I BASIC PROVISIONS

Article 1

This act governs the manner in which the Tourist Organization of the City of Subotica (hereinafter: TOGS) collects, processes, stores, and protects personal data, in accordance with the Law on Personal Data Protection and other applicable regulations of the Republic of Serbia.

Article 2

In its operations, TOGS acts as a "data controller" within the meaning of the Law on Personal Data Protection (LPDP). Personal data shall be collected and processed only to the extent necessary to achieve lawful purposes, while respecting the principles of lawfulness, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality.

II DATA COLLECTED AND PURPOSES OF PROCESSING

Article 3

TOGS may collect the following categories of data:

• Applicants for advertising on the website: First and last name of the authorized person, name of the legal entity / sole proprietor, registered office address, Tax Identification Number (PIB), Company Registration Number (MBR), contact details (email, phone number).

• Website visitors: Anonymized technical data (IP address, browser type, traffic data collected via cookies), solely for the purpose of traffic analysis and improving website performance.

• Persons contacting TOGS via email or other channels: Data necessary to respond to the inquiry or execute cooperation.

Article 4

Data shall be processed exclusively for the following purposes: considering advertising requests; maintaining official records; statistical analysis of website traffic; communication with users and partners; fulfilling legal obligations of TOGS.

III LEGAL BASIS FOR PROCESSING

Article 5

The legal basis for processing personal data includes:

• Consent of the data subject (Article 12, Paragraph 1, Point 1 of the LPDP);

• Performance of a contract or taking steps prior to entering into a contract (Article 12, Paragraph 1, Point 2 of the LPDP);

• Performance of tasks carried out in the public interest in accordance with the statutory powers of TOGS (Article 12, Paragraph 1, Point 5 of the LPDP);

• Compliance with legal obligations to which the controller is subject (Article 12, Paragraph 1, Point 3 of the LPDP).

IV DATA STORAGE AND PROTECTION

Article 6

Personal data shall be stored only for the period necessary to fulfill the purpose for which it was collected, after which it shall be deleted or anonymized, unless a longer retention period is prescribed by law.

Article 7

TOGS implements appropriate technical, organizational, and personnel measures to protect data from unauthorized access, alteration, loss, or destruction.

V RIGHTS OF THE DATA SUBJECT

Article 8

Every person whose data is processed by TOGS has the following rights:

• Right of access — to obtain insight into which data TOGS processes;

• Right to rectification — to request the correction of inaccurate data or completion of incomplete data;

• Right to erasure ("right to be forgotten") — to request the deletion of data where legal grounds exist;

• Right to restriction of processing;

• Right to object to the processing;

• Right to withdraw consent, without affecting the lawfulness of processing based on consent before its withdrawal.

Article 9

A request to exercise the aforementioned rights shall be submitted to the official email address of TOGS or in writing to the address of TOGS headquarters. TOGS is obliged to respond to the request within the deadline prescribed by the LPDP.

VI DATA PROTECTION OFFICER

Article 10

TOGS designates a Data Protection Officer in accordance with Article 56 of the LPDP. The Data Protection Officer is appointed by a decision of the Director of TOGS and reported to the Commissioner for Information of Public Importance and Personal Data Protection in accordance with the Rulebook on the Form and Manner of Keeping Records of Data Protection Officers ("Official Gazette of the RS", No. 40/2019).

Article 11

The Data Protection Officer performs the following tasks:

• Informs and advises TOGS and its employees regarding their obligations under the LPDP;

• Monitors compliance with the LPDP and internal policies;

• Provides opinions regarding data protection impact assessments;

• Cooperates with the Commissioner and acts as the contact point for communication with the Commissioner;

• Serves as the point of contact for data subjects regarding all issues related to the processing of their data.

VII AMENDMENTS AND FINAL PROVISIONS

Article 12

TOGS reserves the right to amend this Rulebook at any time, in accordance with changes in regulations or business procedures. Amendments shall enter into force on the day of their publication on the TOGS website.

Article 13

For all matters not regulated by this Rulebook, the provisions of the Law on Personal Data Protection and other applicable regulations of the Republic of Serbia shall apply.