Privacy Policy — Oblakkarte

1. About Us

The operator of the Oblakkarte website and service is:

ZURKA CE BITI DOO Beograd
PIB: 114432064
MB: 22023195
Kraljice Natalije 11, Beograd, Serbia
[email protected]

For the purposes of applicable data protection laws, Oblakkarte may act as:

As an independent data controller when we determine the purposes and means of processing.
As a data processor on behalf of an organiser when we process customer and participant data on their behalf.
As a separate controller for data related to security, preventing abuse, settlements with organisers, accounting, analytics, event logs, support, legal obligations and protecting our rights.

2. The roles of Oblakkarte and the organiser

Oblakkarte provides an organiser account for publishing event announcements and organising ticket sales. An account for announcements can be created without a company. Enabling ticket sales requires a company or entrepreneur, their business details and the applicable sales terms.

When ticket sales are enabled, ZURKA CE BITI DOO Beograd acts as an agent for receiving and processing payments in the name and on behalf of the organiser under the sales terms for companies (B2B).

The organiser is responsible for their event, its content and fulfilling their obligations to customers.
Oblakkarte processes data necessary for accounts, publishing, orders, tickets, payments, settlements, refunds and support under the applicable agreement.
The organiser may independently determine the purposes of processing data about customers and participants in their event and act as their data controller.

Each party’s role in processing personal data depends on the particular operation. This Policy describes personal data processing and does not replace ticket sales terms or the agency agreement.

3. What information we may collect

Depending on how you interact with Oblakkarte, we may process the following categories of data.

3.1. Data on visitors to the website

IP address;
browser, device, operating system, and language data;
cookies, session identifiers, and similar technical data;
data on pages visited, clicks, referral sources, visit duration, and interaction with the website;
data you provide through feedback forms or support requests.

3.2. Organizer Information

First and last name, email, phone number and other contact details.
Account and authentication data.
Company or entrepreneur name, registration and tax details, address and bank details, when added for ticket sales.
Information about the organiser’s team and assigned roles.
Service terms, commission, invoices, payments and settlement details.
Data provided during verification, onboarding or support requests.

3.3. Customer and Member Data

If a customer or participant interacts with an event page, checkout page, registration form, or ticket, the following may be processed through the Oblakkarte infrastructure:

First and last name;
Email;
phone number;
order and ticket details;
details regarding the event, session, ticket category, seat, price, promo code, and order status;
additional information requested by the organizer in the order or registration form;
information necessary for sending notifications, tickets, QR codes, confirmations, and service messages;
history of interactions with the order, ticket, or event.

3.4. Payment Information

For ticket sales through Oblakkarte, we process data needed to receive and record payments, settle with the organiser, handle refunds and fulfil the agency agreement.

The processing of card details and other payment credentials depends on the selected payment method and involves the relevant payment provider or bank as part of the payment process.

Oblakkarte may receive limited payment metadata, such as:

payment status;
transaction ID;
payment method type;
amount;
transaction date and time;
technical statuses required to display the payment result in the interface.

We may also process organiser payment details, commission, invoices, payouts and refunds to the extent necessary to fulfil the agreement, maintain accounts, reconcile payments and provide support.

3.5. Support and Contact Information

the content of support requests;
attachments and documents you submit;
correspondence via email, forms, chat, or other communication channels;
records of the progress of your request.

3.6. Security and Fraud Prevention Data

access and event logs;
data regarding suspicious activity;
technical alerts used to protect the website, accounts, and infrastructure;
information necessary to investigate violations, complaints, fraud, abuse, or other incidents.

4. Data sources

We may receive personal data from:

directly from you;
from the organizer, if you interact with their event through Oblakkarte;
from your team or colleagues, if they invite you to the organizer’s account;
from payment providers, banks, email providers, and other partners, when necessary for the service to function;
automatically when using the website and service;
from publicly available sources, if necessary for verification, security, legal compliance, or the protection of Oblakkarte’s rights.

