PRIVACY POLICY

The NEBESSA One application (hereinafter: the "Platform") is intended exclusively for residents of the NEBESSA Kvart development, employees involved in the implementation of the project, and business entities that will perform management, maintenance, and security services for the NEBESSA Kvart complex. The Platform enables management of access to NEBESSA Kvart (hereinafter the "Facility"): apartments, elevators, garages, and common areas, as well as communication with the professional management and facility management team, booking of shared amenities, use of additional benefits through cooperation with NEBESSA Kvart partners (hereinafter the "Loyalty Program"), and participation in the work of the Homeowners’ Association.

Your privacy is extremely important to us. This Privacy Policy (hereinafter the "Policy") explains what data we collect, how we use it, and how we protect it.

This Privacy Policy is designed to inform you about the types of data collected and the manner in which it is used. You will also learn how you can exercise your rights as Users, i.e. as data subjects, within the meaning of the General Data Protection Regulation (EU) 2016/679. This Privacy Policy applies to the "NEBESSA One" application.

During the registration process, the user confirms that they are familiar with the Privacy Policy and the Terms of Use of the platform (hereinafter the "Terms"), which together govern the use of the NEBESSA One application.

In addition, this Policy is consistent with the Privacy Policy published on the website www.nebessa.rs, and all provisions of the "Disclaimer" document also apply to it, particularly with respect to visualizations of NEBESSA Kvart, its protected name, and its visual identity, the exclusive owner of the copyright and intellectual property rights to which is Blister Properties d.o.o. Beograd.

Any amendments to this Policy will be published via the Platform. This allows the user to be informed at any time about what data we collect and how we use it.

1. DATA CONTROLLER

Data controller responsible for data processing / Contact details

Blister Properties d.o.o.
Generala Vasića 1
11000 Belgrade
Company registration number: 21594164

acting as the data controller within the meaning of the applicable personal data protection regulations, in accordance with the Law on Personal Data Protection of the Republic of Serbia, as well as the General Data Protection Regulation (EU) 2016/679 (GDPR), to the extent the latter is applicable.

You may exercise your rights as a user against the controllers listed above, as well as against any other joint data controllers. We and any joint controllers responsible together with us will promptly notify each other of any rights exercised by users. We will provide each other with all information necessary to respond to requests for information.

Blister Properties d.o.o. will provide data subjects with the necessary information in accordance with Articles 13 and 14 of the GDPR. Other joint data controllers will, in that process, provide us with all information necessary from their respective areas of business.

For questions regarding the processing of personal data and the exercise of your rights, you may contact us via the e-mail address office@k8.rs, as well as via the project's general contact address info@nebessa.rs and telephone +381 69 777 888.

2. DATA WE COLLECT

Users' personal data is collected exclusively for the purposes defined in the further provisions of this Policy, all in accordance with the regulations governing the protection of personal data in the relevant jurisdiction, primarily the EU General Data Protection Regulation (GDPR).

2.1. TYPES OF DATA

In the course of using the Platform, we may collect the following types of data:

• Basic identification data (first and last name, apartment number, contact phone number, email)
• Access data (entry/exit logs, use of the digital key)
• Reservation data (parking, common areas, amenities)
• Data on the prices of individual units within the Facility
• Data on the availability of individual units within the Facility
• Status of payment of the purchase price in accordance with the agreed payment schedule
• Data on settled and outstanding obligations toward the Homeowners’ Association
• Communication with management and services (messages, fault reports)
• Technical device data (device type, operating system, IP address)
• Data relating to the Loyalty Program (usage history, benefits used, and partners)

2.2. PURPOSE OF DATA PROCESSING

We use your data exclusively to enable the functionality of the Platform, for the following purposes:

