Based on the Law on the Protection of Personal Data (“Official Gazette of RS” No. 87/2018), ARTOP PRO EVENT PR Miloš Đorđević, with headquarters at Branka Radičevića 14, local 8, Knjaževac (hereinafter: ARTOP PRO EVENT), on 5 December 2023 brings:

REGULATION ON THE PROTECTION OF PERSONAL DATA

Article 1.
This regulates the protection of natural persons in connection with the processing of personal data, the purpose of processing personal data, the application of the Rulebook, the meaning of the terms used, the principles of processing, the legality of processing, consent to processing, the conditions for giving consent to the persons to whom the data refer, obligations controller, processor’s obligations, cooperation with state authorities, internal procedure for exercising rights protection, data transfer, transfer and disclosure of personal data based on the decision of state authorities, legal means for exercising rights and amendments to the Rulebook.
Article 2.
A person who enters into a legal relationship with the Ruler is obliged to familiarize himself with the Rulebook, with its possible amendments and additions. The Rulebook and its Amendments will be available to all persons entering into a legal relationship with the bearer.
Article 3.
This Rulebook ensures the protection of the basic rights and freedoms of natural persons, especially their right to the protection of personal data. All legal actions and legal relations arising in connection with the bearer of this Rulebook must be in accordance with the provisions of this Rulebook.
Article 4.
The Rulebook applies to the processing of personal data that is performed, in whole or in part, in an automated manner, as well as to the non-automated processing of personal data that is part of a data collection or is intended for a data collection.
Article 5.
This Rulebook applies to the processing of personal data of the person to whom the data refer, which is clearly and unambiguously identified by means of a personal name or identification number or in another way that enables the unquestionable identification of the person to whom the data refers. The person to whom the data refers is obliged to conscientiously, lawfully and responsibly use every means to identify and bear material, criminal and other legal responsibility if he misuses to identify a third party or presents himself as a third party in order to exercise the rights derived from the Rulebook. Exercising the rights derived from the Rulebook is possible only if the person to whom the data relates is identified in the manner prescribed in paragraph 1 of this article, otherwise ARTOP PRO EVENT is not obliged to retain, obtain or process additional information for the purpose of identifying that person. If, in the case referred to in paragraph 1 of this article, ARTOP PRO EVENT presents that it cannot identify the person to whom the data refer, it will be informed accordingly, if possible.
Article 6.
The method of personal data processing by ARTOP PRO EVENT will be determined in advance and communicated to the person to whom the personal data refers, according to the principle of transparency. This Rulebook applies to the processing and handling of personal data carried out by ARTOP PRO EVENT as part of business activities on the territory of the Republic of Serbia, regardless of whether the processing is carried out on the territory of the Republic of Serbia.
Article 7.
Personal data in ARTOP PRO EVENT must:
be processed lawfully, fairly and transparently in relation to the person to whom the data refer (“lawfulness, fairness and transparency”). Lawful processing is processing that is carried out in accordance with the Law on the Protection of Personal Data (“Official Gazette of RS” No. 87/2018) and other laws regulating processing.
are collected for purposes that are specifically determined, explicit, justified and lawful and still cannot be processed in a way that is inconsistent with those purposes (“limitation in relation to the purpose of processing”);
be appropriate, essential and limited to what is necessary in relation to the purpose of processing (“data minimization”);
be accurate and, if necessary, updated. Taking into account the purpose of the processing, all reasonable measures must be taken to ensure that inaccurate personal data is deleted or corrected without delay (“accuracy”);
be stored in a form that enables the identification of the person only for the period necessary to achieve the purpose of the processing (“storage limitation”);
be processed in a way that ensures adequate protection of personal data, including protection against unauthorized or illegal processing, as well as against accidental loss, destruction or damage by applying appropriate technical, organizational and personnel measures (“integrity and confidentiality”). ARTOP PRO EVENT is responsible for the implementation of the provisions of paragraph 1 of this article and must be able to demonstrate their implementation (“responsibility for action”).

