This Privacy Policy sets out the manner in which Trag Foundation complies with its statutory obligations concerning the protection of personal data in connection with the management of its internet platform. Below you may find information on the circumstances, purposes and methods by which the Trag Foundation collects, uses and stores your personal data, in accordance with Articles 23 and 24 of the Law on Personal Data Protection of the Republic of Serbia (“Official Gazette of the RS”, No. 87/2018), as well as the internal Rulebook on Personal Data Protection of Trag Foundation in its capacity as a data controller.

Trag Foundation, as data controller, processes personal data in accordance with:

• The Law on Personal Data Protection of the Republic of Serbia (“Official Gazette of the RS”, No. 87/2018);
• The fundamental principles of the EU General Data Protection Regulation (GDPR);
• The Rulebook on Personal Data Protection of Trag Foundation.

Identity and Contact Details of the Controller

Trag Foundation
St. Kraljice Natalije No. 45
Belgrade, Republic of Serbia
Registration No.: 17522663

The Foundation is responsible for the content available on this platform.

Trag Foundation respects the privacy of platform users. Accordingly, we process only those personal data that are necessary for achieving clearly defined purposes of processing, including the operation of this platform.

For the purposes of this Policy, personal data means any information relating to an identified or identifiable natural person. In the process of collecting and using personal data, our policy is to ensure transparency regarding the reasons for and methods of processing.

Data Processors:

Data processors may include: hosting providers, technical support providers, and project partners (e.g.IT companies engaged in platform development, external associates). All processors are bound by confidentiality and data processing agreements in compliance with applicable law

1. Contact for Data Protection Matters

Email: office@tragfondacija.org

2. Purpose and Description of the Trag Foundation Platform

Trag Foundation is a foundation operating with the objective of strengthening civil society, fostering solidarity, and promoting social justice, equality and active civic participation in Serbia and the region.

The Foundation implements various support programs, educational and development activities, as well as advocacy initiatives intended for civil society organizations and informal groups. Through its work, Trag Foundation contributes to the development of philanthropy, strengthening of local communities and advancement of socially responsible practices based on solidarity and participation.

The internet platform of Trag Foundation serves as an informational channel through which users are provided with information about the Foundation’s activities, ongoing programs, public calls, educational content and other relevant initiatives. Through the platform, users may obtain information, contact the Foundation, and apply for participation in programs and activities implemented by the Foundation.

The platform does not enable electronic commerce or financial transactions. All content published on the website is of an informational, educational and non-commercial nature.

In performing its activities and managing the internet platform, Trag Foundation processes personal data solely for the purpose of achieving its statutory objectives, communicating with interested parties and implementing its programs, in accordance with applicable data protection regulations and this Privacy Policy.

3. Purpose of Processing, Source of Data and Legal Basis

Trag Foundation collects and processes personal data primarily through the implementation of public calls and grant competitions in order to communicate with users, associates and partners, including civil society organizations, informal groups, representatives of public authorities and institutions, private companies and other interested parties.

The categories of personal data processed may include:

• Contact data (name, telephone number, email address);
• Information regarding the organization represented (position and organization name);
• Information concerning your relationship with the Foundation (e.g. how you learned about our calls and programs);
• Project-related information submitted within applications, including project descriptions and budgets.

Personal data is primarily collected directly from you when submitting applications for public calls, registering for events, training or other activities organized by the Foundation. Data may also be obtained from publicly available sources, including social media platforms (such as LinkedIn, Facebook, Instagram), or directly communicated by you (e.g. updates regarding organizational affiliation or position).

The Foundation may also collect personal data relating to employees, job applicants, grantees, informal groups, donors, suppliers, consultants/experts, as well as from third parties such as former employers, banks and payment processors (in relation to financial data), partner organizations and institutions (e.g. EU Commission, Catalyst Balkans), business partners and competent public authorities.

Based on the data provided, we may send various notifications via email, including invitations to events and important information concerning the Foundation’s activities.

Legal Basis for Processing

Processing is based on one or more of the following legal grounds:

• The data subject’s consent;
• Performance of a contract;
• Compliance with legal obligations;
• Legitimate interests pursued by the controller.

