Pursuant to the Law on Personal Data Protection (Official Gazette of the Republic of Serbia, No.87/2018, hereinafter: Law) the production society of City Expert Global D.o.o. Belgrade, No. 1-3 Knez Mihailova Street, 11000 Belgrade, Republic of Serbia, Registration number: 21081337 TIN: 108854724, Ordinal number in the register of intermediaries 313, inscribed by the decision 46-00-331/2015-04 of 27.05.2015 (hereinafter: Company or Manager) represented by the director Milan Todorović, brings

RULEBOOK/RULE SET ON THE PROTECTION OF PERSONAL DATA WITH NOTICE OF DATA COLLECTION AND PROCESSING

Article 1.

The Company respects User privacy. This notice will help you understand our rules of privacy and we ask that you read it carefully. If you are not in agreement with some of these rules pertaining to our Personal Data Protection Policy (hereinafter: The Policy) please refrain from using the Company's services and do not provide us with your personal information.

In accordance with the Law, the Company acts in the capacity of a Personal Data Handler (hereinafter: The Handler).

Article 2

In the aim of protecting your privacy, the Company applies appropriate technical, organizational and personnel measures and continuously works on improving them in order to ensure that your personal data is handled in accordance with all applicable regulations and your consent. The services provided by the Company are conditioned by you providing consent, because we need it in order to execute them. In this regard, the Company may periodically amend this Policy, in which case it will ensure that an updated version is available to you on the Website, with a clearly marked start of application. We invite you to check our website on every visit in order to see if there has been a change in the Ordinance since your last visit, and if so, to familiarize yourself with the content of the new Rulebook/Ruleset. If you do not agree with the new rules, please refrain from using our website and submitting your data in any way or withdraw your consent to the processing of personal data in accordance with the Rules.

Article 3

You can access the current Rulebook/Ruleset content via the link at the bottom of our website whenever you have internet access. By continuing to use the Website, you will be deemed to have read and understood the applicable Regulations, and that after reading and understanding you have agreed to its application. You give your consent voluntarily, for the processing of the data specified in this Rulebook/Ruleset, after havin read this Rulebook/Ruleset and after confirming in no unclear terms the continued use of our website by unequivocally expressing your will to consent to the processing of personal data relating to you.

This Rulebook/Ruleset is an integral part of the Company’s Terms of Use, published at: https://cityexpert.rs/legal/terms-of-use The regulations of the Republic of Serbia shall apply to this Rulebook, as well as to its possible amendments.

II HANDLER INFORMATION

Article 4

The identity and contact information of the Handler, more precisely the legal entity responsible for managing your data, are defined in this article.

The Handler of your data is:

The contact information of the Handler for exercising the right to protection of personal data are:

According to the provisions of Article 56 of the Law, the Company as the Handler and Data Processor is not obliged to appoint a person for personal data protection, given the fact that the Company's core activity does not consist of processing operations which by their nature, scope or purposes require regular and systematic monitoring of a numerous data subjects.

III METHODS OF GATHERING DATAA

Article 5.

Personal data which relates to employees is collected by the Company in the following ways:

• directly from an individual, when the employee directly submits personal data, when concluding an employment contract, or annex, as well as from candidates for employment when candidates directly submit personal data when applying for a job
• data processing, in which case the Company or a third party engaged on behalf of the Company (for example, an accountant) uses employee identity data for mandatory employee registration and payroll calculation and payment of related taxes and contributions on salaries, in accordance with this Rulebook/Ruleset, laws and bylaws which regulate labor relations.

