Promotion Rules for Pre-order Purchases

1. Organizer of the Promotion

Samsung Electronics Austria GmbH, located at Praterstrasse 31/14 Obergeschoss, Vienna, Austria (hereinafter: "Samsung"), is organizing a promotion for buyers of new Samsung devices for pre-sale, as mentioned in point 3 of these rules (hereinafter individually: "Device" and collectively: "Devices").

2. Participants and Promotional Period

The promotion is available to private buyers, natural and legal persons (end-users – consumers) of the Devices who have a delivery address in the territory of the Republic of Kosovo and who meet the conditions defined by these Rules. The duration of the promotion regarding the Devices is from 07.05.2025 until 25.05.2025 (hereinafter: "Promotional Period") or until the stocks of Devices or the gifts foreseen for this promotion are depleted.

3. Promotion Benefits

These Rules regulate the conditions for participation in the mentioned promotion. The promotion allows participants to pre-order one of the televisions mentioned in the table below from Samsung sales partners mentioned in point 5 of these Rules during the promotional period from 07.05.2025 to 25.05.2025. Upon pre-registration on the page https://www.samsung.com/al/offer/redemption/tv-one-launch-2025-xk/ no later than 25.06.2025 and fulfillment of other conditions defined by these Rules, participants will be entitled to the respective gift – a Samsung Soundbar, as per the table below:

NOTE: Samsung sales partners mentioned in point 5 of these rules determine the retail price of the Devices that are the subject of this promotion independently, so the retail prices of the Devices may vary depending on the Samsung sales partner from whom the Device was purchased. In case the stocks of the gifts mentioned above are depleted, Samsung reserves the right to send the buyer a Samsung device of equal value for the same purpose as a gift.

4. Other Conditions for Participation in the Promotion and for Obtaining the Rights to Promotion Benefits

To gain the right to participate in the promotion and benefit from this promotion, the following conditions must be met:

• The buyer pre-orders one of the Devices;
• The Device is purchased during the Promotional Period exclusively from authorized Samsung sales partners in the territory of the Republic of Kosovo mentioned in point 5 of these rules;
• The Device is purchased by the end-user (end-users are exclusively natural and legal persons from the territory of the Republic of Kosovo who have purchased the Device for their personal needs, not for resale or further distribution).
• To gain the right to the gift mentioned in point 3 of these rules, the buyer of the Device must register for participation in the mentioned promotion via the website https://www.samsung.com/al/offer/redemption/tv-one-launch-2025-xk/ no later than 25.06.2025.
• The registration procedure includes submitting the necessary data for successful registration. Late registrations will be automatically considered rejected. In case of successful and accurate registration, the respective gift from point 3 of these rules will be sent to the buyer at the address they provided during registration, within 150 days of successful registration.
• By submitting data, or registering for participation in the mentioned promotion, the user confirms they are aware of these rules.
• The data to be collected for the needs of promotion participation and gift delivery from point 3 of these rules are as follows:
  • user's name and surname,
  • user's email address,
  • user's exact residential address (for gift delivery),
  • model and serial number of the purchased Device,
  • order confirmation showing the order date (e.g., email, screenshot, photo of a physical confirmation or any similar document from the sales partner mentioned in point 5 of these Rules, showing the Device was ordered during the promotional period from point 2 of these rules),
  • presentation of the fiscal receipt and delivery document for the purchased Device.

By clicking the submit button, the user submits the data to Samsung, which will verify if the entered data complies with these Rules. If the data entered during registration complies with these rules, the gifts will be delivered to the user as specified in point 3 of these rules (depending on the model and code of the purchased Device), and this will be done in the manner and within the timeframe specified by these rules.

NOTE: The right to the gift defined in these rules will be obtained by the first person who completes a successful and complete registration with the serial number of the purchased Device, in accordance with these rules. Subsequent registrations will not be considered for obtaining the gift.

5. List of Authorized Samsung Sales Partners

• AZ TECH, Aztech Logistics, Magjistralja Prishtine - Mitrovice, km 10, Mazgit, Obiliq, Kosovo
• NEPTUN, NEPTUN KOSOVA SH.P.K, Lagjja Marigona, Fshati Preoc, 10 500 Graçanicë, Kosovo

6. Delivery of Purchased Devices

The terms and conditions for the delivery of Devices that are the subject of this promotion, and which are purchased during the period of this promotion, are determined independently by the Samsung sales partners from point 5 of these rules from whom the Devices were purchased.

