In accordance with the Law on Personal Data Protection (Official Gazette of Montenegro, No. 133/26 of 11 September 2026) and international standards in the field of personal data protection, in particular those prescribed by Regulation (EU) of the European Parliament and of the Council of 27 April 2016. on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), the NGO "Center for Youth Education" (hereinafter: NGO COE) adopted 

PRIVACY POLICY

Before you make your personal data available to us, please read this act carefully, in order to inform you about the manner of processing this data, as well as about the rights that belong to you in accordance with the applicable regulations on personal data protection.

Subject

This act aims to regulate the manner in which the NGO COE collects and processes personal data of beneficiaries of its programs, volunteers, employees and other natural persons with whom it cooperates within the framework of projects and programs it implements, in particular within the framework of the "European Youth Card" program (hereinafter: EYC program).

This act regulates in particular: the purpose and legal basis of the processing of personal data, the categories of data processed, the manner of their collection and processing, retention periods, protection measures, the conditions under which the data may be made available to third parties, as well as the rights of the data subject and the manner of their exercise.

The provisions of the Law on Personal Data Protection (hereinafter: LPDP) shall apply accordingly to all issues not regulated by this Policy.

Definition

For the sake of proper understanding and application of this Policy, certain terms have the following meanings:

  • Personal data means all information relating to an identified or identifiable natural person, such as: name and surname, date of birth, unique identification number, address of residence, ID number, EYC serial number, bank account number, telephone number, e-mail address, data on the use of digital services and other data that can be linked to a natural person; 
  • Personal data processing means any operation which is performed on personal data, by which they are automatically or otherwise collected, recorded, recorded, organised, stored, modified, withdrawn, used, disclosed by transmission, published or otherwise made available, classified, combined, deleted, destroyed, etc.;
  • The personal data collection is a structurally regulated set of personal data that are the subject of processing by the controller and that may be available in accordance with the prescribed criteria;
  • Controller of the personal data collection is a natural or legal person, state body, state administration body, local self-government body or local government and any other entity exercising public authority, which determines the purpose and manner of processing personal data;
  • Processor of personal data is a natural or legal person, state body, state administration body, local self-government body or local government and any other entity exercising public authority, to which the controller of the personal data collection entrusts, on its behalf and in accordance with the rules referred to in this act, to perform tasks related to the processing of personal data;
  • The recipient of personal data is any natural or legal person, state body, state administration body, local self-government body or local government and other entity exercising public authority, which has the right to process personal data, and is not the person whose personal data are processed, the original controller of the personal data collection, the personal data processor or the person employed by the controller of the personal data collection or the personal data processor;
  • Consent is a freely given, informed and unambiguous statement of the will of the data subject, on the basis of which he or she consents, in writing or electronically, to the processing of his or her personal data for a specific purpose;
  • NGO COE beneficiary means a natural person who participates in the activities, projects and programmes implemented by the NGO COE and/or uses the services provided by the NGO COE, including beneficiaries of the EYC programme; 
  • Service communication means communication required for the realization and exercise of the rights of beneficiaries of the NGO COE program, including communication for the purpose of submitting and registering an application, issuing, activating and providing support when using the EYC; 
  • Promotional communication is communication to beneficiaries of the NGO COE program, which aims to inform them about benefits, activities, campaigns, partner offers and other content related to the NGO COE programs, when there is an appropriate legal basis for such communication.

Pursuant to paragraph 1, item 4, the controller of the personal data collection, for the purposes of this privacy policy, is the NGO COE, when it independently determines the purpose and manner of personal data processing within its activities, projects and programs, except when otherwise provided by the Policy, LPP, contract or other relevant legal act.

Principles of personal data processing

The NGO COE processes personal data in accordance with the following principles:

  • Legality: Personal data held by the NGO COE shall be processed in accordance with applicable national and international regulations;
  • Transparency: Personal data are processed in a way that enables the data subject to be clearly, timely and understandably informed about who processes his/her data, for what purposes, on what legal basis, which categories of data are processed, to whom the data can be made available, how long they are stored and what rights that person has in relation to data processing;
  • Purposefulness: Personal data shall be processed exclusively for the expressly stated purposes;
  • Proportionality: The processing of personal data is limited only to those data that are necessary to achieve the purpose of the processing; 
  • Accuracy: The personal data processed must be accurate and complete, and the data controller is obliged to take all measures to correct inaccurate data as soon as possible; 
  • Limitation of storage: Personal data are stored for as long as necessary to achieve the purpose of their processing; 
  • Security: Personal data is processed in a way that guarantees its security and protection against unlawful and unauthorized processing. 

