Privacy Policy

EXPO 2027 d.o.o. Belgrade (Stari grad), with its registered office at 5 Kralja Milana Street, Belgrade (Stari grad), ID no. 21973220, TIN: 114113854 (hereinafter: the Company), prescribes as follows its Privacy Policy covering the handling of personal information for users and related parties (hereinafter: Policy) and the adjoining Terms of use (hereinafter: Terms of use) with regard to the services offered by the Company as well as all activities of the Company in association with the specialized world exhibition Expo 2027 Belgrade (hereinafter: Exhibition). “App” refers to any mobile, tablet or desktop application hosted, managed or owned by the Company, developed for the purposes of the Exhibition, which especially includes, but not limited to, the official Exhibition app – “EXPO 2027”. “Nonrelated parties” refers to any visitor of the Exhibition, user of the App (whether registered or non-registered), volunteer staff, freelance journalists, and other individuals who participate in or are involved with the Exhibition as individuals not belonging to any certain organization that participates in or is involved with the Exhibition. “Related parties” refers to individuals who belong to certain organizations that participate in or is involved with the Exhibition, namely, related parties such as officials, employees, and personnel of the Company, sponsors and sponsoring companies, foreign governments, international organizations and private exhibits, all of which may or may not use the Company’s App. Nonrelated parties and Related parties will be jointly referred to as “Users”. By installing and/or using the App, the User confirms that he has duly, truthfully and fully familiarized himself with the Policy and the adjoining Terms of use, his rights and duties as well as the rights and duties of the Company in regard to the Policy and the personal data collected, as stipulated herein.

In accordance with applicable regulation (including but not limited to the Serbian Personal data protection act (hereinafter: Act) and the European General data protection regulation (hereinafter: GDPR)) the Company hereby prescribes the following Policy in order to inform Users of potential collection of personal data during the use of Company’s App, thus committing to guaranteeing the confidentiality of personal data related to such use and the confidentiality of user communication during such use.

The Company will be designated as the controller of all personal information gathered in accordance with the Policy.

The Company processes personal data to the extent necessary to fulfill the purpose of processing, and such data is stored in a protected database at the Company's headquarters for as long as necessary to achieve the purpose, except in cases where the law obliges the Company to keep them longer.

The Company protects the confidentiality of data by taking appropriate organizational, technical, and personnel measures to ensure data security and protect them from any accidental or unlawful destruction, loss, misuse, prohibited disclosure or access, and any other form of unlawful processing.

The Company will not be held responsible for any breach of privacy and security rights of Users committed via the internet by third parties.

The Company will report any violation of Users’ privacy and rights thereto to the competent authorities without delay.

The personal information Users are required to provide for the provision of the App of the Company is indicated in the forms (where applicable) to be entered by the User. The User assumes no obligation to provide such personal information, but if such personal information is not provided, the Company is unable to offer use of the App in that regard.

By using the App of the Company, Users give unequivocal, explicit consent for the collection of the following data:

• Basic Information (first and last name, alias, gender, date of birth, address (postal code, prefecture, municipality), phone number, e-mail address, passport number, nationality or country of residence, registration date, activity history, etc.);
• Location information;
• Information regarding affiliation (government, company name, organization name, department name, position, etc.);
• Information related to Social media (accounts, profiles and password information for X, Facebook, Instagram, Google and/or Apple ID);
• Information related to the user account created through the App (accounts, profiles and password information);
• Information provided for the purpose of participating in the loyalty programs;
• Data on the completed transaction (in case of online payment - amount, currency, date, time, status, card number and other details (if stored), payment system details, account in the payment application, etc));
• Data from conversations with the AI chat bot (messages, questions, answers, and similar information);
• Data provided through the contact form, as well as communications with the Company through it;
• Entered information (language settings, mail delivery settings, hobbies and preferences, and other information entered or sent by Users’ using the Company’s input form or other method prescribed by the Company (excluding information contained in the above));
• Information obtained from the Users’ terminals (type of terminal, OS, terminal identifier, IP address, browser type and other browser information, referrer information, cookie ID, information related to browsing history and purchase history obtained by using cookies and cookie-like technologies, advertising identifiers such as IDFA and Google Play advertising ID, etc.); and
• Other information related to the above, or any information voluntarily submitted by the User during the use of the App or in communication with the Company.

