Samsung Galaxy S24 FE Promotion Rules

Promotion Rules "SAMSUNG GALAXY S24 FE"

1. Organizer of the promotion, subject of the promotion

   Samsung Electronics Austria GmbH, Praterstrasse 31/14 Obergeschoss, Vienna, Austria (hereinafter: "Samsung"), is organizing a promotion for customers of the Samsung Galaxy S24 FE device.

2. Promotion Participants, Promotional Period

   This promotion is available to end-users of the Device (end-users are exclusively natural persons from the territory of the Republic of Croatia who have purchased the Device for their own needs, not for resale and distribution), who have a delivery address within the Republic of Croatia and who meet all the conditions defined by these Rules.

   The duration of the promotion ("Promotional Period") regarding the Device is from 01.07.2025. to 31.07.2025, or earlier if the stock of Devices or gifts provided for this promotion runs out.

3. Promotion Benefits, Conditions for Participation in the Promotion

   These Rules regulate the conditions for participation in this promotion. The promotion allows participants to purchase a Samsung Galaxy S24 FE device of any memory capacity from Samsung's sales partners listed in point 5 of these Rules during the promotional period from 01.07.2025. to 31.07.2025, and provided that the conditions of these Rules are met, to receive the corresponding gift: Samsung Galaxy S24 FE 8/128GB, graphite color, model SM-S721BZKDEUE (hereinafter: "Gift").

   NOTE: Samsung sales partners listed in point 5 of these Rules independently determine the retail price of the Devices subject to this promotion, so the retail prices of the Devices may vary depending on the Samsung sales partner from whom the Device is purchased.

4. Other Conditions for Participation in the Promotion and Realization of Rights to Promotion Benefits

   For a customer to be eligible to participate in this promotion and receive the promotion benefits, the following conditions must be met:

   • The Device must be purchased during the Promotional Period exclusively from one of Samsung's sales partners in the Republic of Croatia listed in point 5 of these Rules.
   • The Device must be purchased by an end-user of the Device (end-users are exclusively natural persons from the territory of the Republic of Croatia who have purchased the Device for their own needs, not for resale and distribution).

   To be eligible for the Gift of Samsung Galaxy S24 FE 8/128GB, graphite color, model SM-S721BZKDEUE, the customer must, in addition to fulfilling the conditions of this point of the Rules, register for the promotion within the Samsung Members application on the purchased Device after receiving it. For a successful registration, the customer must enter the data specified in this point 4. Late registrations will be considered automatically rejected. Registration through the Samsung Members application must be successfully completed no later than 31.08.2025.

   In case of successful fulfillment of all conditions and successful registration via the Samsung Members application on the purchased Device, the aforementioned Gift will be sent to the customer at the address provided during registration no later than 31.12.2025.

   The promotion participant is obliged to collect the gift at the address provided as the delivery address within the Samsung Members application on the purchased Device. If, due to the participant's fault, the gift cannot be delivered to the participant within 6 months from the day preceding the deadline for sending the gift specified in the previous point of these Rules, the promotion participant loses the right to the gift within this promotion.

   For a successful registration to participate in this promotion via the Samsung Members application on the purchased Device, or for the delivery of the Gift Samsung Galaxy S24 FE 8/128GB, graphite color, model SM-S721BZKDEUE, the customer must enter the following data during registration:

   • Customer's first and last name,
   • Customer's e-mail address,
   • Customer's exact home address (for gift delivery),
   • Customer's phone number,
   • IMEI number and serial number of the purchased Device,
   • Proof of purchase (fiscal receipt or delivery note) for the purchased Device.

   By clicking the submit button, the user submits data to Samsung, which will verify if the entered data meets the conditions of these Rules.

   By submitting the data, i.e., registering for the promotion, the user confirms that they are familiar with these Rules.

   If the data entered during registration complies with the conditions of these Rules, the Gift Samsung Galaxy S24 FE 8/128GB, graphite color, model SM-S721BZKDEUE will be delivered to the customer in the manner and within the timeframe specified by these Rules.