Purpose and legal basis of personal data processing

The NGO COE shall process personal data on the basis of the consent of the natural person to whom the data relate and for the purpose of fulfilling its pre-contractual or contractual obligations towards natural persons whose personal data are processed, and for the implementation of its project and program activities, within which the processing of personal data is necessary to provide access to services, programs or benefits provided by the NGO COE.

Data processing based on the consent of the NGO COE shall be carried out exclusively for clearly defined and lawful purposes, depending on the specific program, project, activity, service or legal relationship with the data subject, and in particular, but not exclusively, for the purpose of:

  • Submitting and registering an EYC application, as well as verifying eligibility;
  • Issuing an EYC serial number, activating and using a physical and/or digital EYC, administering user status and enabling the use of available benefits;
  • Activations and uses of the myEYC application;
  • Receiving and processing the request for approval of the Friendly Package and forwarding the data to AD "NLB Banka" in order to continue the procedure, after which AD "NLB Banka" acts as the user of the forwarded data;
  • Receiving and processing the request for approval of the One Vibe package and forwarding the data to the LLC “One Montenegro” in order to continue the procedure, after which the LLC “One Montenegro” acts as a user of the forwarded data;
  • Applications for participation, records of participation, issuance of a certificate or certificates of participation, and reporting on participation in other programs, projects and/or activities of the NGO COE; 
  • Realization of cooperation with state bodies, state administration bodies, local self-government bodies or local government, educational institutions, universities and other entities, in connection with programs, projects, activities and services implemented or provided by the NGO COE;
  • Sending service notifications regarding the application, issuance, activation, administration, security, support and use of the EYC card or other services provided by the NGO COE;
  • Responding to submitted inquiries and achieving communication and cooperation with partners, donors, suppliers and other entities relevant to the implementation of programs, projects and/or activities of the NGO COE;
  • Enabling the operation, maintenance, implementation of analytics, improvement of user experience and security of websites, applications and other digital services of NGO COE;
  • Achieve informative and promotional communication about benefits, activities, campaigns, partner offers and other content within the programs, projects and/or activities of the NGO COE. 

Method of informing and giving consent

The NGO COE shall ensure that the person to whom the personal data relate, prior to their submission, is informed of the purpose of the processing, the categories of data to be processed and the rights that belong to him on the basis of the processing, by referring to this act, by means of a special notice, form, electronic form or other appropriate means.

Consent must be freely given, informed and declared for a specific purpose. It may be given in writing, electronically, by submitting an application or application, by a certificate through an appropriate form or by other means that allow reliable identification of the person giving consent.

The person may withdraw consent at any time, in whole or in part. The withdrawal of consent does not affect the lawfulness of the processing carried out before the withdrawal.

The revocation of consent takes legal effect from the moment the NGO COE receives a proper request for revocation and from that moment the personal data are no longer processed for the purposes to which the revocation relates, unless there is another appropriate legal basis for further processing in accordance with the LPPoL.

The revocation of consent for promotional communication does not affect the right to use EYC or other NGO COE services, nor the data processing necessary for the implementation of programs, projects and activities or the fulfillment of legal obligations.

Forms for granting and revoking consent are available on the official website of the NGO COE and the website of the EYC program.

The processing of personal data without consent may be carried out only in exceptional cases, which are prescribed by Article 10, paragraph 2 of the LPPoL.

Giving consent to minors

Where the processing of personal data is based on consent and is carried out in connection with the direct provision of information society services to a child, the child who is at least 16 years old may independently give his or her consent to the processing of his or her personal data.

If the child is under 16 years of age, the processing of their personal data on the basis of consent is allowed only if the consent has been given or approved by the holder of parental authority over the child, in accordance with the law.

Collection and processing of personal data

As a rule, NGO COE collects personal data directly from the data subject. 

Exceptionally, NGO COE may also collect data indirectly, from state bodies, state administration bodies, local self-government bodies or local government and other entities, when there is an appropriate legal basis for such collection in accordance with this Act and the LPP.

In certain cases, NGO COE may also process personal data available from public sources, all in accordance with the LPPoL and this Policy.

Data may be collected through written and electronic forms, websites, applications, as well as other channels used by NGO COE as part of its programs, projects, activities and for the purpose of providing services.

