Privacy Policy.

DEFCROS 2026 – Privacy Policy

General Data Protection Regulation (GDPR) (EU) 2016/679 Compliance

Version: 1.1 | Date: September 2026
Effective Date: January 6, 2026 | Last Updated: September 26, 2026

1. Introduction and Commitment to Privacy

Sky Fort Systems d.o.o. (“We,” “Us,” “Our,” or “Organizer“) operates DEFCROS Public Safety & Defense Expo 2026 (“Event“). We are committed to protecting your privacy and ensuring you have a positive experience on our platforms and at our Event.

This Privacy Policy explains how we collect, use, process, and protect your personal data when you register for, participate in, or attend the Event. This Policy applies to all participants including Exhibitors, Sponsors, Delegations, and Business Visitors (collectively, “Participants” or “You“).

We comply fully with the General Data Protection Regulation (GDPR) (EU) 2016/679 and other applicable data protection laws in Croatia and the European Union.

2. Identity of the Data Controller and Supervisory Authority

2.1 Data Controller

The data controller responsible for your personal data is:

Sky Fort Systems d.o.o.
Gospodarska zona 10
31000 Osijek
Croatia
OIB (Tax ID): 88167585767
Email: [email protected]
Phone: +385 97 7486 986

2.2 Data Protection Officer

While not legally mandated, we have appointed an internal Data Protection Officer to oversee our privacy practices. For data protection inquiries, please contact: [email protected]

2.3 Supervisory Authority

You have the right to lodge a complaint with the competent supervisory authority:

Croatian Personal Data Protection Agency (Agencija za zaštitu podataka)
Selska cesta 130
10000 Zagreb
Croatia
Email: [email protected]
Website: www.azop.hr

3. What Personal Data We Collect

3.1 Categories of Personal Data

We collect the following categories of personal data, depending on your participant category and the services you receive:

3.2 Sensitive Data

We DO NOT intentionally collect sensitive personal data, such as data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, or data concerning sex life or sexual orientation.

Exception: If you voluntarily disclose such information in a free-text field (e.g., “dietary requirements” including religious considerations), we will treat it as sensitive data and apply heightened protections.

4. How We Collect Your Data

4.1 Direct Collection

We collect data directly from you when you:

• Complete the registration form on www.defcros.com or via Fillout.com (forms platform)
• Submit a sponsorship agreement or delegation registration
• Create an exhibitor account
• Communicate with us via email, phone, or in-person
• Visit our Event and provide information onsite
• Scan your badge or participate in onsite lead capture

4.2 Indirect Collection

In limited circumstances, we may receive your personal data from:

• Your organization (if registering as part of a delegation or group)
• Exhibitors or Sponsors (if they nominate you for event information or tickets)

5. Legal Basis for Processing

Under GDPR Article 6, we process your personal data based on the following lawful grounds:

5.1 Contractual Necessity (Article 6(1)(b))

We process data necessary to fulfill our contract with you, including:

• Event registration and confirmation
• Stand/booth allocation and logistics
• Payment processing
• Badge generation and onsite access
• Providing services or benefits associated with your participation

5.2 Legitimate Interest (Article 6(1)(f))

We process data for our legitimate business interests, including:

• Event organization & improvement: Analyzing attendance patterns, optimizing floor layouts, improving services
• Marketing & promotion: Sending event information, promotional materials, future event updates (subject to your consent and opt-out rights)
• Legal compliance: Maintaining records for audit, tax, and regulatory purposes
• Fraud prevention & security: Detecting unauthorized access or misuse of the Event
• Networking facilitation: Sharing attendee lists with Exhibitors, Sponsors, and Delegations (subject to opt-out rights)

These legitimate interests do not override your fundamental rights to privacy and data protection.

5.3 Consent (Article 6(1)(a))

We collect explicit, informed consent for:

• Email marketing: Receiving newsletters, promotional materials, and follow-up communications
• Data sharing: Sharing your information with Exhibitors, Sponsors, or third parties for networking purposes
• Cookies & tracking: Using non-essential cookies and analytics tools
• Photography/recording: Recording or photographing you at the Event for promotional purposes

Consent is freely given, specific, informed, and unambiguous. You may withdraw consent at any time by contacting us at [email protected].