   In case of any technical difficulties preventing registration via the Samsung Members application on the purchased Device, Samsung will provide support to the customer through a subcontractor and will register on their behalf, provided that the customer provides Samsung or its subcontractor with a screenshot of the IMEI number of the purchased Device, as well as other data required for registration via the Samsung Members application.

5. List of Samsung Sales Partners
   • Hrvatski telekom d.d., Zagreb, Radnička cesta 21, 10 000 Zagreb
   • Telemach Hrvatska d.o.o., Zagreb, Josipa Marohnića 1, 10 000 Zagreb
   • Mobis Electronic d.o.o., Radnicka cesta 1A, 10000 Zagreb
   • A1 Hrvatska d.0.0., Zagreb, Vrtni put 1, 10 000 Zagreb
   • E PLUS d.o.o. (Elipso), Donji Stupnik, Gospodarska 16c, 10 255 Donji Stupnik
   • Big Bang d.o.0., Sveta Nedelja, Dr. Franje Tuđmana 69, 10431 Sveta Nedelja
   • Links d.o.o., Sveta Nedelja, Ljubljanska ulica 2A, 10431 Sveta Nedelja
   • Mikronis d.o.o., Zagreb, Nova cesta 166, 10 000 Zagreb
   • Ekupi d.o.o., Zagreb, Buzinski prilaz 10, 10 010 Zagreb
   • Svijet Medija d.0.0., Trg Drage Iblera 10, 10 000 Zagreb
   • Harvey Norman Croatia d.0.0., Zagreb, Velimira Škorpika 34, 10 000 Zagreb
   • SeMark d.o.o., Sesvete, Bjelovarska 36a, 10 360 Sesvete
   • Vacom d.o.o. Petra Svačića 20, 43 500 Daruvar
   • Pevex d.d., Savska cesta 84, 10 360 Sesvete
   • Internet trgovina Samsung Hrvatska (https://www.samsung.com/hr/)
6. Delivery of Purchased Devices

   The deadlines and conditions for the delivery of Devices subject to this promotion, which are purchased during this promotion, are independently determined by the individual Samsung sales partners from point 5 of these Rules from whom the Devices were purchased.

7. Obligation to Return the Gift in Case of Exercising the Right to Return Goods Purchased Remotely

   In the event that a customer – participant in this promotion who purchased the Device subject to the promotion remotely via the online store of one of the participating partners exercises their legal right to return such purchased Device, the customer-participant in this promotion is obliged to return the Gift(s) received as part of this promotion.

   To return the gift as mentioned above, the customer-participant in the promotion should contact Samsung via email at [email protected] Upon receipt of the email from the customer-participant in the promotion, Samsung will inform the customer-participant in the promotion of the address to which the customer-participant in the promotion should return the gift.

8. Right to Amend Promotion Rules

   Samsung reserves the right to amend these Rules at any time for justified reasons, with the obligation to publicly announce such amendments without delay.

9. Contact

   E-mail address for contact regarding this promotion: [email protected]

NOTICE ON COLLECTION AND PROCESSING OF PERSONAL DATA

The registration process to exercise the right to a gift within this promotion includes the submission of the customer's personal data necessary for successful registration.

The data to be collected for the aforementioned purposes are as follows:

• Customer's first and last name,
• Customer's e-mail address,
• Customer's phone number (for gift delivery),
• Customer's exact home address (for gift delivery),
• Serial number of the purchased device,
• Proof of purchase (scan) of the fiscal receipt for the purchased device.

The customer's personal data will be collected and processed in accordance with Samsung's privacy and personal data protection rules, as stated below in this notice and in accordance with these Rules, as well as in accordance with the relevant regulations of the Republic of Croatia on personal data protection.

The purpose of collecting customer personal data is to verify the fulfillment of conditions for exercising the right to a gift and to determine the customer's address for gift delivery.

By entering their personal data in the manner and in accordance with the Rules of this promotion, the customer (participant in this promotion) confirms that they are aware that Samsung Electronics Austria GmbH, its branch in the Republic of Croatia, and its subcontractors will collect and process the aforementioned personal data for the purpose of registering for the gift within this promotion.

