How we protect your data

1. Who processes your data

The data controller is the CITIZENS' ASSOCIATION ZELENI NAR (Udruženje građana Zeleni Nar), Trgovačka 1, Boleč, Belgrade, registration number 28397852, tax ID (PIB) 114983860. Office: Kajmakčalanska 4, Zvezdara, Belgrade.

For all questions about the processing of data and to exercise your rights, write to info@zeleninar.org or call +381 60 091 90 29. The Association is not obliged to appoint a data protection officer, because its core activity is not processing that requires regular and systematic monitoring of a large number of persons, but the person authorized to represent the Association is responsible for this area and is available at the contacts stated.

2. The principles we follow

We process data lawfully, fairly and transparently, we collect it for a specific purpose and only to the extent necessary for that purpose, we keep it for as long as needed and we protect it with appropriate measures.

We do not sell data, we do not exchange it with advertisers, we do not use it for profiling and we do not make automated decisions about you.

3. What data we collect and why

We collect only what you yourself send us through one of the forms. By type of form, this is:

• Contact form: name, email address, subject and message text. Purpose: to answer your inquiry.
• Membership application: first and last name, email address, telephone number, home address, city and date of birth. Purpose: deciding on admission to membership and keeping the register of members, which the Association keeps under the regulations on associations. We ask for the date of birth in order to verify legal age.
• Application for a donor gift: name, address, city, country, telephone number and gift size. Purpose: sending a token of gratitude.
• Pollution report: a description and type of the phenomenon, a description of the location and coordinates, optionally photographs, optionally a vehicle's license plate, and the reporter's name and contact details if the report is not anonymous. Purpose: acting on the report and informing the public and the competent authorities.
• Comment on a public report: the name you enter yourself and the comment text. Purpose: public discussion of the reported case.
• Subscription to air and fire notifications: email address and the city or area you follow. Purpose: sending the notifications you requested. The subscription is activated only once you confirm it by clicking the link in the message we send you, so no one can subscribe someone else's address.

You can submit a pollution report completely anonymously, without a name or contact details. In that case we will not be able to inform you of the outcome, but we will consider the report.

4. Legal basis for processing

Every processing has its basis in the Personal Data Protection Act (Zakon o zaštiti podataka o ličnosti):

• Consent (Article 12, paragraph 1, item 1): answering an inquiry, sending the notifications you subscribed to, publishing your report in the public feed and publishing your comment. You give consent by an explicit action before submitting a form and you may withdraw it at any time.
• Performance of a contract and taking steps prior to entering into a contract (item 2): processing a membership application and sending a donor gift.
• Compliance with legal obligations (item 3): keeping the register of members, retaining accounting documentation on donations and acting upon the request of a competent authority.
• Legitimate interest (item 6): protecting the website from abuse and unsolicited messages, keeping an internal record of how reports are handled, and asserting or defending a legal claim. We have assessed that this interest does not override your rights, since it concerns a small volume of data and has no effect on your position.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

5. Data we deliberately do not ask for

We do not ask for, and do not want you to send us, data about health, ethnicity, religion, political opinion, trade union membership or sexual life, nor biometric data or data on criminal convictions.

We do not receive or store payment card numbers, payment service passwords or the personal identification number (JMBG). Donations are paid directly to the Association's account, so payment data does not even reach us in a form we could store. If you do nevertheless send us such data in free text, we will remove it without delay.

6. If your data ended up in our records although you never contacted us

This section applies to you if you did not send anything from this website, yet your data is with us: because you happened to be in a photograph accompanying someone's report, or because your vehicle's license plate was reported.

• The basis for processing is our legitimate interest in acting on a report and, where there is a basis for it, notifying the competent authority. We weighed that interest and reduced the processing to the minimum: we do not publish the photographs, we do not publish the plate, and we do not use the data for anything else.
• Where the data comes from: from the person who submitted the report. We do not disclose the reporter's identity, as that would endanger their safety, except when we are required by law to disclose it.
• Why we did not notify you: as a rule we can neither identify nor contact you, because from a photograph we do not have your name or address, and obtaining that data would require a disproportionate effort and would mean collecting even more data about you. In such a case the law allows an exception from the duty to notify.
• What you can request: access to what we hold about you, rectification, erasure and restriction of processing, as well as to lodge an objection. It is enough to write to info@zeleninar.org and describe the case.

You may object to processing based on legitimate interest at any time, and we will stop the processing unless we demonstrate that there is a statutory basis that overrides your interests, or that the processing is necessary for a legal claim. If the report has already been forwarded to the competent authority, the further course of the proceedings before that authority does not depend on us.

7. Photographs and license plates accompanying reports

When you send a photograph or a license plate with a report, you are also handing us data about persons who have not given consent. That is why we handle them with particular care.