Related parties also give their unequivocal, explicit consent for the collection of the following data (in addition to the data already mentioned in the paragraph above):

• Information on responsible authority/authorities;
• Information obtained through internal communications (information obtained through personnel evaluations, internal audits or internal reporting, as well as communication with the internal AI chatbot, contact forms and similar business support tools, etc.);
• Log-in information (ID, password, etc.);
• Entered information (information entered or sent by Related Persons using the Company’s input form or other method prescribed by the Company);
• Information obtained from the Related Persons’ terminals (type of terminal, OS, terminal identifier, IP address, browser type and other browser information, referrer information, cookie ID, information related to browsing history and purchase history obtained by using cookies and cookie-like technologies, advertising identifiers such as IDFA and Google Play advertising ID, etc.); and
• Other information related to the above, or any information voluntarily submitted by the User during the use of the App or in communication with the Company.

The Company notes that under no circumstances does it collect special categories of data, such as data revealing the User’s racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, nor does it process genetic data, biometric data, or data concerning health, sex life, or sexual orientation.

The Company will use the above-stated data for the following purposes (in accordance with its’ applicability):

• To create a user account for the Users;
• To authenticate and confirm the identity of Users, as well as a user account;
• For selection and registration of volunteer/user/participation applications;
• To organize and implement the loyalty program;
• To request feedback from the Users regarding the App or the provided services;
• To provide Users with promotional marketing, advertising and publicity relating to the App and/or the services provided by the Company and/or Exhibition as well as related entities of the Company;
• To investigate and analyze the usage of the App by Users and to maintain, protect and improve the App, etc.;
• To register the reservation information and manage and operate the Exhibition safely and smoothly;
• To process and execute the payments;
• To create backup copies of parts or all of the data (including configurations, content, programs, messages, and others) and to store such copies for the purposes of system maintenance;
• To respond to inquiries about the App;
• To respond to actions that violate the Company’s terms or the like regarding the App;
• To notify changes etc. of the terms or like regarding the App;
• To prevent the occurrence of failures, malfunctions, and accidents in the systems used for the use of the App, and to respond to them when they occur;
• To plan and operate the Exhibition and related events (including official ceremonies and official events);
• To carry out administrative procedures related to the Exhibition and related events;
• To contact Related Persons or to prepare a contact list;
• To communicate and coordinate information among Related Persons;
• To authenticate and confirm the identity of Related Persons;
• To monitor the use of systems by Users, to detect and prevent unauthorized log-ins or the like;
• To detect and prevent fraud and misconduct at an early stage;
• To provide personal information to third parties in accordance with this Policy.

The Company will retain personal data for as long as it is necessary to fulfil the purposes prescribed in this article, with respect to whether there is an ongoing relation with the User whose data is retained as well as whether the Company is legally obligated to store such data. The Company intends to retain the data no later than 31st of December 2027, unless applicable law stipulates a different retention period for certain data.

The App allows Users with a registered account to make purchases through it.

For the purpose of processing transactions, the following data may be collected:

• the cardholder's first and last name,
• card or payment account details,
• the transaction amount,
• the transaction date.

The processing of this data is carried out by a third party — a payment processor integrated into the App system, in accordance with its own Privacy Policy and applicable law.

The Company does not store the User’s card number in its original form, but only to the extent necessary for payment processing. All data is transmitted and processed via encrypted channels, and the User gives consent to this processing when completing a purchase.

The Company may enable Users to use the AI chat bot within the App for the purpose of providing customer support, responding to inquiries, providing information, and collecting feedback. All data entered by the User in communication with the AI chat bot is processed in accordance with the provisions of this Privacy Policy.

By using this service, the User agrees that all information entered in communication with the AI chat bot will be processed in accordance with this Privacy Policy.

The User may stop using the AI chat bot at any time, and the rights to access, correct, or delete previously entered data shall apply in accordance with the provisions of this Privacy Policy.

The Company is not responsible for the accuracy, or the truthfulness of the data entered or provided to the Company by the Users or any third parties, nor for the results of any data processing that involved such data.

The Company will not be liable to the User or any third party for the loss of data provided by the User or otherwise collected from the User, considering that the use of the internet is not, and cannot be, completely secure. To avoid any doubt, by using the App, and/or providing personal data, the User exclusively agrees to the risk of using the internet, which includes all security risks associated with the use of the internet and will not have the right to compensation from the Company in the event of any damage due to data loss.

The Company pledges to respect the privacy of Users to the greatest extent possible, withstanding the provisions of the Policy provided herein.

