Privacy Policy

1. Data Controller

The organizing entity behind Wine Vision by Open Balkan serves as the Data Controller. For matters regarding your information, contact:

2. Information We Collect

Personal Identification Information

Full name, title, and date of birth (when necessary) collected during registration as exhibitor, buyer, or visitor.

Contact Details

Email address, telephone number, and postal address obtained through contact forms and registration.

Professional and Company Information

For exhibitors: company name, address, job title, business information, professional experience, and qualifications.

Financial and Billing Information

Billing name and address, VAT number, and payment details. Payment card information is collected directly by our secure payment gateway (Raiffeisen Bank) and not stored internally.

Uploaded Files and Content

Company logos, product photos, brochures, and competition submissions may contain personal data used for stated purposes.

Social Media and Web Presence

LinkedIn profiles, Facebook pages, and Instagram handles (optional) help understand participant profiles.

Automatically Collected Data

Device and browser information (IP address, device type, browser version, operating system). Usage details (pages viewed, visit duration, clickstream data) tracked via cookies. Approximate location derived from IP address, typically at country or city level.

Children's Data

If you are under the age of 15 (in Serbia) or under the minimum digital consent age in your country, you should not provide personal data without verifiable parental consent.

3. How We Use Information

• Providing and Managing Event Services: registration processing, booth allocation, invoicing, pass issuance
• Communication: confirmations, invoices, announcements, inquiry responses
• Marketing and Updates: with permission, promotional communications. We auto-enroll event participants into our mailing list with opt-out rights
• Processing Payments: financial transaction handling with payment processors
• Facilitating Networking: B2B matchmaking and controlled networking activities
• Event Operations and Improvements: usage data analysis for website and event planning
• Security and Fraud Prevention: maintaining site security
• Legal Compliance: tax, accounting, and regulatory compliance

4. Legal Bases for Processing

• Contractual Necessity: fulfilling contracts (event registration, service provision)
• Consent: explicit permission for marketing emails and sensitive data
• Legitimate Interests: improving security, promoting events to previous participants, facilitating networking
• Legal Obligation: tax records and regulatory compliance

5. Data Sharing and Disclosure

We do not sell personal data. Sharing occurs with:

• Service Providers: Raiffeisen Bank (payments) and IT hosting. When we activate analytics or email-marketing services, we will update this policy and request fresh consent.
• Event Partners: government entities and partners receive aggregated data for protocol
• Exhibitors/Attendees: company names on public exhibitor lists, B2B limited profile info
• Legal and Compliance: when required by law or court orders
• Business Transfers: during business transitions

6. Cookies and Tracking

Essential cookies enable basic site operations. The Site does not currently load third-party analytics, but is wired so that — if analytics or marketing tools are activated in future — non-essential cookies will only be set after the user's explicit consent. Users can manage preferences through the consent banner or browser settings.

7. Your Rights

• Right to Access: request copies of held personal data
• Right to Rectification: correct inaccurate information
• Right to Erasure: request deletion in certain circumstances
• Right to Restrict Processing: suspend processing while accuracy contested
• Right to Data Portability: receive data in machine-readable formats
• Right to Object: object to processing, especially direct marketing
• Right to Withdraw Consent: at any time without affecting prior processing
• Right to Lodge a Complaint: with supervisory authorities

Contact [email protected] with requests. Responses within one month.

8. Data Security

• SSL/TLS encryption for transmitted data
• Access controls with role-based permissions
• Secure hosting with firewalls and monitoring
• Data minimization: only necessary information collected
• Staff training on data protection
• Regular encrypted backups
• Incident response procedures for data breaches

9. International Transfers

Data primarily stored in Serbia. Serbia does not have an EU adequacy decision. Safeguards include Standard Contractual Clauses, explicit consent for transfers, and compliance frameworks for US-based providers.

10. Data Retention

• Event Registration Data:kept for a few years for future events. Visitors' data kept ~2 years
• Financial Records:5–10 years per Serbian law
• Marketing Lists: until opt-out or purge of inactive contacts
• Web Analytics: typically 14 months
• After retention, data securely deleted or anonymized

11. Changes to This Policy

Material changes notified by updating the Effective Date. Continued use signifies acceptance.

12. Contact Us

Personal-data requests (data-subject rights, processing concerns, breach notifications) are handled at the email address below. No separate Data Protection Officer has been designated under GDPR Article 37 because the criteria for mandatory designation are not met. You also have the right to lodge a complaint with the competent supervisory authority in Serbia, the Поверenик за информације од јавног значаја и заштиту података о личности (poverenik.rs), or with the supervisory authority of your country of residence.