The customer (participant in this promotion) also confirms that they are aware of Samsung's Privacy Policy, which is attached to this text, and that they are aware that Samsung will process the collected personal data of the customer (participant in this promotion) in accordance with the provisions of the said Privacy Policy.

By registering for this promotion, or by entering their personal data in the manner and in accordance with the Rules of this promotion, the customer (participant in this promotion) also confirms that they are aware of the following:

• The data controller for personal data is Samsung Electronics Austria GmbH, Zagreb Branch, Radnička cesta 37, Zagreb, Croatia.
• In case the customer decides not to share their personal data with Samsung, they will not be eligible for the gift within this promotion.
• The aforementioned data controller will, upon the customer's request, supplement, modify, or delete their personal data if it is incomplete, inaccurate, or outdated, and if its processing is not in accordance with the law.
• The legal basis for collecting and processing customer personal data is the fulfillment of the contract or the realization of the right to a gift within this promotion.
• Customer personal data will be stored exclusively until the expiration of the deadlines for submitting customer complaints or for taking legally prescribed actions.
• Access to customer personal data for the purpose of gift delivery within this promotion, in addition to Samsung Electronics Austria GmbH, Zagreb Branch, will also be available to Samsung's subcontractor.
• If the customer believes that their personal data is being processed unlawfully, they have the right to lodge a complaint with the Personal Data Protection Agency at any time.

Samsung Electronics Austria GmbH

SAMSUNG ELECTRONICS AUSTRIA GMBH, ZAGREB BRANCH

PRIVACY POLICY

Privacy Policy

In Samsung Electronics Austria GmbH, our branch in Zagreb and our affiliated companies ("Samsung", "we", "us", "our") know how important privacy is to our employees, suppliers, clients, and everyone else we cooperate with, so we strive to be clear about how we collect, use, disclose, transfer, and store personal data.

Below are the main questions covered by our Privacy Policy.

1. Scope and Purpose
2. Responsibility for Compliance
3. Our Responsibility
4. Definitions
5. Principles of the General Data Protection Regulation
6. Special Categories of Personal Data
7. Sharing of Personal Data (including transfer of data outside the EEA)
8. Profiling and Automated Decision-Making
9. Direct Marketing
10. Record Keeping
11. Data Subject Rights
12. Personal Data Breach
13. Policy Updates
14. Useful Contact Information

1. Scope and Purpose

This document establishes the data protection rules and legal requirements that must be met, relating to the obtaining, handling, processing, storage, transfer, and destruction of personal data.

The types of data we may process include details about current, past, and potential future staff members, suppliers, clients, and all those with whom we communicate. Data stored on paper, computer, or any other medium is subject to legal safeguards established by the General Data Protection Regulation ("GDPR") and applicable data protection laws, which impose restrictions on how we may use the mentioned data.

Maintaining the highest standards in our handling of personal data is a collective and individual responsibility, and these Rules apply to the ways of obtaining, using, storing, deleting, and other forms of processing personal data that we encounter in our business. They include a comprehensive summary of the main data protection obligations applicable to us as an organization.

This Privacy Policy applies to all Samsung employees and other service providers to Samsung (including, but not limited to, contractors and agency workers) (collectively "staff members"). All staff members are obliged to ensure they understand and comply with these Rules regarding any personal data they access in their work.

Staff members will also be required to attend training related to these and related policies upon Samsung's request.

2. Responsibility for Compliance

The data protection officer, whose contact details are at the end of these Rules, is responsible for overseeing the implementation of data protection and compliance with these Rules.

3. Our Responsibility

The General Data Protection Regulation provides for high fines for organizations that violate its provisions. Depending on the type of violation, organizations could pay a fine of up to 20 million euros, or 4% of their total annual global turnover for the previous financial year.

4. Definitions

Criminal record data refers to criminal offenses committed by a person and convictions imposed on them.

Data controllers are persons or organizations that determine the purpose and method of personal data processing. Their duty is to establish practices and rules that comply with the General Data Protection Regulation. We are the data controllers for all personal data used in our business. Our suppliers, consultants, and contractors may also be data controllers.

