Samsung Galaxy Z Fold7, Z Flip7, Z Flip7 FE Pre-Order Promotion Rules

1. Promoter

Samsung Electronics Austria GmbH, headquartered at Praterstrasse 31/14 Obergeschoss, Vienna, Austria, and registered under business registration number FN 217924b (hereinafter referred to as "Samsung"), is organizing the promotion for Samsung Galaxy Z Fold7, Z Flip7, Z Flip7 FE (hereinafter individually referred to as "Device", and collectively as "Devices").

The promotion is available to natural and legal persons residing or established in the territory of Bosnia and Herzegovina, who purchase the device(s) for their own needs, not for the purpose of further resale (hereinafter referred to as "User").

2. Promotional Period, Conditions, Delivery, Gifts, and Benefits

Pre-orders are available to users during the period from July 9, 2025, to July 24, 2025.

During the promotion period, by visiting the website or going to a retail store of Samsung's sales partners listed in point 3 of these rules, and provided that other conditions defined in these rules are met, users have the opportunity to:

• Purchase a Samsung Galaxy Z Fold7 mobile phone 12GB/512GB at the price of a Samsung Galaxy Z Fold7 mobile phone 12GB/256GB,
• Purchase a Samsung Galaxy Z Flip7 mobile phone 12GB/512GB at the price of a Samsung Galaxy Z Flip7 mobile phone 12GB/256GB,
• Purchase a Samsung Galaxy Z Flip7 FE mobile phone 8GB/256GB at the price of a Samsung Galaxy Z Flip7 FE mobile phone 8GB/128GB.

The retail prices of the devices in this promotion are a business decision of each individual Samsung sales partner and may vary. In this regard, the organizer has no influence on the retail prices of the devices, and it is necessary for users to be informed about the retail prices at Samsung sales partners before purchasing the device.

Delivery/pickup of purchased devices will be carried out in accordance with the terms and conditions of the Samsung sales partner from whom the user made the purchase, and it is necessary for users to be informed about the purchase conditions, which include, but are not limited to, the delivery/pickup of the purchased device, from the Samsung sales partner.

Furthermore, Samsung Electronics is the organizer of the event "Unpacked Samsung Galaxy Z Fold7, Samsung Galaxy Z Flip7, and Galaxy Z Flip7 FE", which represents the first official and public launch of the Samsung Galaxy Z series, taking place on July 9, 2025 (hereinafter referred to as the "Event").

Users who pre-ordered Samsung Galaxy Z Fold7, Z Flip7, or Z Flip7 FE from Samsung's sales partners listed in point 3 of these Rules during the period from July 9 to July 24, 2025, and who registered on the website during the period from June 24 to July 9, 2025, at https://www.samsung.com/ba/unpacked/ to follow the Event, provided all other conditions specified in these Rules are met, will be entitled to a Clear Magnet Case gift (hereinafter referred to as the "Gift"), as follows:

• For the purchase of a Samsung Galaxy Z Fold7 mobile phone, they will be entitled to a Clear Magnet Case gift, model GP-FFF966YCATW,
• For the purchase of a Samsung Galaxy Z Flip7 mobile phone, they will be entitled to a Clear Magnet Case gift, model GP-FFF766YCATW,
• For the purchase of a Samsung Galaxy Z Flip7 FE mobile phone, they will be entitled to a Clear Magnet Case gift, model EF-ZF741CTEGWW.

To participate in this promotion and receive benefits, the user must meet the following conditions:

1. The user must purchase the device on the website or by visiting a retail store of a Samsung sales partner in Bosnia and Herzegovina during the pre-order period; the list of Samsung sales partners is defined in point 3 of these Rules;
2. To be eligible for the gift, in addition to the conditions related to the Event, the user must successfully register the device purchase. Device purchase registration is done on the website www.samsung.com/ba/offer/preorder-galaxy-z-fold7-z-flip7, and the purchase registration must be successfully completed by August 30, 2025.

