Privacy NoticeHR Experience

1. DATE OF ISSUE OF THE PRIVACY NOTICE

April 7, 2025

2. PURPOSE OF THE PRIVACY NOTICE

This Privacy Notice (hereinafter: the "Notice") serves to inform users of the HR Experience website (hereinafter: the "Service") about all relevant information concerning the processing of their personal data. The Service is available at the Internet address www.hrexperience.rs to users who wish to secure their participation in the HR Experience conference (hereinafter: the "Users"). www.hrexperience.rs.

In light of the applicable legal framework regarding the privacy of natural persons, primarily the Law on Personal Data Protection (hereinafter: the "LPDP"), it is important that you carefully read this Notice in order to understand what types of personal data we commonly process, the purposes for which your personal data is processed, who has access to your data, and most importantly, your rights related to such processing.

We are committed to the protection of your personal data and fully support your rights as a User under the LPDP. Personal data is any information relating to an identified or identifiable natural person, particularly based on an identifier such as name, identification number, location data, online identifier, or one or more characteristics specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person. Questions, complaints, requests, and additional information related to this Notice, personal data protection, and the exercise of your rights may be submitted to the following email address: zzpl@infostud.com. zzpl@infostud.com.

3. ABOUT US

The Service is an information society service provided by INFOSTUD 3 DOO SUBOTICA, Matije Korvina 17, 4th floor, 24000 Subotica, Republic of Serbia, registration number: 20175095, VAT number: 104505119 (hereinafter: the "Company"). Accordingly, references to "we" or "our" in this Notice refer to the Company.

By using the Service, you provide us with information, some of which may constitute personal data.

Depending on the purpose, we process your data in the capacity of a controller.

The controller is the entity that independently or jointly determines the purposes and means of the processing of personal data.

Please read the Terms of Use of the Service before continuing with this Notice.

4. LEGAL BASIS FOR PROCESSING

In other cases, the legal basis for processing is a contractual relationship with the data subject, such as the processing required to complete the purchase of a conference ticket. We may also rely on legitimate interests, for example, to prevent fraud or misuse.

In other cases, the legal basis for processing is a contractual relationship with the data subject, such as the processing required to complete the purchase of a conference ticket. We may also rely on legitimate interests, for example, to prevent fraud or misuse.

We may process your personal data if required to do so by law. We may also process your personal data if such processing is necessary for the protection of your vital interests. If we process your personal data based on a legal obligation or for the protection of your vital interests, we will inform you accordingly.

5. PURPOSE OF PROCESSING, RETENTION PERIOD, AND DATA PROCESSED

All data we request from you is collected for a specific purpose, of which you will always be clearly informed.

The primary purposes for the collection and processing of personal data are to enable the provision of information society services:

Purchase of tickets for the HR Experience conference. Tickets are purchased via the Ticketline.rs platform, an authorized intermediary for ticket sales. During the purchase process, users provide personal data such as their full name, email address, and contact phone number. The legal basis for processing is the contract—by accepting the Terms of Use and completing the ticket purchase, you enter into a contractual relationship with us.

Provision of information and improvement of customer service. During the purchase of tickets for the conference, users provide their personal data, and the legal basis for processing is the user’s consent. Users also provide personal data when subscribing to the newsletter. In these situations, users consent to the use of their personal data in order to receive relevant information and enhanced customer service in connection with the HR Experience conference.

Successful HR Stories. By applying to participate in the “Successful HR Stories” project, users provide personal data such as the name and contact information of the representative, including email and phone number. The legal basis for processing is the contractual relationship entered into with us upon registration for the project.

We retain your personal data for as long as necessary to fulfill the specific purpose, or until consent is withdrawn, or until the expiration of the period for which you provided consent. After this period, the data is deleted or anonymized.

Exceptionally, we may retain your data even after the withdrawal of consent or fulfillment of the processing purpose, where such retention is necessary for the performance of a legal obligation or for the establishment, exercise, or defense of legal claims.