Personal data related to web page visitors, is collected by the Company as follows:

• automatically, when using the websites, in which case the Company or an engaged third party on behalf of the Company uses the so-called. "Cookie" technologies for adequate display of content and monitoring of the number of visits and movements on the Company's website and the like (hereinafter: "cookie"), in accordance with this Rulebook/Ruleset

Personal data pertaining to users of the Company’s services, is collected by the Company as follows:

• directly from an individual, when the person directly submits their data to us when the individual contacts the Company via the website, e-mail or telephone (e.g., for the purpose of registration or user verification), or
• automatically, when using the websites, in which case the Company or an engaged third party on behalf of the Company uses the so-called. "Cookie" technologies for adequate display of content and monitoring of the number of visits and movements on the Company's website and the like (hereinafter: "cookie"), in accordance with this Rulebook/Ruleset

IV DATA PROCESSED BY THE HANDLER, THE METHOD AND BASIS OF USE

Article 6

The Company collects data, which is appropriate, relevant and limited to what is necessary in relation to the specific purpose of the processing.

Article 7

Personal data relating to employees and candidates for employment, is processed by the Company in the following manner and on the following basis:

• The Company uses personal data of employees to achieve the purpose specified in this Rulebook/Ruleset, the Employment Contract and laws and bylaws. For each processing undertaken by the Company, there is an appropriate basis regulated by the laws governing the field of work, more precisely, labor relations, social security, taxes and accounting, as well as other laws of the Republic of Serbia.
• The Company must process the data it directly collects in order to comply with the employment contract and fulfill legal obligations in the law-abiding manner in order to exercise the rights of employees in their employment (such as the right to salary, vacation, leave due to disability, safety and health at work, calculation and payment of taxes and contributions, etc.), as well as proper keeping of legally required records
• The Company can process personal data related to the candidate for employment and their request (applying for a vacancy), before concluding an employment contract for the purpose of selecting candidates.

CONCERNING EMPLOYEES:

CONCERNING CANDIDATES FOR EMPLOYMENT:

Article 8.

Personal data relating to website visitors is processed by the Company in the following manner and on the following basis:

• Visitor data may be used by the Company to achieve several purposes specified in this Rulebook/Ruleset. For each processing undertaken by the Company, there is an appropriate basis stated by the Law on Personal Data Protection and other laws of the Republic of Serbia.
• Data directly collected by the Company can be compared and combined with data collected automatically, and thus data collected as anonymous (for example, data on the frequency of visits to certain content on the website) can become personal data (for example, how often a user visits certain content on a website). This allows the Company to provide a personalized experience when visiting the website.
• The Company may process only some and / or all the data listed in this article. The Company continuously works on the development of websites and improving the available functionalities of its websites, because of which it is possible that the processing of certain data listed below will begin later, as the functionalities of the website change. Also, the amount of data that the Company processes depends, for example, on how and for what reasons the person contacts the Company or how it uses the internet pages

CONCERNING VISITORS

Article 9

Personal data relating to users of the Company's website or services is processed by the Company in the following manner and on the following basis:

• User data may be used by The Company to achieve several purposes specified in this Rulebook/Ruleset. For each processing undertaken by the Company, there is an appropriate basis stated by the Law on Personal Data Protection and other laws of the Republic of Serbia.
• The Company, in the capacity of a real estate broker, enters a contractual relationship with the client (seller or lessor - real estate owner) in accordance with the regulations stated by the Law on Real Estate Brokerage and Leasing "Official Gazette of RS", No. 95/2013, 41/2018 and 91/2019). The registered activity of the company implies the performance of mediation or finding activities in order to bring in contact the client and the other contracting party, which would negotiate with them on the conclusion, i.e., conclude a contract on the sale or lease of real estate. To carry out its activities, the Company (as an intermediary) delivers to the specific client by email "Notice of scheduled viewing of real estate and interest (for) the buyer". This Notice contains information that refers only to the user of the site who in a particular case has the status of an interested buyer or tenant. Data on site users who do not have the status of an interested buyer or tenant for a specific real estate is not processed in the specified manner, i.e., the data of such persons are not submitted to the principals. In this sense, a distinction is made between registered users, i.e., users who have registered on the company's website, and verified users, i.e., users who, after registration, verified themselves by submitting their data. The company can enable viewing of real estate only and exclusively to verified users. Registration or verification of users is exclusively voluntary.
• Data that the Company collects indirectly from users can be compared and combined with data collected automatically, and thus data collected as anonymous (for example, data on the frequency of visits to certain content on the website) can become personal data (for example, how often a person visits certain content on a website). This allows the Company to provide a personalized user experience when visiting the website.

