Privacy Policy – find out how we process your personal data

Thank you for choosing us for your next adventure!

We have to process some of your personal data so that you could enjoy your next adventure with us. The purpose of this document is for you to find out how we process your personal data. Please read it carefully, and in case you have any questions, feel free to contact us by using information mentioned below.

Who are we? We determine the purpose and means of processing of your personal data (‘data’) and we are considered to be a controller under the General Data Protection Regulation and the Serbian Data Protection Law. Go2Trail platform and internet page are owned by  Crystal Mobile PIB:107775009 (‘Go2Trail, Platform, We or Controller’).

Purpose of processing, categories of personal data and legal bases

In order to participate and book an adventure, create your account and use our Platform, we have to collect and process certain personal data. Some of the data is required to enter into a contract with you, and if you decide not to disclose that data to us, you will be unable to use our Platform or participate in the adventures. More information about what data we collect, for what purposes and what are our legal bases for that can be found in the below table.

Legitimate interest as a legal basis

In case where we process your personal data on a basis of legitimate interest, we carefully balance your interests against ours. If your interests and fundamental rights and freedoms override the legitimate interest pursued by, us we will find another legal basis or we will not process personal data for that purpose. You can always contact us to find out how did we apply the legitimate interest assessment for the particular processing activity.

Recipients of the personal data

We have to share some or all of your personal data with third parties (‘Recipients’), so that you could use our platform and participate in adventures.
They help us operate our Platform. These are hosting companies, our IT vendors who are helping us to operate the Platform, our partners who are advertising their adventures, authorities where required by law, payment processors and similar.
They can be independent controllers (such as payment processors or partners who are advertising their adventures), joint-controllers or processors (e.g., hosting companies). For more information on this you can always contact us.

Transfers of personal data to third countries

Your personal data may be transferred to third parties in the Republic of Serbia or other countries.
If you are in the European Union at the time of collection of your personal data, and we transfer your personal data outside the European Union, European Economic Association or countries deemed to provide adequate level of protection of personal data by the European Commission we use standard contractual clauses approved by the European Commission.
Where we collect your personal data while you are in Serbia, we transfer your data to countries deemed adequate by the European Commission, they are signatories of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data or to countries on the List of countries, parts of their territories, one or more sectors in which an adequate level of protection is provided available here. If the countries where we export personal data are not in the aforementioned categories we employ Standard Contractual Clauses.

Retention periods

Data collected to open your account are kept while the account is active. The rest of the personal data such as payment information, information about your adventures, correspondence with us and similar are kept longer, in order to meet legal obligations, we are subject to or if it’s in our legitimate interest.

Your rights

1. Right of access
   You can always contact us to find out if we process your personal data, and where that is the case, to acquire additional information about the purpose of processing, recipients, to receive copies of personal data processed and similar.
2. Right to rectification
   If you think that some of your personal data is inaccurate or outdated, you can rectify them through your profile or contact us so that we could do it for you.
3. Right to erasure
   Where conditions prescribed by laws are met and you request erasure of your personal data, we will fulfil your request and delete your personal data.
4. Right to restriction of processing
   You can request us to restrict your data from further processing where permitted by Law (e.g., where your data is inaccurate).
5. Right to data portability
   We deliver your data in a structured, commonly used electronic format. You have the right to request to have this data transferred to another controller where legal requirements are met.
6. Right to object
   You can always object to processing of your personal data. If your personal data is processed for direct marketing purposes, including profiling related to direct marketing, we will stop processing your personal data for those purposes.
   Where we process your personal data on a basis of legitimate interest or the processing is necessary or the performance of a task carried out in the public interest we will stop processing your personal data, unless our legitimate grounds for the processing override your interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
7. Right to withdraw consent
   If we process your personal data on a basis of your consent, you can always withdraw your consent (e.g., where you have given your consent to have you data processed for direct marketing purposes). Withdrawal of your consent does not affect lawfulness of processing prior to that.
8. Use of cookies
   Our website uses cookies. For more information visit our Cookie policy. Where cookies process personal data, this Privacy Policy applies in addition.

Right to lodge a complaint with Serbian Commissioner or Supervisory Authorities in the European Union.
If you think that we process your personal data contrary to the Serbian Data Protection Law, you can lodge a complaint with the Commissioner for Information of Public Importance and Protection of Personal Data. You can contact the Commissioner here.
If you are in the European Union when we collect your personal data, you can lodge a complaint with one of the bodies responsible for monitoring the application of the GDPR or a National Member State Law. You can find the list here.