Privacy Notice

This Privacy Notice (Notice) was issued on February 25, 2021.

With this Notice, we aim to provide you with information in an easily understandable and transparent manner regarding how SBT processes personal data of individuals to whom the data relates, which categories of personal data SBT processes, and what rights individuals to whom the data relates have. We process your personal data on behalf of the companies we collaborate with (Clients) to:

1. enable our Clients to enjoy all the benefits of using our software platform Benefiti.app (Platform), through which they, in their capacity as employers and data controllers, provide their employees (End Users) with personalized, flexible, and measurable benefits and incentives within their predefined budget (Benefits);
2. allow Clients to deliver selected Benefits to End Users.

All personal data mentioned in this Notice is processed and protected in full compliance with the Serbian Law on Personal Data Protection (ZZPL) and the General Data Protection Regulation (GDPR), and solely based on the written instructions of the Client as the data controller.

1. Personal data refers to any data relating to an identified or identifiable natural person, such as personal name, year of birth, photograph, or location. Data that is anonymized is not considered personal data.
2. Processing refers to any action or set of actions performed on personal data or sets of personal data (e.g., collection, storage, use, reproduction, disclosure, deletion, or destruction).

This is the latest version of the Notice (February 25, 2021).

SBT reserves the right to amend this Notice at any time. In the event that the Notice is amended or supplemented, we will enter the date of the latest version of the document. We will inform you promptly of any changes to the Notice. Please keep in mind that amendments and supplements to this Notice do not in any way affect the Privacy Notice prepared by the Client or any third party regarding the Platform or Benefits.

In this Notice, "SBT," "we," and "our" refer to Smart Benefit Technologies d.o.o. Belgrade, with its registered office at Takovska Street No. 12, Belgrade-Palilula, Republic of Serbia.

SBT acts solely as a processor in the processing of your personal data:

• When we process data of End Users on behalf of Clients as controllers, which Clients and End Users leave on the Platform;
• When we process personal data of End Users provided to us by Clients on behalf of Clients to enable the delivery of selected Benefits to End Users. We do this on behalf of Clients who have engaged us for this purpose in the form of purchasing Benefits from their business partners (Partners) and transferring rights to them to Clients, as Clients are unable to independently deliver selected Benefits to End Users. In this way, SBT enables its Clients to achieve the delivery of selected Benefits to End Users in the fastest and most efficient manner based on a concluded business cooperation agreement for the provision of selected Benefits.

Clients are controllers in the processing of your personal data since they determine the purpose and means by which your personal data is collected, used, and otherwise processed, while we provide services for using the Platform on their behalf, namely services enabling the delivery of selected Benefits to End Users.

Other Privacy Notices on the Platform

The Client, as the controller in the processing of your personal data, has created a separate privacy notice in accordance with its legal obligation under the ZZPL, which is available to you when logging into our Platform. SBT cannot be held liable to the data subjects in any way if the controller fails to inform the data subjects of any circumstances it was required to transparently present in its privacy notice.

Questions, complaints, requests to exercise your rights, and additional information regarding this Notice and the protection of personal data at SBT can be obtained via the following email address: gdpr@benefiti.rs.

Based on the cooperation agreement with Clients regarding the use of the Platform

1. Enabling the use of the Platform and training for using the Platform



When Clients use our Platform to enable their employees, as End Users, to select Benefits, view the status of selected Benefits, and manage them, while providing them with different rights on the Platform depending on their role within the Client's company (admin, HR, employee), we process personal data of the End Users on behalf of the Clients.

In addition, SBT processes personal data of the End Users on behalf of the Clients for the purpose of training the End Users who will use the Platform, depending on the extent of the rights assigned to them by the Clients.

The personal data we collect at that time includes, but is not limited to, the following categories of personal data:

• Identification data, such as: first and last name, date of birth, gender;
• Contact details, such as: business email address, personal email address, business and personal landline or mobile phone numbers;
• Employment data: exact title and position of the End User in the Client's company, date of employment with the Client, hierarchical level within the Client (e.g., Junior, Medior, Senior, etc.), scope of rights the End User has on the Platform relative to their position in the Client's company (e.g., Admin, HR, employee), name of the team the End User belongs to;
• Personal status data, such as marital status;
• Data about the active account of the End User on various electronic digital services, for example, when the End User selects Benefits provided by digital service providers;
• Data about the unique user code, which SBT generates for the End User in the event that the selected Benefit represents a voucher/coupon/code;
• Data about the consumption habits and interests of End Users, such as the selection of specific Benefits when using the Platform;
• Data about the cultural identity of End Users;
• Data about the social identity of End Users;
• Data about the physiological identity of End Users;
• Data about the mental identity of End Users;
• Other data about the use of the Platform, such as data obtained from insights into the activities on the End User's account (the number of tokens available to the End User, the current status of the available number of tokens, and changes in the number of tokens in relation to availability), as well as data about realized Benefits.

SBT, in this case, processes the specified personal data as a data processor to enable Clients to use the Platform to its full extent, based on the concluded contract with the Clients regarding business cooperation in the use of the Platform.

2. Technical Support



SBT, as a processor on behalf of the Client, also processes information about user sessions (such as loading errors and response times), as well as data related to communication with customer support via phone, email, and written correspondence regarding inquiries submitted by End Users (communication channel, type of inquiry, date, time, content). We process the mentioned data to provide Clients with customer support aimed at ensuring uninterrupted use of the Platform, based on the business cooperation agreement regarding the use of the Platform, which also includes providing technical support by SBT.