Personal data will not be disclosed, sold, or made available to third parties, except for the purpose and under the conditions specified in this Policy or when explicitly required by applicable law (i.e. to the competent courts, the government or government affiliated bodies).

The Company reserves the right to outsource some of its services (e.g. marketing, payment, security or organizational services) for which purposes the Company may disclose information to such third parties (in such cases the Company shall impose on such persons the obligation to securely manage such personal information and shall exercise necessary and appropriate supervision thereof). Government of the Republic of Serbia has and will create multiple companies in order to fulfill its obligations for the purposes of the Exhibition and the Company may disclose information to such companies, the Bureau International des Expositions (BIE) or a legal successor of the Company.

The Company will not transfer, use, store, or make available to any third party outside the borders of the Republic of Serbia the data collected from Users or data that may be collected during the use of the App, except for the purpose and under the conditions specified in this Policy, when necessary in accordance with this article or when explicitly required by applicable law. When the Company conducts a transfer, use, storing or making available of personal data outside of the border of the Republic of Serbia, the Company will take all necessary measures for the protection of personal information pursuant to the relevant applicable law.

The Company primarily collects information directly from the Users.

The Company may obtain personal information indirectly from (i) organizations, corporations, or entities to which Users belong or are associated with, (ii) companies sponsoring the Exhibition, related parties of the Exhibition (iii) public sources such as traditional media, publicly available web-sites social media (such as X, Facebook, Instagram, Google, Apple etc.) as well as other publicly available sources and (iv) outsourcing companies and affiliated companies mentioned in article 5. above.

The Company informs Users that they must be at least 15 years old to use the App, and by using the App, the User confirms that they have read, understood, and agree with this provision and explicitly confirms that they are at least 15 years old at the time of downloading and using the App.

To the best of the Company's knowledge, it does not collect, process, or in any way come into contact with data about persons under 15 years of age without the consent of a parent or guardian.

Users under the age of 15 must provide their personal information to the Company only with the consent of a parent or guardian.

If the Company discovers that it has collected the personal information of a User under the age of 15 without the consent of the parent or guardian, it will immediately take appropriate action.

As a data subject whose data has been collected and processed by the Company, Users have the following rights:

• Right of Access
  The User can obtain information about whether their personal data is being processed and, if so, gain access to their personal data and receive information such as: the purpose of processing, types of personal data, data recipients, retention period, etc. When personal data is transferred to another country or international organization, the User has the right to be informed about the safeguards related to the transfer and whereabouts of the personal data.
• Right to Rectification
  Upon the User's request, inaccurate personal data will be corrected, or incomplete data will be supplemented.
• Right to Erasure (i.e. “right to be forgotten”)
  Upon the User's request, personal data will be erased if the conditions prescribed by applicable law are met. Personal data cannot be erased if their processing is required by applicable law or if processing is necessary for the protection of public interest or for the initiation, submission, or defense of a legal claim.
• Right to Restriction of Processing
  Upon the User's request, the processing of personal data will be restricted if any of the conditions prescribed by applicable law are met.
• Right to data portability
  Upon the User’s request, all personal data concerning that User will be sent to the User in a readable format.
• Automated individual decision making
  User has the right to not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
• Right to Object
  At any time, the User can object to the processing of personal data based on legitimate interest or necessary for the performance of tasks in the public interest or the exercise of legally prescribed powers, after which the Company will cease further processing of such data, unless there is a lawful basis for processing that overrides the user's interests or freedoms or if the processing is carried out for the initiation, submission, or defense of a legal claim.
• Right to Lodge a Complaint with the Commissioner for Information of Public Importance and Personal Data Protection and the Right to Administrative and Judicial Protection
  Users may have the right to file a complaint with a supervisory authority under applicable laws and regulations. The Company hereby informs the Users that a Serbian supervisory authority is the Serbian Commissioner for Information of Public Importance and Personal Data Protection (contact info to be found at https://www.poverenik.rs/en/contact.html).
• Right to withdraw
  Users have the right to withdraw consent whenever the Company handles personal information based on consent. This withdrawal does not affect the legality of any treatment made on the basis of previously given consent.
  Since the Company creates a profile on the App solely based on the User’s consent, the User may withdraw their consent at any time by deleting their profile, after which the Company will delete all data it holds about the User.

If you wish to exercise any of the afore-mentioned rights, please use the contact details listed in section ”Inquiries” below.