Article 8.
ARTOP PRO EVENT will process data in accordance with the provisions of this Rulebook, the Personal Data Protection Act and other related regulations. The processing of personal data is carried out in a lawful manner if it is necessary for the execution of:
the contract concluded with the person to whom the data refer;
for undertaking actions, at the request of the person to whom the data refer, before concluding the contract;
in order to comply with the legal obligations of ARTOP PRO EVENT;
in order to protect vital interests of the person to whom the data refer or a long natural person;
in order to perform tasks in the public interest;
in order to exercise the legally prescribed powers of ARTOP PRO EVENT;
in order to achieve the legitimate interests of ARTOP PRO EVENT or a third party, unless those interests are overriding interests or fundamental rights and freedoms of the person to whom the data refer, which require the protection of personal data, especially if the person to whom the data refer is a minor ;
Article 9.
Consent to data processing can be given in written form or in the form of an electronic record, in such a way that the user can be unequivocally identified, i.e. the person whose data is being processed. Consent can also be given within the framework of a written statement that also refers to other issues. The request for consent must be presented in a way that distinguishes it from those other matters in an understandable and easily accessible form, and using clear and simple words.
Article 10.
The data subject has the right to withdraw consent at any time. Revocation of consent does not affect the admissibility of processing that was carried out on the basis of consent before the revocation.
Article 11.
A person who is less than 18 years old and whose personal data should be processed for the purpose of entering into a legal relationship with ARTOP PRO EVENT is obliged to present the consent of parents or legal representatives, and ARTOP PRO EVENT has the right to reject the proposal of that person for processing data on of a person under the age of 18 if he is unable to prove that he has the necessary consent.

Article 12.
When ARTOP PRO EVENT (author of this Rulebook) processes personal data in the capacity of handler or processor, the person to whom the data refers has the right to information about the method of processing personal data and the method of accessing personal data, the right to correction and addition, the right to erasure of personal data, right to restriction of processing, right to be informed regarding correction or deletion of data and restriction of processing, right based on data transfer, right to object, right to object to automated individual decision-making and profiling and limitation of rights.
When ARTOP PRO EVENT processes personal data in the capacity of handler or processor, it is obliged to provide assistance to the person to whom the data refers in exercising the right to access personal data, the right to correction and addition, the right to delete personal data, the right to be informed about the correction or deletion of data and the restriction of processing, the right to transfer data, the right to object and the right to object to automated individual decision-making and profiling.
If ARTOP PRO EVENT processes personal data in the capacity of handler or processor, and it is not able, in accordance with the provisions of Article 4 of this Rulebook, to identify the person to whom the data refer or it is no longer necessary to identify the person to whom the data refer in accordance with the provisions of Article 20. paragraph 1 of the Law on Protection of Personal Data, the adopter of this Rulebook is not obliged to retain, obtain or process additional information for the purpose of identifying that person only for the purpose of applying this Rulebook and the Law on Protection of Personal Data, while he is obliged to o informs that person accordingly, if possible. In that case, the provisions of Article 26, para. 1 to 4, Article 29, Article 30, para. 1. to 5, Article 31, paragraph 1. to 3, Article 33, paragraph 1. and 2. and Article 36, para. 1 to 4 of the Personal Data Protection Act, unless the person to whom the data relates, in order to exercise the rights from those articles, submits additional information that enables his identification.