CONCERNING REGISTERED USERS:

CONCERNING VERIFIED USERS:

To ensure good understanding, scheduling the viewing of real estate is enabled only for verified users of the Company's site. The company is unable to provide the real estate viewing scheduling service to unverified users. User verification is necessary for the execution of the said service of the Company, provided that no one who does not wish to use the services of the Company is obliged to be verified. Through the verification process, the user agrees that the Operator informs the owner of the real estate who is viewing the user schedules with the user's personal data, to prove the existence of mediation, or to acquaint the client with (potential) buyer or tenant. Persons who do not want their data related to name, surname, country and identification number (Unique Citizen’s ID Number for citizens of the Republic of Serbia, i.e. record number, personal number, passport number or registration number for foreign citizens) to be delivered to the owner of the real estate whose viewing they want to they are not obliged to submit the stated data to the Company, but the submission of this data is necessary in order to enable the scheduling of viewing of the real estate.

In addition to the legal basis from Article 12, paragraph 1, item 1) of the Law, which established the legality of processing based on consent, in relation to verified users, we legally process data based on Article 12, paragraph 1, item 6) of the Law. the legitimate interests of the Operator or a third party, the interests or fundamental rights and freedoms of the verified user do not prevail. Collection and processing of a narrowed scope of data on the verified user are necessary for the business of the Handler as an intermediary, to operate safely, transparently and reliably, because only by collecting these data and forwarding them to the client can prove that the Operator has performed mediation and provide minimum information. the principal (owner of the real estate) in respect of the potential buyer or lessee. Given the fact that there is no other volume (set) of data that is not subject to change and manipulation (e.g., address information), the legitimate interest of the Company can be achieved only by collecting and processing the identification number of users.

Article 10

Personal data related to the ordering parties, is processed by Company in the following manner and on the following basis:

• The Company uses the personal data of the principals to achieve the purpose specified in this Ordinance, the Mediation Agreement and the laws and bylaws. For each processing undertaken by the Company, there is an appropriate basis prescribed by the laws governing the field of real estate brokerage and lease, as well as other laws of the Republic of Serbia.
• The company collects data directly for the purpose of complying with the Brokerage Agreement and fulfilling legal obligations that it must process in the manner abiding by law to exercise the rights of the ordering party from the mediation relationship (such as meeting and contacting the client to conclude a deal). subject of the brokerage contract, giving the client an objective opinion on the price of real estate or the amount of real estate lease, inspecting documents proving the right of ownership, presenting real estate on the market and placing advertisements, enabling real estate inspection, mediating in negotiations, keeping personal data of the ordering party, informing on all circumstances of importance for the subject, etc.), as well as proper keeping of legally required records, and compliance with obligations arising from the Law on Prevention of Money Laundering and Terrorist Financing ("Official Gazette of RS", No. 113/2017, 91 / 2019 and 153/2020).
• Data that the Company collects indirectly from users can be compared and combined with data collected automatically, and thus data collected as anonymous (for example, data on the frequency of visits to certain content on the website) can become personal data (for example, how often a person visits certain content on a website). This allows the Company to provide a personalized user experience when visiting the website

CONCERNING ORDERING PARTIES:

Article 11

If there is a subsequent need to process personal data for a purpose other than that for which the data were collected, the Company will provide persons with information about that other purpose, as well as all other information in accordance with the law before further processing.

Article 12

Company may take some data as anonym and use for statistic and analytical aim so that the individuals to whom the data relate cannot be directly or indirectly identified. For example, the Company may obtain data on the percentage of visitors who viewed a particular video or visited other content on a website.