5.4 Legal Obligation (Article 6(1)(c))

We process data as required by:

• Croatian employment law
• EU tax and accounting regulations
• Event safety and security regulations
• Export control and sanctions compliance checks

6. Purposes of Processing

6.1 Core Event Purposes

We process your personal data for the following purposes:

1. Event Registration & Confirmation

• • Process your registration, issue confirmation emails, and send event updates
  • Allocate stand space, sponsorship benefits, or delegate passes

1. Event Organization & Logistics

• • Create badges and credentials
  • Manage onsite access and security
  • Coordinate meals, accommodations, or special services
  • Communicate about build-up, schedules, and procedural changes

1. Payment Processing

• • Process exhibitor fees, sponsorship payments, and any charges
  • Issue invoices and financial records
  • Prevent fraud and unauthorized transactions

1. Lead Generation & Networking (Exhibitors & Sponsors)

• • Capture business visitor information for exhibitor/sponsor follow-up
  • Create attendee lists for networking and business development
  • Facilitate introductions between complementary organizations

1. Event Analytics & Improvement

• • Analyze attendance demographics, session popularity, and floor traffic
  • Gather feedback via surveys and post-event questionnaires
  • Optimize future Event planning, design, and services

1. Safety, Security & Compliance

• • Maintain security and prevent unauthorized access
  • Conduct background checks or sanctions screening (where applicable for defense/public safety roles)
  • Comply with export control and trade compliance regulations
  • Respond to legal requests from law enforcement

6.2 Marketing & Communication Purposes

7. Event Marketing & Promotion

• • Send promotional materials and event updates (prior to and after the Event)
  • Invite you to future DEFCROS editions
  • Share case studies or testimonials (with consent)

7. Email Marketing

• • Send newsletters, product updates, and industry news (where you have opted in)
  • Communicate changes, announcements, or important notices

7. Photography, Recording & Media

• • Photograph or record the Event for promotional, educational, or archival purposes
  • Use images/videos in marketing materials, social media, and press releases
  • Publish case studies or participant spotlights featuring your company

7. How Long We Retain Your Data

7.1 Data Retention Schedule

7.2 Deletion Upon Request

If you request erasure (the “right to be forgotten”) per GDPR Article 17, we will delete your data within 30 days, except where retention is required by:

• • Legal or contractual obligations (e.g., tax records, liability disputes)
  • Legitimate, compelling business interests
  • Credible allegations of fraud or misconduct

We will inform you if deletion is refused and explain the legal basis for retention.

8. Who We Share Your Data With

8.1 No Data Resale

We DO NOT SELL, rent, or resell participant data to third parties for their independent commercial use.

Your data is not a product and will not be shared with unrelated companies for their marketing or business purposes.

8.2 Data Sharing with Event Participants

We share attendee data with other Event participants for legitimate business purposes:

1. Exhibitors & Sponsors:

• Business Visitor names, titles, companies, and email addresses (attendee list shared)
• Badge scan data (captured via exhibitor lead capture technology, if you are scanned)
• Purpose: Enabling exhibitors/sponsors to follow up on leads and facilitate networking
• Your Control: You may opt out of data sharing at registration or request a non-scannable badgeDelegations:
  • Delegation member names, organizations, and titles included on delegation lists
  • Shared with Exhibitors, other Sponsors, and Business Visitors for networking
  • Your Control: Opt out via email to [email protected] at least 72 hours before the Event

8.3 Third-Party Service Providers (Data Processors)

We share your personal data only with the service providers we actually use to run the Event and this website. Each of them processes personal data under data processing terms that meet GDPR Article 28: they may use your data only on our instructions and are bound by confidentiality and security obligations.

This list is reviewed with every change to our systems. The systems listed below are the ones in use for DEFCROS 3 (October 2026).

8.3.1 List of Third-Party Processors

Not a third party: website visit counting runs on Umami, an open-source analytics tool that we host on our own server (see Section 10). No analytics data leaves our infrastructure. We do not use Google Analytics, Google Forms, Zapier or advertising networks.

8.3.2 Sub-Processors

These service providers may use sub-processors (i.e., processors of processors) to deliver their services. Examples include:

• Stripe: Fraud detection services, banking partners, payment networks
• Resend, Fillout, Airtable, Dropbox, Attio: Cloud infrastructure providers (e.g., Amazon Web Services, Google Cloud)
• Make.com and Brevo: EU cloud infrastructure providers

We require all sub-processors to maintain the same GDPR compliance standards. For a current list of sub-processors, contact [email protected].

8.4 Legal Compliance & Law Enforcement

We may disclose your personal data to:

• Government authorities or law enforcement agencies if required by law, court order, or regulatory investigation
• Croatian public health authorities (in the event of a health emergency requiring contact tracing)
• Tax authorities for compliance with accounting and tax laws

We will inform you of any such disclosure, except where legally prohibited.

8.5 Business Transfers

If Sky Fort Systems d.o.o. is acquired, merged, or sold, your personal data may be transferred as part of the transaction. We will notify you of any material change in data handling practices.

9. International Data Transfers

9.1 Transfers Outside the EEA

Some of our service providers are located, or operate infrastructure, outside the European Economic Area (EEA): the United States, Switzerland and the United Kingdom.