When ARTOP PRO EVENT processes personal data in the capacity of handler or processor, it is obliged to inform the person to whom the data refers about the action based on the request for exercising the right to access personal data, the right to correction and addition, the right to delete personal data , the right to be informed in connection with the correction or deletion of data and restriction of processing, the right to transfer data, the right to object and the right to object to automated individual decision-making and profiling without delay, and at the latest within 30 days from the date of receipt of the request. That deadline can be extended by another 60 days if necessary, taking into account the complexity and number of requests. About the extension of the deadline and the reasons for that extension, the operator is obliged to inform the person to whom the data refer within 30 days from the day of receipt of the request. If the data subject has made a request electronically, the information will be provided electronically if possible, unless the data subject has requested that the information be provided by other means. If ARTOP PRO EVENT processes data in the capacity of handler and does not act on the request of the person to whom the data refer, it is obliged to inform that person of the reasons for not acting without delay, and no later than within 30 days from the date of receipt of the request. The right to exercise the right to protect personal data from this Rulebook is exercised without charging a fee, unless the request of the person to whom the data refers is clearly unfounded or excessive, and especially if the same request is repeated frequently, in which case the necessary administrative costs of providing information may be charged, that is, acting upon the request or rejecting the request for action. If the controller justifiably doubts the identity of the person who has submitted a request to exercise the rights prescribed in paragraph 1 of this article, he may request the submission of additional information necessary to confirm the identity of the person. ARTOP PRO EVENT guarantees the realization of the rights from this Rulebook to persons depending on the capacity in which it processes data in accordance with the Law and Rulebook.
Article 13.
If personal data is collected from the person to whom it relates, ARTOP PRO EVENT is obliged to provide the following information to that person at the time of personal data collection:
the identity and contact information of the handler, as well as his representative, if he is designated;
contact details of the person for the protection of personal data, if it is specified;
on the purpose of the intended processing and the legal basis for the processing;
on the existence of a legitimate interest of the operator or a third party, if the processing is carried out on the basis of processing that is necessary in order to achieve the legitimate interests of the operator or a third party, unless these interests are outweighed by the interests or fundamental rights and freedoms of the person to whom the data refer, which require the protection of personal data, especially if the person to whom the data refers is a minor;
about the recipient, that is, the group of recipients of personal data, if they exist;
on the period of storage of personal data or, if this is not possible, on the criteria for its determination;
on the existence of the right to request from the operator access, correction or deletion of his personal data, that is, the existence of the right to limit processing, the right to object, as well as the right to data portability;
on the existence of the right to revoke consent at any time, as well as the fact that the revocation of consent does not affect the admissibility of processing on the basis of consent before the revocation, if the processing is carried out on the basis of the consent of the person to whom the personal data refer for one or more specially determined purposes or processing of special types of personal data of the person to whom the data relates, who has given express consent to processing for one or more purposes;
on the right to submit a complaint to the Commissioner;
about whether the provision of personal data is a legal or contractual obligation or whether the provision of data is a necessary condition for concluding a contract, as well as whether the person to whom the data refers has an obligation to provide personal data and about the possible consequences if the data is not provided ;
about the existence of automated decision-making, including profiling and purposeful information about the logic used, as well as about the significance and expected consequences of that processing for the person to whom the data refer.
If the person to whom the data refers is already familiar with some of the information from this article, the operator is not obliged to provide that information.

Article 14.
If personal data is not collected from the person to whom it relates, ARTOP PRO EVENT is obliged to provide the person to whom the data relates with information about the rights prescribed by the provisions of this Rulebook within a reasonable time after the collection of personal data, and within 30 days at the latest , taking into account all the special circumstances of the processing or at the latest when establishing the first communication, if the personal data is used for communication with the person to whom it relates, i.e. at the latest at the first disclosure of the personal data, if the disclosure of the personal data to another recipient is foreseen.
If ARTOP PRO EVENT intends to further process personal data for another purpose that is different from the one for which the data was collected, the operator is obliged to provide information about that other purpose to the person to whom the data refer before starting further processing, as well as all other important information from this article.
ARTOP PRO EVENT is not obliged to provide the person to whom the data refer information from paragraph 1 and 2 of this article if:
the person to whom the personal data refers already has that information;
the provision of such information is impossible or would require a disproportionate expenditure of time and resources, especially in the case of processing for the purposes of archiving in the public interest, for the purposes of scientific or historical research, as well as for statistical purposes, if the conditions and measures from Article 92, paragraph 1 are applied of the Personal Data Protection Act or if it is likely that the fulfillment of the obligations referred to in paragraph 1 of this article would make it impossible or significantly difficult to achieve the purpose of the processing. In those cases, the operator is obliged to take appropriate measures to protect the rights and freedoms, as well as the legitimate interests of the persons to whom the data refer, which includes the public publication of information;
is the collection or disclosure of personal data expressly prescribed by law, which provides appropriate measures to protect the legitimate interests of the person to whom the data refer;
the confidentiality of personal data must be preserved in accordance with the obligation to preserve professional secrecy prescribed by law.

Article 15.
The person to whom the data refers has the right to receive from ARTOP PRO EVENT, by submitting a request, information on whether it processes his personal data, access to that data and the following information:
processing purposes;
on the types of personal data processed;
about the recipient or types of recipients to whom the personal data has been disclosed or will be disclosed to them, especially recipients in other countries or international organizations;
on the expected period of storage of personal data, or if this is not possible, on the criteria for determining that period;
on the existence of the right to request from the controller the correction or deletion of his personal data, the right to limit processing and the right to object to processing;
on the right to submit a complaint to the Commissioner;
available information about the source of the personal data, if the personal data was not collected from the person to whom it relates;
about the existence of an automated decision-making procedure, including profiling, and information about the logic used in it, as well as about the importance and expected consequences of that processing for the person to whom the data refer.