The delivery of gifts to users, provided they have successfully registered their device purchase in accordance with these rules, will be carried out on November 30, 2025, to the address provided by the user during device purchase registration. Gift delivery will be made provided the user has provided the correct address located in Bosnia and Herzegovina. The cost of gift delivery is covered by the organizer.

The data provided for the purpose of registering the device purchase on the website www.samsung.com/ba/offer/preorder-galaxy-z-fold7-z-flip7, in order for the user to be eligible for the gift, are:

• User's email address,
• User's first and last name, or company name,
• User's home address/registered address in Bosnia and Herzegovina (for gift delivery),
• User's contact phone number,
• IMEI number and serial number of the purchased device,
• Display/scan of the fiscal invoice or delivery note for the purchased device.

The user provides the aforementioned data to the organizer and its subcontractors to verify if the conditions are met, i.e., whether the user is eligible for the gift, and the user also gives their explicit consent for the use of their personal data in accordance with the provisions of these rules, the Notice on the collection and use of personal data, and the Data Protection Policy.

NOTES:

• Device purchase registration on the website www.samsung.com/ba/offer/preorder-galaxy-z-fold7-z-flip7 must be done using the purchased device.
• Device purchase registration must be done using the same email address with which the customer registered for the Event.
• Late device purchase registration requests will be considered automatically rejected.
• Participation in this promotion does not limit users from participating in other promotions organized in connection with the device promotion.
• In case of any technical difficulties that prevent the purchase registration on the website www.samsung.com/ba/offer/preorder-galaxy-z-fold7-z-flip7, Samsung will provide user support through subcontractors and will register the purchase on their behalf. To register the purchase, the user needs to provide a screenshot of the IMEI number of the purchased device, as well as other data required for the purchase registration on the website www.samsung.com/ba/offer/preorder-galaxy-z-fold7-z-flip7.
• In the event that the user purchases the device remotely through the online store of one of Samsung's sales partners, and exercises their legal right to withdraw from the purchase, the user is obliged to return the received gift. In case of withdrawal from the device purchase, and in order to return the gift, the user should contact Samsung via email at samsungbih@toolbox.ba. Samsung will then inform the user of the address to which the customer should return the gift.

3. Samsung Sales Partners

The purchase of the device can only be made from the following Samsung sales partners:

• BH Telecom
• Mtel
• HT Eronet
• Domod
• Tehno Mag
• Kim tec d.o.o.
• Roaming Electronics d.o.o. Banja Luka
• Comtrade Distribution d.o.o
• Ekupi

4. Right to Change Terms and Conditions

Samsung reserves the right to amend these Rules at any time for justified reasons and to publish them without delay. All changes to these rules will be published by the organizer on the website www.samsung.com/ba/offer/preorder-galaxy-z-fold7-z-flip7.

Contact regarding this promotion: samsungbih@toolbox.ba.

Notice on Collection and Use of Personal Data

Samsung Electronics Austria GmbH, headquartered at Praterstrasse 31/14 Obergeschoss, Vienna, Austria (hereinafter referred to as the "Controller"), hereby informs you about the processing of personal data:

1. Data Controller

The data controller is Samsung Electronics Austria GmbH, headquartered at Praterstrasse 31/14 Obergeschoss, Vienna, Austria, through its subsidiary Samsung Electronics Austria GmbH Belgrade (hereinafter referred to as the "Controller").

2. Data Collected

The controller will collect and process the following personal data:

• First and last name,
• Purchaser's email address,
• Purchaser's address in BiH (for gift delivery),
• IMEI number and serial number of the purchased device,
• Purchase data, invoice/delivery note,
• Proof of receipt of the purchased device, or a scanned document confirming the date of receipt/delivery (for users who have received an additional gift)

(hereinafter collectively referred to as "Personal Data").