For transfers to the US (Cloudflare, Resend, Fillout, Airtable, Dropbox, and Stripe's US entity): these providers are either certified under the EU-US Data Privacy Framework (adequacy decision of 10 July 2023) or rely on Standard Contractual Clauses (SCCs) adopted by the European Commission, or both. SCCs ensure your data receives adequate protection even where the third country's laws differ from the GDPR.

For transfers to Switzerland (Proton AG) and the United Kingdom (Attio): both countries hold an adequacy decision from the European Commission, meaning their data protection laws are deemed equivalent to the GDPR.

Processed within the EU only: hosting (Hostinger), automation (Make.com), event marketing email (Brevo) and payment processing through Stripe Payments Europe.

9.2 Your Rights Regarding International Transfers

You have the right to:

• Request information about the safeguards used in international transfers
• Request a copy of the applicable Standard Contractual Clauses
• Object to transfers where you reasonably believe your rights are not protected

Contact [email protected] for transfer documentation.

10. Cookies and Tracking Technologies

10.1 What Are Cookies?

Cookies are small text files placed on your device by websites you visit. Similar technologies include browser local storage. We use as few as possible.

10.2 What We Actually Use

10.3 How to Manage Cookies

Cookie Consent Banner: When you first visit our website, a banner lets you accept or reject analytics. Rejecting it changes nothing about how the site works.

Change your mind: Use the "Manage cookies" link in the footer of every page to reopen the banner and change your choice at any time. Withdrawing consent is as easy as giving it (GDPR Article 7(3)).

Browser Settings: Most browsers let you refuse cookies or clear local storage. Consult your browser's "Help" section for instructions.

Marketing emails: Every marketing email carries an unsubscribe link; your address is then added to our do-not-contact ledger and is never emailed again.

10.4 Third-Party Analytics

We do not use any third-party analytics service. Our analytics (Umami) is open-source software running on our own infrastructure; no visitor data is sent to Google or any other analytics provider.

11. Your Rights Under the GDPR

11.1 Your Data Protection Rights

You have the following rights under the GDPR:

Right of Access (Article 15)

You have the right to request a copy of your personal data and information about how we process it.

Right to Rectification (Article 16)

You can request correction of inaccurate or incomplete personal data.

Right to Erasure (Article 17)

You can request deletion of your personal data under certain circumstances (the “right to be forgotten”). Exceptions apply where retention is legally required.

Right to Restrict Processing (Article 18)

You can request that we limit how we use your data while a dispute is resolved.

Right to Data Portability (Article 20)

You can request your data in a structured, commonly used, machine-readable format (e.g., CSV) to transfer it to another organization.

Right to Object (Article 21)

You can object to processing based on legitimate interest or direct marketing. Upon your objection, we will cease that processing unless we have compelling legal grounds.

Right to Automated Decision-Making (Article 22)

You have the right not to be subject to decisions based solely on automated processing that significantly affects you. We do not use fully automated decision-making processes.

Right to Withdraw Consent (Article 7)

Where processing is based on consent (e.g., marketing emails), you can withdraw consent at any time. Withdrawal does not affect processing that occurred before withdrawal.

11.2 How to Exercise Your Rights

To exercise any of the above rights, please submit a written request to:

[email protected]

Subject Line: “Data Subject Request – [Your Right, e.g., Access, Deletion, Portability]”
Include:

• • Your full name
  • Email address
  • Specific request and the right(s) you are exercising
  • Supporting information if applicable

Response Timeframe: We will respond within 30 calendar days of receiving your complete request. Complex requests may be extended by 60 additional days with notice.

No Fee: Requests are typically provided free of charge. We may charge a reasonable fee or refuse manifestly unfounded or repetitive requests.

12. Security Measures

12.1 Data Security Practices

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:

Technical Safeguards

• Encryption in Transit: All data transmission to and from our website and our service providers uses TLS encryption (HTTPS)
• Passwords and Card Data: Account passwords are stored only as salted hashes. We never receive or store full card numbers; card payments are handled entirely by Stripe
• Access Controls: Only named staff accounts can access personal data, with role-based permissions and automatic lockout after repeated failed logins; server access is key-based
• Firewall and Edge Protection: The server accepts web traffic only through our edge provider, which filters abusive traffic; public forms are protected against automated submission
• Backups: The database is backed up nightly to a separate location under our control
• Security Reviews: The platform's code and server are reviewed for security before major releases and after significant changes

Organizational Safeguards

• Data Protection by Design: Privacy considered in all new systems and processes
• Confidentiality: Staff with access to personal data are bound by confidentiality obligations
• Data Minimization: We collect only data necessary for stated purposes
• Do-Not-Contact Ledger: Objections and unsubscribes are recorded in an append-only ledger that no process may bypass
• Incident Response Plan: Procedures in place to respond to data breaches (see Section 13)

12.2 Limitations

While we apply industry-standard security measures, no system is 100% secure. We cannot guarantee absolute security against sophisticated cyberattacks, insider threats, or unforeseen vulnerabilities. You use our services at your own risk, though we take all reasonable precautions.