The request to exercise the right is submitted by submitting the request in the following way: To the address ARTOP PRO EVENT: [Branka Radičevića 14, local 8, KNJAŽEVAC], or to the email address: [office@artop.rs], with the subject: “Protection of personal data ” in the form and with the evidence prescribed by this Rulebook and the Personal Data Protection Act.
Article 16.
The data subject has the right to have inaccurate personal data corrected without undue delay. Depending on the purpose of the processing, the person to whom the data refers has the right to supplement his incomplete personal data, which includes providing an additional statement. The person to whom the data refers exercises the right guaranteed by paragraph 1 of this article in the manner prescribed by this Rulebook.

Article 17.
The person to whom the data refers has the right to have his personal data deleted by ARTOP PRO EVENT.
ARTOP PRO EVENT is obliged to delete the data from paragraph 1 of this article without undue delay in the following cases:
1) personal data are no longer necessary to achieve the purpose for which they were collected or otherwise processed;
2) the person to whom the personal data refers has revoked his consent to the processing of his personal data for one or more specially determined purposes;
3) the person to whom the data refer has submitted an objection to the processing in accordance with:
a) the right to submit an objection to the automated making of individual decisions, and there is no other legal basis for processing that prevails over the legitimate interest, right or freedom of the person to whom the data refer;
b) the right of the data subject to object at any time to the processing of his/her personal data that is processed for the purposes of direct advertising, including profiling, to the extent that it is related to direct advertising;
4) personal data were illegally processed;
5) personal data must be deleted in order to fulfill the legal obligations of the operator;
6) personal data were collected in connection with the use of information society services, i.e. in connection with the consent of a minor in connection with the use of information society services.
If ARTOP PRO EVENT of this Rulebook makes personal data publicly available, its obligation to delete data in accordance with paragraph 1 of this article includes taking all reasonable measures, including technical measures, in accordance with available technologies and the possibility of bearing the costs of their use, in order to informing other handlers who process that data that the person to whom the data refers has submitted a request for the deletion of all copies of this data and references, i.e. electronic links to this data.
The person to whom the data refers submits a request for the exercise of the rights referred to in paragraph 1 of this article to the controller in the manner prescribed by this Rulebook.
Paragraphs 1 to 3 of this article do not apply to the extent that processing is necessary due to:
1) exercising freedom of expression and information;
2) compliance with the operator’s legal obligation, which requires the processing or execution of tasks in the public interest or the execution of the operator’s official powers;
3) purposes of archiving in the public interest, purposes of scientific or historical research, as well as statistical purposes in accordance with Article 92, paragraph 1 of this Law on the Protection of Personal Data, and it is reasonably expected that the exercise of the rights from paragraph 1. and 2. of this article could make it impossible or significantly threaten the achievement of the goals of that purpose;
5) submitting, exercising or defending a legal claim.