• Report photographs are stored outside the publicly accessible part of the server. Photographs of a report for which you did not give consent to publication are accessible solely to a logged-in administrator, through a protected address.
• Before storing, we remove from the photograph the hidden data recorded in the file, including data about the device and the place where it was taken.
• We do not publish the license plate publicly. We use it only when we notify the competent authority and where there is a basis for it.
• A report for which you gave consent to publication appears in the public feed immediately upon submission, together with the attached photographs. Before publication the text passes through an automated check that stops offensive content; such a report is not published until an authorized person reviews it.
• A person who recognizes themselves in published content may request removal at info@zeleninar.org, and we remove the content without delay.

8. What we publish publicly about people

Data about people is also publicly visible on the website. Every such publication rests on consent and can be withdrawn.

• Photographs from planting actions, workshops and other events are published alongside the action's gallery. Participants are visible in them. We photograph so as to avoid close-ups of faces, and anyone who recognizes themselves may request removal.
• The names and logos of donors and partners are published on the donations page, only if the donor has expressly consented to it. A donation without publication of the name is always possible and does not differ in any way.
• Participants' impressions, with a name and photograph, are published only with the consent of the person who gave them.
• Reports in the public feed are published with the reporter's consent, immediately upon submission. Comments are published only after an authorized person reviews them. We remove published content without delay at the request of the reporter or of a person who recognizes themselves in it.

We publish photographs of children only with a separate, written and voluntary parental consent, distinct from the consent to participate. Refusal of that consent does not in any way affect the child's right to take part in the activity. Consent may be withdrawn at any time, and we then remove the photograph from the website and from our social media accounts.

9. What we do not record about a visitor

The website does not use visitor tracking tools. We have no analytics, no advertising networks, we do not build a visitor profile and we do not track you on other websites.

• Queries you enter in the website search are recorded without a single piece of data about you: without the address you come from, without session data and without an account. We record only the query text and the number of results, so that we can see what people are missing on the website.
• For comments and endorsing a report, we keep only an irreversibly hashed record derived from the address, and solely so that the same comment is not submitted more than once. Your address cannot be reconstructed from that record and it is not used for anything else.
• The hosting provider keeps technical logs of access to the server, which are usual for the operation of any website and serve security and troubleshooting.
• In the administrative part we record who performed an action on the data and when (for example, who approved a report). That record concerns our administrators and editors, not visitors, and serves to make it known who accessed the data.

10. Cookies

The website sets only the cookies necessary for its operation: a session cookie, a cookie that protects forms from abuse, and a "zn_jezik" cookie that remembers which site language you chose (Serbian or English) and lasts one year. They are deleted when you close the browser or upon expiry, and no consent is required for them because without them the website would not work the way you asked it to.

We have no cookies for tracking, advertising or measuring traffic. If you disable all cookies in your browser, you will be able to read the website, but form submission may stop working.

11. To whom we forward data

We do not sell data and do not disclose it for marketing purposes. Access is available only to authorized persons in the Association, to the extent they need for their work. Data may be found with the following recipients:

• The hosting provider, which holds the server and its backups, as our processor.
• The email service provider, through which answers to inquiries and the notifications you opted into are sent.
• Competent state authorities, when we are required by law to submit data or when it is necessary for the establishment, exercise or defense of a legal claim. When forwarding a pollution report we submit the description, location and evidence, and the reporter's data only if you consented to it.

With processors we have a regulated relationship by which they undertake to process data only on our instructions and to protect it.

12. Transfer of data out of Serbia

The server on which the website is located is hosted in the Kingdom of the Netherlands, a member state of the European Union and a contracting party to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data.

For a transfer of data to such a state, an adequate level of protection is deemed to be ensured, so a special authorization of the Commissioner is not required, in accordance with the Personal Data Protection Act (Zakon o zaštiti podataka o ličnosti). Your data is not transferred to other states.

13. Data we obtain from third parties

The Green Monitor displays data on air, pollen, fires, water levels and weather, which we obtain from public sources and institutions. These are data about phenomena in the area, not about people, and obtaining them does not process your personal data.

On the Contact page a map loaded by Google is displayed. The map does not load on its own, but only when you open it. By opening it you establish a connection with Google, which may then set its cookies and process data under its own rules, which the Association does not influence. The same applies when you open a link to the map or to the Association's social media account. On your first visit, if you have not yet chosen a language, the website determines the country you are visiting from in order to offer the English edition to visitors outside Serbia, Croatia, Bosnia and Herzegovina, and Montenegro: for that purpose your IP address is sent once to a geolocation service (ipwho.is, with ip-api.com as a fallback), which returns only a country code. The Association does not store your IP address; the country code is kept in the website cache for at most seven days, and your language choice in the "zn_jezik" cookie. Search engines and other automated visitors are not checked.