5. Purposes of data processing

We may process personal data for the following purposes:

providing access to the website and service;
account registration and management;
providing platform features to event organizers;
setting up, managing, and publishing events;
processing orders, tickets, registrations, notifications, and service communications;
user support;
performance of the contract with the user or organizer;
recording commission, invoicing, processing payments, settlements with organisers and refunds under the applicable agreement;
ensuring the operation of the website, hosting, API, integrations, and applications;
ensuring security, preventing fraud, spam, abuse, and other misuse;
logging and auditing of actions;
analytics, improving interfaces, functionality, and service quality;
compliance with legal obligations;
establishing, exercising, and defending legal claims;
sending mandatory service notifications;
sending marketing messages, if permitted by law and where there is a valid basis.

6. Legal Basis for Processing

Depending on the situation, we process data on one or more of the following grounds:

performance of a contract or actions taken prior to entering into a contract;
compliance with a legal obligation;
the legitimate interests of Oblakkarte or a third party, provided that such interests are not overridden by your rights and freedoms;
consent, where required by law;
other grounds permitted by applicable law.

6.1. When we typically rely on the performance of the contract

creating and maintaining an account;
providing access to service features;
sending service notifications;
processing requests related to the use of Oblakkarte;
managing settlements, payment records and refunds.

6.2. When we typically rely on legitimate interest

site and infrastructure security;
prevention of fraud, abuse, and violations;
service support and improvement;
internal administration;
protection of Oblakkarte’s rights in disputes, claims, and investigations;
limited analytics necessary for service development.

6.3. When We Typically Rely on Consent

non-essential cookies and similar technologies, where consent is required by law;
certain marketing communications;
other instances where it is expressly required by law.

7. When is Oblakkarte the controller, and when is it the processor?

The role of Oblakkarte depends on the specific context of the processing.

7.1. Oblakkarte as a controller

Oblakkarte typically acts as a standalone controller when processing data:

organizers and their team members;
commission, invoices, payments, settlements and refunds in fulfilling our own contractual and legal obligations;
support and user communications;
security, logs, anti-fraud, and abuse prevention;
analytics on the use of the Oblakkarte service itself;
legal compliance and protection of Oblakkarte’s rights.

7.2. Oblakkarte as a processor acting on behalf of the organizer

Oblakkarte may act as a data processor when an organizer uses the platform to process data:

ticket buyers;
event participants;
guests, visitors, and registered users;
individuals who fill out additional forms created by the organizer;
recipients of tickets, QR codes, registrations, and notifications for a specific event.

In such cases, the organizer determines the essential purposes of the processing, such as holding the event, selling tickets, registering participants, communicating with them, handling refunds, and providing customer service.

7.3. A separate role for the organizer

The organizer may act as the independent data controller for customer and participant data in connection with its event, including:

description of the purposes of data collection;
content of the order or registration form;
admission policies;
returns;
event-related communications;
tax and other legal obligations related to ticket sales.

If your question concerns a specific event, booking, or ticket, in some cases you will need to contact the organizer directly, as they are responsible for handling your inquiry.

8. Who we may share data with

We may disclose personal data to the following categories of recipients:

event organizers;
members of the organizer’s team, within the scope of their assigned access rights;
hosting providers, cloud providers, CDNs, and infrastructure contractors;
email, SMS, and communication providers;
analytics and monitoring providers;
payment providers, banks, and financial intermediaries—to the extent necessary for ticket payment processing, settlements with organisers, refunds and technical status synchronization;
support, CRM, and helpdesk tool providers;
security, anti-fraud, logging, and audit contractors;
lawyers, auditors, accountants, and other consultants;
government agencies, courts, law enforcement agencies, regulators, and supervisory authorities, if we are required to do so by law or to protect the rights of Oblakkarte, users, or third parties;
the buyer or organizer—when necessary to fulfill a request, resolve a dispute, confirm an order, process a return, or address a complaint or claim.

We do not sell personal data as a separate commercial product.

9. International data transfer

Depending on the infrastructure and contractors used, personal data may be processed or transferred outside the country from which you are accessing the service, including to countries where Oblakkarte’s servers, contractors, or technical providers are located.

If a specific data transfer requires the use of specific legal mechanisms, we will rely on the legal grounds provided by law, including:

a decision on an adequate level of protection, if applicable;
standard contractual clauses;
other mechanisms permitted under applicable law.

10. Data Retention Periods

We retain personal data only for as long as is necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.