Consent may be withdrawn at any time.

4. Disclosure of Personal Data

Trag Foundation does not share personal data outside its organization unless explicitly stated in a public call or project documentation (e.g. where project partners or selection committee members are granted access for evaluation purposes).

All associates of Trag Foundation, irrespective of their legal status, are bound by confidentiality obligations.

Personal data may be disclosed to third parties only in the following cases:

• Service providers: IT service providers and other processors engaged to ensure platform functionality, bound by data processing agreements ensuring confidentiality and security;
• Legal and security purposes: where disclosure is required by law or reasonably necessary to comply with legal obligations, respond to lawful requests or protect the rights, safety and security of the Foundation, its associates or the public.

5. Transfer of Personal Data to Other Countries

Personal data collected through the platform are processed in the Republic of Serbia or on servers located within the European Union.

Data may be shared with processors providing hosting and analytics services solely to the extent necessary for service provision, or where required by law.

The Foundation uses Google Analytics for website traffic analysis. Google Analytics processes aggregated and statistical data without directly identifying individual users.

Google acts as a data processor in accordance with its Privacy Policy. Any transfer of data outside Serbia or the EU (if applicable) is based on Standard Contractual Clauses (SCCs), in compliance with applicable data protection legislation, including GDPR and the Serbian Law on Personal Data Protection.

Data collected through Google Analytics are not used for marketing purposes or profiling, but exclusively for statistical analysis and improvement of platform quality and functionality.

6. Data Retention Period

Personal data are retained only for as long as necessary to achieve the stated purposes and in compliance with applicable law.

Consent provided upon registration is valid for two (2) years, after which renewed consent will be requested.

Email addresses of individuals who unsubscribe from newsletters are deleted upon unsubscribe request.

Data Deletion Procedure

1. Submit an email request with:
   • Subject: “Data Deletion – [TYPE OF DATA]”
   • Body: Specify the type of data and the name of the data subject
   • Send to: office@tragfondacija.org
2. Request processing period: 30 calendar days
3. Deletion from records: within 10 calendar days following processing of the request

7. Rights of Data Subjects

Data subjects have the right to:

• Receive transparent and complete information regarding processing;
• Access and obtain a copy of their personal data;
• Rectify inaccurate or incomplete data;
• Request erasure under legally prescribed conditions;
• Request restriction of processing under applicable conditions;
• Data portability;
• Withdraw consent at any time (where consent is the legal basis);
• Lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection and seek judicial protection;
• Object to processing based on legitimate interests.

Requests may be submitted to: office@tragfondacija.org
Subject line: “Request for Exercising Data Subject Rights”

8. Security of Processing

Trag Foundation applies appropriate technical and organizational measures, including:

• Regular system updates;
• Access control limited to authorized personnel;
• Protection against unauthorized access and data loss.

9. Right to Lodge a Complaint

Complaints may be submitted to:

Commissioner for Information of Public Importance and Personal Data Protection
St. Bulevar kralja Aleksandra 15
11120 Belgrade, Republic of Serbia
Email: office@poverenik.rs

10. Governing Law and Jurisdiction

This Policy is governed by the laws of the Republic of Serbia. Any disputes arising from the use of the platform shall fall under the jurisdiction of the First Basic Court in Belgrade.

11. Automated Decision-Making and Profiling

Cookies are small text files placed on users’ devices to store information.

Trag Foundation does not use cookies or trackers that process personal data. The platform does not collect cookies but may process basic access metadata (e.g. date and time of access, device type, operating system) for technical security purposes.

The platform does not engage in automated decision-making, including profiling.

12. Amendments to the Privacy Policy

Trag Foundation may update this Privacy Policy to ensure compliance with legal changes.

This Privacy Policy was published on 2 February 2026 and shall remain in force until amended.

Users will be notified of any amendments via the platform in a visible manner at least 15 working days prior to the application of new rules.

The latest version will always be available at www.tragfondacija.org, and the date of the most recent amendment will be clearly indicated.