Privacy Notice
Processing of personal data in connection with the use of the MyAFI digital platform
Last updated: 8 July 2026
This Privacy Notice regarding the processing of personal data in connection with the use of the MyAFI digital platform (hereinafter referred to as the “Privacy Notice”) describes the manner in which your personal data is processed when you use the MyAFI digital platform (hereinafter referred to as the “Platform”).
The controller of your personal data processed through the Platform, as described in this Privacy Notice (the so-called Tenant Personal Data, as defined in Section 1 of this Privacy Notice), is the legal entity leasing office premises within the business park in relation to which the Platform is used and with which you are employed or otherwise engaged (hereinafter referred to as the “Tenant”).
In addition, the controller of your personal data processed through the Platform, as described in this Privacy Notice (the so-called TenPal Personal Data, as defined in Section 1 of this Privacy Notice), is TENPAL d.o.o., a company with its registered office at Kneza Miloša 88a, 11000 Belgrade (Savski Venac), Republic of Serbia, registered with the Serbian Business Registers Agency under registration number 22128477 (hereinafter referred to as “TenPal”).
Accordingly, the Tenant and TenPal act as independent data controllers with respect to the processing of your personal data carried out through the Platform.
The Platform has been developed and is operated by TenPal with the purpose of improving the day-to-day functioning of the business community within the business park managed by AFI (such as, for example, Airport City Belgrade, AFI City Zmaj, and similar business parks, hereinafter referred to as the “Business Park”), in which, among numerous other business entities, the Tenant—your employer—leases office premises.
The Platform is a closed digital platform intended for tenants within the Business Park, through which employees and other individuals engaged by such tenants may access various information and content relevant to the operation and day-to-day functioning of the Business Park, including, but not limited to, announcements and notices regarding the operation of the Business Park facilities, information on business community events and activities, promotional offers and benefits available within the Business Park, as well as other functionalities designed to improve communication and the exchange of information within the Business Park, including the reporting and resolution of ongoing technical issues and the submission of operational requests relating to the Business Park and/or the office premises used by tenants, including the Tenant.
More specifically, the use of the Platform is organized so that the company managing the Business Park, AFI PROPERTY MANAGEMENT DOO BEOGRAD, with its registered office at Tadije Sondermajera 11a, 17th floor, 11000 Belgrade (New Belgrade), Republic of Serbia, registered with the Serbian Business Registers Agency under registration number 20193158 (hereinafter referred to as “AFI”), first provides a link for registration and access to the Platform (hereinafter referred to as the “Registration Link”) to the individual designated by each tenant within the Business Park as its contact person for the use of the Platform (hereinafter referred to as the “Tenant Contact Person”). The Tenant Contact Person will then forward the Registration Link to you and to other individuals employed or otherwise engaged by the Tenant.
Through the Registration Link, you, as well as all other individuals employed or otherwise engaged by the Tenant, will be able to access the Platform and its available content. However, only the Tenant Contact Person will be authorized to use those functionalities of the Platform that enable direct communication with AFI representatives through or in connection with the Platform.
Given that you, as an employee or other individual engaged by the Tenant, will be able to use the Platform (with the exception of the above-described functionalities reserved exclusively for the Tenant Contact Person), your personal data will be processed for the purposes of and in connection with your use of the Platform.
Accordingly, the purpose of this Privacy Notice is to inform you about the nature and characteristics of such processing. As such, it constitutes a comprehensive notice regarding the processing of your personal data as a user of the Platform, including information on which personal data is processed, the purposes and legal bases for such processing, your rights in relation to the processing, and other relevant information, all in accordance with the Law on Personal Data Protection of the Republic of Serbia (Official Gazette of the Republic of Serbia, No. 87/2018) (hereinafter referred to as the “Law”), as further described below.
1.What Categories of Your Personal Data Are Processed, for What Purposes and on What Legal Basis?
Your personal data processed through the Platform (hereinafter referred to as the “Personal Data”) by the Tenant and/or TenPal (hereinafter collectively referred to as the “Controllers”) includes: (i) where the Tenant acts as the data controller – your name and surname, email address, and the name of the Tenant as your employer (hereinafter referred to as the “Tenant Personal Data”), and (ii) where TenPal acts as the data controller – your IP address, MAC address, unique device identifier (Device ID), and activity logs (hereinafter referred to as the “TenPal Personal Data”).
