This Privacy Policy applies to the processing of personal data by Short Notice Productions d.o.o., Zagreb with its headquarters at Slavonska avenija 6, Zagreb, Croatia, OIB: 17877731232 (referred to as: the "Organizer", "we", "us", or "our"), in connection with the events it organizes, including Money Motion Conference, MoneyTalks, Automation Summit, and other related or accompanying events (collectively referred to as: the "Event" or "Events").

This Privacy Policy explains how we collect, use and manage your personal data and it applies to all Events, their websites, digital platforms, mobile applications and all other services provided and/or operated by the Organizer in connection with its Events, with the aim of providing clear and transparent information to our participants, visitors, partners and users of our services (referred to as: "data subjects") about the processing of their personal data and their related rights.

This Privacy Policy complies with the Regulation (EU) 2016/679 (GDPR) and applicable national regulations.

Please read this Policy carefully to understand why and how we collect your personal data and how it will be used.

1. Data Controller Information

Short Notice Productions d.o.o., Zagreb with its headquarters at Slavonska avenija 6, Zagreb, Croatia, OIB: 17877731232, acts as the data controller for any personal data collected during and in relation to the organization of the Events. We collect, use, and protect all personal information that you provide when using our Events websites and mobile applications and/or when attending our Events.

If you have any questions regarding this Privacy Policy, the processing of your personal data, or wish to exercise your rights under the GDPR, you may contact us at: hello@money-motion.eu. This e-mail address serves as the central contact point for all questions relating to this Privacy Policy, the processing of personal data, and the exercise of your rights under the GDPR.

2. Types of Personal Data Collected

We collect your personal data when necessary to meet your needs and requirements, perform services or for the purposes of our business and the organisation of the Events. Personal data refers to any information relating to an identified or identifiable natural person. For our purposes, this includes:

• Name and Surname
• Email Address
• Personal Identification Number (OIB)

These data points are collected specifically to manage registrations for the Events.

When you register on our websites or subscribe to our newsletters, we collect personal data such as your name, surname, email address, country, and the company you work for, and by submitting the registration form and actively ticking the designated consent checkbox, you provide your explicit consent to the processing of your personal data for the stated purposes.

3. Ticket Purchase and Third-Party Provider

When purchasing a ticket through our websites, you will be redirected to the external ticketing platform Entrio (https://www.entrio.hr/). All personal data required for completing your ticket purchase is collected directly by Entrio.

We do not collect, process, or store any personal data that you provide on the Entrio website. Entrio acts as an independent data controller and is solely responsible for the processing of your personal data in accordance with its own Privacy Policy and applicable data protection laws.

We encourage you to review Entrio's Privacy Policy before providing any personal information on their platform.

4. Reasons and Methods of Data Collection

We collect your personal information when necessary to meet your needs and requirements, perform services or for the purposes of our business and the organisation of the Events.

We also process your data in order to take action at your request.

When you access the Event website, we will collect your IP address, which is also considered to be personal data. We collect other types of information such as the date and time of access to the site, information about the hardware, software or Internet browser you use as well as about your computer's operating system and application version and language settings. We may collect information about clicks and your access to the Event web pages displayed to you.

We process your data when registering a person as a user or recipient of a newsletter or other information about our products and promotions. The newsletter contains the so-called tracking pixels. A tracking pixel is a miniature graphic element embedded in an email that is sent in HTML format to allow saving and analysis via log files. This allows statistical analysis of the success of marketing campaigns. Through tracking pixels we can see when and if an email was opened by you as a data subject and which links you followed. Personal data collected through tracking pixels in the newsletter is stored and analyzed by us as the Data Controller in order to optimize the process of sending the newsletter, as well as adjust the content of future newsletters to the interests of data subjects.

As a Data Controller, we will ask you to enter information about yourself and some information may be marked as optional. The legal basis for the processing of your data is consent. Therefore, the user who signs up to receive notifications about our products and promotions by entering their data gives consent to the processing of their personal data. The user can withdraw the consent at any time by notifying the e-mail address of the personal data protection team at: hello@money-motion.eu.

When you contact us or our office to request assistance, submit an inquiry, or exercise any of your rights under applicable data protection regulations, including when you contact us via social media, we process the personal data that you voluntarily make available to us. This may also include personal data processed when you participate in our giveaways, depending on the type of giveaway, about which you will be additionally informed in the applicable giveaway rules. Furthermore, when you complete satisfaction surveys, we may process technical data such as your IP address, and when you submit inquiries related to our products or services, we process your contact details and any other information you choose to provide in your inquiry, such as your name, surname, and, where applicable, an address for the delivery of gifts.

We will process your data when photographing and recording lectures and/or short videos or the atmosphere and we may process your photo, movement, hair colour, etc., all based on a legitimate interest.