We process personal data to enable the delivery of the Service and its functionalities, to measure usage and improve the Service, to protect users, and to ensure smooth use of the website along with the provision of customer support services. More details regarding the purposes and duration of the processing of your information are provided below.

6. OUR LEGITIMATE INTERESTS

To achieve our business purposes, we process your personal data based on our legitimate interest. Of course, we only do so when your interests or fundamental rights and freedoms do not override our legitimate interest. We rely on legitimate interest in order to:

• diagnose technical issues with the Service;
• better understand you as a user through your behavior, interests, and preferences;
• protect our business and provide support to our users;
• test and develop new products and services, and improve existing ones;
• identify and protect users of the Service and the Service itself from fraud or unlawful activities.

By using the Service, you agree that certain employees of the Service may contact you using the contact information you have provided, in order to alert you of certain irregularities, assist in diagnosing technical issues with the Service, or if there is suspicion of potentially fraudulent or unlawful activities (e.g., hacking attempts, sending inappropriate files, spam, etc.), for the purpose of preventing harmful consequences. The legal basis for this processing is our legitimate interest as the owner of the Service. For the purpose of protecting the Service, the following data may be processed: your behavior on the website (e.g., pages visited), IP address, information about your access device, browser, operating system, and similar data.

You may object to this type of processing of your personal data at any time by sending an email to: zzpl@infostud.com. For more information about your rights, please refer to the section “Your Rights” below.

7. SECURITY OF YOUR DATA

For the purpose of ensuring the security of the data we process, we consistently strive to apply the necessary standards in personal data protection and to implement all required technical, organizational, and personnel protection measures in accordance with the applicable Law on Personal Data Protection (LPDP). This includes, but is not limited to: technical security measures, measures related to physical access to locations where your data is stored, information security measures in line with applicable regulations, and other measures appropriate to the nature of the processing and necessary to ensure the protection of specific personal data.

Third-party processors are also required to implement appropriate safeguards.

8. TRANSFER OF PERSONAL DATA TO OTHER COUNTRIES

Certain processors who may have access to personal data are based in foreign countries, primarily in EU member states or in member states of the Council of Europe Convention 108. The transfer of data to these countries is carried out based on the presumption of an adequate level of personal data protection in those jurisdictions, in accordance with the law.

If certain processors are based outside the aforementioned group of countries, the transfer of data is permitted only in accordance with Article 65 of the Law on Personal Data Protection, which governs transfers subject to the implementation of appropriate safeguards.

9. YOUR RIGHTS REGARDING PERSONAL DATA

1. TRANSPARENCY: When you provide us with your personal data, we will transparently inform you about the purpose for which such data is required, who will use the data, and we will provide you with all other relevant information concerning the processing of your data (this right is fulfilled by making this Notice available to you).
2. RIGHT OF ACCESS: You have the right to be informed whether we are processing your personal data, and if we are, you have the right, based on such access, to request correction, supplementation, updating, deletion of data, as well as suspension or temporary restriction of processing. Since we process your personal data as a controller, you are entitled to receive all information concerning the processing from us.
3. RIGHT TO RECTIFICATION, SUPPLEMENTATION AND UPDATING: The data being processed must be accurate and complete. You have the right to have any inaccurate personal data corrected without undue delay, and incomplete data supplemented.
4. RIGHT TO ERASURE: You have the right to have your personal data erased in accordance with the LPDP. If we are required to continue processing certain data in order to fulfill our legal obligations (e.g., under the Law on Accounting or similar), or for the purpose of establishing, exercising, or defending legal claims, we will delete only the portion of the data that is no longer necessary.
5. RIGHT TO DATA PORTABILITY: If you wish (i) to receive the personal data you provided to us at the time of registration in a structured, commonly used and machine-readable format, or (ii) to have such data transmitted to another controller, you have the right to request this from us, provided that the processing is based on consent or a contract and is carried out by automated means.
6. RIGHT TO RESTRICTION OF PROCESSING: You have the right to request restriction of the processing of your personal data in certain situations.
7. RIGHT TO OBJECT: You have the right to object to the processing of your personal data carried out on the basis of legitimate interest.
8. RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY: You have the right to file a complaint with the Commissioner for Information of Public Importance and Personal Data Protection – Bulevar kralja Aleksandra no. 15, 11120 Belgrade, Phone: +381 11 3408 900, Email: office@poverenik.rs. office@poverenik.rs.
9. ALL OTHER RIGHTS PROVIDED UNDER APPLICABLE LAW: The data subject may exercise all rights by submitting a request to the following email address: zzpl@infostud.com. zzpl@infostud.com.

