1. Scope and controller
Platform operator: MARKO RATIĆ PR RAČUNARSKO PROGRAMIRANJE WEBTRIBE BEOGRAD-NOVI BEOGRAD, trading as Webtribe, Belgrade, Serbia.
Business registration number: 62953349 · Tax identification number (PIB): 107734033.
Contact: support@birdwatch.info. Privacy requests: privacy@birdwatch.info or the support address above.
This notice applies to the extent that processing is subject to the EU General Data Protection Regulation (GDPR) or the UK GDPR and relevant UK law. Applicability depends on the processing and territorial rules, not simply on citizenship. It supplements our Privacy Policy, which describes information, sources, recipients, browser storage and retention criteria.
Webtribe is the controller for operating BirdWatch. Independent organizers generally act as separate controllers for their own quotations, booking relationships and travel services. The privacy contact above handles requests; it is not a claim that a statutory data protection officer or an EU or UK representative has been appointed.
2. Purposes and legal bases
A legal basis is assessed for a specific purpose, not applied indiscriminately to all data. The relevant bases are:
| Activity | Relevant basis and limits |
|---|---|
| Requested account and inquiry services | Performance of a contract with you, or steps you request before a contract, where the processing is objectively necessary to provide that service. This does not mean BirdWatch is a party to the organizer's travel contract. |
| Business contacts and listing administration | Contract where the individual is the contracting party; otherwise legitimate interests in communicating with authorized business representatives and maintaining relevant listings, subject to balancing their rights. |
| Security, abuse prevention and support | Legitimate interests in maintaining a secure, functional service and handling complaints; legal obligation where a specific applicable law requires action. |
| Legal and compliance records | Compliance with applicable legal obligations, or legitimate interests in establishing, exercising or defending legal claims, limited to information needed for that purpose. |
| Public guest stories and personal media | Consent where publication is based on an individual's permission. An intellectual property license and a data protection basis are separate questions. |
| Optional measurement and marketing | Consent where required by data protection or electronic communications law. A legitimate-interest assessment for limited service analysis does not remove a separate requirement for consent to device storage or tracking. |
Legitimate interests are not an unrestricted permission. Processing must be necessary and proportionate, and your interests and fundamental rights must be considered. You may object on grounds relating to your situation. Acceptance of the Terms, silence or merely continuing to browse does not provide consent for a purpose that requires a freely given, specific, informed choice.
3. Sources and required information
We receive information from you and your browser, from Google if you choose its sign-in service, and from organizers or people authorized to act for you. Professional profile material may come from organizer submissions, correspondence and relevant public business sources.
Where information is obtained indirectly and notice is required, it must be provided within the applicable period, normally within one month under the EU GDPR, or earlier at the first communication or disclosure where required, unless a lawful exception applies.
Fields marked as required are needed for the relevant account or request; without sufficient name, contact or message information, for example, we may be unable to provide that service. Optional information is not required merely to browse. Do not include special-category information, such as detailed health data, in a general inquiry. Any necessary processing of such information requires an additional lawful condition and appropriate safeguards.
4. Recipients and international processing
BirdWatch is operated from Serbia. Relevant organizers may be located in the country of the requested experience. Hosting, email, Google features and other service providers may also involve processing outside the EEA or UK. Sharing an inquiry can therefore involve countries with different legal protections.
Where a disclosure is a restricted international transfer, the applicable law requires a valid transfer mechanism and any necessary additional safeguards before it takes place. Depending on the circumstances, mechanisms can include an applicable adequacy decision, approved contractual safeguards with the required assessment, or a narrowly applicable statutory exception. A generic mention of standard contractual clauses does not establish that every recipient or transfer is covered.
Submitting an inquiry or accepting our Terms is not blanket consent to every international transfer. You may ask the privacy contact which recipient, country and transfer mechanism apply to your information and request information about or a copy of applicable safeguards, subject to necessary redactions. A separate organizer's privacy information should explain its own processing and onward disclosures.
5. Retention and purpose limits
The Privacy Policy explains retention by record type: accounts, inquiries and email correspondence, public contributions and permission records, operational logs and backups. Relevant criteria include whether a service or inquiry remains active, the last substantive contact, the trip date, a legal retention requirement and applicable claim periods.
A device cookie expiring does not automatically erase a server record. Conversely, keeping a record for a legal claim does not justify unrelated marketing use. Requests for erasure or restriction are assessed against the actual purpose and any applicable exception. Ask us for the period or criteria applying to your particular record.
6. Your rights
- Access
- Ask whether we process your personal data and request a copy and the information required by law.
- Rectification
- Ask us to correct inaccurate information or complete information that is incomplete for its purpose.
- Erasure
- Ask for deletion where the legal conditions apply, for example when information is no longer needed or consent is withdrawn and there is no other basis. Legal obligations and the establishment or defense of claims can justify retaining limited records.
- Restriction
- Ask us to limit use in the circumstances specified by law, including while certain accuracy or objection issues are resolved.
- Portability
- Where automated processing is based on consent or contract, request the data you provided in a structured, commonly used, machine-readable format and transmission to another controller where technically feasible.
- Objection
- Object to processing based on legitimate interests on grounds relating to your situation. We must stop unless the applicable legal conditions for continuing are met. You may object to direct marketing at any time; this also covers profiling related to that marketing.
- Withdrawal of consent
- Where consent is the basis, you can withdraw it without affecting processing already lawfully carried out before withdrawal. Withdrawal does not itself end processing justified by a separate, valid legal basis for a different purpose.
- Automated decisions
- Applicable law protects you against certain decisions based solely on automated processing that have legal or similarly significant effects. Automated page ordering or a technical security check is not automatically such a decision. Contact us if you believe a decision affecting you requires explanation or human review.
These rights have conditions and exceptions; none permits us to disregard another person's rights. If a request cannot be fully granted, we will explain the applicable reason and available complaint routes as required by law.
7. How to make a request
Email privacy@birdwatch.info or support@birdwatch.info, preferably from the address associated with the account or inquiry. State the right or outcome you seek and identify the relevant account, tour, message or public page. You do not need to use legal terminology or a particular form.
We may request proportionate additional information if there are reasonable doubts about identity or authority. Do not send a passport or other identity document unless we explain why it is necessary and how to provide it appropriately.
For EU GDPR requests, we respond without undue delay and normally within one month of receipt. Where legally permitted because of complexity or the number of requests, this can be extended by up to two further months; we will explain an extension within the initial month. UK requests follow the applicable UK time-limit and clarification rules. Applicable Serbian deadlines also remain binding.
Requests are normally free. A reasonable fee or refusal is possible only where the relevant law allows it, such as a demonstrably manifestly unfounded or excessive request, and must be explained. If the information is controlled by an independent organizer, we will clarify that distinction rather than promise deletion from systems we do not control.
8. Complaints and remedies
We welcome the opportunity to address a concern, but you may complain directly to a competent data protection authority. Under the EU GDPR this includes an authority in the Member State of your habitual residence, place of work or the alleged infringement. In the UK, the authority is the Information Commissioner's Office (ICO). In Serbia, it is the Commissioner for Information of Public Importance and Personal Data Protection.
This notice does not restrict access to a court, compensation or other remedies available under applicable law. No BirdWatch term requires you to waive data protection rights.
9. Changes to this notice
We will update this notice when relevant practices or legal requirements change and show the revised date. Where required, we will give additional information before processing for a new purpose. A notice update alone does not create consent or establish a missing legal basis.