When you are on the list of our visitors or you are a speaker at our Event, we will inform you about the program, news, exhibitors and other important issues that we consider important and part of the organisational process. During the above activities, we will process your e-mail or other contact based on a legitimate interest or in order to fulfil the obligations we have towards you.

Direct Collection

We collect personal data directly from you when you:

• Register for any of our Events
• Purchase or inquire about tickets
• Subscribe to our services or communications

Automated Collection

When you interact with our website, we may automatically collect certain technical data, such as:

• IP Address
• Browser Type
• Device Information
• Cookies (please see our Cookie Policy for further information)

Third-Party Collection

For analytic purposes, we may use third-party services (such as Google Analytics) to collect and analyze non-personal data, such as visitor counts and website navigation data. Non-personal data is anonymized and cannot be used to identify any individual.

For the purposes of web analytics via Google Analytics, we use the application "_gat._anonymizelp," through which the data subject IP address is truncated by Google and anonymized when the data subject accesses the Event website from a member state of the EU or another country under the jurisdiction of the European Economic Area. This ensures that the full IP address is never stored or processed, complying with data protection regulations by masking the last part of the IP address before any data storage or processing occurs.

5. Purpose and Legal Basis for Data Processing

We collect the above specific categories of your personal data either on the basis of the consent shown to you when you visit the Event website via a pop-up window, or on the basis of a legitimate interest, for example in cases of cookies that are necessary for functioning of the Event website or when we are already sending you some interesting information and/or offers or in order to fulfil our obligations arising from the applicable regulations of the Republic of Croatia.

If the processing is based on your consent, you have the right to withdraw your consent at any time. The withdrawal of consent must be notified to the head of processing by e-mail: hello@money-motion.eu or to the address Slavonska avenija 6, 10 000 Zagreb, with the indication "n/r data protection team". Such withdrawal shall not affect the lawfulness of processing based on consent prior to its withdrawal.

We generally collect your personal information directly from you either to enter a contract with us, to perform an action at your request, when you hire us to perform certain services provided by us or our contractual partners or fill out a specific form or when you want to receive our newsletters.

We process your personal data based on the following legal grounds and purposes:

• Contractual Necessity — Registering and managing your access to the Events.
• Legitimate Interest — Providing customer support and ensuring smooth Event operations.
• Legal Obligation — Compliance with applicable legal obligations, including accounting, tax, and record-keeping requirements.
• Consent — Marketing communication, updates regarding future Events and promotions, and promotional purposes.

6. Use of Data for Marketing Purposes

With your consent, we may send you marketing updates about our services, events, and products. You may opt out of marketing communications at any time via unsubscribe links in our e-mails or by contacting us at hello@money-motion.eu.

We do not use your personal information for marketing purposes unless you agree to that.

Where you expressly consent, we may use your feedback, reviews or testimonials, together with your name, surname, job title and organisation (where applicable), for promotional purposes relating to our Events and services. You may withdraw your consent at any time. Withdrawal will not affect the lawfulness of any use prior to the withdrawal.

7. Data Retention

We treat your personal information as confidential information and they are properly protected by us and/or our trusted partners.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. The data retention period is based on our business needs and legal obligations.

If you have given us consent (for example, you have subscribed to our newsletters, selected to use a certain category of cookies), we will process your personal data until the consent is withdrawn. If you make a well-founded objection to the processing of personal data based on a legitimate interest, we will not process your personal data in the future.

Furthermore, if a legal, administrative, or extrajudicial proceeding is initiated, personal data may be retained until the conclusion of such proceedings, including any possible period for pursuing legal remedies. Certain personal data will be retained for the period prescribed by law or other regulations that obligate the data controller to retain the data.

We will not retain your personal data for longer than the period required to fulfill the purpose of its use, and for a maximum period of 3 years after your last interaction with us, except in exceptional cases where longer retention period is prescribed by the law or justified by the purpose of processing (for example, data related to unilaterally terminated contracts and complaints will be kept for 1 year, data related to exercising of your privacy rights will be kept for as long as necessary to demonstrate compliance with our legal obligations and to establish, exercise or defend legal claims, data related to prize contests will be kept for 5 years, data on lecturers and speakers will be kept for 5 years).

You can find out more about data retention periods by contacting our data protection team.

8. Data Security Measures

To safeguard your personal data, we implement appropriate technical and organizational security measures. These include data encryption, access control, regular security testing, and protocols for ensuring data confidentiality and integrity.

We store the personal information we collect about you in a secure environment. Your personal information is protected from unauthorised access, disclosure, use, alteration, or destruction by any organisation or individual.

The processed data is stored in our premises and secure IT systems, but sometimes we store the data on the servers of our trusted service providers located in the EU. Some data is still stored in paper form.

