Privacy Policy

Effective Date: July 24, 2026

Last Updated: July 24, 2026

1. Introduction

This Privacy Policy explains how personal data is processed when you use the EXLRT NS Office mobile application (the "App").

The data controller responsible for processing personal data is:

EXLRT d.o.o.
Registered address: Mornarska 7, 21000 Novi Sad, Serbia
Company registration number: 20363380

For privacy-related questions or to exercise your data protection rights, please contact:

privacy@exlrt.com

For general technical support, contact:

mobile-dev@exlrt.com

2. Information We Process

Access to the App’s features requires a company account.

We process the following information:

  • name and EXLRT company email address;
  • company-account or Microsoft Entra identifier;
  • authentication and authorization information;
  • the gate or entrance involved;
  • whether the gate-opening request succeeded or failed;
  • security and audit records associated with use of the App; and
  • diagnostic logs voluntarily shared with EXLRT technical support.

EXLRT obtains account and authorization information from its company identity-management systems and authorized EXLRT administrators. Gate-opening and audit records are generated when you use the App.

3. Analytics, Diagnostics, and Local Logs

The App does not include third-party analytics SDKs or crash-reporting tools.

The App may generate diagnostic logs containing technical information about its operation. These logs are stored locally on your device and are not automatically transmitted to us or any third party.

You may choose to export and share the logs as a compressed ZIP file, for example when requesting technical support. Sharing is entirely optional, and you control whether the logs are shared and who receives them. Once you share the logs, their handling is subject to the privacy practices of the chosen recipient or sharing service.

If you choose to send diagnostic logs to EXLRT technical support, EXLRT will process the logs only to investigate the reported technical, operational, or security issue. The logs will be accessible only to authorized personnel and will be retained for 90 after the related support request is resolved, unless a longer period is necessary to investigate a security incident, establish or defend legal claims, or comply with an applicable legal obligation.

Depending on your device settings and platform configuration, Apple or Google may separately collect diagnostic or crash information relating to the operation of the App. Any such processing is governed by Apple’s or Google’s respective privacy policies.

4. Purpose of Processing

We use the information we collect for the following purposes:

  • authenticating EXLRT employees;
  • processing and executing gate-opening requests;
  • managing access to EXLRT parking facilities;
  • maintaining gate-access audit records;
  • preventing and investigating unauthorized access or misuse;
  • diagnosing technical issues;
  • providing technical support;
  • compliance with applicable legal and regulatory obligations and enforcement of EXLRT’s parking-access, physical-security, and information-security policies.

EXLRT does not use personal data processed through the App for advertising, marketing, or user profiling purposes.

Gate-opening and access records are used for parking-access management, operational, security, and audit purposes and are not used to monitor employee productivity, performance, or working hours.

5. Legal Basis for Processing

EXLRT processes personal data in accordance with the Serbian Law on Personal Data Protection and, where applicable, the General Data Protection Regulation (“GDPR”), relying on the following legal bases:

  • Article 12(1)(6) of the Serbian Law on Personal Data Protection and Article 6(1)(f) GDPR (Legitimate Interests): EXLRT processes personal data where necessary for its legitimate interests in authenticating authorized employees, managing and securing access to its parking facilities, recording and investigating access events, preventing misuse and unauthorized entry, protecting employees and property, and maintaining the security, stability, and technical operation of the App. EXLRT assesses these interests against the rights and freedoms of affected employees.
  • Article 12(1)(3) of the Serbian Law on Personal Data Protection and Article 6(1)(c) GDPR (Legal Obligation): EXLRT may process personal data where necessary to comply with an applicable legal or regulatory obligation.

6. Data Sharing

EXLRT does not sell, rent, or trade your personal data.

Personal data may be accessed by or disclosed to the following recipients where necessary for the purposes described in this Privacy Policy:

  • authorized EXLRT IT and system-administration personnel responsible for operating, maintaining, and securing the App and related systems;
  • authorized EXLRT facilities, office-management, parking, and security personnel responsible for managing access to company parking facilities and investigating access-related incidents;
  • authorized EXLRT privacy, legal, human resources, or management personnel where access is necessary for a legitimate and authorized business, security, compliance, or legal purpose;
  • Microsoft and other contracted technology service providers used for authentication, infrastructure, hosting, maintenance, or technical support;
  • professional advisers, such as legal counsel, auditors, or insurers, where necessary and subject to appropriate confidentiality obligations; and
  • courts, regulators, law-enforcement authorities, or other public authorities where disclosure is required by applicable law or a valid legal request.

Access to personal data within EXLRT is limited according to each person’s role and legitimate need to access the information.