• Registration and management of Loyalty Program membership
• Registration and management of the Platform
• Enabling access to the Facility and to the Platform’s functions
• Managing reservations and use of common amenities
• Enabling the use of benefits under the Platform’s various offers
• Communicating with users and resolving requests
• Ensuring the safety and security of the Facility and its residents
• Improving the functionality of the Platform
• Communicating with users and implementing the Loyalty Program and its benefits
• Sending promotional offers and notifications (with user consent)
• Enabling insight into the construction process of the Facility
• Enabling insight into the status of users’ financial obligations

3. LEGAL BASIS FOR PROCESSING

Data processing is based on:

• Performance of the Agreement on Use of the Platform as part of the housing service (hereinafter the "Agreement")
• Legitimate interest (security of the Facility and optimization of services)
• User consent (for certain optional functionalities defined by the Agreement)

4. DATA SHARING

Your data may be made available to:

• The professional building management and facility management team
• Technical partners who maintain the Platform
• Partners within the Loyalty Program (only to the extent necessary to provide the relevant benefits)

Blister Properties will not share personal data with third parties except in cases provided for under this Policy, with an appropriate legal basis and the application of appropriate protective measures.

5. DATA RETENTION

Data is retained for the duration of the user relationship and thereafter for as long as necessary to fulfill legal obligations, resolve disputes, protect legal interests, and ensure the security of the system.

6. DATA SECURITY

We take all reasonable technical and organizational measures to protect your data from unauthorized access, loss, or misuse.

7. LOYALTY PROGRAM

User data referred to in Section 2.1 is used so that Blister Properties d.o.o. may provide services at the user’s request, as well as on the basis of the user’s consent, primarily:

• for the purpose of awarding points
• for the purpose of providing benefits
• for the purpose of customizing communication preferences

8. PROMOTIONAL MESSAGES

We process the User’s personal data (contact details) for promotional purposes (e-mail, electronic notifications) through which we provide information about news, promotions, and educational events organized by Blister Properties d.o.o.

By accepting the Platform’s Terms of Use and by using the Platform, the user agrees that the Platform may send notifications and messages to the contact details provided during registration and profile creation (e-mail, contact telephone number). If the user’s data is outdated or invalid, important notifications may be missed.

By accepting the Terms and by using the Platform, the user confirms the accuracy of the contact details provided.

9. RECIPIENT OF PERSONAL DATA

Data is, as a rule, stored in the Republic of Serbia or in any other country in which Blister Properties d.o.o. or other data controllers have affiliated companies or subsidiaries. Data is primarily stored in Serbia. Blister Properties d.o.o. may cooperate with service providers based in and outside the European Union who may potentially have access to user data in order to provide data storage, processing, or maintenance services, where they have processor capacity within the meaning of the GDPR and applicable regulations. Regardless of the storage location, we take the necessary measures to ensure that the processing of information we collect under this Privacy Policy is carried out in accordance with this Policy and applicable legal regulations.

As a rule, we do not transfer your data to third parties, unless we are legally obligated to do so (for example, at the request of law enforcement authorities) or unless third parties are necessary for us to carry out business processes or provide us with services on the basis of a data processing agreement. These include, for example, parcel delivery service providers, payment service providers, providers of merchandise-handling services, order processing service providers, internet hosting providers, communication agencies, internal group call centers, as well as external call centers or IT service providers. In all cases, we strictly comply with legal regulations. In this context, transfers of data to other countries in which the aforementioned contractual partners may be based or may process data are also possible. These are primarily countries of the European Economic Area (EEA), as well as, in individual cases, countries outside the EEA whose data protection regulations may differ from or provide a lower level of protection than European Union regulations. A consequence of this may be, for example, that your data may be processed by state authorities for purposes of control and oversight, possibly without the possibility of legal recourse. As personal data is processed outside the European Union, and there is no European Commission adequacy decision in place, we implement appropriate safeguards, including entering into the EU Standard Contractual Clauses on data protection. The text of the EU Standard Contractual Clauses agreement and the adequacy decisions can be found on the European Commission’s website. You can access the EU Standard Contractual Clauses on data protection here, and the adequacy decisions here.