Data subjects, within the meaning of these Rules, include all living individuals whose personal data we process, including current, past, and potential clients, suppliers, agents, investors, and our staff members. All data subjects have legal rights regarding their personal data.

Personal data is data relating to a living individual whose identity can be determined from that data (or from that and other data we hold). Personal data can be facts (e.g., name, address, or date of birth) or opinions (e.g., performance appraisal). The definition of personal data in the General Data Protection Regulation and applicable data protection law is very broad, so under personal data, many identifiers can be classified. This includes name, identification number, and location data.

Processing is any operation involving the use of personal data. It includes obtaining, using, reviewing, accessing, recording, or holding data, or performing one or a series of operations in relation to data, including their organization, correction, retrieval, use, disclosure, deletion, or destruction. Processing also includes the transfer of personal data to third parties.

Special categories of personal data (formerly known as sensitive personal data) include data about a person's racial or ethnic origin, their political opinions, religious or similar beliefs, trade union membership, physical or mental health or condition, and sexual life, as well as genetic and biometric data for the purpose of identifying an individual.

5. Principles of the General Data Protection Regulation

Anyone processing data must adhere to the applicable good practice principles established by the General Data Protection Regulation, which Samsung will adhere to in the following ways:

• We will process personal data lawfully, fairly, and transparently (see "lawfulness, fairness, and transparency").
• We will collect personal data for specific, explicit, and legitimate purposes and will not process it in a manner inconsistent with those purposes (see "purpose limitation and data minimization").
• We will process personal data that is adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed (see "purpose limitation and data minimization").
• We will ensure that personal data is accurate and, where necessary, kept up to date; if data is inaccurate, we will take every reasonable step to have it erased or corrected without delay, taking into account the purposes for which the data is processed (see "accuracy").
• We will keep personal data in a form which permits identification of the data subject for no longer than is necessary for the purposes for which the personal data is processed (see "storage limitation").
• We will implement appropriate technical or organizational measures to ensure the security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage (see "integrity and confidentiality").

The following provides additional information on each of these principles.

5.1. Lawfulness, Fairness, and Transparency

The aim of applicable data protection law is not to prevent the processing of personal data, but to ensure that it is done fairly and without negative impact on the rights of the data subject.

The processing of personal data is lawful if one of the legal grounds for processing is met. These legal grounds include: the data subject has given explicit and free consent for processing; processing is prescribed by law; processing is necessary for the performance of a contract we have entered into with the data subject; processing is necessary for the legitimate interests of Samsung or a third party to whom the data is disclosed (unless the interests or fundamental rights and freedoms of the individual override these interests). Before processing personal data (e.g., before collecting personal data from an individual), we consider the reasons for collecting the data and why we need it. We also determine the legal basis that allows us to lawfully obtain and process data.

The data subject must be provided with certain information in accordance with the law, including (but not limited to) the following: who the data controller is (in this case, us, Samsung Electronics Austria GmbH, Zagreb Branch, Zagreb, Radnička cesta 37b, Republic of Croatia); the purposes for which we will process the data, the legal basis for processing, the identity of persons to whom the data may be disclosed or transferred, and the data subject's rights regarding their personal data. This information must be contained in the appropriate privacy notice or fair processing statement.

5.2. Purpose Limitation and Data Minimization

Personal data may only be processed for specific purposes of which the data subject has been informed at the time of the initial data collection or for other purposes expressly permitted by applicable data protection law. This means that personal data must not be collected for one purpose and used for another. If it is necessary to change the purpose for which personal data is processed, the data subject must be informed of the new purpose before any processing begins.

5.3. Accuracy

Personal data must be accurate and up-to-date. Inaccurate or misleading data is not accurate, so steps must be taken to verify the accuracy of all personal data at the time of its collection and thereafter at regular intervals. Inaccurate or outdated data must be destroyed.

5.4. Storage Limitation

Personal data must be kept in a form which does not permit the identification of the data subject for no longer than is necessary for the purposes for which the personal data is collected. This means that data must be destroyed or deleted from our system when it is no longer needed, and personal data must be anonymized.

