Sends faxes, in North Macedonia

Zakon za zastita na licnite podatoci (Law on Personal Data Protection), Official Gazette No. 42/2020 as amended by Official Gazette Nos. 294/2021 and 101/2025, fully applicable 24 August 2021, arts. 1-11, 15, 28-47, 81-83, 85-87, 94-96 (general provisions, principles and controller obligations) · Read the law's page

• Have one of the lawful grounds Article 10 lists, such as consent, necessity for a contract, a legal obligation, vital interests, a public-interest task or official authority, or legitimate interests, before processing personal data.
• Where processing rests on consent, be able to demonstrate that the data subject consented, present the request for consent clearly distinguishable from other matters, and let the data subject withdraw consent at any time as easily as it was given.
• Apply technical and organizational measures proportionate to the risk, keep them under review, and be able to demonstrate that your processing complies with the Law.
• Build data protection into your processing by design and by default, including pseudonymization and data minimization.
• Keep a record of the processing operations you are responsible for, carry out a data protection impact assessment before processing likely to result in a high risk to the rights and freedoms of natural persons, and designate a data protection officer where Article 41 requires one.
• Where a certification mechanism under Articles 46 and 47 is used, know that it is voluntary and does not by itself reduce responsibility for complying with the rest of this Law.
• Get the Agency's prior approval before any systematic and extensive processing of a citizen's national identification number, and otherwise process it only with the data subject's prior consent or another case a law states.
• Process personal data for direct marketing, including related profiling, only after the data subject has given explicit consent.
• Apply appropriate safeguards, such as pseudonymisation or data minimisation, when processing personal data for archiving in the public interest, or for scientific, historical or statistical purposes.
• Disclose personal data held in an official document only to fulfil a task in the public interest, reconciling public access to official documents with the right to data protection.

Zakon za zastita na licnite podatoci, arts. 16-25 and 27 (rights of the data subject) · Read the law's page

• Facilitate the exercise of a data subject's rights under Articles 19 to 26.
• Answer a data subject's access request under Article 19 with confirmation of whether their data are processed and, if so, access to the data along with the listed information, including the purposes, categories, recipients, retention period and source.
• Rectify inaccurate personal data within 15 days of a request under Article 20.
• Erase personal data within 30 days of a request under Article 21 wherever one of its listed grounds applies.
• Stop processing a data subject's personal data for direct marketing once they object under Article 25.