Article 18.
The data subject has the right to have the processing of his personal data restricted by ARTOP PRO EVENT if one of the following cases is met:
1) the person to whom the data refers contests the accuracy of the personal data, within the time limit that allows the operator to check the accuracy of the personal data;
2) the processing is illegal, and the person to whom the data refers opposes the deletion of personal data and instead of deletion requests restriction of the use of the data;
3) ARTO PRO EVENT no longer needs personal data to achieve the purpose of the processing, but the person to whom the data refers has requested it in order to submit, implement or defend a legal claim;
4) the person to whom the data refers has submitted an objection to the automated making of individual decisions, and an assessment is underway as to whether the legal basis for processing by the controller outweighs the interests of that person.
If the processing is limited in accordance with paragraph 1 of this article, these data can be further processed only on the basis of the consent of the person to whom the data refer, unless it is about their storage or for the purpose of submitting, realizing or defending a legal claim or for protection the rights of other natural or legal persons or due to the realization of significant public interests.
If the processing is limited in accordance with paragraph 1 of this article, ARTO PRO EVENT is obliged to inform the person to whom the data refers about the termination of the limitation, before the limitation ceases to be valid.
Article 19.
ARTOP PRO EVENT is obliged to inform all recipients to whom personal data has been disclosed about any correction or deletion of personal data or restriction of their processing, unless this is impossible or requires an excessive expenditure of time and resources.
ARTOP PRO EVENT is obliged to inform the person to whom the data refer, upon his request, about all recipients from paragraph 1 of this article.
Article 20.
The person to whom the data refers has the right to receive his personal data previously provided by ARTOP PRO EVENT in a structured, commonly used and electronically readable form and has the right to transfer this data to another operator without interference from the operator to whom the data is provided. were delivered, if the following conditions are met together:
1) the processing is based on the person’s consent to the processing of their personal data for one or more specially determined purposes, or a special type of personal data is processed and the person to whom the data refers has given express consent to the processing for one or more processing purposes, unless it is prescribed by law that the processing is not carried out on the basis of consent or on the basis of a contract, and the processing is necessary for the execution of the contract concluded with the person to whom the data refer or for taking actions, at the request of the person to whom the data refer, before the conclusion of the contract ;
2) processing is done automatically.
The right from paragraph 1 of this article also includes the right of a person to have his personal data immediately transferred to another controller by ARTOP PRO EVENT to whom this data was previously delivered, if this is technically feasible.
Exercising the right from paragraph 1 of this article does not affect the exercise of the right to delete data.
The right from paragraph 1 of this article cannot be exercised if the processing is necessary for the performance of tasks of public interest or for the exercise of official powers of the controller.
The exercise of the rights referred to in paragraph 1 of this article cannot adversely affect the exercise of the rights and freedoms of other persons.
Article 21.
If he considers that it is justified in relation to the special situation in which he is, the person to whom the data refers has the right to submit to ARTOP PRO EVENT at any time an objection to the processing of his personal data, which is carried out for the purpose of performing tasks in in the public interest or the exercise of the controller’s statutory powers or in order to achieve the legitimate interests of the controller or a third party, unless these interests are overridden by the interests or basic rights and freedoms of the person to whom the data refer that require the protection of personal data, and especially if the person to which data refer to a minor, including profiling based on those provisions. ARTOP PRO EVENT is obliged to stop processing data about the person who submitted the complaint, unless it has presented that there are legal reasons for processing that prevail over the interests, rights or freedoms of the person to whom the data refer or are related to the submission, realization or by defending a legal claim.
The data subject has the right to object at any time to the processing of his personal data that is processed for the purposes of direct advertising, including profiling, to the extent that it is related to direct advertising.
If the data subject objects to the processing for the purposes of direct advertising, the personal data can no longer be processed for such purposes.
ARTOP PRO EVENT is obliged to warn that person about the existence of the right from para. 1. and 2. of this article and to inform him of those rights explicitly and clearly

separate from any other information it provides.
The objection is submitted to the operator in the manner provided for in this Rulebook.

Article 22.
If the violation of personal data can cause a high risk to the rights and freedoms of natural persons, the operator will notify the person to whom the data refer to the violation without undue delay.
In the notification from paragraph 1 of this article, ARTOP PRO EVENT will describe the nature of the data breach in a clear and comprehensible manner and provide the following information:
1) the way in which data on the injury can be obtained;
2) description of the possible consequences of the injury;
3) a description of the measures that ARTOP PRO EVENT has taken or the taking of which is proposed in connection with the violation, including the measures taken in order to reduce the harmful consequences.
For the purposes of exercising the rights prescribed by this article, the way in which data can be obtained in violation is prescribed in accordance with the provision of this Rulebook, which prescribes the internal procedure for exercising the protection of the rights prescribed by this Rulebook.

Article 23.
The following rights and obligations related to personal data:

• transparent information, information and ways of exercising the rights of persons to whom the data refer;
• information provided when personal data is collected from the person to whom it relates;
• information provided when personal data is not collected from the person to whom it relates;
• the right of the person to whom the personal data relates to access;
• the right to correction and addition;
• the right to delete personal data;
• the right to limit processing;
• the obligation to notify in connection with the correction or deletion of data, as well as the restriction of processing;
• the right to data portability;
• the right to object;
• automated individual decision-making and profiling;
• informing the person about the violation of personal data;
• processing principles,

if they relate to the exercise of rights and obligations in connection with:

• transparent information, informing and the way of exercising the rights of the persons to whom the data refer;
• information provided when personal data is collected from the person to whom it relates;
• information provided when personal data is not collected from the person to whom it relates;
• the right of the person to whom the personal data relates to access;
• the right to correction and addition;
• the right to delete personal data;
• the right to limit processing;
• notification obligations regarding correction or deletion of data, as well as limitation of processing;
• the right to data portability;
• the right to object;
• automated individual decision-making and profiling,
  can be limited if these restrictions do not interfere with the essence of fundamental rights and freedoms and if this represents a necessary and proportionate measure in a democratic society to protect:
  1) national security;
  2) defense;
  3) public security;
  4) prevention, investigation and detection of criminal acts, prosecution of perpetrators of criminal acts, or enforcement of criminal sanctions, including prevention and protection against threats to public safety;
  5) other important general public interests, and especially important state or financial interests of the Republic of Serbia, including monetary policy, budget, tax system, public health and social protection;
  6) independence of the judiciary and court proceedings;
  7) prevention, investigation, detection and prosecution for violation of professional ethics;
  8) functions of monitoring, supervision or performing a regulatory function that is permanently or occasionally connected to the exercise of official powers in the cases referred to in point 1) to 5) and point 7) of this paragraph;
  9) the persons to whom the data refer or the rights and freedoms of other persons;
  10) realization of claims in civil matters.
  When applying the limitations of rights and obligations from paragraph 1 of this article, the following must be taken into account, as necessary:
  1) purposes of processing or types of processing;
  2) types of personal data;
  3) scope of restrictions;
  4) protection measures aimed at preventing misuse, unauthorized access or transfer of personal data;
  5) particularities of the operator, that is, the type of operator;
  6) storage period and personal data protection measures that can be applied, considering the nature, scope and purpose of processing or types of processing;
  7) risks to the rights and freedoms of persons to whom the data refer;
  8) the right of the person to whom the data refer to be informed about the organization, unless that information makes it impossible to achieve the purpose of the restriction.
  ARTOP PRO EVENT is not obliged to notify the person referred to in Article 23 of the Rules if:
  1) has taken appropriate technical, organizational and personnel protection measures in relation to data about a person whose security has been violated, especially if he has prevented the intelligibility of the data to all persons who are not authorized to access this data by means of crypto-protection or other measures;
  2) subsequently took measures to ensure that the violation of personal data with a high risk for the rights and freedoms of the person to whom the data relates can no longer produce consequences for that person;
  3) informing the person to whom the data refer would represent a disproportionate expenditure of time and resources. In that case, the operator is obliged to ensure the provision of information to the person to whom the data refer through public notification or in another effective way.

Article 24.
In the event that ARTOP PRO EVENT, in the role of operator, is an enterprise, appropriate technical, organizational and personnel measures are taken to ensure that the processing is carried out in accordance with the Personal Data Protection Act and this Rulebook, by making this Rulebook available to the user, taking into account the nature, scope, circumstances and purpose of processing, as well as the probability of occurrence of risk and the level of risk for the rights and freedoms of natural persons.
Article 25.
When ARTOP PRO EVENT acts in the role of operator, it will ensure that personal data cannot be made available to an unlimited number of natural persons without the participation of a natural person.
For the purposes of exercising the user’s rights, ARTOP PRO EVENT, when acting in the role of operator, will make available a special means of communication for the protection of the user’s rights.
Any user who submits a request for the exercise of rights in accordance with this Rulebook and the Law on Protection of Personal Data can submit the same by sending a letter to the email address office@artop.rs or by mail to ARTOP PRO EVENT, Branka Radičevića 14, local 8, Knjaževac with the indication ” PERSONAL DATA PROTECTION”.
Article 26.
When the processing is carried out on behalf of the operator, the operator will designate as the processor only that person or authority that fully guarantees the application of the rules prescribed by this Rulebook, in a way that ensures that the processing is carried out in accordance with the provisions of the Personal Data Protection Act and that ensures the protection of the rights of the persons to whom the data refer as prescribed here.
If the Commissioner drafts standard contractual clauses related to the obligations of the operator from paragraph 1 of this article, especially taking into account the European practice in the drafting of standard contractual clauses, ARTOP PRO EVENT will apply them in relation to the processor and may make amendments and additions to this Rulebook accordingly. .
ARTOP PRO EVENT will ensure that the processor, i.e. another person authorized by the processor or the processor to access personal data, cannot process such data without the processor’s order, unless such processing is prescribed by law.
Article 27
In order to exercise the rights prescribed by this Rulebook and the Personal Data Protection Act, the handler, the processor and their representatives, if they are designated – ARTOP PRO EVENT, will cooperate with the Commissioner in the exercise of his powers, and for the protection of users.
ARTOP PRO EVENT acts in the role of handler or processor and when the provisions of this Rulebook and the Law on Protection of Personal Data are applied to it, and in order to exercise the rights of persons whose rights are protected by this Rulebook and the Law on Protection of Personal Data, all requests are fulfilled by initiating procedure before the adopter of this Rulebook in the following manner:
To the address of ARTOP PRO EVENT, Branka Radičevića 14, Knjaževac, or to the email address: office@artop.rs, with the title: “Protection of personal data” in the form and with the evidence prescribed by this Rulebook and the Law on Protection of Personal Data.
Article 28
When ARTOP PRO EVENT acts as a handler or processor and when it transfers personal data for further processing to another country or international organization, it will notify the user separately.
The notification of the user will contain information on the obligations of the handler and processor, as well as on the rights of the user when personal data is transferred for further processing to another country or international organization, all in accordance with the provisions of Chapter V of the Law on the Protection of Personal Data, which prescribes the rules on data transfer about individuals to other countries and international organizations.