Where third-party service providers process personal data on behalf of EXLRT, they are required to process it only in accordance with EXLRT’s instructions, applicable data-protection law, and appropriate contractual confidentiality, security, and data-protection obligations.

7. International Data Transfers

Personal data may be processed in Serbia and in other countries where Microsoft or its authorized subprocessors provide the services used by the App.

Where personal data is transferred outside Serbia or, where the GDPR applies, outside the European Economic Area (“EEA”), EXLRT uses safeguards required by applicable data-protection law. Depending on the circumstances, these safeguards may include an applicable adequacy decision, standard contractual clauses, or another legally recognized transfer mechanism.

Further information about the safeguards applicable to a particular transfer may be requested by contacting privacy@exlrt.com.

8. Data Retention

Gate-opening, access, and related audit records are retained for one year from the date of the recorded event, unless a longer period is necessary to investigate a security incident, establish or defend legal claims, or comply with an applicable legal obligation.

App-related account, authentication, authorization, and parking-access information is processed for as long as you remain authorized to use the App. Access permissions are removed or deactivated when your authorization to use the App ends, subject to applicable legal, security, employment, and record-retention requirements.

Diagnostic logs stored locally on your device remain on the device until they are automatically overwritten, deleted through the App, or removed when the App is uninstalled.

Diagnostic logs voluntarily submitted to EXLRT technical support are retained for 90 after the related support request is resolved, unless a longer period is necessary for security investigation, legal compliance, or the establishment, exercise, or defence of legal claims.

When a retention period expires, personal data is deleted or anonymized unless continued retention is required or permitted by applicable law.

9. Security

The Controller implements appropriate technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, or destruction, taking into account the nature of the processing and the available technology.

Although no method of electronic transmission or storage is completely secure, reasonable measures are taken to safeguard personal data.

10. Your Rights

Where applicable, including under the Serbian Law on Personal Data Protection and the General Data Protection Regulation (“GDPR”), you may have the following rights in relation to your personal data, subject to the conditions and limitations established by applicable law:

  • request confirmation as to whether your personal data is being processed and obtain access to that personal data;
  • request correction of inaccurate or incomplete personal data;
  • request deletion of your personal data;
  • request restriction of the processing of your personal data;
  • object to processing based on legitimate interests;
  • request the portability of personal data you provided, where applicable;
  • lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia or, where applicable, with the competent data protection supervisory authority in an EU or EEA country.

The App does not use personal data to make decisions based solely on automated processing that produce legal or similarly significant effects.

App Data Deletion Requests

You may request deletion of personal data associated with your use of the App by sending an email to privacy@exlrt.com. A deletion request does not delete your underlying EXLRT company or Microsoft account, which is managed separately in accordance with EXLRT’s employment, identity-management, and record-retention procedures.

Deletion of App-related account, authorization, or parking-access information may prevent you from using the App or opening the office parking gate. EXLRT manages App access and parking permissions through authorized administrators. Where necessary, a deletion request may be coordinated with authorized EXLRT IT, facilities, HR, security, or privacy personnel to verify and process the request.

The right to deletion is not absolute. EXLRT may retain specific information, including gate-access and security audit records, where and for as long as retention is necessary:

  • to comply with an applicable legal or regulatory obligation;
  • to establish, exercise, or defend legal claims;
  • to investigate an ongoing or suspected security incident, unauthorized access, misuse, or fraud, where permitted by applicable law; or
  • where EXLRT demonstrates compelling legitimate grounds for continued processing that override the deletion request, as permitted by applicable law.

Where information must be retained, it will be limited to what is necessary, protected in accordance with this Privacy Policy, and deleted or anonymized when the applicable retention period expires.

We may request reasonable information to verify your identity before acting on a request. We will respond without undue delay and within the period required by applicable law. If we cannot comply with all or part of your request, we will explain the reasons for our decision and inform you of the available complaint and judicial remedies, unless applicable law prevents us from doing so.

11. Children's Privacy

The App is intended only for EXLRT employees who have been expressly authorized to use it. The App is not offered to the general public and is not directed to children.

EXLRT does not knowingly process personal data through the App in relation to anyone who is not authorized to use it. If EXLRT becomes aware that such information has been processed, appropriate steps will be taken to restrict access and delete the information where required by applicable law.

12. Changes to This Privacy Policy

This Privacy Policy may be updated from time to time to reflect changes to the App, applicable law, or our data processing practices.

The current version will always be available at the App's published Privacy Policy URL together with the updated Effective Date and Last Updated date.

13. Contact

For questions regarding this Privacy Policy or the processing of personal data, please contact:

EXLRT d.o.o.
Mornarska 7, 21000 Novi Sad, Serbia
Email: privacy@exlrt.com

For technical support:

mobile-dev@exlrt.com