After the retention period expires, records containing personal data will be securely removed and destroyed, unless there is a justified business reason for retaining them beyond this period (e.g., the data subject has initiated legal proceedings against us and the retained personal data is relevant to that case).

5.5. Integrity and Confidentiality

We are obliged to take appropriate measures to protect against unlawful or unauthorized processing of personal data and against their accidental loss, destruction, or damage. Data subjects may initiate court proceedings to claim compensation for damages resulting from the loss of personal data.

Data security involves ensuring the confidentiality, integrity, and availability of personal data, defined as follows:

• Confidentiality means that only those persons authorized to use personal data have access to it.
• Integrity means that personal data must be accurate and suitable for the purposes for which it is processed, and reliable throughout its lifecycle (i.e., unauthorized persons must not alter the data).
• Availability means that authorized users can access data if it is necessary for approved purposes. Therefore, personal data should be stored in our central computer system rather than on individual personal computers.

Security procedures include:

• Access controls. Registering strangers in controlled access areas.
• Secure desks and cabinets. Locking desks and cabinets if they contain confidential information of any kind. (Personal data is always considered confidential).
• Destruction methods. Paper documents must be shredded. Floppy disks and read-only compact discs (CD-ROMs) must be physically destroyed when they are no longer needed.
• Equipment. Samsung staff members must ensure that confidential information is not visible to passers-by on screens and must log out of their personal computers when leaving them unattended.

Samsung adheres to all procedures and uses all available technologies to preserve the security of all personal data from the moment of its collection until its destruction. In practice, this means the following:

• Only personal data for which there is authorization may be accessed, and only for approved purposes.
• No other person (including other Samsung staff members) may be granted access to personal data unless they have appropriate authorization to do so.
• Personal data is protected, for example, by adhering to rules on access to premises, computer access, password protection and encryption, secure data storage and destruction, and other security measures defined in Samsung's data security policies.
• Personal data (including personal data in files) or devices containing personal data (or devices that can be used to access personal data) must not be stored on a local disk or personal device used for work purposes.

6. Special Categories of Personal Data

We may occasionally need to process special categories of personal data.

We will process special categories of personal data only when we have a legal basis for it (see Section 5 of these Rules) and when one of the special conditions for processing special categories of data applies. Special conditions include, but are not limited to, the following:

• The data subject has given explicit consent for processing.
• Processing is necessary for the exercise of rights and fulfillment of Samsung's or the data subject's obligations in the field of labor law.
• Processing is necessary to protect the vital interests of the data subject, and the data subject is physically unable to give consent.
• Processing relates to data that the data subject has clearly made public.
• Processing is necessary for the establishment, exercise, or defense of legal claims.
• Processing is necessary for reasons of substantial public interest.

Special categories of personal data will not be processed:

• until an impact assessment of the collection has been carried out, and
• until the person to whom the personal data relates has been appropriately informed (by means of a privacy statement or otherwise) about the nature of the processing, the purposes for which it is carried out, and the legal basis on which it is carried out.

7. Sharing of Personal Data (including transfer of data outside the EEA)

Personal data may only be transferred to a third-party service provider who agrees to comply with the necessary rules and procedures and to fulfill all relevant contractual terms required by us, and who agrees to implement appropriate measures upon request.

Personal data may be shared with another member of our group (which includes our subsidiaries and our parent company along with its subsidiaries) only if such data is necessary for business purposes for the recipient, and the transfer is in accordance with applicable cross-border transfer restrictions (see below).

Data protection legislation restricts the transfer of data to countries outside the European Economic Area ("EEA") so as not to compromise the required level of data protection. Personal data originating from one country is transferred across borders if it is delivered, sent, viewed, or accessed in another country. Before cross-border transfer of personal data, it will be verified whether all necessary conditions are met.

8. Profiling and Automated Decision-Making

There are significant limitations regarding the circumstances under which automated decisions can be made about individuals (i.e., decisions made solely automatically, without human intervention). This also applies to profiling (i.e., automated processing of personal data to assess certain aspects relating to an individual, such as whether an individual would be interested in certain products).