10. RIGHTS OF USERS (DATA SUBJECTS) AND STORAGE PERIOD

You have the right to information about the processing of personal data relating to you, the right to data portability, as well as – where applicable – the rights to erasure, rectification, restriction of processing and/or objection to processing, as well as the right to lodge a complaint regarding processing with a supervisory authority:

A complaint may be lodged with the supervisory authority in the country of the data controller:

Commissioner for Information of Public Importance and Personal Data Protection
Bulevar kralja Aleksandra 15,
11120 Belgrade, Serbia
e-mail: office@poverenik.rs

Below is an explanation of data subjects’ rights:

• Right of access: the data subject has the right to request access to their personal data and to find out details about which data is collected and for what purposes.
• Right to rectification: the data subject has the right to have inaccurate personal data concerning them corrected.
• Right to erasure: the data subject may request the deletion of their personal data, for example, if the data is no longer needed for the purposes for which it was collected or otherwise processed.
• Right to restriction of processing: the data subject has the right to request the restriction of the processing of their personal data; in such a case, the data will be blocked from any processing. This right exists in particular if the accuracy of the personal data is disputed between the data subject and the data controller.
• Right to lodge a complaint with a data protection supervisory authority: the data subject has the right to lodge a complaint with a supervisory authority at any time, in particular with the supervisory authority in the Member State of their habitual residence, place of work, or place of the alleged infringement, if they consider that the processing of personal data relating to them infringes applicable data protection laws.
• Right to data portability: If we process personal data to perform a contract with the data subject or on the basis of the data subject’s consent, the data subject has the right to receive their personal data in a structured, commonly used, and machine-readable format, under the conditions and to the extent that the data subject has made the data available to the data controller.
• Right to withdraw consent: If the data subject has given consent to the processing of their personal data, they have the right to withdraw such consent at any time, with effect for the future. Withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

10.1. LEGAL BASIS, WITHDRAWAL OF CONSENT, AND STORAGE PERIOD

We base the processing of data subjects’ personal data in this context on the user’s consent in accordance with Article 6(1)(a) of the GDPR. The user may withdraw their consent at any time, with effect for the future, by changing or deleting the relevant consent in their user profile, or by sending a letter or e-mail to the contact address listed above. Consent to receive our newsletter / other e-mail advertising may be withdrawn by the user in the same way. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

We will process users’ personal data for the purposes stated above only for as long as the consent remains valid or for as long as necessary to fulfill any legal data retention obligation.

11. SENDING OF GIFT PACKAGES

For the purpose of sending gift packages, we share the user’s first name, last name, and address with our logistics service provider and delivery company so that the package can be delivered to the user. The user also has the option of receiving notifications from the delivery company about the delivery status by providing their e-mail address.

User data is processed for the purpose of / on the basis of the legitimate interest of sending gift packages, pursuant to Article 6(1)(b) or (f) of the GDPR. The user may also give their consent to receive delivery notifications via their e-mail address. In that case, the user’s e-mail address will be processed on the basis of their consent and for the purposes and to the extent described therein.

We store user data for as long as necessary to fulfill the purposes stated above or for as long as necessary to fulfill any legal data retention obligation.

The address to which users may turn in order to obtain information about how Blister Properties d.o.o. processes personal data, as well as the means by which consent to the processing of personal data may be withdrawn, is office@k8.rs.

If the user withdraws their consent, Blister Properties d.o.o. will delete the user’s data within 15 business days from the date of withdrawal of consent.

12. CHANGES TO THE PRIVACY POLICY

Blister Properties d.o.o. reserves the right to amend and adapt this Privacy Policy at any time.

If the Privacy Policy is amended as described, users will be notified of the changes in a timely manner via the Platform before the changes take effect. Continued use of the "Platform" after receiving notice of the changes will be deemed acceptance by the user of the amended Privacy Policy.

If the user does not accept the change to the Privacy Policy, they may delete their profile.

This version was published on 30 June 2026.