With regard to the exercise of the aforementioned rights, the Company will provide you with all necessary additional information and assistance, in accordance with the conditions and procedures set forth in the applicable LPDP.

You may exercise your rights by sending a request to the following email address: zzpl@infostud.com. zzpl@infostud.com.

We will respond to your request as soon as possible, but no later than 30 days from the date of receipt. In case of complexity or a large number of requests, an additional response period may be required. This period shall not exceed 90 days, and you will be informed accordingly.

If your request is manifestly unfounded or repetitive, we may refuse to act on it or charge a fee for handling it. A request is considered repetitive if you contact us to exercise the same right more than once within a single year. If you contact us two or more times in one year regarding the same right, we will respond to your request only if you have a justified reason.

10. WHO HAS ACCESS TO YOUR DATA – RECIPIENTS

Depending on the specific purpose, access to certain personal data of users may be granted to:

• Employees of the Company, as well as contractors and similar associates (who are bound by confidentiality obligations), but only to the extent necessary for the purposes of processing;
• The Company, as part of a group of affiliated companies, may transfer data to its affiliated entities when necessary, always within the scope of our legitimate interest and the defined purpose;
• Newly established entities or any acquiring entity in the event that the Company is involved in a merger, acquisition, sale of shares, or any other corporate restructuring;
• Our partners who perform certain data processing tasks for the Company as processors, such as external associates providing specific services to us, as well as software companies that develop and maintain the software used to store data;
• Exceptionally, personal data may also be disclosed to competent public authorities when required by law, and only to the extent necessary for the fulfillment of a specific legal obligation;
• Any other recipient when reasonably necessary, for example in life-threatening situations.

All recipients are required to implement appropriate technical, organizational, and personnel measures to protect your personal data. In cases where we act as the data controller and a third-party legal entity processes data on our behalf as a processor, we enter into a data processing agreement with such processors to regulate all essential aspects of data processing and applicable security measures.

List of Processors:

• Google Ireland Ltd (Irska) https://policies.google.com/privacy?gl=uk
• Meta Platforms Ireland Limited (Malta) https://www.facebook.com/business/m/privacy-and-data
• Zoho (SAD) https://www.zoho.com/campaigns/terms.html
• Ticket Line (Serbia)
  https://www.ticketline.rs/uslovi-poslovanja.php

11. CONSENT AND WITHDRAWAL OF CONSENT

If you have given us your consent for the processing of your personal data, you may withdraw it at any time. In the event that you withdraw your consent, we will cease further processing of your personal data and delete such data within a maximum period of 90 days from the date your withdrawal was submitted. Withdrawal of consent is free of charge and may be submitted to the following email address: zzpl@infostud.com. zzpl@infostud.com.

12. WEBSITE POLICY

We use various technologies on our website, some of which are controlled by us (first-party), and others are controlled by third-party organizations.

The technologies we use include, but are not limited to, cookies and scripts. Some of these technologies are essential for the functioning of the website and for our understanding of how you use it. We also use these technologies for marketing and other purposes, as described below.

The use of cookies enables certain functionalities of our website and provides you with an improved user experience. To deliver better customer service, our website uses specific external scripts such as Google Analytics, Firebase, Facebook Pixel, Google Ads, and similar technologies, which may collect some of your personal data.

13. FINAL PROVISIONS

This is the latest version of the Notice (April 7, 2025).

This Notice is subject to change. If this Notice is amended or supplemented, the date of the latest version will be updated accordingly.