Categories of personal data being processed

The NGO COE processes personal data to the extent necessary to achieve the specific purpose of processing, depending on the program, project, activities it implements or the service it provides.

The data processed may include, in particular, but not exclusively: name and surname, date of birth, unique identification number (UMCN), address of residence, telephone number, e-mail address, data from personal documents submitted for inspection, bank account number, as well as information on used communication channels and digital applications. 

Special categories of personal data are processed by the NGO COE only exceptionally, when there is an explicit consent of the data subject or other appropriate legal basis prescribed by law, with the application of special measures to protect against unauthorized access and processing.

Photos, videos, and more from your activity

NGO COE may, as part of its programs, projects or activities, process photographs, videos and other audio-visual material of participants, participants and other present persons, for the purpose of documenting, reporting, informing and promoting its activities. This processing is carried out on the basis of an appropriate legal basis, depending on the nature of the activity, how the material is used and the category of data subject. 

When the material relates to minors or is used in a way that may have a wider public outreach, the NGO COE will apply additional care and, where necessary, obtain appropriate consent.

Controller of the personal data collection 

The controller of the personal data collection, within the meaning of this Policy, is NGO COE, based in Podgorica, at the address: Bulevar Mihaila Lalića, Science and Technology Park of Montenegro, Office No. 27/2, Podgorica 81000.

The contact details of the NGO COE are as follows:

Phone number: +382 67 018 959;
E-mail address: info@nvocoe.me;
NGO COE website: https://www.nvocoe.me;
EYC program website: https://www.omladinskakartica.me. 

The person authorized to protect personal data in the NGO COE is the person designated by the decision of the authorized representative. 

All requests regarding the exercise of rights under this Policy may be submitted via the specified e-mail address or in writing to the address of the headquarters of the NGO COE. 

Access to and disclosure of personal data to third parties 

Internal access to personal data

Access to personal data is granted to the person authorized to represent the NGO COE, as well as to other employees of the NGO COE, who are specifically authorized to process personal data, to the extent necessary for the performance of specific tasks within the business of the NGO COE, in accordance with the purposes of processing.

When processing personal data, the persons referred to in the previous paragraph shall act exclusively according to the instructions of the NGO COE, in accordance with this Act, as well as not to use the data for their own purposes.

Third parties as processors of personal data

NGO COE may, for the purpose of implementing its programs, projects and/or activities, as well as providing services, entrust the processing of personal data to third parties, external, natural or legal persons (providers of services of development, maintenance and administration of Internet platforms, applications, electronic communication systems or other technical and administrative communication channels used by NGO COE), who, in their capacity as data processors, act exclusively according to the previously defined instructions of NGO COE.

Third parties to whom the NGO COE entrusts the processing of personal data do not use this data in their own name or for their own purposes, but exclusively in the name and on behalf of the NGO COE, on the basis of a contract concluded in writing. 

The contract regulates the rights and obligations of a third party as a processor, including the obligation to take all technical, personnel and organizational measures to protect data, in accordance with this Policy and the LPPoL.

Third parties as recipients of personal data

In certain cases, the NGO COE may make personal data available to third parties who use them for their clearly defined purposes, within the framework of a lawful legal basis. These persons are considered to be recipients of personal data and may not use data contrary to the purpose for which they were provided, nor process them beyond the extent necessary to achieve that purpose.

Beneficiaries can be: partner organizations within joint projects, donors and sponsors for reporting on the results of activities, external consultants, expert associates and associates engaged in the implementation of individual segments of the program, projects and/or activities of the NGO COE. 

Access to personal data is allowed to the user only if:

  • There is a clearly defined legal basis for the provision of data, such as a legal obligation or the express and informed consent of the data subject;
  • The purpose of the data processing by the user is not inconsistent with the purpose for which the NGO COE originally collected them;
  • Commits to take appropriate technical, personnel and organizational data protection measures, in accordance with this Policy and LPPoL.

Access to personal data by competent authorities

In accordance with the LPPoL and other applicable regulations in the field of personal data protection, NGO COE may, in cases prescribed by the LPPoL, submit data to the competent state authorities, such as: courts, prosecutor's office, police, Central Bank of Montenegro, etc.

Such access shall be granted only to the extent necessary for the exercise of the competences of those authorities, subject to compliance with the principles of legality, proportionality and purpose limitation.

