PRIVACY POLICY ON PROCESSING PERSONAL DATA OF THIRD PARTIES
ADRENALIN LTD BELGRADE (VRAČAR), company registration number: 20041676, with registered office at Topolska 22, Belgrade (hereinafter referred to as the “Company”), represented by Maja Antić, hereby adopts this Privacy Policy on July 1, 2022.
1. Introductory Provisions
1.1. The purpose of this Privacy Policy is to regulate the Company’s internal privacy policy, rules, and procedures in accordance with the General Data Protection Regulation (“GDPR”) and the Serbian Personal Data Protection Act (“Official Gazette RS,” No. 87/2018) (hereinafter referred to as the “Act”).
1.2. The definitions and terms in this Privacy Policy correspond to the definitions and terms contained in the Act.
1.3. The Company is committed to complying with the legislation of the Republic of Serbia regulating personal data protection and GDPR, as well as respecting the protection of fundamental human rights and freedoms, primarily the right to privacy of individuals whose personal data the Company processes.
1.4. The Company may collect, and process data as defined in Section 2.1 of this Privacy Policy.
1.5. The relevant legislation of the Republic of Serbia, GDPR, and this Privacy Policy apply to all personal data processing activities conducted by the Company concerning third parties. “Third parties” refers to individuals visiting the Company’s premises, individuals engaged by the Company for service provision purposes, and individuals collaborating with the Company or receiving specific services from it, including those who apply for or participate in the quiz show “Potera” (hereinafter collectively referred to as “Individuals”).
1.6. Section 2.1 identifies cases where the Company may process certain personal data while providing services to clients within its business activities (as a data processor), ensuring that each such processing activity is regulated by a specific data processing agreement with the respective client.
1.7. Employees engaged by the Company are required to adhere to and implement this Privacy Policy in their work. In case of violation of this Privacy Policy, GDPR, or the Act, applicable laws and internal procedures prescribed by this Privacy Policy (as outlined in Section 6) shall apply.
1.8. Third parties collaborating with the Company and potentially having access to processed data must comply with this Privacy Policy. No third party may access the data processed by the Company without first signing an agreement containing appropriate confidentiality provisions, a joint data processing agreement, or a data processing agreement between the controller and processor.
1.9. The personal data listed in Section 2.1 of this Privacy Policy may be disclosed to specific recipients, including I&F Grupa d.o.o. Beograd, Two Rivers d.o.o. Beograd, affiliated entities of the Company in Serbia, Company employees, security system maintenance service providers, security service providers, video surveillance providers, Company clients, legal service providers (e.g., attorneys), IT service providers, external auditors, and accounting agencies.
2. Data Processed by the Company
2.1. The Company processes the following personal data of Individuals (as a Data Controller):
a) Full name;
b) Gender;
c) ID card number;
d) Time of entry and exit from Company premises;
e) Photograph;
f) Job title;
g) Contact phone number;
h) Email address.
Additionally, the Company processes (as a Data Controller) personal data of authorized representatives/contact persons of business partners engaged for service provision purposes:
a) Full name, email address, contact phone number, job title, date of birth;
b) Unique Citizen Identification Number (JMBG) of the authorized representative (if authorized for issuing electronic invoices).
The Company processes (as a Data Controller) personal data of individuals applying for or participating in the quiz show “Potera” (contestants) for candidacy, participation, and execution of all quiz-related activities, including but not limited to prize payment:
a) Full name;
b) Email address;
c) Contact phone number;
d) Permanent or temporary residence address;
e) Unique Citizen Identification Number (JMBG);
f) Bank account number; and any other personal data provided by the contestant for participation in the quiz.
Furthermore, for the purpose of providing services within its business activities, the Company may process (as a Data Processor) personal data of third parties submitted by its clients or independently collected on behalf of and for the account of the client in accordance with legal regulations. In such cases, the clients act as Data Controllers, while the Company serves as a Data Processor. The Company may engage sub-processors following client instructions while ensuring an equivalent level of data protection. Details regarding such data processing are stipulated in data processing agreements with specific clients and maintained in the Company’s records of processing activities.