The retention period depends on the data category and the context of processing. For example:

Account data — for the duration of the account and a reasonable period after its closure;
contractual and billing data — for the time necessary to fulfill the contract, for accounting and tax purposes, and to comply with legal requirements;
support data — for the period necessary to process inquiries, for internal quality control, to protect rights, and to fulfill legal obligations;
technical logs and security data — for the period reasonably necessary for security, incident investigation, and service protection;
customer and participant data processed on behalf of the organizer — in accordance with the organizer’s instructions, the terms of service, and applicable legal requirements.

Once the applicable retention period has expired, the data will be deleted, anonymized, or otherwise rendered unidentifiable, unless further storage is required by law.

11. Cookies and Similar Technologies

Depending on the part of the Oblakkarte website or account you use, cookies, local storage and similar technologies may be used for the following purposes:

to ensure the website functions properly and for user authentication;
to save user settings;
to ensure the security and stability of the service;
for analytics and to improve functionality;
for marketing and performance measurement, where permitted by law and where there is a valid legal basis.

You can manage cookies and local storage through your browser settings. Blocking them may affect account access and certain features. Questions about these technologies can be sent to [email protected].

12. Your Rights

Depending on applicable law and the specific context of the processing, you may have the right to:

request access to your data;
request the correction of inaccurate or incomplete data;
request the erasure of your data;
request the restriction of processing;
object to processing if it is based on a legitimate interest;
withdraw consent if processing is based on consent;
request data portability, if applicable;
not be subject to a decision based solely on automated processing, if such a right applies;
lodge a complaint with the competent supervisory authority.

If Oblakkarte processes your data as a processor on behalf of the organizer, we may forward your request to the organizer or involve them in processing your request, if necessary.

13. How to exercise your rights

You can send a request regarding your personal data to: [email protected]

We may ask you to verify your identity if necessary to protect your data and prevent unauthorized disclosure.

We will review your request within the timeframe and in accordance with the procedures set forth in applicable law.

14. Complaints to the supervisory authority

If you believe that the processing of your personal data violates applicable law, you have the right to file a complaint with the competent supervisory authority.

For the Republic of Serbia, this body is:

Commissioner for Information of Public Importance and Personal Data Protection
15 King Alexander Boulevard, 11120 Belgrade, Serbia
Website: poverenik.rs
Email: [email protected]

If the laws of another country or jurisdiction apply to your situation, you may also contact the relevant competent supervisory authority in the place where you habitually reside, work, or where the alleged infringement occurred, provided that such a right is provided for by applicable law.

15. Data Security

Oblakkarte implements reasonable technical and organizational measures to protect personal data, taking into account the nature of the data, the risks associated with processing, and available technologies.

Such measures may include:

access control;
authentication and account management;
event logging;
backup;
encryption and data transmission protection where appropriate;
security monitoring;
internal incident response procedures.

However, no method of data transmission or storage can guarantee absolute security.

16. Children's data

The Oblakkarte service is not intended for use by children on their own in violation of applicable laws.

If you believe that a child has provided us with personal data in violation of the law, please contact us at [email protected], and we will consider deleting the data or taking other appropriate action.

Organizers using Oblakkarte for events aimed at children are solely responsible for complying with applicable laws regarding the processing of minors’ data, including obtaining the necessary consents and informing legal guardians where required.

17. Third-party websites and services

The Oblakkarte website and service may contain links to third-party websites, services, applications, and platforms.

Use of Evenda as a separate service is covered by Evenda’s privacy policy. Third-party services, including payment provider websites, may have their own policies. This Policy covers only processing within the Oblakkarte services described here.

18. Changes to the Policy

Oblakkarte reserves the right to amend this Policy from time to time.

The latest version is always posted on the website. If the changes are significant, we will make every effort to notify users in a reasonable manner, such as via the website, email, or your account dashboard.

By continuing to use the website or service after the new version takes effect, you acknowledge that you have read the updated Policy.

19. Contact Information

If you have any questions about this Policy or the processing of personal data, please contact us at:

ZURKA CE BITI DOO Beograd
PIB: 114432064
MB: 22023195
Kraljice Natalije 11, Beograd, Serbia
[email protected]