In this regard, your Tenant Personal Data is also processed by TenPal, acting as a data processor on behalf of the Tenant. Conversely, the Tenant does not process your TenPal Personal Data in any capacity whatsoever.
Purpose and Legal Basis for the Processing of TenPal Personal Data
The purpose of processing your TenPal Personal Data is to maintain the security and integrity of the Platform, ensuring that all Platform users, including yourself, can use the Platform safely, securely, and without interruption across all available functionalities.
The legal basis for processing your TenPal Personal Data for the above purposes is TenPal’s legitimate interest (Article 12, Paragraph 1, Item 6 of the Law). TenPal’s legitimate interest consists of its business need to: (i) ensure an appropriate level of Platform security by preventing misuse, abuse, security incidents, fraud, and other unauthorized or undesirable activities, and (ii) ensure the uninterrupted operation of the Platform by enabling the timely and efficient resolution of any issues affecting its functionality.
Purpose and Legal Basis for the Processing of Tenant Personal Data
In order to use the Platform, you must first create and activate a user account through the Registration Link, as described in the introductory section of this Privacy Notice. To activate your account, you will be required to verify your registration using your email address. During the registration process, you will provide your name and surname, email address, and the name of the Tenant as your employer. Without these personal data, you will not be able to register for, access, or use the Platform, as such information is necessary for the creation and subsequent use of your user account.
The purpose of processing your Tenant Personal Data is to enable your use of the Platform so that, on behalf of the Tenant, you may submit service requests, report faults, and communicate other technical or operational issues relating to the Tenant’s premises within the Business Park to AFI representatives.
The legal basis for processing your Tenant Personal Data for the above purposes is the Tenant’s legitimate interest (Article 12, Paragraph 1, Item 6 of the Law). The Tenant’s legitimate interest consists of its business need to ensure the uninterrupted use of the office premises it leases within the Business Park in accordance with the applicable lease agreement. By using the Platform to report issues relating to the Tenant’s premises within the Business Park, you contribute to the fulfilment of that legitimate interest.
No Processing of Personal Data in Relation to Other Platform Functionalities
As described in the introductory section of this Privacy Notice, the Platform provides various functionalities intended, among others, for your benefit as a Platform user. Through the Platform, you may access a variety of information and content of potential interest, including business community events and activities within the Business Park, promotional offers and benefits available within the Business Park, general information regarding the use of the Business Park, frequently asked questions (FAQ), surveys requesting your feedback, and similar content.
However, your Personal Data will not be processed by either the Tenant or TenPal in connection with your use of these functionalities of the Platform.
2.How Long Will Your Personal Data Be Processed?
Your Personal Data will be processed in accordance with all requirements and conditions prescribed by the Law. With respect to the retention period, your Personal Data will be processed only to the extent and for as long as necessary to fulfil the specific purpose for which it is processed, as described in Section 1 of this Privacy Notice. However, your Personal Data may be retained: (i) for a shorter period if the relevant personal data processing agreement terminates before the relevant processing purpose has been achieved, or (ii) for a longer period where such retention is required by law, but no longer than the applicable statutory retention period.
Specifically, your TenPal Personal Data (i.e. your IP address, MAC address, unique device identifier (Device ID), and activity logs) will be retained for as long as necessary to fulfil the purposes for which it was collected (e.g. resolving security incidents, preventing misuse and other unauthorized activities on the Platform, or troubleshooting issues affecting the proper functioning of the Platform). In exceptional circumstances, your TenPal Personal Data may be retained for a longer period where necessary for the establishment, exercise or defence of legal claims, in which case the legal basis for such processing shall be TenPal’s legitimate interest (Article 12, Paragraph 1, Item 6 of the Law).
Your Tenant Personal Data (i.e. your name and surname, email address, and the name of the Tenant as your employer) will be retained for as long as your user account on the Platform remains active. You may request the deactivation of your user account at any time. If you do not access your user account on the Platform for a period of two (2) years, TenPal may automatically deactivate your account.