3. Purpose of Collecting Personal Data

The Controller will collect and process the aforementioned personal data exclusively for the purpose of verifying the fulfillment of conditions for participation in the "Pre-sale of Samsung Galaxy Z Fold7, Z Flip7, Z Flip7 FE" promotion, and for delivering the gift in case the user is entitled to it.

4. Use of Personal Data

Personal data collected with consent will be used exclusively for the aforementioned purposes of the Controller, in accordance with the Data Protection Law (Law) and the Controller's Privacy Policy.

5. Legal Basis for Processing Personal Data

Personal data is collected and processed by the controller based on the voluntary consent of the data subject.

6. Retention Period of Personal Data

Personal data will be stored only for as long as necessary to fulfill the stated purpose, and in any case not longer than 6 months from the date of purchase.

7. Your Rights

Upon the participant's request, the personal data controller will supplement, amend, update, and delete personal data if the data is incomplete, inaccurate, or outdated, and if its processing is not in accordance with the law, or if the purpose of data collection has been fulfilled. For more information, please consult our Privacy Policy or contact us by sending an email to dataprotection.sead@samsung.com.

In case participants believe that the processing of their personal data violates their privacy, they can contact the personal data controller or the Agency for the Protection of Personal Data and request an explanation.

8. Additional Information

For detailed information on the measures taken to protect personal data, as well as the possible disclosure of personal data, please read our Privacy Policy.

DATA PROTECTION POLICY

Effective Date: May 2018.

Samsung Electronics Austria GmbH and our subsidiaries (hereinafter "Samsung", "we", "us", "our") know how important privacy is to our staff, suppliers, customers, and other individuals with whom we cooperate, and we strive to be clear about how we collect, use, disclose, transfer, and store personal data.

Below are the main issues covered by our Data Protection Policy.

1. Scope and Purpose
2. Responsibility for Compliance
3. Our Obligations
4. Definitions
5. GDPR Principles
6. Special Categories of Personal Data
7. Sharing of Personal Data (including transfers outside the EEA)
8. Profiling and Automated Decision-Making
9. Direct Marketing
10. Record Keeping
11. Individual Data Subject Rights
12. Procedure in case of Data Security Breach
13. Policy Updates
14. Useful Contact Information

1. Scope and Purpose

This policy defines the data protection rules as well as the legal requirements that must be met when it comes to obtaining, handling, processing, storing, transferring, and destroying personal data.

The types of information we will process include details about current, past, and potential staff members, suppliers, customers, and other individuals with whom we communicate. Data held on paper or computer is subject to certain legal safeguards outlined in the General Data Protection Regulation ("GDPR") and applicable data protection laws, which provide limitations on how we may use that information.

Maintaining the highest standards in our handling of personal data is both a collective and individual responsibility, and this policy outlines how we obtain, use, store, and otherwise process the personal data we use in the course of our business. It includes an overview of key data obligations that apply to us as an organization, which also includes the expectation that you will play your part in compliance.

This data protection policy applies to every Samsung employee as well as other personnel providing services to Samsung (including, but not limited to, contractors and agency staff) (collectively referred to as "Staff Members"). All Staff Members are obliged to ensure they understand and comply with this policy regarding any personal data they access in the course of their work.

2. Responsibility for Compliance

Responsibility for overseeing compliance with data protection, including adherence to this policy, lies with our Data Protection Officer, whose contact details can be found at the end of this policy.

Individuals in management positions are responsible for data protection compliance within their teams.

If you believe that the policy has not been followed regarding your personal data or the personal data of others, you should raise the matter with your immediate manager or with the human resources or legal departments.

3. Our Obligations

GDPR provides for significant fines against organizations that violate its provisions. Depending on the type of violation, organizations can be fined more than 20 million euros or 4% of their total annual turnover in the previous financial year. These high fines increase the risk exposure in relation to data protection compliance.

4. Definitions

The following definitions may be useful when reading this policy:

Criminal record data is information related to criminal offenses and convictions against a specific person.