3. The Company as a Data Controller
Personal Data Processed by the Company as a Data Controller
3.1. The Company, as a Data Controller, processes the Personal Data of the following Individuals:
a) Those visiting the Company’s premises;
b) Those engaged by the Company for service provision purposes;
c) Those receiving certain services from the Company or collaborating with it (based on a concluded contract) (legal representatives/contact persons/employees of clients and clients if they are entrepreneurs);
d) Those who apply for or participate in the quiz show “Potera”.
3.2. If, in the future, the Company needs to process the Personal Data of categories of Individuals not listed in section 3.1, it will do so in accordance with the Law and GDPR without requiring amendments to this Privacy Policy. However, if such data processing becomes systematic and/or part of the Company’s daily activities, this Privacy Policy will be appropriately updated.
3.3. A detailed description of the categories of Individuals whose Personal Data is processed and other relevant information related to the processing is maintained in the Company’s records of data processing activities, which are regularly updated.
Purpose of Data Processing
3.4. When Personal Data is processed based on the conclusion and execution of a business cooperation agreement or for actions that are part of the pre-contractual phase, the purpose of processing is to conclude the specific contract and fulfill contractual obligations. When the Company processes Personal Data based on consent, such data will be used exclusively for communication purposes, sending special offers, occasional gifts, newsletters, event invitations, evaluating the Company’s service quality, and their participation in the “Potera” quiz. Furthermore, Personal Data is processed to ensure the security of assets and individuals present in the Company’s premises, prevent incidents, or collect data in the event of an emergency.
3.5. In cases where the Company acts as a Data Processor, collecting or processing Personal Data on behalf of a client, the purpose of data processing is always determined by the client, as the client holds the role of Data Controller. Additional details regarding such data processing are defined in data processing agreements concluded with specific clients and documented in the Company’s records of processing activities.
3.6. If the Company ever needs to process the Personal Data of Individuals listed in section 3.1 for a purpose not specified in this Privacy Policy, it will do so in compliance with the relevant laws of the Republic of Serbia and GDPR without requiring amendments to this Privacy Policy. However, if such data processing becomes systematic and/or part of the Company’s daily activities, this Privacy Policy will be updated accordingly.
3.7. The Company has established data retention periods fully aligned with the specific purpose of processing, which are recorded in its data processing records. These retention periods are periodically reviewed and adjusted as necessary.
3.8. The Company’s data processing activities do not include profiling, or any form of automated Personal Data processing intended to evaluate specific personal aspects of Individuals, such as financial or health status, personal preferences, or other personal characteristics.
3.9. Additional details on data processing and retention periods are maintained in the Company’s data processing records.
Legal Basis for Data Processing
3.10. Before initiating any data processing activities, the Company determines the legal basis by clearly defining, specifying, and, where applicable, documenting the specific purpose of processing and the appropriate legal basis.
3.11. As of the adoption of this Privacy Policy, the Company processes Personal Data based on: (i) the Individual’s consent; (ii) legal obligations; (iii) the Company’s legitimate interest; and (iv) the conclusion and execution of contracts between the Company and Individuals.
3.12. When processing Personal Data based on the Individual’s consent, the form and content of such consent will comply with the provisions of the Law and GDPR. If consent is required for specific data processing activities, the consent form may be included within other documentation or as part of a contract between the Company and the Individual, always in a clear and transparent manner. To avoid any doubt, if an Individual provides consent for data processing, they may withdraw such consent at any time. A sample consent form is provided in Appendix 1 of this Privacy Policy.
3.13. The Company processes Personal Data based on its legitimate interest when conducting video surveillance within its business premises and surrounding areas, as well as when recording Individuals’ entry into the Company’s business complex (through logbooks). The purpose of video surveillance and logbook records is to protect the Company’s assets, ensure the general security of individuals within its premises, and provide personal safety to Individuals visiting the Company’s premises.
3.14. In cases where the Company acts as a Data Processor, processing Personal Data on behalf of a client, the legal basis for processing is always determined by the client, as the client holds the role of Data Controller. Additional details regarding such processing are defined in data processing agreements with specific clients and documented in the Company’s records of processing activities.
3.15. The specific legal basis for each data processing activity is determined and regularly updated in the Company’s data processing records.
Data Processing Agreements
3.16. Agreements concluded between the Company and its Data Processors and/or Joint Data Controllers will include all relevant provisions required by the Law and GDPR.
3.17. The above applies to cases where the Company acts as a Data Processor, collecting or processing Personal Data on behalf of a client within the scope of its business activities.