V ‘’COOKIE’’ DATA-COOKIES (https://cityexpert.rs/blog/en/cookie-policy)

Article 13

Our website uses cookies to provide you with the best user experience. They allow us, for example, to display the content of the website in an adequate way on each of your devices or web browser ("web browser") through which you access it, or to adapt the content that we place on the website to your interests. The information we collect in this way may in some cases be personal information, but it does not have to be. Because the Company respects your privacy, in this section we want to explain to you what and how we use "cookie" data, as well as to show you that in certain cases you can manage the way we use "cookies" in connection with your use of the website. When a website allows you not to select or exclude certain "cookies" and you opt for this option, it may reduce the functionality of the website. Also, keep in mind that the settings you choose to turn off will need to be turned off for each other device or web browser separately.

Cookies are simple text files that are stored in the user's web browser or on his device. The task of the "cookie" is primarily to enable the website to "recognize" the user when he accesses it next time. In this situation, the website uses the data stored in the "cookie" and thus automatically receives information about the previous activity of the user on the website. Cookies cannot access your data stored on devices, but they can collect information about your online activities.

Cookies are not harmful to the user or his device and should not be confused with viruses. Cookies do not contain viruses or other malicious code.

Depending on how long they stay in the user's web browser, we distinguish between cookie sessions (they are retained only during a specific search session and are automatically deleted when it ends, and are used to give you access to specific content) or permanent " cookie ”(longer or shorter period,“ remembers ”information for subsequent visits to the website, is retained until you delete them manually or until they expire according to the estimated duration, e.g.“ cookies ”that allow the website to“ remember ”login information in case of creating an account or "cookie" for tracking).

Depending on who they belong to, there are first-party cookies (cookies set by the Company as the owner of the website you are browsing) and third-party cookies set by our selected partner companies that provide us with various services, e.g. analytical because they collect and process certain information about how you use the website and provide us with information in an anonymized form, or these "cookies" allow you to display related content on their websites or other sites on the Internet).

Cookies can contain different information and be used for different purposes. The company uses the following types of cookies:

• MANDATORY – necessary "cookies" - Mandatory cookies make the site usable by enabling basic functions such as page navigation and access to protected content. The company uses cookies that are necessary for the proper functioning of our website, to enable certain technical functions and thus provide you with a positive user experience.
• PERMANENT – necessary for easy access - These cookies usually have an expiration date far in the future and as such will remain in your web browser until they expire, or until you delete them manually. We use persistent cookies for functionalities such as “Stay logged in”, which makes it easier for the user to access as a registered user. We also use persistent cookies to better understand user habits, so that we can improve the website according to your habits. This information is anonymous - we do not see individual user data.
• STATISTICS - statistical cookies - Statistical cookies anonymously collect and send data to help site owners to understand how visitors communicate with the site. These are cookies that enable the Company web analytics, i.e., analysis of the use of our site and measurement of traffic, which the Company conducts to improve the quality and content of the services offered.
• MARKETING - "cookie" data for marketing purposes data for marketing purposes - Marketing cookies are used to track visitors through websites. They are used to show users relevant ads and encourage them to participate, which is important for third-party publishers and advertisers.

You can control the use of cookies by selecting the appropriate settings in your web browser. More information can be found at the following links:

VI PROFILINGE

Article 14

Profiling is a form of automated data processing that is used to assess a certain personality trait, especially to analyze or predict personal preferences, interests, behaviors, etc. Cookie profiling (cookie profiling or web profiling) involves the use of persistent cookies to track users' online activities. The company does not conduct profiling in any way.

VII DATA NOT PROCESSED BY THE COMPANY

Article 15

The company does not collect or process data on minors. The company will never intentionally or purposefully collect and process data on minors, but the possibility of providing inaccurate data by individuals cannot be ruled out. If the parent or legal representative of the minor receives information that the data of the minor have been submitted to the Company, it is necessary to inform the Company without delay so that the Company would take appropriate measures and stop further processing of this data and destroy the collected data.

The company does not collect or process special types of personal data (data related to racial or ethnic origin, political opinion, religious or philosophical beliefs, union membership, genetic, biometric or health data or data on sexual life / orientation of a person, as well as data related to criminal convictions, criminal offenses and security measures).

Please do not disclose or send us this information.