Data controllers are individuals or organizations that determine the purpose and method of processing personal data. They are responsible for establishing practices and policies in accordance with GDPR. We are the controllers of all personal data used in our business. Our suppliers, consultants, and contractors may also be data controllers.

For the purposes of this policy, the term Data Subjects includes all living individuals whose personal data we hold, including current, past, and potential customers, suppliers, agents, investors, as well as our staff members. A data subject does not have to be a citizen or resident of Bosnia and Herzegovina. All data subjects have certain legal rights regarding their personal data.

The term personal data refers to data relating to a living person who can be identified from that data (or from such data or other information in our possession). Personal data can be factual (such as name, address, or date of birth) or it can be an opinion (such as performance appraisal). The definition of "personal data" used in GDPR and the applicable data protection law is very broad and allows a wide range of personal identifiers to be classified as personal data. This includes name, identification number, and location data.

Processing is any activity that involves the use of personal data. This includes obtaining, using, observing, recording, or holding data, or carrying out any action or group of actions, including organizing, modifying, retrieving, using, disclosing, deleting, or destroying data. Processing also includes the transfer of personal data to third parties.

Special categories of personal data (formerly known as sensitive personal data) include information about a person's racial or ethnic origin, political opinions, religious or similar beliefs, trade union membership, physical or mental health, or sexual life, as well as genetic and biometric data, when used to identify an individual.

5. GDPR Principles

Any person processing personal data must act in accordance with the applicable principles of good practice defined in GDPR, which Samsung is obliged to adhere to.

• We will process personal data lawfully, fairly, and transparently (see "Lawfulness, Fairness, and Transparency" section).
• We will collect personal data for specified, explicit, and legitimate purposes; we will not process it in a manner that is incompatible with those purposes (see "Purpose Limitation and Data Minimization" section).
• We will process personal data that is adequate, relevant, and limited to what is necessary in relation to the purposes of processing (see "Purpose Limitation and Data Minimization" section).
• We will ensure that personal data is accurate and, where necessary, kept up to date; where data is inaccurate, we will take all necessary steps to erase or correct it without delay, taking into account the purposes for which the data is processed (see "Accuracy" section).
• We will refrain from storing personal data in a form that allows the identification of the data subject for longer than is necessary for the purposes for which the data is processed (see "Storage Limitation" section).
• We will use appropriate technical or organizational measures to ensure the security of personal data, which will include protection against unauthorized or unlawful processing or accidental loss, destruction, or damage (see "Integrity and Confidentiality" section).

The following provides additional information on each of these principles.

5.1. Lawfulness, Fairness, and Transparency

The purpose of applicable data protection law is not to prevent the processing of personal data, but to ensure that it is done fairly and without negative impact on the rights of the data subject.

For personal data to be processed in accordance with the law, one of the legal conditions for processing must be met. These conditions include the following: the data subject explicitly and freely consents to the processing; processing is required by law, processing is necessary for the performance of a contract we have with the data subject; or processing is necessary for the legitimate interests of Samsung or the data subject (unless those interests are overridden by the interests or fundamental rights and freedoms of the individual). Before we start processing personal data (for example, before collecting personal data from an individual), we consider our data collection details and why we need that data. We also identify the legal basis that allows us to obtain and process this information lawfully.

The data subject must be provided with certain information in accordance with the law, including (but not limited to) who the data controller is, the purpose(s) for which the data is processed, the legal basis for processing, the identity of any data subject to whom the data may be disclosed or transferred, and the data subject's rights regarding their personal data. This information must be provided through appropriate privacy notices or fair processing notices.

5.2. Purpose Limitation and Data Minimization

Personal data may only be processed for specific purposes for which the data subject was informed when the data was first collected, or for any other purposes expressly permitted by applicable data protection laws. This means that personal data cannot be collected for one purpose and then used for another. If it becomes necessary to change the purpose for which the data is processed, the data subject will be informed of the new purpose before any processing occurs.

