Privacy Policy

EXPO 2027 d.o.o. Belgrade (Stari grad), with its registered office at Bulevar Vojvode Bojovića 6, 11000 Belgrade, ID no. 21973220, TIN: 114113854 (hereinafter: the Company), prescribes as follows its Privacy Policy covering the handling of personal information for users and related parties (hereinafter: Policy) and the adjoining Terms of use (hereinafter: Terms of use) with regard to the services offered by the Company as well as all activities of the Company in association with the specialized world exhibition Expo 2027 Belgrade (hereinafter: Exhibition). “Website” refers to any website hosted, managed or owned by the Company with regard to the Exhibition, which especially includes but is not limited to the website “https://expobelgrade2027.org”. “Nonrelated parties” refers to any visitor of the Exhibition, user of website or application, volunteer staff, freelance journalists, and other individuals who participate in or are involved with the Exhibition as individuals not belonging to any certain organization that participates in or is involved with the Exhibition. “Related parties” refers to individuals who belong to certain organizations that participate in or is involved with the Exhibition, namely, related parties such as officials, employees, and personnel of the Company, sponsors and sponsoring companies, foreign governments, international organizations and private exhibits, all of which may or may not use the Company’s services or the website. Nonrelated parties and Related parties will be jointly referred to as “Users”. By using any of the services of the Company and/or visiting the website, the User confirms that he has duly, truthfully and fully familiarized himself with the Policy and the adjoining Terms of use, his rights and duties as well as the rights and duties of the Company with regard to the Policy and the personal data collected, as stipulated herein.

In accordance with applicable regulation (including but not limited to the Serbian Personal data protection act (hereinafter: Act) and the European General data protection regulation (hereinafter: GDPR)) the Company hereby prescribes the following Policy in order to inform Users of potential collection of personal data during the use of Company’s services and/or the website, thus committing to guaranteeing the confidentiality of personal data related to such use and the confidentiality of user communication during such use.

The Company will be designated as the controller of all personal information gathered in accordance with the Policy.

The Company processes personal data to the extent necessary to fulfill the purpose of processing, and such data is stored in a protected database at the Company's headquarters for as long as necessary to achieve the purpose, except in cases where the law obliges the Company to keep them longer.

The Company protects the confidentiality of data by taking appropriate organizational, technical, and personnel measures to ensure data security and protect them from any accidental or unlawful destruction, loss, misuse, prohibited disclosure or access, and any other form of unlawful processing.

The Company will not be held responsible for any breach of privacy and security rights of Users committed via the internet by third parties.

The Company will report any violation of Users’ privacy and rights thereto to the competent authorities without delay.

The personal information Users are required to provide for the provision of the services of the Company is indicated in the forms (where applicable) to be entered by the User. The User assumes no obligation to provide such personal information, but if such personal information is not provided, the Company is unable to offer such services.

By using the services of the Company, or by visiting the website, Users give unequivocal, explicit consent for the collection of the following data:

• Basic Information (name, alias, gender, date of birth, address (postal code, prefecture, municipality), phone number, e-mail address, passport number, nationality or country of residence, etc.);
• Location information;
• Information regarding affiliation (government, company name, organization name, department name, position, etc.);
• Information related to Social media (accounts, profiles and password information for X, Facebook, Instagram or Google);
• Entered information (language settings, mail delivery settings, married or unmarried status, has children or not, hobbies and preferences, and other information entered or sent by Users’ using the Company’s input form or other method prescribed by the Company (excluding information contained in the above)); and
• Information obtained from the Users’ terminals (type of terminal, OS, terminal identifier, IP address, browser type and other browser information, referrer information, cookie ID, information related to browsing history and purchase history obtained by using cookies and cookie-like technologies, advertising identifiers such as IDFA and Google Play advertising ID, etc.); and
• Other information related to the above;

Related parties also give their unequivocal, explicit consent for the collection of the following data (in addition to the data already mentioned in the paragraph above):

• Information on responsible authority/authorities;
• Information on background (education, employment history, qualifications, history of disciplinary, criminal and administrative actions, etc.);
• Information obtained through internal communications (information obtained through personnel evaluations, internal audits or internal reporting, etc.);
• Log-in information (ID, password, etc.);
• Entered information (information entered or sent by Related Persons using the Company’s input form or other method prescribed by the Company);
• Information obtained from the Related Persons’ terminals (type of terminal, OS, terminal identifier, IP address, browser type and other browser information, referrer information, cookie ID, information related to browsing history and purchase history obtained by using cookies and cookie-like technologies, advertising identifiers such as IDFA and Google Play advertising ID, etc.); and
• Other information related to the above;