Data Transfers
3.18. The Company does not, as a rule, transfer Personal Data outside the Republic of Serbia. However, data may be transferred to another country or international organization without prior approval if it has been established that such a country or organization ensures an adequate level of personal data protection in accordance with the Decision on the List of Countries, Parts of Their Territories, or Sectors of Certain Activities in Those Countries and International Organizations Where an Adequate Level of Personal Data Protection is Ensured (“Official Gazette RS,” No. 55/2019). Additionally, the Company may transfer Personal Data outside the Republic of Serbia by applying appropriate protective measures in accordance with Article 65 of the Law (e.g., standard contractual clauses, binding corporate rules, etc.).
Records of Data Processing
3.19. To comply with relevant regulations and establish good practices, the Company maintains up-to-date records of its data processing activities as a Data Controller. The Company reserves the right to amend these records in the event of changes to relevant legal regulations.
4. Technical Measures
4.1. The Company is committed to implementing appropriate technical measures, as prescribed by its internal procedures, aimed at ensuring optimal data protection for all categories of data processed by the Company.
4.2. In line with this, the Company’s policy is that data creation, storage, processing, and access should be conducted within the Company’s document management systems (including, but not limited to: Microsoft SharePoint portal, File Server, Archive Server, Microsoft NAV, Pantheon, etc.). Employees are required to create and process data, documents, and information exclusively on company computers and associated storage devices, while storing confidential data and documents on these devices is strictly prohibited. Additionally, data in document management and ERP solutions are stored within predefined structures of locations, sites, and document libraries, which have predefined access rights. All company computers and external storage devices are protected by “BitLocker” encryption. Access to IT services is managed through a multi-factor authentication system (“MFA”) controlled by “Microsoft Active Directory” and “Network Access Protection (NAP)”. Furthermore, the Company ensures that employees do not use unauthorized systems, prohibiting the use of private, public, and cloud computing resources and storage systems for the creation, processing, storage, and access to data, documents, and information. Finally, the Company periodically conducts employee training on the secure use of system applications.
4.3. Access to data stored in the corporate system is controlled and granted based on assigned rights, meaning only designated employees have access to the data. Access rights to documents and information are granted granularly according to each employee’s business duties within the Company. Access rights to all IT systems and applications are managed through an automated ticket system, where employee requests must be approved by Company management and executed by the IT department. The IT department periodically sends notifications to all employees regarding potential threats and how to recognize unusual or malicious activities by third parties.
4.4. If there are any issues related to non-compliance with internal procedures regarding information security incident management or privacy policy, or if there is a suspicion of a breach or compromise of information assets or an infringement of an individual’s rights concerning data, employees are required to report the security incident through the electronic ticket “Incident Report on ITC System,” available on the Company’s internal portal.
Access Control
4.5. The Company implements a procedure to prevent system access for individuals who are no longer employed or engaged by the Company.
Testing and Evaluation of Technical Measures
4.6. The Company conducts regular testing, assessment, and evaluation of technical measures to determine whether they ensure effective data protection. If the Company finds that existing technical measures are insufficient to protect data integrity, it will implement alternative technical measures accordingly and amend this Privacy Policy as necessary.
5. Organizational Measures
Confidentiality
5.1. The Company has established a practice of signing confidentiality agreements or incorporating appropriate confidentiality clauses into contracts with employees and associates who have access to the data processed by the Company.
Measures to Restrict Data Access
5.2. Access to the Company’s systems and data is restricted to specific individuals working in certain Company sectors to perform their assigned duties. Access rights are defined by groups; for example, Group “A” includes a list of employees authorized to access a particular folder based on their job position and management approval. IT department members technically implement access rights.
Designation of a Data Protection Officer
5.3. Although the Company is not legally required to appoint a Data Protection Officer, to implement best practices in data protection, the Company will designate an authorized Data Protection Officer (email: dpo@ifgrupa.com) (hereinafter referred to as the “Data Protection Officer”).
Internal Training and Education
5.4. The Company will organize internal training sessions for individuals who interact with and have access to data.
6. Procedure in Case of a Data Breach
Notification of a Breach
6.1. Notification to the Commissioner for Information of Public Importance and Personal Data Protection
6.1.1. The Company or the Data Protection Officer must notify the Commissioner without undue delay, or within 72 hours of becoming aware of a personal data breach that may pose a risk to individuals’ rights and freedoms (hereinafter referred to as “Commissioner Notification”).