13. Data Breach Notification

13.1 Notification Procedure

If we discover a data breach affecting your personal data, we will:

1. Notify you promptly without undue delay (typically within 72 hours of discovering the breach)

2. Notify the Croatian Data Protection Agency if the breach poses a high risk to your rights and freedoms

3. Provide clear information about:

• • What data was affected
  • What happened and when
  • What you should do to protect yourself
  • Our contact information for further inquiries

13.2 Exceptions

We may not notify you if:

• The data was encrypted and the decryption key was not compromised
• We have reasonable assurance the breach was not discovered by unauthorized persons
• Notification would compromise a law enforcement investigation

14. Changes to This Privacy Policy

14.1 Updates & Amendments

We may update this Privacy Policy at any time to reflect changes in our data practices, legal requirements, or other factors. Changes will be effective upon posting to www.defcros.com.

14.2 Significant Changes

If we make material changes that reduce your privacy rights or expand data processing in ways not previously disclosed, we will:

• Provide at least 30 days’ notice before changes take effect
• Email notification to registered participants (where contact information is available)
• Post a clear notice on our website

Your continued participation in the Event or use of our website after changes are posted constitutes acceptance of the updated Privacy Policy.

15. Children & Minors

15.1 Age Restriction

Our Event and related services are not directed to children under 16 years of age. We do not knowingly collect personal data from individuals under 16.

If we become aware that we have collected data from a child under 16 without verifiable parental consent, we will delete that data immediately.

15.2 Parental Consent

If you are between 16 and 18 years old, you may participate with explicit parental/guardian consent. A parent or guardian should review this Privacy Policy and confirm understanding before your registration is finalized.

16. Contact Information & Requests

16.1 Data Protection Inquiries

For questions, requests, or concerns regarding this Privacy Policy or our data practices:

Sky Fort Systems d.o.o. – Data Protection Team
Email: [email protected]
Phone: +385 97 7486 986
Mailing Address:
Gospodarska zona 10
31000 Osijek
Croatia

Response Time: We aim to respond within 5 business days.

16.2 Supervisory Authority

If you believe we have violated your data protection rights, you have the right to lodge a complaint with the Croatian Personal Data Protection Agency:

Croatian Personal Data Protection Agency (Agencija za zaštitu podataka)
Selska cesta 130
10000 Zagreb
Croatia
Email: [email protected]
Website: www.azop.hr
Phone: +385 1 4609 000

17. Additional Information for Specific Participant Categories

17.1 Exhibitors

As an Exhibitor, we collect additional data related to stand allocation, build-up schedules, and exhibitor personnel. Your data may be shared with:

• Co-exhibitors and contractors building/managing your stand
• Security and venue management for access control
• Sponsors (if you have opted in for networking)

Your rights: You may request a copy of your exhibitor record, including all stored communications and logistics details.

17.2 Sponsors

As a Sponsor, we collect data related to sponsorship package, promotional activities, and branding. Your logo and organization name may be used in Event marketing materials as part of the sponsorship agreement.

Your rights: You may request removal of your branding from future marketing materials by notifying us in writing.

17.3 Delegations

As a Delegation member, your data is included on a group list shared with Exhibitors and Sponsors for networking purposes. You may opt out of this sharing by contacting us at least 72 hours before the Event.

Your rights: You can request that your name be removed from delegation lists sent to third parties.

17.4 Business Visitors

As a Business Visitor, your data may be captured via badge scanning at Exhibitor booths. You may request a non-scannable badge at registration if you do not wish to be tracked by exhibitors.

Your rights: You may request an opt-out list at any time; exhibitors must honor your request not to be contacted.

18. Compliance & Legal Framework

18.1 Applicable Laws

This Privacy Policy is governed by and interpreted in accordance with:

• GDPR (EU) 2016/679 – General Data Protection Regulation
• Croatian Law on Personal Data Protection (OZ, 2018)
• Croatian Act on Electronic Communications (if applicable)
• PECR (UK) – Privacy and Electronic Communications Regulations (if you are a UK resident)

18.2 Data Protection Impact Assessment (DPIA)

For large-scale or sensitive data processing activities, we conduct Data Protection Impact Assessments to identify and mitigate privacy risks. A summary of our DPIA is available upon request.

19. Glossary of Key Terms

20. Document Version & History

21. Acknowledgment & Acceptance

By registering for or participating in DEFCROS 2026, you acknowledge that:

• You have read and understood this Privacy Policy
• You consent to the collection, processing, and use of your personal data as described herein
• You understand your rights under the GDPR and how to exercise them
• You agree to the data sharing arrangements outlined in Section 8

This Privacy Policy is effective as of January 6, 2026.

For questions or to exercise your rights, contact [email protected]

Last Updated: January 6, 2026