Based on the business cooperation agreement with Clients regarding the provision of selected Benefits to End Users.

3. Enabling the delivery of selected Benefits to End Users



In order to enable Clients to deliver selected Benefits to End Users on behalf of the Clients, we process the personal data of End Users provided to us by the Clients, which relates to, but is not limited to, the following categories of personal data:

• Personal identification data, such as: first name and last name, date of birth, gender;
• Contact details, such as: business email address, personal email address, business and personal landline or mobile phone numbers;
• Job-related data: exact title and position that the End User holds in the Client's company, start date of employment with the Client, hierarchical level within the Client (e.g., Junior, Medior, Senior, etc.), scope of rights that the End User has on the Platform in relation to their position in the Client's company (e.g., Admin, HR, employee), name of the team to which the End User belongs;
• Data about the active End User account on various electronic digital services, for example, when the End User selects Benefits provided by digital service providers;
• Data about a unique user code, which SBT generates for the End User in the event that the selected Benefit represents a voucher/coupon/code.

SBT, as the processor of personal data of End Users, particularly notes and emphasizes that it acts as a processor of personal data of End Users concerning their active user account on various electronic digital services only and exclusively when processing this data based on written instructions from the controller at the moment when the End User is an employee of the controller. SBT bears no responsibility for the processing of such data if the processing occurs based on instructions from the controller after the individual to whom the data relates has ceased to be employed by the Client company, since SBT cannot and is not obliged to independently verify the status of the individual to whom the data relates within the Client company.

The Client, as the controller in the processing of your personal data, determines the purpose and legal basis on which your personal data is processed. Data processing is most often carried out based on a signed employment contract, based on the legitimate interest of the controller, or when processing is necessary to protect the vital interests of the individual to whom the data relates or another individual.

If you have questions regarding the purpose or legal basis on which the Client, as the controller in processing your data, processes your personal data, or if you need additional information regarding this, please contact the Client, i.e., your employer as the controller in the processing of your personal data.

Our Platform collects certain personal data from all Platform users with your consent using technologies that the Platform employs (cookies/trackers) and stores them in files. If you would like to learn more about this, including exactly what personal data we collect at that time, please read our Platform Policy.

On the one hand, when we enable Clients to use our Platform and related activities, SBT retains your personal data during the period of use of the Platform by the Clients and thereafter for a certain period to allow Clients, in their capacity as controllers, to recover the user accounts of End Users. Once an End User’s profile is deactivated, regardless of the reason for deactivation by the End User, the Client will decide whether to delete or anonymize such personal data, unless there is a legal obligation to retain the data, and SBT will act in accordance with the received instruction.

On the other hand, when we process your personal data to enable Clients to deliver selected Benefits to End Users, SBT retains your personal data for a strictly limited time frame, which includes the period from the moment of purchasing Benefits from Partners to the moment of transferring rights to the Benefits to the Clients. After that, the Client will decide whether to delete or anonymize such personal data, unless there is a legal obligation to retain the data, and SBT will act in accordance with the received instruction.

The Client, as the controller in the processing of your personal data, and we also retain your personal data if their processing is necessary for the submission, realization, or defense of a legal claim. To the extent possible, your controller will limit the processing of data for such purposes after the contractual relationship with our company has ended.

For more information regarding how and for how long your personal data is retained, as well as for more information about your right to erasure and data portability, please contact the Client as your controller.

We will take reasonable steps to ensure that the personal data we process is reliable for its intended use, accurate, complete, and up-to-date. You are responsible for the accuracy of all personal data you provide to us. We will make reasonable efforts to maintain the accuracy and integrity of the personal data obtained and to update it as necessary.

Our company takes appropriate security measures to protect your personal data from unauthorized access and disclosure in accordance with this Notice, as well as in compliance with the Law on Personal Data Protection (ZZPL) and the General Data Protection Regulation (GDPR).

We implement appropriate physical, procedural, technical, organizational, and personnel measures to achieve an adequate level of protection for your personal data that we process. We apply the best industry standards in data protection. Protection covers loss, purpose misuse, unauthorized access and disclosure, alteration, and destruction of personal data. However, no security measure can guarantee that personal data will be 100% protected. Still, Benefits continuously improve all security measures at all times to protect your personal data with their controlled processes and high responsibility.

As a data subject, you can exercise certain rights with respect to the personal data processed about you by the Client as the controller. However, we specifically emphasize that it is important to understand and be clearly informed that SBT is merely a processor concerning the processing of your personal data and, as such, cannot respond to or fulfill any request for the exercise of your rights as a data subject, unless we have received such written instruction. Therefore, in the event that any such request for the exercise of your rights is directed to our address, we will forward it to the Client as the controller as soon as possible.

You have the following rights:

• Information: the right to be informed about how we process your personal data;
• Access: the right to request access to all your personal data that we process;
• Correction/Completion: the right to request the immediate correction of inaccurate or incomplete personal data about you;
• Deletion: the right to request the immediate deletion of your personal data;
• Restriction: the right to request a restriction on the processing of your personal data in certain situations;
• Objection: the right to object to specific processing of personal data;
• Portability: the right to request that we transfer this data to another company if the processing is based on consent or a contract and is carried out by automated means.

Please send all requests to exercise your rights to the appropriate address of the Client. Only if they deem it appropriate will the Clients, as the data controllers, provide us with written instructions on how to handle your request.

At any time, if you believe that your rights as the data subject are restricted or violated in any way, you can file a complaint with the Commissioner for Information of Public Importance and Personal Data Protection.

Your Smart Benefit Technologies