delivered to our mailbox hosted by Proton AG (Proton Mail, Switzerland). Switzerland benefits from an adequacy decision of the European Commission pursuant to Art. 45 GDPR (Commission Decision 2000/518/EC), so the transfer is lawful under the GDPR.

4.2 Server log data

When you access the Website, our web server automatically collects and stores standard HTTP log data in a log file:

IP address of the requesting device
Date and time of the request
Requested URL and HTTP status code
Amount of data transferred
Referrer URL (the page you came from, if any)
User-agent string of your browser

These logs are stored in rotating files and deleted automatically after a maximum of 14 days, except where a longer retention is required to investigate a specific security incident.

4.3 Local storage

The Website uses your browser's local storage to remember your language preference (pp-lang) and whether you have acknowledged our cookie notice (pp-cookie-ack). This data is stored only on your device and is not transmitted to us. It is strictly necessary for the Website to function as expected and does not require your consent under § 25(2) No. 2 TDDDG and the corresponding provisions of the ePrivacy Directive 2002/58/EC.

5. Purposes of Processing and Legal Basis

Purpose	Legal basis	Retention
Responding to your contact form enquiry and related business correspondence	Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(f) GDPR (legitimate interest in replying to business enquiries)	Up to 24 months after the last communication, unless longer retention is required under applicable commercial or tax law
Operating, securing and stabilising the Website (server logs, rate limiting, abuse protection)	Art. 6(1)(f) GDPR — legitimate interest in ensuring IT security and the integrity of our systems	Up to 14 days, longer only if needed to investigate a concrete security incident
Language preference and cookie-notice acknowledgement (browser local storage)	Art. 6(1)(f) GDPR and § 25(2) No. 2 TDDDG — strictly necessary to provide the service you explicitly requested	Until you clear your browser storage
Compliance with legal obligations	Art. 6(1)(c) GDPR	As required by the applicable law

6. Recipients of Personal Data

We do not sell, rent or otherwise disclose your personal data to third parties for marketing purposes. Personal data is only accessible to authorised employees of Phoenix Pharma d.o.o. who need it to perform their duties, and to the following processors who act strictly on our instructions under a written agreement as required by Art. 28 GDPR:

Web hosting and DNS: IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. IONOS operates the server that hosts the Website and the DNS zone in the European Union (Germany). See IONOS privacy information.
Email service: Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Switzerland, which operates our Proton Mail mailbox for incoming business correspondence. See Proton privacy policy. Switzerland benefits from an adequacy decision under Art. 45 GDPR (Commission Decision 2000/518/EC).

In addition, we may disclose personal data to public authorities, courts or regulators where we are legally obliged to do so (e.g., under Art. 6(1)(c) GDPR).

7. Transfers to Third Countries

Personal data processed on this Website is stored on servers located in Germany (European Union). Emails sent via the contact form are delivered to a mailbox hosted by Proton Mail in Switzerland, which is recognised as a third country ensuring an adequate level of data protection under Art. 45 GDPR (Commission Decision 2000/518/EC).

The Website does not use Google Fonts, Google Analytics, Facebook Pixel, reCAPTCHA, Google Maps embeds, YouTube embeds or any other third-party services that would transmit your data outside the EU/EEA. All web fonts are self-hosted. Should you contact us by email using a provider located outside the EU/EEA, additional transfers may occur at your own email provider's level; please consult their respective privacy policy.

8. Your Rights as a Data Subject

Subject to the conditions in the GDPR, you have the following rights in relation to your personal data:

Right of access (Art. 15 GDPR) — to obtain confirmation whether we process your personal data, and if so, to receive a copy of that data and additional information.
Right to rectification (Art. 16 GDPR) — to have inaccurate personal data corrected and incomplete data completed.
Right to erasure / "right to be forgotten" (Art. 17 GDPR) — to have your personal data deleted under the conditions laid down in Art. 17 GDPR.
Right to restriction of processing (Art. 18 GDPR).
Right to data portability (Art. 20 GDPR) — to receive your personal data in a structured, commonly used and machine-readable format, and to transmit it to another controller.
Right to object (Art. 21 GDPR) — in particular, you have the right to object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR.
Right not to be subject to automated decision-making, including profiling, under the conditions of Art. 22 GDPR. We do not use automated decision-making on this Website.
Right to withdraw consent (Art. 7(3) GDPR) — where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

To exercise any of these rights, please contact us at phoenixpharmadoo@proton.me. We will respond without undue delay and in any event within one month of receiving your request (Art. 12(3) GDPR).

9. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR or the Montenegrin Law on Personal Data Protection (Art. 77 GDPR).

The competent authority in Montenegro is:

Agencija za zaštitu ličnih podataka i slobodan pristup informacijama (Agency for Personal Data Protection and Free Access to Information)
Bulevar revolucije 11
81000 Podgorica, Montenegro
Email: azlp@azlp.me
Website: www.azlp.me

Residents of the European Union may also lodge a complaint with the supervisory authority of the EU Member State of their habitual residence, place of work or place of the alleged infringement. A list of EU supervisory authorities is available on the European Data Protection Board website.

10. Is Providing Your Personal Data Required?

Providing personal data is not a statutory or contractual obligation. However, if you do not provide the information we ask for in the contact form (name, email, message), we will not be able to respond to your enquiry.

11. Automated Decision-Making and Profiling

We do not use automated decision-making, including profiling, within the meaning of Art. 22(1) and (4) GDPR.

12. Cookies and Similar Technologies

We do not set any cookies for analytics, advertising, social media or tracking. The Website uses only the following strictly necessary client-side storage items, which do not require consent under § 25(2) No. 2 TDDDG and Art. 5(3) ePrivacy Directive:

pp-lang — stores your chosen display language. Kept until you clear your browser storage.
pp-cookie-ack — remembers that you have dismissed the information notice. Kept until you clear your browser storage.

Both values are stored in your browser's localStorage. No data is transmitted to us or to third parties. You can delete these entries at any time via your browser settings.

13. Data Security

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, in accordance with Art. 32 GDPR. In particular, all traffic between your browser and our Website is encrypted using industry-standard TLS (HTTPS).

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our processing activities or the applicable law. The date of the most recent update is shown at the top of this page. We recommend that you review this page regularly.

15. Contact

For any question regarding this Privacy Policy or the processing of your personal data, please contact us at:

Phoenix Pharma d.o.o.
Donji Zagarač bb, 81410 Danilovgrad, Montenegro
Email: phoenixpharmadoo@proton.me