VIII EXISTENCE OF THE OBLIGATION TO PROVIDE DATA

Article 16

The existence of a legal obligation to provide data is prescribed for the following categories of natural persons:

• Labor Law ("Official Gazette of RS", No. 24/2005, 61/2005, 54/2009, 32/2013, 75/2014, 13/2017 - US decision, 113/2017 and 95/2018 - authentic interpretation), the Law on Records in the Field of Labor ("Official Gazette of the FRY", No. 46/96 and "Official Gazette of the RS", No. 101/2005 - other law and 36/2009 - other law), the Law on contributions for obligatory social insurance ("Official Gazette of RS", no. 84/2004, 61/2005, 62/2006, 5/2009, 52/2011, 101/2011, 7/2012 - adjusted dinar amounts., 8/2013 - adjusted dinar amounts., 47/2013, 108/2013, 6/2014 - adjusted dinar amounts., 57/2014, 68/2014 - other law, 5/2015 - adjusted dinar amounts., 112/2015, 5/2016 - adjusted dinar amounts, 7/2017 - adjusted dinar amounts, 113/2017, 7/2018 - adjusted dinar amounts, 95/2018, 4/2019 - adjusted dinar amounts., 86/2019, 5/2020 - adjusted dinar amounts, 153/2020 and 6/2021 - adjusted dinar amounts) For natural persons who have the status of an employee with the Company.
• Law on Real Estate Brokerage and Leasing ("Official Gazette of RS", no. 95/2013, 41/2018 and 91/2019) and Law on Prevention of Money Laundering and Terrorist Financing ("Official Gazette of RS", no. 113/2017, 91/2019 and 153/2020) for natural persons who have the status of ordering the Company.

Other individuals are not legally obliged to provide the Company with any personal data if they do not want to use the Company's services or apply for a job in the Company

If an individual wishes to use the Company's services, the obligation to submit data arises from the need to collect and process such data precisely for the purpose of using the Company's services. The company is not able to provide certain services without data collection and processing, under the conditions and in the manner regulated by this Ordinance.

IX RECIPIENTS OF PERSONAL DATA

Article 17

Your data is processed and used primarily by the Company.

In some cases, we may need to make your information available to third parties. These may be members of company groupations to which the Company belongs, which help us answer your questions or requests, or our business partners who help us maintain the functionality of the website or provide us with analytical, accounting, courier, banking, auditing and other services. To ensure that your data is handled in a lawful manner, we have concluded appropriate agreements with third parties relating to the processing of personal data, which, inter alia, provide for their obligation to handle data exclusively in accordance with our instructions and this Ordinance, so that, regardless of such processing, you have the rights established by the Law and this Ordinance.

In case of scheduling a viewing of real estate (which is enabled only to verified users of the Company's website), the Company will provide data related to name, surname, country and identification number (Unique Citizen’s ID Number) for citizens of the Republic of Serbia, i.e., record number, personal number, passport number or registration number for foreign nationals) to be delivered only to the owner of the real estate whose viewing is verified by the verified user.

Also, in certain legal situations, there may be a legal obligation to make your information available to the competent authorities (e.g., court or prosecutor's office, etc.).

X SENDING THE INFORMATION ABOARD

Article 18

We use your data on the territory of the Republic of Serbia.

In addition, the data we collect is stored on servers located in the Federal Republic of Germany, which are owned and controlled by the domestic hosting company Hetzner Online GmbH, Industriestraße 25, 91710Gunzenhausen, identification number: DE812871812, tax number: 203/118/21556. In accordance with the policy of the hosting company, a high degree of technical and software protection of these servers is provided, while access to the data stored on them is not allowed.