Article 29.
ARTOP PRO EVENT will ensure appropriate protection measures, the application of the rules prescribed by this Rulebook and the Law on the Protection of Personal Data and the exercise of user rights when, in the role of handler or processor, it transfers personal data to another country, to part of its territory or to one or more sectors of certain activities in that country or to an international organization for which the list of countries, parts of their territories or one or more sectors of certain activities in those countries and international organizations in which it is considered that an adequate level of protection is provided. When the Government determines that an appropriate level of protection is not provided in another country or international organization, the adopter of this Ordinance will in that case ensure compliance with the rules prescribed by this Ordinance and the Personal Data Protection Act through contractual clauses.
Article 30.
ARTOP PRO EVENT transfers personal data to state authorities in order to exercise the rights of the user for which the personal data was collected, the processing of personal data by the competent authorities for special purposes will be legal only if such processing is necessary for the performance of the duties of the competent authorities and if prescribed by law. Such a law determines at least the goals of the processing, the personal data that is processed and the purposes of the processing, in accordance with Article 13 and Article 100 of the Law on the Protection of Personal Data.
The provisions of the law governing the unique identity number of citizens, i.e. another law, are applied to the processing of the unique identity number of citizens, with the application of the provisions of this Rulebook and the Law on the Protection of Personal Data, which relate to the protection of the rights and freedoms of the persons to whom the data relate.
The provisions of the law regulating work and employment and collective agreements are applied to processing in the field of work and employment, with the application of the provisions of the Personal Data Protection Act and this Rulebook.

Article 31.
The person to whom the data refers has the right to file a complaint with the Commissioner if he believes that the processing of his personal data has been carried out contrary to the provisions of the Personal Data Protection Act.
In order to simplify the submission of a complaint, the Commissioner prescribes the form of the complaint and enables it to be submitted electronically, without excluding other means of communication.
The commissioner is obliged to inform the complainant about the course of the procedure he is conducting, the results of the procedure, as well as the right of the person to initiate court proceedings in order to protect the rights of the person.
Article 32.
The person to whom the data refers has the right to judicial protection if he believes that, contrary to the Personal Data Protection Act, ARTOP PRO EVENT’s processing of his personal data has violated his right prescribed by the Law.
A person who has suffered material or non-material damage due to a violation of the provisions of the Personal Data Protection Act has the right to monetary compensation for this damage from the handler, or the processor who caused the damage.

Article 33.
ARTOP PRO EVENT reserves the right to amend the Rulebook on the Protection of Personal Data in accordance with the opinion of the Commissioner and in accordance with the provisions of Article 100 of the Law on the Protection of Personal Data, which stipulates that the provisions of other laws relating to the processing of personal data shall be harmonized with the provisions of the Personal Data Protection Act.
Article 34.
The Rulebook becomes valid 8 days from the day of its publication on ARTOP PRO EVENT’s bulletin board, as well as in other analog and digital ARTOP PRO EVENT newsletters.

In Knjaževac, Miloš Đorđević PR
05.12.2023. years