Personal data protection measures

NGO COE takes appropriate technical, organizational and personnel measures to protect the personal data it processes, in accordance with the LPPoL. 

These measures include, but are not limited to:

  • Limited access to personal data exclusively to authorized persons;
  • Use of passwords and protection of computer systems on which data is stored;
  • Keeping records of data processing;
  • Obligation of employees and external associates to treat personal data as a business secret and not to disclose, use or make it available to unauthorized persons, neither during engagement with NGO COE nor after its termination, in accordance with LPPoL, other applicable regulations in the field of personal data protection and internal policies of NGO COE;
  • Regular updating and assessment of security measures in accordance with technical development and identified risks.

If there is a breach of security leading to destruction, loss, alteration, unauthorized disclosure or access to personal data, NGO COE will take reasonable measures to assess the risk, limit the consequences and remedy the cause of the incident.

Where necessary in accordance with applicable regulations, the NGO COE will inform the competent authority and/or data subjects of the personal data breach, in particular if the breach may result in a risk to the rights and freedoms of natural persons.

Rights of the data subject

The right to information and access to your personal data

The NGO COE is obliged, at the written request of any natural person, or their legal representative or proxy, and after determining the identity of that person, within 15 days from the date of submission of the request, to submit a written notice on whether personal data relating to that person are processed. 

In the event that data on this person are processed, the NGO COE is obliged to provide additional information in the notification on: 

  • Personal name or name and address of the controller of the personal data collection;
  • The personal name, i.e. the name and address of the place of residence or registered office of the personal data processor, where expressly required to do so;
  • Categories of data being processed;
  • Purpose and legal basis for data processing;
  • Data source according to available information;
  • A third party, i.e. a user of personal data; 
  • as well as other relevant notices regarding the processing. 

Right to amend and/or supplement personal data

The NGO COE is obliged, at the written request of the person whose data it processes, or his/her legal representative or proxy, within 15 (fifteen) days from the date of submission of the request, to supplement incomplete or amend inaccurate personal data. 

NGO COE is obliged to inform the data subject, i.e. his/her legal representative or proxy, within 8 (eight) days, about the completed amendment and/or modification of personal data.

If the NGO COE does not act in this way or rejects the request of the person whose data it processes, that person has the right to file a complaint with the NGO COE or to request the protection of rights with the Agency for Personal Data Protection and Free Access to Information (hereinafter: the Agency). 

Right to erasure of personal data

NGO COE is obliged, at the written request of the person whose data it processes, or his/her legal representative or proxy, within 15 days from the date of submission of the request, to delete personal data. 

The NGO COE is obliged to inform the data subject, i.e. his/her legal representative or proxy, about the deletion of personal data within 8 (eight) days.

If the NGO COE does not act in this way or rejects the request of the person whose data it processes, that person has the right to file a complaint with the NGO COE or to request protection of rights with the Agency. 

Right to object and request for protection of rights

If the NGO COE does not act on the request for information and/or access to personal data, their modification, amendment or deletion, the person whose personal data is processed, his/her legal representative or proxy, may file a complaint with the NGO COE or a request for the protection of rights with the Agency.

The NGO COE shall decide on the complaint within 15 days from the date of submission of the complaint. The Agency shall decide on the request for the protection of rights within 60 days from the date of submission of the request. 

Pending a decision, the Agency may, at the written request of the person who submitted the request for the protection of rights, i.e. his/her legal representative or proxy, temporarily prohibit further processing of personal data by a decision, if there is or has been a probable violation of the rights determined by the LPDP.

Time period of personal data retention

NGO COE will keep personal data for as long as necessary to achieve the purpose for which they were collected, i.e.:

  • Until the expiration of the legally prescribed deadlines;
  • While there is a legitimate interest in processing them; or
  • While the consent given by the person is valid, in the case where the processing is based on consent.

After the expiration of the relevant deadlines or the termination of the legal basis for processing, the data will be permanently deleted, destroyed or anonymized, in accordance with the applicable regulations.

Final provision

NGO COE reserves the right to amend or supplement this Policy.

All matters not specifically regulated by this Policy shall be subject to the applicable regulations of Montenegro governing the protection of personal data, privacy and other matters of importance for the processing of personal data.

Updated versions of the Policy will be published on the official website of the NGO COE, as well as on the website of the EYC program.

This Policy enters into force 25 September 2026, and shall apply from the date of its publication on the official website of the NGO COE and the website of the EYC program.
Document