6.1.2. If the Company or the Data Protection Officer fails to act within 72 hours as specified in section 6.1.1 of this Privacy Policy, they must provide justification for the delay.
6.1.3. The Commissioner Notification must include at least the following information:
a. A description of the nature of the data breach, including the type of data affected and an approximate number of individuals impacted, as well as the approximate number of affected personal data records.
b. The name and contact details of the Data Protection Officer.
c. A description of the potential consequences of the breach.
d. A description of measures taken or proposed to address the breach, including measures to mitigate any negative effects.
6.1.4. The Commissioner Notification must be submitted in writing, either in person, by post, or as a scanned copy via email to: povredapodataka@poverenik.rs
6.2. Notification to the Affected Individuals
6.2.1. If a personal data breach is likely to result in a high risk to the rights and freedoms of individuals, the Company or the Data Protection Officer must notify the affected individuals without undue delay (hereinafter referred to as the “Individual Notification”).
6.2.2. The Individual Notification must clearly and concisely describe the nature of the breach and include the following:
a) The name and contact details of the Data Protection Officer.
b) A description of the possible consequences of the breach.
c) A description of measures taken or proposed to address the breach, including those to mitigate potential negative effects.
7. Rights of the Data Subject
7.1. The individual referenced in section 3.1 of this Privacy Policy has the following rights:
7.1.1. To request confirmation from the Company regarding whether it processes their personal data.
7.1.2. To request access to their data.
7.1.3. To request correction of their data.
7.1.4. To request supplementation of their data.
7.1.5. To request deletion of their data.
7.1.6. To request restriction of data processing.
7.1.7. To submit an objection.
7.2. Procedure for Exercising Rights Under Section 7.1
7.2.1. Requests to exercise the rights listed in section 7.1 of this Privacy Policy may be submitted in any form, in writing, to the authorized Data Protection Officer mentioned in section 5.3 of this Privacy Policy.
7.2.2. Any requests not directly addressed to the Data Protection Officer will be forwarded accordingly.
7.2.3. The Data Protection Officer verifies and confirms the identity of the requester based on available data. Additional information may be requested if necessary.
7.2.4. The Data Protection Officer records the date of identity verification and the specifics of the requested data.
7.2.5. The requested information must be provided within 30 days of receipt. This period may be extended by up to 60 additional days if necessary due to complexity or volume. The requester must be notified within 30 days if an extension is required.
7.2.6. The response to the request must be provided free of charge. However, if the request is clearly unfounded or excessive (especially if repeated), the Company may:
a. Charge of administrative costs;
b. Refuse to act on the request.
The burden of proof that a request is unfounded or excessive lies with the Data Protection Officer.
8. Final Provisions
8.1. This Privacy Policy is issued by the Company’s director, who has the right to amend or supplement it as necessary. The Privacy Policy is binding on the Company from the date of its adoption.
ANNEX 1 TO THE PRIVACY POLICY
Notice on Personal Data Processing for Legal Representatives/Contact Persons/Authorized Persons of Business Partners and Request for Consent to Personal Data Processing
Considering that the business partner is a legal entity or an entrepreneur, this document relates to the processing of personal data of the legal representative/contact person/authorized person of the business partner who, on behalf of and for the account of the business partner, has concluded a contract with the company ADRENALIN LTD BEOGRAD (VRAČAR) (hereinafter: “ADRENALIN”) or who, on behalf of and for the account of the business partner, fulfills undertaken obligations. In this regard, ADRENALIN collects, processes, and stores the personal data of the aforementioned individual in its database for the purpose of concluding and executing a service agreement or another business cooperation agreement, as well as for maintaining email and telephone communication to conclude and execute such an agreement and for future cooperation.
In accordance with the provisions of the Personal Data Protection Act (“Official Gazette of RS”, No. 87/2018), ADRENALIN provides the business partner, i.e., the legal representative/contact person/authorized person of the business partner, with this Notice on Personal Data Processing and Request for Consent to Personal Data Processing, as defined below.
I Personal Data Processed by ADRENALIN
ADRENALIN processes the following personal data of the legal representative/contact person/authorized person of the business partner:
– Full name and gender;
– Email address;
– Contact phone number;
– Job title;
– Date of birth.