7. Obligation to Return the Gift in Case of Exercising Rights for Return of Goods in Distance Purchases

In case the buyer – participant in the promotion who purchased the Device(s) subject to the promotion, remotely via the website, from one of the sales partners involved in the promotion, exercises their legal right to return the purchased goods, the buyer-participant in the promotion is obliged to return the received gift within the scope of the promotion. To return the gift as described above, the buyer-participant in the promotion must contact Samsung via email at ce.promotion@samsung.com. Upon receipt of the email from the buyer-participant in the promotion, Samsung will inform the buyer-participant in the promotion about the address where the gift return should be made.

8. Right to Change Promotion Rules

Samsung reserves the right at any time, for justified reasons, to make changes to these Rules, with the obligation to publish them immediately, without delay.

9. Contact

Email address for contact regarding the promotion: ce.promotion@samsung.com.

Notice on the Collection and Processing of Personal Data

Samsung Electronics Austria GmbH, with its registered office at Praterstrasse 31/14 Obergeschoss, Vienna, Austria, informs you about the processing of personal data:

1. Controller and Processor

The data controller is Samsung Electronics Austria GmbH, with its registered office at Praterstrasse 31/14 Obergeschoss, Vienna, Austria, through its branch Samsung Electronics Austria GmbH Zagreb, Radnička cesta 37B, 10000, Zagreb, Croatia (hereinafter: "Controller"). The data processor is Cheil Centrade Adriatic d.o.o, Bulevar Milutina Milankovića 11v, Republic of Serbia, 11070 Belgrade.

2. Personal Data Collected

The Controller will collect and process the following personal data: buyer's name and surname, buyer's email address, buyer's phone number, user's exact residential address (for gift delivery), serial number of the purchased Device (hereinafter collectively: Personal Data).

3. Purpose of Collecting Personal Data

The Controller will collect and process the above personal data exclusively for the purpose of determining eligibility for promotion participation and for delivering the Gift, should the buyer exercise their right to it.

4. How Personal Data is Used

Personal data collected based on consent will be used exclusively for the aforementioned needs of the Controller, in accordance with the Personal Data Protection Law (Law) and the Controller's Privacy Policy attached below.

5. Legal Basis for Processing Personal Data

The Controller collects and processes personal data based on the voluntary consent of the person to whom the data relates.

6. Personal Data Retention Period

Personal data will be retained only for as long as necessary to fulfill the declared purpose, and in any case no longer than 6 months from the date of purchase.

7. Your Rights

Upon request by the participant, the operator will complete, change, update, and delete personal data if the data is incomplete, inaccurate, or outdated, and if its processing is not in compliance with the law, or if the purpose of data collection has been fulfilled. For more information, see our Privacy Policy or contact us by sending an email to dataprotection.sead@samsung.com. If participants believe that the processing of their personal data infringes their privacy, they may contact the Personal Data Processing Manager or the Information and Privacy Agency to seek clarification.

8. More Information

For detailed information on the measures taken to protect personal data, as well as possible disclosure of personal data, read our Privacy Policy.

Privacy Policy

Effective from: May 2018. Samsung Electronics Austria GmbH, our branch in Zagreb, and our affiliated companies ("Samsung", "we", "us", "our"), are aware of the importance of privacy for employees, suppliers, customers, and all others with whom we work, and therefore we strive to be clear about how we collect, use, share, transfer, and store personal information. The main issues covered by our Privacy Policy are as follows:

• 1. Scope and Purpose
• 2. Compliance Responsibility
• 3. Our Responsibility
• 4. Definitions
• 5. Principles of the General Data Protection Regulation
• 6. Special Categories of Personal Data
• 7. Sharing of Personal Data (including transfer of data outside the European Economic Area (EEA) countries)
• 8. Profiling and Automated Decision-Making
• 9. Direct Marketing
• 10. Record Keeping
• 11. Data Subject Rights
• 12. Personal Data Breach
• 13. Authorization to Access Data
• 14. Useful Contact Information