5.3. Accuracy

Personal data must be accurate and up-to-date. Information that is inaccurate is inaccurate and therefore steps must be taken to verify the accuracy of any personal data at the point of collection, and then to do so regularly at specified intervals. Inaccurate or outdated data must be destroyed. When you become aware that personal data we process is inaccurate, you must inform your data processing manager/contact person, and take the necessary steps to destroy or modify it, taking into account our data retention policy requirements where applicable.

5.4. Storage Limitation

Personal data should be kept in a form that does not allow the identification of the data subject for longer than is necessary for the purposes for which the data is collected. This means that data must be destroyed or deleted from our systems when it is no longer needed, or that personal data must be managed by them.

After the retention period expires, unless there is a valid business reason for retention beyond that period (for example, if the data subject has initiated legal proceedings against us and the retained personal data is relevant to such proceedings), records containing personal data will be eliminated in a secure and efficient manner.

5.5. Integrity and Confidentiality

Maintaining data security means ensuring the confidentiality, integrity, and availability of personal data, in accordance with the following definitions:

• Confidentiality means that only persons authorized to use the data can access it.
• Integrity means that personal data should be accurate and fit for the purpose for which it is processed, and reliable throughout its lifecycle (i.e., it cannot be changed by unauthorized persons).
• Availability means that authorized users should be able to access data when they need it for permitted purposes. Personal data should therefore be stored on our central computer system rather than on individual personal computers.

Security procedures include:

• Access controls. Any unauthorized person observed in controlled access areas must be reported.
• Securing tables and cabinets that are locked. Keep tables and cabinets locked if they contain confidential information of any kind. (Personal data is always considered confidential.)
• Destruction methods. Paper documents should be shredded. Floppy disks and CD-ROMs should be physically destroyed when no longer needed.
• Equipment. Samsung staff should ensure that individual monitors do not display confidential information to passers-by, and that they log out of their personal computers when they are unattended.

6. Special Categories of Personal Data

From time to time, it may be necessary to process special categories of personal data. We will process special categories of personal data only when we have a legal basis for processing personal data (see section 5 of this policy) and when one of the special conditions for processing special categories of data applies. These special terms include, but are not limited to, the following cases:

• The data subject has given their explicit consent.
• Processing is necessary for the purpose of exercising the rights or obligations of Samsung or the data subject under labor law.
• Processing is necessary to protect the vital interests of the data subject, and the data subject is physically unable to give consent.
• Processing relates to personal data that has been made public by the data subject.
• Processing is necessary for the establishment, exercise, or defense of legal claims.
• Processing is necessary for reasons of significant public interest.
• Processing is necessary for the assessment of an employee's performance.

Special categories of personal data will not be processed until:

• The above assessment has been carried out; and
• The data subject has been adequately informed (through a privacy notice or otherwise) about the nature of the processing, the purposes for which it is carried out, and the legal basis.

7. Sharing of Personal Data (including transfers outside the EEA)

Personal data may only be transferred to third parties who agree to comply with the necessary policies and procedures, as well as all relevant contractual provisions, and who agree to implement appropriate measures, in accordance with the requirements.

Personal data may be shared with another member of our group (which includes our subsidiaries, as well as our ultimate holding company, together with its subsidiaries) if the recipient needs the information for business reasons, and if the transfer complies with applicable cross-border data transfer restrictions (see below).

Data protection laws restrict transfers to countries outside the European Economic Area (hereinafter referred to as the "EEA") to ensure that the required level of data protection is not compromised. You transfer personal data originating from one country across borders when you transfer, send, view, or access that information in or to another country. Special permission from the local legal department/data protection office must be obtained before transferring personal data across borders in order to verify that the necessary conditions are met.

8. Profiling and Automated Decision-Making

There are significant limitations on the circumstances under which automated decisions can be made about individuals (where a decision is made solely automatically without any human intervention). This is also the case when it comes to profiling (which is the automated processing of personal data to evaluate certain things about an individual, for example, whether they like a particular product).