The Company will use the above-stated data for the following purposes (in accordance with its’ applicability):

• To authenticate and confirm the identity of Users;
• For selection and registration of volunteer/user/participation applications;
• To request feedback on the provided services from the Users;
• To provide Users with promotional marketing, advertising and publicity relating to the services provided by the Company and/or Exhibition as well as related entities of the Company;
• To investigate and analyze the usage of the services by Users and to maintain, protect and improve the services, etc.;
• To register the reservation information and manage and operate the Exhibition safely and smoothly;
• To respond to inquiries about the services provided by the Company;
• To respond to actions that violate the Company’s terms or the like regarding the services;
• To notify changes etc. of the terms or like regarding the services;
• To prevent the occurrence of failures, malfunctions, and accidents in the systems of the services, and to respond to them when they occur;
• To plan and operate the Exhibition and related events (including official ceremonies and official events)
• To carry out administrative procedures related to the Exhibition and related events;
• To contact Related Persons or to prepare a contact list;
• To communicate and coordinate information among Related Persons;
• To authenticate and confirm the identity of Related Persons;
• To monitor the use of systems by Related Persons, to detect and prevent unauthorized log-ins or the like;
• To detect and prevent fraud and misconduct at an early stage;
• To provide personal information to third parties in accordance with this Policy;

The Company will retain personal data for as long as it is necessary to fulfil the purposes prescribed in this article, with respect to whether there is an ongoing relation with the User whose data is retained as well as whether the Company is legally obligated to store such data.

The Company is not responsible for the accuracy, or the truthfulness of the data entered or provided to the Company by the Users or any third parties, nor for the results of any data processing that involved such data.

The Company will not be liable to the User or any third party for the loss of data provided by the User or otherwise collected from the User, considering that the use of the internet is not, and cannot be, completely secure. To avoid any doubt, by using the services of the Company and/or accessing the website, and/or providing personal data, the User exclusively agrees to the risk of using the internet, which includes all security risks associated with the use of the internet and will not have the right to compensation from the Company in the event of any damage due to data loss.

As a data subject whose data has been collected and processed by the Company, Users have the following rights:

• Right of Access
  The User can obtain information about whether their personal data is being processed and, if so, gain access to their personal data and receive information such as: the purpose of processing, types of personal data, data recipients, retention period, etc. When personal data is transferred to another country or international organization, the User has the right to be informed about the safeguards related to the transfer and whereabouts of the personal data.
• Right to Rectification
  Upon the User's request, inaccurate personal data will be corrected, or incomplete data will be supplemented.
• Right to Erasure(i.e. “right to be forgotten”)
  Upon the User's request, personal data will be erased if the conditions prescribed by applicable law are met. Personal data cannot be erased if their processing is required by applicable law or if processing is necessary for the protection of public interest or for the initiation, submission, or defense of a legal claim.
• Right to Restriction of Processing
  Upon the User's request, the processing of personal data will be restricted if any of the conditions prescribed by applicable law are met.
• Right to data portability
  Upon the User’s request, all personal data concerning that User will be sent to the User in a readable format.
• Automated individual decision making
  User has the right to not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
• Right to Object
  At any time, the User can object to the processing of personal data based on legitimate interest or necessary for the performance of tasks in the public interest or the exercise of legally prescribed powers, after which the Company will cease further processing of such data, unless there is a lawful basis for processing that overrides the user's interests or freedoms or if the processing is carried out for the initiation, submission, or defense of a legal claim.
• Right to Lodge a Complaint with the Commissioner for Information of Public Importance and Personal Data Protection and the Right to Administrative and Judicial Protection
  Users may have the right to file a complaint with a supervisory authority under applicable laws and regulations. The Company hereby informs the Users that a Serbian supervisory authority is the Serbian Commissioner for Information of Public Importance and Personal Data Protection (contact info to be found at https://www.poverenik.rs/en/contact.html)..
• Right to withdraw
  Users have the right to withdraw consent whenever the Company handles personal information based on consent. This withdrawal does not affect the legality of any treatment made on the basis of previously given consent.

If you wish to exercise any of the afore-mentioned rights, please use the contact details listed in section ”Inquiries” below.