This document defines the rules for personal data protection and the legal provisions that must be respected, related to the acquisition, processing, use, storage, transfer, and destruction of personal data. The types of data we may process include information details of employees, suppliers, buyers, and anyone with whom we interact. Data stored in paper documents, computers, or other media are subject to legal protection measures defined in the General Data Protection Regulation ("GDPR") and the applicable law for the protection of personal data, which impose restrictions on how we may use the mentioned data. Maintaining the highest standards in the processing of our personal data is a collective and individual responsibility, and these Rules apply to the methods of obtaining, using, storing, deleting, and other forms of processing personal data encountered in our business. They include a comprehensive summary of the main data protection obligations applicable to us as an organization. This Privacy Policy applies to all Samsung employees and other service providers for Samsung (including, but not limited to, contractors and agency employees) (collectively referred to as "Staff Members"). All staff members are required to ensure they understand and comply with these Rules regarding any personal information they access in their work. Staff members will also be required to participate in training related to the above as well as related policies, upon Samsung's request.

2. Compliance Responsibility: The Data Protection Officer, whose contact details are at the end of these Rules, is responsible for monitoring the implementation of personal data protection and compliance with these Rules. People in management positions are responsible for ensuring that their team members comply with personal data protection rules. If you believe the policy has not been respected regarding your personal data or that of others, you should raise the issue with your immediate manager or the human resources or legal departments. High fines increase exposure to data protection compliance risks.

3. Our Responsibility: The General Data Protection Regulation provides for high fines for organizations that violate its provisions. Depending on the type of violation, organizations may be fined up to 20 million euros, or 4% of their total annual worldwide turnover for the last financial year.

4. Definitions: Data from criminal records refers to criminal offenses committed by a person and their sentences. Controllers are persons or organizations that determine the purpose and method of processing personal data. It is their duty to establish practices and rules that will be in compliance with the General Data Protection Regulation. Our suppliers, consultants, and contractors may also be controllers. Subjects, in the context of these Rules, mean all individuals whose personal data we hold, including current, past, and potential buyers, suppliers, agents, investors, and our staff members. All data subjects have legal rights regarding their personal data. Personal data is data that relates to a living individual whose identity can be determined from that data (or from that data and other data we hold). Personal data can be facts (e.g., name, address, or date of birth) or opinions (e.g., performance appraisal). The definition of personal data in the General Data Protection Regulation and the applicable law for data protection is very broad, so in accordance with this, it is possible to classify many identifiers under personal data. This includes name, identification number, and location information. Processing is any procedure that involves the use of personal data. It includes obtaining, using, viewing, accessing, recording, or possessing personal data, or performing an action or set of actions related to the data, including organizing, correcting, retrieving, using, sharing, deleting, or destroying it. Processing also implies the transfer of personal data to third parties. Special categories of personal data (formerly known as sensitive personal data) include data on a person's racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, physical or mental health, or intimate personal life, and genetic and biometric data for personal identification purposes.

5. Principles of the General Data Protection Regulation: Anyone processing personal data must act in accordance with the applicable principles of good practice defined in the General Data Protection Regulation, which Samsung will adhere to in the following ways: We will process personal data lawfully, impartially, and transparently (see under "Lawfulness, Impartiality, and Transparency"). We will collect personal data for specific, clear, and lawful purposes and will not process it in a manner inconsistent with those purposes (see "Purpose Limitation and Data Minimisation"). We will process personal data that is adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed (see "Purpose Limitation and Data Minimisation"). We will ensure that personal data is accurate and, where necessary, kept up to date; if personal data is inaccurate, we will take all reasonable steps to erase or correct it without delay, considering the purposes for which the data is processed (see "Accuracy"). We will retain personal data in a form that allows identification of the individual to whom it relates only for as long as necessary for the purposes for which the personal data is processed (see "Storage Limitation"). We will implement appropriate technical or organizational measures to ensure the security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage (see "Integrity and Confidentiality").