We will ensure that personal data is kept in a secure location (which includes reasonable administrative, technical, and physical protection to prevent unauthorised use, access, disclosure, copying or alteration of personal data), which can only be accessed by authorized persons. All authorised persons sign a statement of confidentiality and/or a contract regulating that matter.

9. Disclosure of Personal Data to Third Parties

We may share your personal data with:

• Our affiliates for Event coordination and related activities.
• Service providers such as IT, analytics, and marketing automation providers.
• Event partners and sponsors, where necessary, to enhance your event experience. We ensure that any third party with access to your personal data complies with GDPR standards and safeguards your data accordingly.
• In addition to all the above, it is important to point out the following: if judicial, administrative, or extrajudicial proceedings are instituted, we may share personal data and personal data may be retained until the end of such proceedings, including a possible period for declaring legal remedies.

Privacy protection is important to us, so we will never share your personal information with third parties except for the purposes described in this Policy. We will always inform you when sharing and transferring data.

We cooperate with other companies. This means that we sometimes share your personal information, using secure IT systems. When we do so, the data is transferred to servers located in the EU or in a country that provides an adequate level of protection in accordance with EU legislation.

We may share your personal data where necessary for the performance of our contractual obligations, the organization and promotion of the Events, or the provision of related services.

We will share your data for the purpose of executing cooperation agreements with our partners who work on the organization and promotion of our Events:

Your data is shared with 3rd Floor d.o.o., Zagreb, Bakačeva ulica 5, OIB: 81082061483, company responsible for coproduction of the Money Motion Conference, MoneyTalks events, the Automation Summit and other Events.

Your data is shared with GOODTOGO d.o.o., Zagreb, Zavrtnica 17, OIB: 21447846241, company responsible for creating the Money Motion app used for our Events.

Your data is shared with Entrio Tehnologije d.o.o., Strojarska cesta 20, 10000 Zagreb, OIB: 30513194761, as the ticket provider responsible for collecting personal data for ticketing purposes.

Depending on the specific Event, we may also share your personal data with other partners and third-party service providers engaged to deliver particular Event-related services, including accommodation, travel, venue management, hospitality, transport, logistics and other operational services, where such sharing is necessary for the organization of the Event or the provision of the requested services.

In some cases, our partners providing services on behalf of or for us may process your data outside the European Union. However, the contracts we conclude with such entities oblige them to treat your data using special security measures in accordance with the regulations in force in the Member States of the European Union.

The purposes for which we share data with our trusted partners are, for example, marketing needs, maintenance of the website, advertising, delivery, and other services in and outside Data Controller. These service providers are obliged, according to the relevant contracts, to use the data entrusted to them only in accordance with our guidelines and exclusively for the purpose we have strictly determined. We also oblige them to adequately protect your data and to consider it a business secret.

Once a year, we audit all our partners to make sure that the protection of your personal data is still at the required level and that it complies with applicable regulations.

Other websites that can be accessed through our website have their own confidentiality and data collection statements and the ways in which they are used and published. The controller of the website you have accessed is responsible for the processing of personal data through cookies on those websites.

Short Notice Productions d.o.o., Zagreb, is not responsible for the ways and conditions of work of third parties.

We also collect and process personal information through user interactions on social networks such as LinkedIn, Facebook, Instagram, TikTok, X, and YouTube. Data Controller or authorised persons appointed by us have access to messages and/or posts on the mentioned social networks, however personal data collected through them, especially those contained in messages, is not stored and further processed by us except for the purposes specified in this Policy.

We use a business profile within the services of LinkedIn, Facebook, TikTok, YouTube, X, and Instagram, and you can check their Privacy Policy or Privacy Statements online, including the way they use your personal data. Short Notice Productions d.o.o., Zagreb, is not responsible for the ways and conditions of work of these third parties.

On the Event website, the Data Controller has installed the following social networks components:

Facebook

META PLATFORMS IRELAND Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Contact of the Data Protection Officer: https://hr-hr.facebook.com/policy.php.

If you are not satisfied with the way your personal data is collected and processed, you can contact the leading supervisory body of Facebook, the Irish Data Protection Commissioner or the Personal Data Protection Agency of the Republic of Croatia.

By opening our website, the data subject's browser will display the corresponding Facebook component as a result of using the Facebook plugin. During this technical procedure, Facebook is provided with information about a specific subpage visited by the data subject.

In case you are, as the data subject, logged in to Facebook, Facebook can additionally detect each of your visits to our website. This information is collected through the Facebook component and remitted to the data subject's Facebook account. If the data subject clicks on any Facebook button integrated on our website, Facebook can transfer the information to the data subject's personal Facebook account and thus save personal data.

Each time a data subject is logged in to Facebook and at the same time visits our website, Facebook will receive information about it via the Facebook component. This will happen regardless of whether the data subject clicks on the Facebook component or not. If data subjects do not want to transfer this type of information, they can prevent this by logging out of the Facebook account before accessing our website.

