When you use the Joomy platform (hereinafter: the Platform), we collect and process your personal data.
We process personal data in accordance with the Law on Personal Data Protection (Official Gazette of the Republic of Serbia, No. 87/2018), as subsequently amended (hereinafter: the "Law"), and other regulations governing this area.
In this Privacy Policy (hereinafter: the "Policy"), we explain what information we collect about you, why and on what legal basis we process it, who has access to it, how long we retain it, and what rights you have. Please read it carefully.
For questions regarding the processing of your personal data and the exercise of your rights, you may contact your employer using the contact details it has made available to you.
You may also contact us by email at support@joomy.app or in writing at Omladinskih brigada 86i, apartment 25, Belgrade-Novi Beograd. Where a request relates to processing that we carry out as a processor, we will, in accordance with our obligations to your employer and applicable regulations, forward your request to your employer or provide it with appropriate assistance in handling the request.
This Policy applies to all persons who use the Platform in connection with employment or another form of engagement with us (hereinafter: a User or you).
The Platform is an internal tool that we use for information sharing, communication, education, and HR processes.
The Platform was developed and is maintained by HR XCEL d.o.o. Beograd-Novi Beograd, with its registered office at Omladinskih brigada 86i, Belgrade-Novi Beograd, company registration number: 21362727, tax identification number: 110558281 (hereinafter: the "Processor"). The Processor processes your data solely on the instructions and on behalf of your employer, under the personal data processing agreement we have concluded with it.
The Commissioner is the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11000 Belgrade, email: office@poverenik.rs, telephone: +381 11 3408 900.
We collect your data in three ways:
from you - when you enter information in your profile, submit requests, attend training, publish content, or otherwise use the Platform's functionality;
from your employer - when it provides or makes available to us personal data collected in connection with your employment so that it can be entered and processed through the Platform;
automatically - when technical data is generated while you use the Platform, such as device information, your IP address, and records of your actions on the Platform.
When you use the Platform, we process the following personal data:
first and last name;
date and place of birth;
permanent or temporary residential address;
business email address and business telephone number;
private email address and private telephone number, if you have provided them to us;
position, organisational unit, and information about your engagement;
education and work experience data;
data about absences and the grounds for them;
data about training, tests, and results achieved, including points, badges, and other data generated through the rewards functionality;
documents made available to you through the Platform;
content you enter yourself - profile information, posts, comments, and attached files;
technical data relating to your use of the Platform;
salary and other employment-related remuneration data and current account details, if payslips or other documents containing such data are provided to you through the Platform.
In addition, we process the following special categories of personal data to a limited extent:
health data, solely to the extent that it is contained in records of absence due to temporary incapacity for work or in documents made available through the Platform. We process this data to comply with our obligations under employment and social security regulations;
data concerning religious beliefs, solely because, when exercising the right to absence for a family patron saint day or religious holiday, you are required to state the basis for the absence. We record the type and date of absence, rather than your religion as such. We process this data to comply with our obligations under employment regulations.
Every processing activity we carry out has a purpose and a legal basis:
| Purpose of processing | Legal basis |
|---|---|
| Maintaining HR records, processing absence requests, delivering documents, and other processes arising from your employment | Performance of an employment contract or other engagement agreement and compliance with the controller's legal obligations |
| Internal information and communication, delivery of training and monitoring its implementation, ensuring Platform security and preventing misuse, and analysis of Platform use at an aggregate level | The controller's legitimate interest in organising work, informing employees, and protecting its operations |
| Processing your private email address and private telephone number if you do not have business contact details | Your consent |
| Processing content that you provide voluntarily, including posts, photographs, and information about additional training | Your consent |
| Processing the special categories of personal data referred to in Section 5 | Compliance with the controller's obligations under employment and social security regulations |
| Establishment, exercise, or defence of a legal claim | The controller's legitimate interest |
Use of the Platform is governed by your employer's internal policies. The legal basis for processing your data is set out in the table.
We retain personal data in accordance with applicable regulations and for the periods determined by your employer as the controller, which are established in accordance with the law and the personal data processing agreement. At the end of the relevant period, the data is erased or otherwise permanently removed, unless further retention is necessary to comply with a legal obligation.