14. How long we keep data

We delete data when the purpose for which it was collected ceases. The retention periods are:

• Messages from the contact form: at most two years from the last communication.
• Members' data: while the membership lasts and two years after it ends, except for data we are required by the regulations to keep longer.
• Donors' data: one year from sending the gift. The accounting documentation on the payment is kept for the period prescribed by law.
• Rejected and unaccepted membership applications: one year from the decision.
• Pollution reports: five years, and the photographs accompanying a report two years from the conclusion of handling, except when they are part of a case before a competent authority.
• The license plate from a report: deleted 30 days after the report is concluded or forwarded to the competent authority. Deliberately short: a plate tied to an allegation of a punishable act must not turn into our permanent record, and by then it is already with the authority that is competent for the case.
• Comments: while the public report is published. Unapproved comments are deleted after 90 days.
• Notification subscriptions: until you unsubscribe. An unconfirmed subscription is deleted after 30 days.
• Backups: 30 days, after which they are overwritten.

Deletion under these periods is carried out automatically, and not at our discretion. Data that is the subject of proceedings before a court or another authority is kept until the final conclusion of those proceedings.

15. Your rights

In relation to your data you have the following rights:

• Access: to learn whether we process your data, which data and why, and to obtain a copy of it.
• Rectification and completion: to have inaccurate data corrected and incomplete data completed.
• Erasure: to have data deleted when it is no longer needed, when you withdraw consent or when it was processed unlawfully.
• Restriction of processing: to have processing temporarily halted, for example while we check the accuracy of the data.
• Objection: to object to processing based on legitimate interest.
• Portability: to receive the data you gave us in a machine-readable form or to have it transferred to another controller.
• Withdrawal of consent: at any time, without explanation and without consequences.

You can send a request <a href="https://zeleninar.org/en/zahtev-za-podatke">using the form on the website</a>, which was made for that purpose, or by a message to info@zeleninar.org. We respond without delay, and no later than within 30 days of receiving the request, whereby that period may be extended by a further 60 days where the request is complex, of which we notify you. Acting on a request is free of charge. Unsubscribing from notifications is also possible with a single click, via the link in every message we send you. If we have a reasonable doubt about the identity of the applicant, we may request additional data for verification, and only as much as is necessary for the verification.

We draw your attention in particular to the RIGHT TO OBJECT: at any time you may object to processing based on our legitimate interest, including the processing of photographs and license plates from reports. Upon receiving an objection we stop the processing, unless we demonstrate that there is a statutory basis that overrides your interests, rights and freedoms, or that the processing is necessary for the submission, exercise or defense of a legal claim.

16. Complaint to the Commissioner

If you consider that we process your data contrary to the law, you have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11120 Belgrade, or via the website poverenik.rs.

You may lodge a complaint regardless of whether you have previously contacted us, and may also initiate judicial protection.

17. Data security

We implement technical and organizational measures appropriate to the risk:

• all traffic with the website goes over a secure connection
• access to the administrative part is held only by a designated person, with a separate account and two-factor identity verification
• report photographs are kept outside the publicly accessible part of the server
• the forms are protected against automated submission
• actions in the administrative part are logged, so it is known who accessed the data and when
• backups are made daily and kept separately

No transmission of data over the internet is absolutely secure. We therefore ask that you not send us through the forms data that is particularly sensitive to you, nor documents that contain other people's personal data.

18. Handling a data breach

If a personal data breach occurs, we notify the Commissioner of it without delay, and no later than within 72 hours of becoming aware of it, except where the breach is unlikely to have caused a risk to the rights of individuals.

Where a breach may cause a high risk to your rights, we will also notify you directly, describing the nature of the breach, the possible consequences and the measures we have taken.

19. Children

The membership application and the application for a donor gift are intended for persons of legal age. The other forms may be used by a person over 15 years of age, who under the law independently gives consent to processing in connection with information society services.

For a child under 15 years of age, consent is given by a parent or other legal guardian. For children's participation in workshops and actions we use the written consent of the legal guardian, which is given on the spot and not through the website. Consent for photographing a child is separate, voluntary and may be withdrawn, and refusal does not affect the child's right to participate. If we learn that we received a child's data without the necessary consent, we delete it without delay.

20. Changes to this policy

We may supplement the policy when the way the website works, or a regulation, changes. The current version is always published on this page, and the date of the last change is stated at the bottom.

If a change materially alters the way we process data or the scope of processing, we will notify members and subscribers by email before the change starts to apply. If the Association ceases to exist, the data is deleted, except for documentation we are required by the regulations to hand over for safekeeping; the data is not transferred to another person as an asset.

21. Contact for data protection

For any question, request or complaint regarding data:

• Citizens' Association Zeleni Nar, Trgovačka 1, Boleč, Belgrade
• Email: info@zeleninar.org
• Phone: +381 60 091 90 29
• Registration number 28397852, tax ID (PIB) 114983860