1 Data controller
The controller is the Kulturni element Association (details at the bottom of this page). We are not required to appoint a data protection officer; for any question about your data write to info@kulturnielement.org.
2 What we process, why and on what basis
Visiting the site
Our web server automatically logs technical data for each visit: IP address, date and time, requested page and browser type, solely to keep the site secure and working. Basis: legitimate interest (Art. 12(1)(6) LPDP). Retention: short-term, according to the hosting provider’s settings. Fonts and scripts are served from our own server, so opening a page does not send your data to third parties.
Analytics (Google Analytics 4) — only with consent
If you accept analytics in the cookie banner, we use Google Analytics 4 to understand which pages are read and where visitors come from. It processes a pseudonymous device identifier, pages visited, device and browser type, approximate location (country, city) and traffic source. Google Analytics 4 does not store IP addresses. Basis: your consent (Art. 12(1)(1) LPDP), which you can withdraw at any time via “Cookie settings” at the bottom of every page. Retention: up to 14 months.
Contact form and email
When you write to us we process what you provide (name, email, subject, message) only to reply. Basis: steps taken at your request and legitimate interest (Art. 12(1)(2) and (6) LPDP). Retention: up to two years after the last correspondence.
Press accreditation
For accreditation requests we process name, media outlet, email, phone, request type, event, equipment and message. Requests are received by our public relations officer. Basis: steps taken at your request (Art. 12(1)(2) LPDP). Retention: up to two years.
Newsletter
If you subscribe, we process your email address (and name, if given) to send news about our programmes. Basis: your consent (Art. 12(1)(1) LPDP). You can unsubscribe at any time via the link in every newsletter or by writing to info@kulturnielement.org. Subscriber lists are kept in Brevo (Sendinblue SAS, Paris, France). Retention: until you unsubscribe.
Shop and orders
Orders are placed by email. We process name, delivery address, phone, email and ordered items to fulfil the order and keep accounting records. Basis: performance of a contract and legal obligation (Art. 12(1)(2) and (3) LPDP). Retention: for the periods required by accounting regulations.
Ktitor Circle, donations and partnerships
For members of the Ktitor Circle, donors and partners we process the data needed to conclude and perform agreements and meet legal obligations (name, company, contact details, payment data). Your name is published in acknowledgements only with your consent.
External content (YouTube, Google Maps)
YouTube videos and Google Maps are not loaded automatically. They load only when you click “Play video” or “Show map”, or when you allow them in the cookie settings. Google/YouTube then processes your data as an independent controller under its own privacy policy.
Social networks
We run pages on Facebook, Instagram, YouTube, LinkedIn and other networks. When you interact with our pages, those platforms process your data as independent controllers; we only see what you share publicly.
3 Who receives your data
We never sell your data or share it for marketing. We share it only with processors providing services to us, to the extent necessary:
- our hosting provider (site hosting);
- Google (Google Workspace and Apps Script for receiving site messages; Google Analytics — only with your consent);
- Brevo (Sendinblue SAS, France) — newsletter delivery;
- Post of Serbia or a courier — order delivery;
- our accounting firm — bookkeeping;
- competent authorities — only where required by law.
4 International transfers
Brevo processes data in the European Union, which provides an adequate level of protection. Google may also process data in the United States; for analytics this transfer is based on your explicit consent (Art. 69(1)(1) LPDP) and the standard contractual clauses applied by Google, and for receiving messages on the provider’s contractual safeguards.
5 Security
The site runs only over encrypted HTTPS. Access to data is limited to people who need it. External services (analytics, video, maps) are not loaded without your permission. In case of a data breach that may affect your rights, we will notify the Commissioner and you within the deadlines set by law.
6 Your rights
Under Articles 26–38 LPDP you have the right to access and obtain a copy of your data, rectification, erasure, restriction of processing, data portability, to object to processing based on legitimate interest, and to withdraw consent at any time without affecting the lawfulness of prior processing.
Send requests to info@kulturnielement.org. We will reply without delay and within 30 days at the latest (extendable by 60 days in exceptional cases, in which case we will inform you).
You may lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11000 Belgrade, www.poverenik.rs.
7 Minors
A person aged 15 or over may give consent for the processing of their data in information society services (Art. 16 LPDP). For children under 15, consent is given by a parent or guardian.
8 Changes
We will update this policy whenever the way we process data changes. The date of the last change is always shown at the top and bottom of this page.
Data controller
Kulturni element Association (Udruženje Kulturni element)
Office: Čumićevo sokače 2, unit 87, 11000 Belgrade, Serbia
Registered seat: Brodarska 48, 11070 Belgrade, Serbia
Registration no.: 28071299 | Tax ID (PIB): 107407843
Email: info@kulturnielement.org | Phone: +381 11 4532898