We do not share your data with third parties for purposes not described in this Policy.
Your data may be accessed by:
employees of the controller who require access to perform their duties, to the extent appropriate to their role. Access rights and administrative permissions on the Platform are determined solely by us;
other Users, but only in relation to data that you have made visible through Platform functionality, such as profiles, posts, and comments;
our employees who require such access to perform their duties, solely to maintain and enable the operation of the Platform and provide support;
our subprocessors engaged with the appropriate authorisation, a list of which forms an integral part of the personal data processing agreement;
competent public authorities, where the conditions prescribed by law are met.
The Processor must use your data solely in accordance with our instructions, must not share it with third parties without our consent, must ensure its confidentiality, and must implement appropriate safeguards.
The Platform may include artificial intelligence-based functionality provided by a third party selected by your employer. Content you enter into that functionality is transmitted to that provider, which acts as a subprocessor. Please do not enter personal data of other persons, health data, or other special categories of data through this functionality. Responses provided by this functionality may be inaccurate or incomplete and should not be relied upon without verification.
Independently of processing carried out on the controller's instructions, the Processor processes certain data to a limited extent for its own purposes: managing access accounts, maintaining security logs, and recording support requests. In relation to that processing, the Processor acts as an independent controller.
Your personal data is stored and processed in the Federal Republic of Germany.
We implement appropriate technical, organisational, and personnel measures to protect your data against unauthorised or unlawful access, alteration, loss, or destruction. We have imposed the same obligations on the Processor by contract.
Nevertheless, please note that no system can completely eliminate every risk. You should therefore keep your access credentials confidential and notify us without delay if you suspect that someone has accessed your account without authorisation.
You have the following rights in relation to the processing of your personal data:
You have the right to ask us to confirm whether we process your personal data and to obtain access to that data and a copy of it.
This right also includes the right to receive information about the purpose and legal basis of processing, the categories of data, recipients or categories of recipients, the retention period or the criteria used to determine it, your rights to rectification, erasure, restriction of processing and objection, and your right to lodge a complaint with the Commissioner.
If you believe that your data is inaccurate, incomplete, or outdated, you have the right to request its rectification or completion. You may also update some data yourself in your profile on the Platform.
You have the right to request the erasure of your data where the conditions prescribed by the Law are met. You may not exercise this right where there is a legal obligation to retain the data or another legal basis justifying continued processing, such as the establishment, exercise, or defence of a legal claim.
You have the right to request restriction of processing in the cases prescribed by the Law, particularly if you contest the accuracy of the data, if you consider the processing unlawful but oppose erasure, if we no longer need the data but you require it for a legal claim, or while the merits of your objection are being assessed.
For the duration of the restriction, your data may, unless you have consented to other processing, be processed only for storage, the establishment, exercise, or defence of a legal claim, the protection of the rights of another person, or important reasons of public interest.
You have the right to request that data concerning you which has been provided to us be supplied to you in a structured, commonly used, and machine-readable format. You may exercise this right where processing is based on your consent or the performance of a contract and is carried out by automated means.
You have the right to object to processing based on our legitimate interests. In that case, we will stop the processing unless we demonstrate compelling grounds for processing that override your interests, rights, and freedoms, or unless processing is necessary for the establishment, exercise, or defence of a legal claim.
Where processing is based on your consent, you have the right to withdraw it at any time by contacting your employer. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
We respond to your request without delay and no later than 30 days after receiving it. Where additional time is required due to the complexity or number of requests, this period may be extended by up to 60 days, and we will inform you of the extension and the reasons for it in a timely manner.
If we do not act on your request, we will inform you of the reasons within 30 days of receipt.
If a request is manifestly unfounded or excessive, particularly because it is repeated frequently, we may charge a reasonable administrative fee or refuse to act on it.
If you believe that your data is being processed unlawfully, you have the right to lodge a complaint with the Commissioner using the contact details set out in Section 3 of this Policy.
A cookie is a small text file stored on your device that enables certain parts of the Platform to function.
We use the following cookies on the Platform:
This Policy takes effect on 9 September 2026.
We may amend this Policy. An amended version takes effect on the date it is published on the Platform. If the amendments materially affect the processing of your data, we will inform you in a timely manner before they take effect.