5.1 Lawfulness, Impartiality, and Transparency: The objective of the applicable personal data protection law is not to prevent the processing of personal data, but to ensure that it is done fairly and without negative impact on the rights of the data subject. Processing of personal data is lawful if one of the legal processing conditions is met. These legal requirements include: the data subject has expressly and freely given consent for processing; processing is required by law; processing is necessary for the performance of a contract we have with the data subject; processing is necessary for the purposes of legitimate interests of Samsung or the party to whom the data is disclosed (unless these interests are overridden by the fundamental rights or freedoms of an individual). Before we begin processing personal data (e.g., before collecting personal data from an individual), we consider the reasons for collecting the data and why we need it. We also determine the legal basis that allows us to lawfully obtain and process data. The data subject is required by law to provide certain information, including (but not limited to): who the data controller is (in this case, us, Samsung Electronics Austria GmbH, Podružnica Zagreb, Zagreb, Radnička cesta 37b, Croatia); the purposes for which we will process the data, the legal basis for processing, the identity of persons to whom the data may be disclosed or transferred, and the rights of data subjects regarding their personal data. This information must be contained in an appropriate privacy notice or a fair processing statement.

5.2 Purpose Limitation and Data Minimisation: Personal data may only be processed for specific purposes for which the data subject has been informed during the initial collection or for other purposes expressly permitted by applicable personal data protection law. This means that personal data should not be collected for one purpose and used for another. If it is necessary to change the purpose for which personal data is processed, the data subject must be informed of the new purpose of data collection before any processing begins.

5.3 Accuracy: Personal data must be accurate and up-to-date. Inaccurate or misleading information is not accurate, and therefore steps must be taken to verify the accuracy of all personal data at the time of collection and at regular intervals thereafter. Inaccurate or outdated data must be erased. When notified that personal data we process is inaccurate, you must inform the manager/contact person for data processing and take the necessary steps to erase the changes, taking into account our data retention policy requirements where necessary.

5.4 Storage Limitation: Personal data must be retained in a form that does not allow identification of the individual to whom it relates only for as long as necessary for the purposes for which the personal data is processed. This means that data must be destroyed or deleted from our system when no longer needed. After the retention period expires, data containing personal data will be removed and securely destroyed, unless there is a legitimate business reason for retaining it beyond this period (e.g., the data subject has initiated a dispute against us and retaining the personal data is important for the dispute in question).

5.5 Integrity and Confidentiality: We are obliged to take appropriate protective measures against unlawful or unauthorized processing of personal data and against accidental loss or damage to it. Data security means ensuring the confidentiality, integrity, and availability of personal data, which are defined as follows: a) Confidentiality means that only authorized persons have access to personal data. b) Integrity means that personal data must be accurate and suitable for the purposes for which it is processed and reliable throughout its lifecycle (i.e., unauthorized persons should not alter this data). c) Availability means that authorized users can access the data if they need it for approved purposes. Therefore, personal data must be stored in our central computer system, not on individual personal computers. Security procedures include: a) Access controls. Reporting strangers in controlled access areas. b) Securing desks and cabinets. Locking desks and cabinets if they contain confidential information of any kind. (Personal information is always considered confidential). c) Destruction methods. Paper documents must be shredded. Disks and CD-ROMs must be physically destroyed when no longer needed. d) Devices. Samsung staff members are required to ensure that confidential information is not visible on screens to passers-by and is disconnected from the computer when not in use by them.

6. Special Categories of Personal Data: From time to time, we may need to process special categories of personal data. We will process special categories of personal data only when we have a legal basis to do so (see Section 5 of these Rules) and when one of the special conditions for processing special category personal data applies. Special conditions include, but are not limited to, the following: a) The data subject has given explicit consent for processing. b) Processing is necessary for the exercise of rights and fulfillment of Samsung's or the subject's obligations in the field of labor law. c) Processing is necessary to protect the vital interests of the data subject and the data subject is physically unable to give consent. d) Processing relates to data that is clearly made public by the data subject. e) Processing is necessary for the establishment, exercise, or defense of legal claims. f) Processing is necessary for reasons of public interest. g) Processing is necessary for assessing an employee's work capacity. Special categories of personal data will not be processed: a) until an impact assessment of the collection is carried out; b) until the person to whom the personal data relates is duly informed (by means of a privacy statement or otherwise) about the nature of the processing, the purposes for which it is carried out, and the legal basis on which it is carried out.

7. Sharing of Personal Data (including transfer of data outside the EEA): Personal data may only be transferred to a third party as a service provider who agrees to comply with the necessary rules and procedures and fulfills all relevant contractual provisions that we require from it and agrees to implement appropriate measures as required. Personal data may be shared with another staff member of our group (which includes our subsidiaries and our parent company together with its subsidiaries) only if the recipient needs such data for business purposes and the transfer complies with applicable cross-border transfer restrictions (see below). Data protection legislation restricts the transfer of data to countries outside the European Economic Area ("EEA") so as not to compromise the required level of data protection. Personal data originating from a country is transferred across borders if it is delivered, sent, inspected, or accessed in another country. Before cross-border transfer of personal data, it will be checked whether all necessary conditions have been met.