In exceptional circumstances, your Tenant Personal Data may also be retained for a longer period where necessary for the establishment, exercise or defence of legal claims, in which case the legal basis for such processing shall be the Tenant’s legitimate interest (Article 12, Paragraph 1, Item 6 of the Law).
3.Can Your Personal Data Be Processed by Third Parties?
Yes. The processing of your Personal Data may include the disclosure and transfer of such data, including transfers outside the Republic of Serbia, to the Controllers’ affiliated companies and other third parties (hereinafter referred to as the “Data Recipients”).
Such third parties include the Controllers’ business partners, competent public authorities and regulatory bodies, as well as service providers whose services are legitimately required for the Controllers’ business operations and the functioning of the Platform (such as IT service providers, including hosting providers, lawyers, accountants, auditors, insurance companies, marketing agencies, and similar service providers).
Personal Data may be transferred to the Data Recipients only to the extent necessary to comply with the Controllers’ legal obligations, fulfil their obligations towards competent public authorities and regulatory bodies, perform their legitimate contractual obligations, enable third-party service providers to provide services to the Controllers, or pursue the legitimate interests of the Controllers, their affiliated companies or third parties (hereinafter referred to as the “Processing Limitation”).
The Data Recipients shall process the Personal Data within the scope of the Processing Limitation, either as independent controllers or as processors acting on behalf of the relevant Controller and in accordance with its instructions, and always in compliance with all applicable legal requirements.
Where the Data Recipients are located outside the Republic of Serbia, or where Personal Data is transferred to a country that does not provide an adequate level of personal data protection under the Law, the Controllers shall implement appropriate safeguards to ensure an adequate level of protection and compliance with all applicable legal requirements. Such safeguards may include, without limitation, the application of Standard Contractual Clauses approved by the Commissioner for Information of Public Importance and Personal Data Protection (the “Commissioner”), binding corporate rules, approvals issued by the Commissioner, or other legally recognized transfer mechanisms. For further information regarding the safeguards implemented, where applicable, you may contact the relevant Controller using the email address specified in Section 5 of this Privacy Notice.
4.What Rights Do You Have in Relation to the Processing of Your Personal Data and How Can You Exercise Them?
Subject to the conditions and limitations prescribed by the Law, you are entitled to the following rights in relation to the processing of your Personal Data: (i) the right to obtain information regarding the processing of your Personal Data, (ii) the right of access to your Personal Data, (iii) the right to obtain a copy of your Personal Data, (iv) the right to request the rectification, completion or erasure of your Personal Data, (v) the right to restriction of processing, (vi) the right to data portability, (vii) the right to object to the processing of your Personal Data and to request the cessation of such processing, and (viii) where applicable, the right not to be subject to a decision based solely on automated processing.
Should you wish to exercise any of the above rights, you may contact the relevant Controller in the manner specified in Section 5 of this Privacy Notice. Each Controller is responsible, with respect to the Personal Data it processes in its capacity as a data controller, for ensuring that the above rights are respected and may be exercised within the time limits prescribed by the Law.
If you believe that the processing of your Personal Data is not carried out in accordance with the Law, you also have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection, at the following address: Bulevar Kralja Aleksandra 15, 11000 Belgrade, Republic of Serbia, or by email at [email protected].
5.Contacting the Controllers
Should you have any questions regarding the information contained in this Privacy Notice, or should you wish to exercise any of your rights relating to the processing of your Personal Data (as described in Section 4 above), please submit your request to [email protected].
If your request does not relate to TenPal but to the Tenant, TenPal shall, without undue delay, forward your request to the Tenant’s designated email address.
6.Amendments to this Privacy Notice
The Controllers reserve the right to amend or supplement this Privacy Notice for regulatory or other legitimate reasons.
You will always be notified of any such amendments by email and will receive a link to the updated version of this Privacy Notice, which will also be published on the Platform without undue delay.
If you continue to use the Platform after such publication and email notification, you shall be deemed to have accepted the terms and conditions of the updated Privacy Notice.