This type of decision-making is only possible for the execution of a contract, when permitted by law, or if the individual has given explicit consent. Individuals have the right to information about decision-making and have certain rights that must be communicated to them, including the right to request human intervention or the right to challenge a decision, and this type of decision-making also has strict limitations regarding the use of special categories of personal data.

All profiling activities will be carried out in full compliance with applicable legislation.

9. Direct Marketing

There are strict data protection requirements regarding direct marketing targeted at our clients, and we follow all relevant guidelines.

10. Record Keeping

It is important that we can demonstrate that we comply with data processing principles. When necessary, we maintain appropriate records of our personal data processing. This may include records of the legal bases on which we process personal data, records of data sent to data subjects, and records of our personal data processing.

11. Data Subject Rights

Personal data is processed in accordance with the rights of the data subject. Data subjects have the following rights:

• If they have given consent for processing, they may withdraw that consent at any time (this must be as easy as giving it).
• They have the right to clear, transparent, and easily understandable information about how their personal data is used (which is why we provide a privacy statement).
• They have the right to request access to all data held by the data controller relating to them.
• They have the right to request that inaccurate data be amended and corrected.
• They have the right to request the deletion of data relating to them held by the data controller if certain conditions stipulated by applicable law are met.
• They have the right to request the restriction of processing in cases where certain conditions stipulated by applicable law are met.
• They have the right to request the transfer of data to another data controller if certain conditions stipulated by applicable law are met.
• They have the right to object to the processing of personal data if certain conditions stipulated by applicable data protection law are met.
• They have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, unless they have given explicit consent for it or if it is necessary for the conclusion or performance of a contract with them.
• They have the right to lodge a complaint with the Personal Data Protection Agency regarding our data processing (contact details are below), although we would encourage the data subject to contact us first in case of any doubts so that we can try to resolve the issue.

If a data subject wishes to exercise any of their rights, they should contact the Data Protection Officer. It may be necessary to take appropriate steps to establish the identity of the person submitting the request.

The data subject's formal request (of the data subject) for access to personal data relating to him/her and held by the Zagreb branch of Samsung Electronics Austria GmbH can be submitted in writing. However, the data subject's request for access to personal data does not necessarily have to be formal or submitted in writing (access to personal data can be requested via social networks or by phone). Any staff member who receives a request for access to personal data will promptly forward the request to the data protection officer and/or legal service and compliance monitoring service.

The Data Protection Officer will, except in exceptional cases, respond to the request within 30 days of its receipt. If Samsung cannot provide the requested personal data, the reasons for this will be fully documented, and the data subject will be notified in writing. The data subject will also be provided with information about the competent supervisory authority to whom a complaint can be submitted, in accordance with the requirements of applicable data protection law.

12. Personal Data Breach

A personal data breach is a security violation that leads to accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access to personal data that has been transmitted, stored, or otherwise processed. A breach does not necessarily mean that personal data has been disclosed to an external source without proper authorization, but it can mean that someone from within has accessed that data without proper authorization.

We are obliged to report certain types of breaches to the competent regulatory authority, and in a limited number of cases, to the data subjects themselves.

We will promptly notify the Security Department of Samsung's European headquarters, the Data Protection Officer of Samsung Electronics Austria GmbH, Zagreb Branch, and/or the legal and compliance monitoring service of any personal data breach or suspected breach, so that they can take the necessary measures or forward the case as needed.

13. Policy Updates

The Human Resources Department, Legal Service, and Compliance Monitoring Service are responsible for maintaining, regularly reviewing, and updating these Rules. You will be notified of any updates and changes to these Rules via the notice board and/or email.

14. Useful Contact Information

For matters related to personal data protection, you can contact us at the following address:

Samsung Electronics Austria GmbH, Zagreb Branch
Radnička cesta 37b, Zagreb, Republic of Croatia

E-mail address: dataprotection.sead@samsung.com

Personal Data Protection Agency, Ulica grada Vukovara 54, Zagreb, Republic of Croatia