8. Profiling and Automated Decision-Making: There are significant restrictions on the circumstances under which automated decision-making for individuals is possible (this is a decision made exclusively automatically, without human intervention). This also applies to profiling (this is the automated processing of personal data for evaluating certain aspects relating to an individual, for example, whether the individual would be interested in certain products). This type of decision-making is possible only for the purpose of contract execution, when permitted by law, or if the individual has given their express consent. Individuals have the right to receive information about decision-making and have certain rights to information, including the right to request human intervention or the right to appeal a decision, and for this type of decision-making, there are also strict limitations regarding the use of special categories of personal data.

9. Direct Marketing: There are strict personal data protection requirements related to direct marketing aimed at our customers, and we follow all applicable guidelines.

10. Record Keeping: It is important that we can prove we are compliant with the principles of personal data processing. Also, when necessary, we keep appropriate data on the processing of personal data. This may include data on the legal basis on which we process personal data, records of data sent to respondents, and our personal data processing records.

11. Data Subject Rights: Personal data is processed in accordance with the rights of data subjects. Data subjects have the following rights: a) If they have given their consent for processing, they can withdraw this consent at any time (this should be as simple as giving it). b) They have the right to clear, transparent, and easily understandable information about how their personal data is used (this is precisely why we offer a privacy statement). c) They have the right to request access to all data that the data controller holds about them. d) They have the right to request the amendment and correction of inaccurate data. e) They have the right to request the erasure of data relating to them, which is held by the controller, if certain conditions stipulated by applicable legislation are met. f) They have the right to request restriction of processing if certain conditions stipulated by applicable legislation are met. g) They have the right to request the transfer of data to another personal data controller, if certain conditions stipulated by applicable legislation are met. h) They have the right to object to the processing of their personal data, if certain conditions stipulated by applicable legislation for data protection are met. i) They have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, except where they have given their consent for this, or if it is necessary for the conclusion or performance of a contract with them. j) They have the right to complain to the Personal Data Protection Agency regarding our processing of your data (contact details are below), although we would encourage the data subject to contact us first in case of any concerns, so that we can try to find a solution to the issue in question. If the subject wishes to exercise any of their rights, they must contact the Personal Data Protection Officer. It may be necessary to take appropriate steps to determine the identity of the person making the request. A formal request from a data subject (requester) for access to personal data related to them and held by the Zagreb branch of Samsung Electronics Austria GmbH may be submitted in writing. However, the data subject's request for access to their personal data does not have to be formal and does not have to be submitted in writing (access to personal data can be requested via social networks or by phone). Any staff member receiving an access request for personal data will forward the request without delay to the Personal Data Protection Officer and/or the Legal and Compliance Department. Except in exceptional cases, the Personal Data Protection Officer will respond to the request within 30 days of its receipt. If Samsung is unable to provide the requested personal data, the reasons for this will be fully documented, and the data subject will be notified in writing. The data subject will also be provided with information about the competent supervisory authority to which a complaint can be addressed, in accordance with the requirements of applicable legislation on personal data protection.

12. Personal Data Breach: A personal data breach is a security breach resulting in accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access to personal data that has been transmitted, stored, or otherwise processed. A breach does not necessarily involve the disclosure of personal data to an external source without necessary permission, but it may imply that someone has accessed this data without necessary permission. We are obliged to report certain forms of breaches to the competent regulatory authority and, in a limited number of cases, even to the data subjects themselves.

13. Authorization to Access Data: Access to data collected and/or used by Samsung Electronics Austria GmbH, Zagreb Branch, is granted only to the following persons: Personal data about customers collected through websites created for specific marketing purposes: For legal representatives of Samsung Electronics Austria GmbH Zagreb Branch; Marketing employees whose duties include processing personal data collected for specific marketing purposes.

14. Useful Contact Information: For matters concerning personal data protection, you can contact the following addresses: Samsung Electronics Austria GmbH Belgrade Branch O. brigada 90v, Belgrade, Republic of Serbia. Email Address: Contact us at dataprotection.sead@samsung.com.