The data that the Company collects and processes from the Employees for the purpose of fulfilling the obligations from the employment relationship are submitted to ROEDL & PARTNER DOO BELGRADE-STARI GRAD, No. 1A, floor 1 Dositejeva Street, 11000 Belgrade, registration number: 20805994, TIN: 107453727, for the purpose of calculation and payment of salaries and related taxes and contributions

In the event that we need to make your data available to recipients in countries that are considered not to provide an adequate level of protection of personal data, we will provide an appropriate basis for such transfer, including the possible application of appropriate standard contractual clauses developed by the competent supervisory authority. protection, by which the recipient will be obliged to protect your data in a manner that is in accordance with the protection standards established by the regulations of the Republic of Serbia.

XI DATA STORAGE PERIOD

Article 19

We store your data only if necessary, to achieve the purpose for which the data was collected, after which we will safely remove it from our systems and delete it.

As a rule, we will keep your data covered by this Ordinance for five years, except when the regulations inform us that we keep the data either for a shorter period or when it comes to data on "cookies" stored for up to one year (more information on "cookies"). -you will find them in a special section of this Rulebook/Ruleset).

XII YOUR RIGHTS REGARDING DATA PROCESSING

Article 20

It is important for us to know that under certain conditions you have rights regarding the processing of your data that are guaranteed by law:

Right of access – you have the right to request information about whether we process your personal data, as well as access to that data. At your request, we will provide you with a copy of your data that we process.

Right to correction and supplementation – you have the right to correct inaccurate data relating to you without undue delay, as well as to supplement incomplete data, which includes giving an additional statement.

Right to delete data – you have the right to request the deletion of your data, in particular:

• if the data are no longer necessary for the purpose for which they were collected or otherwise processed.
• if you have revoked the consent based on which the processing was performed, and there is no other legal basis for the processing
• if you have filed an objection to processing in accordance with the law.

Right to limit processing – you have the right to restrict the processing of your data if one of the following cases is met:

• if you dispute the accuracy of the data, within a time limit that allows us to verify the accuracy of the personal data;
• if the processing is illegal and you oppose the deletion of personal data and instead of deleting you request a restriction on the use of data;
• if we no longer need personal data for the purpose of processing, but you have requested them for the purpose of filing, pursuing or defending a legal claim;
• if you have filed an objection to the processing carried out based on the legitimate interest of the operator, and an assessment is underway as to whether the legal basis for the processing by the Company outweighs your interests.

Right to object – if you consider this to be justified in relation to the specific situation in which you find yourself, you have the right to object at any time to the processing of your personal data based on the legitimate interest of the controller, including profiling based on these provisions.

Right to data portability – you have the right to obtain personal data from us in a structured, commonly used and electronically legible form and the right to transfer this data to another controller without interference, if the processing is based on consent or contract and if performed automatically. You also have the right to transfer this data directly to another controller, if technically feasible.

Right to revoke consent – if the processing is based on your consent, you have the right to revoke the consent at any time, whereby the revocation of consent does not affect the admissibility of processing based on consent before revocation.

Right to file a complaint – you have the right to file a complaint regarding the processing of your personal data to the Commissioner for Information of Public Importance and Personal Data Protection whose contact details are:

XII SECURITY OF YOUR DATA

Article 21

The security of your data is very important to us. Therefore, the Company takes physical, technical and electronic protection measures to prevent accidental or unlawful destruction, loss, replacement, unauthorized disclosure or access to personal data. These measures are aimed at persons both outside our organization and within it because access to your data is limited only to those persons whose duties necessarily require such access and who are instructed in the protection of personal data.

Unfortunately, there are no impenetrable security systems, so we cannot guarantee that the security of systems over which we have direct control will never be compromised. In case of violation of personal data, we will take all available measures and inform the competent authorities in accordance with the regulations, as well as the individuals whose data are in question, if possible.

XI INTERMEDIARY AND FINAL PROVISIONS

Article 22

This Regulation shall apply eight days after its publication on the Company's website.

Article 23

Each printed copy of this Ordinance produces full legal effect based on the provisions of the Law on Electronic Document, and its validity or probative value cannot be disputed.

Brought to Belgrade, on 06.05.2021.

Published on 27.09.2023.

Enters into force 27.09.2023.

CITY EXPERT GLOBAL D.O.O. BEOGRAD

Milan Todorović, direktor