This type of decision-making may only be applied where it is necessary for the performance of a contract, where it is permitted by law, or in cases where the individual gives their explicit consent. In addition, individuals have the right to be informed about decision-making and have certain rights that must be communicated to them, including the right to request human intervention or to challenge a decision, and there are strict limitations on the use of special category data for this type of decision-making.

In any case, all profiling activities will be processed in full compliance with any applicable law.

9. Direct Marketing

We adhere to strict data protection requirements regarding direct marketing.

10. Record Keeping

It is important that we are able to demonstrate that we comply with the principles of data processing. Where necessary, we maintain appropriate records regarding our handling of personal data. Specifically, this may include records of our legal basis for processing personal data, records of data sent to data subjects, and records of our data processing.

11. Individual Data Subject Rights

Data must be processed in accordance with the rights of data subjects. Data subjects have the right to:

• Withdraw their consent to the processing at any time (and it must be as easy for them as it was to give consent), if they have consented to the processing of data.
• Be provided with clear, transparent, and easily understandable information about how their personal data is used (for this reason, we provide a privacy notice).
• Request access to all data that the data controller holds about them.
• Request the correction and rectification of inaccurate data.
• Request that the data held about them by the data controller be erased when certain conditions stipulated by applicable law are met.
• Request the restriction of processing when certain conditions stipulated by applicable laws are met.
• Request the transfer of personal data to another controller when certain conditions stipulated by applicable laws are met.
• Object to the processing of personal data when certain conditions stipulated by applicable laws are met.
• Not be subject to a decision based solely on automated processing, including profiling, where it has legal or other significant consequences for them, unless they have explicitly consented to it, or where it is necessary for the conclusion or performance of a contract with them.
• Lodge a complaint with the Information Commissioner and data protection authorities regarding our data processing, providing details below, although we encourage data subjects to notify us of any problems they have, so that we can try to resolve them.

When you know that a data subject wishes to exercise any of their rights, you should contact the Legal Affairs/Data Protection Office. It may be necessary to take appropriate steps to identify the person making the request.

Formal requests for access to data from a data subject (requester) for information that Samsung Electronics Austria GmbH can provide in writing, using Annex 2 (Data Subject Request Form). However, data subject requests for access to data do not have to be formal or in writing (they can be submitted, for example, via social media or by phone). Any staff member who receives a request (regardless of whether it is submitted using the attached form or not) should immediately forward it to the data protection officer and/or the legal and compliance team. If you have any doubts about whether a request has been submitted, you should discuss the circumstances with them.

The Data Protection Officer will respond to each request within 30 days of receipt, with certain exceptions (unless applicable law provides for a shorter period, in which case that shorter period will apply). If Samsung is unable to provide the requested personal data, the reasons for this will be fully documented and the data subject will be informed in writing. The data subject will also be provided with details of the relevant supervisory authority to whom a complaint may be made, as required by applicable data protection law.

12. Procedure in case of Data Security Breach

A data security breach is defined as "a breach of security that leads to accidental or intentional destruction, loss, alteration, unauthorized disclosure, or other processing." A breach does not necessarily mean that personal data has been externally disclosed without proper authorization, but it can mean that someone has accessed it internally without proper authorization.

We are obliged to notify the relevant regulatory authority of certain data breaches and, in more limited cases, the data subject themselves.

13. Data Access Authorization

Authorization for access to personal data collected and/or used by Samsung Electronics Austria GmbH, Zagreb Branch, is granted only to the following persons:

• For customer personal data collected through websites established for specific marketing purposes:
• Authorized legal representatives of Samsung Electronics Austria GmbH, Zagreb Branch
• Marketing managers whose job responsibilities include handling personal data collected for specific marketing purposes

14. Useful Contact Information

You can contact the Data Protection Service at:

Samsung Electronics Austria GmbH, Zagreb Branch, Radnička cesta 37b, Zagreb, Republic of Croatia

Email: Please contact us by sending an email to dataprotection.sead@samsung.com.