Hereinafter collectively referred to as “Personal Data”.
Additionally, ADRENALIN stores electronic invoices issued by business partners (if the concluded contract requires issuing an invoice to ADRENALIN), which often contain the full name of the authorized person, as well as their personal identification number (JMBG). These documents contain a set of personal data that ADRENALIN does not process individually but stores in its databases for five (5) years from the invoice issuance date (in accordance with legal regulations).
II Legal Basis for Personal Data Processing
Considering the nature of the cooperation between ADRENALIN and the business partner, including the pre-contractual phase, ADRENALIN processes the personal data of the legal representative/contact person/authorized person of the business partner based on multiple legal grounds.
Primarily, ADRENALIN processes Personal Data for the purpose of concluding and executing a service agreement or another business cooperation agreement (including the transfer of contact data to other business partners when necessary for business operations) or for taking certain actions before concluding such agreements. Providing personal data is a contractual obligation and a necessary condition for concluding and executing the service agreement or another business cooperation agreement. Therefore, the legal representative/contact person/authorized person of the business partner is obliged to disclose personal data to ADRENALIN employees. Otherwise, ADRENALIN will be unable to conclude and execute the service agreement or another business cooperation agreement.
Furthermore, personal data is processed based on consent, which the legal representative / contact person / authorized person of the business partner provides by signing this document. The data is processed for communication maintenance, sending special offers, gifts, newsletters, event invitations, and company evaluations related to the provided service.
Finally, electronic invoices containing personal data are stored to comply with ADRENALIN’s legal obligations (tax regulations).
III Purpose of Personal Data Processing
When personal data is processed based on contract conclusion and execution or for pre-contractual actions, the purpose is to conclude the specific contract and fulfill contractual obligations.
When personal data is processed based on consent, the data will be used solely for communication maintenance, sending special offers, sending occasional gifts, sending newsletters, event invitations, company evaluations related to service quality. As the processing of Personal Data for these purposes is based on consent, please note that consent may be withdrawn at any time by sending a request to the email address: dpo@ifgrupa.com. Withdrawal of consent does not affect the legality of processing conducted before the withdrawal.
Finally, electronic invoices containing personal data are stored to fulfill ADRENALIN’s legal obligations.
IV Retention Period of Personal Data
When personal data is processed based on a concluded service agreement or another business cooperation agreement, the data of the legal representative/contact person/authorized person of the business partner is stored in ADRENALIN’s databases for the duration of the contractual relationship and for three (3) years after its termination.
When personal data is processed based on consent, ADRENALIN will store the data until consent is withdrawn.
Lastly, electronic invoices (which contain a set of personal data that ADRENALIN does not process individually) are stored in ADRENALIN’s databases for five (5) years from the invoice issuance date (in accordance with legal regulations).
V Rights of Individuals Regarding Personal Data Processing
Individuals whose personal data is processed by ADRENALIN may request the following: 1) access to their personal data, 2) correction of personal data, and 3) deletion of personal data. Additionally, they have the right to: 1) restrict the processing of their personal data, 2) data portability, and 3) file a complaint with the Commissioner for Information of Public Importance and Personal Data Protection.
To exercise these rights, a request should be submitted to the email address: dpo@ifgrupa.com.
VI Disclosure and Transfer of Personal Data
ADRENALIN may disclose the personal data of the legal representative/contact person/authorized person of the business partner to other business partners (when necessary), ADRENALIN’s affiliated entities within Serbia, ADRENALIN employees, security service providers, legal service providers, IT service providers, Government authorities (State Audit Institution).
ADRENALIN generally does not transfer personal data outside the Republic of Serbia. However, data may be transferred to another country or an international organization without prior approval if that country or organization ensures an adequate level of personal data protection, in accordance with the Decision on the List of Countries and Organizations Providing Adequate Protection (“Official Gazette of RS”, No. 55/2019). Additionally, ADRENALIN may transfer personal data outside Serbia with appropriate protection measures in accordance with Article 65 of the Personal Data Protection Act (e.g., standard contractual clauses, binding corporate rules, etc.).
By signing this document, I acknowledge that I have fully understood its content and give my consent for the processing of my personal data in cases where consent is required.
Legal Representative/Contact Person/Authorized Person of the Business Partner
________________________________________
Full Name and Date of Signing