YouTube

Google Ireland, Ltd., Gordon House Barrow St, Dublin 4, Ireland.

Contact of the Data Protection Officer: https://support.google.com/policies/contact/general_privacy_form.

If you are not satisfied with the way your personal data is collected and processed, you can contact the leading supervisory body for YouTube, the Irish Data Protection Commissioner or the Personal Data Protection Agency of the Republic of Croatia.

If you are logged in to YouTube as a user of the website (data subject), YouTube will record every time you open a subpage that contains a YouTube video. This data will be collected by YouTube and Google and will be credited to the data subject's YouTube account.

YouTube or Google will receive information via the YouTube component that the data subject visited the Event website if the data subject was logged in to YouTube during the visit to the website; this will happen regardless of whether you clicked on the YouTube video or not. In case you do not want to allow such transfer of information, you can prevent it by logging out of your YouTube account before opening our website.

Instagram

META PLATFORMS Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

Contact of the Data Protection Officer: https://hr-hr.facebook.com/policy.php, https://www.facebook.com/help/contact/540977946302970.

If you wish to raise a concern about Instagram use of your information (and without prejudice to any other rights you may have), you have the right to do so with your local supervisory authority or Instagram International Company's lead supervisory authority, the Irish Data Protection Commission or the Personal Data Protection Agency of the Republic of Croatia.

By opening our website, the data subject's browser will display the corresponding Instagram component as a result of using the Instagram plugin. During this technical procedure, Meta is provided with information about a specific subpage visited by the data subject.

In case you are, as the data subject, logged in to Instagram, Meta can additionally detect each of your visits to our website. This information is collected through the Instagram component and remitted to the data subject's account. If the data subject clicks on any Instagram button integrated on our website, Meta can transfer the information to the data subject's personal account and thus save personal data.

Each time a data subject is logged in to Instagram and at the same time visits our website, Meta will receive information about it via the component. This will happen regardless of whether the data subject clicks on the component or not. If data subjects do not want to transfer this type of information, they can prevent it by logging out of the Instagram account before accessing our website.

X

X Internet Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07 IRELAND

Contact the Data Protection Officer: https://privacy.x.com/en, https://help.x.com/en/forms/privacy.

If you wish to raise a concern about X's use of your information, you have the right to do so with your local supervisory authority or X Internet Unlimited Company's lead supervisory authority, the Irish Data Protection Commission or the Personal Data Protection Agency of the Republic of Croatia.

Each time you access our website, which has a built-in X component, the browser on the data subject's computer system will automatically display an overview of the said X component. During this technical procedure, X will receive information about a specific subpage visited by the data subject.

If the data subject is logged in to X at the same time, X will detect each visit to our website as well as which specific subpages the data subject visited during their stay on the website. The information is collected by the X component and remitted to the data subject's X account. If the data subject clicks on one of the X buttons on the website, X will transfer this information to the data subject's X account and store such personal data.

X receives information via the X component provided that the data subject is logged in to X during the visit to the website. This will be the case regardless of whether the data subject clicked on the X button or not. If data subjects do not want to transfer this type of information, they can prevent this by logging out of the X account before accessing our website.

LinkedIn

LINKEDIN IRELAND UNLIMITED COMPANY, Wilton Plaza, Wilton Place, Dublin 2, Ireland.

Contact of the Data Protection Officer: https://www.linkedin.com/help/linkedin/ask/TSO-DPO.

If you are not satisfied with the way your personal data is collected and processed, you can contact the leading supervisory authority for LinkedIn Ireland, the Irish Data Protection Commissioner or the Personal Data Protection Agency of the Republic of Croatia.

LinkedIn receives information via the LinkedIn component provided that the data subject is logged in to LinkedIn during the visit to the website. This will be the case regardless of whether the data subject clicked on the LinkedIn button or not. If data subjects do not want to transfer this type of information, they can prevent this by logging out of the LinkedIn account before accessing our website.

TikTok

TikTok USDS Joint Venture LLC, Attn: Privacy Policy Inquiry, 5800 Bristol Parkway, Suite 300, Culver City, CA 90230.

Contact of the Data Protection Officer: https://www.tiktok.com/legal/report/privacy.

If you are not satisfied with the way your personal data is collected and processed, you can contact the Personal Data Protection Agency of the Republic of Croatia.

10. International Data Transfers

As the Organizer's Events are intended to operate globally, there may be instances in the future where your personal data is transferred to recipients located outside your country of residence; any such international data transfers will be carried out securely and in full compliance with applicable data protection laws and safeguards.

11. Rights of Data Subjects

Under the GDPR, you have the following rights regarding your personal data:

• Access — you may request access to the personal data we hold about you.
• Rectification — you may request corrections to any inaccurate or incomplete data.
• Erasure — you may request deletion of your data, subject to certain conditions.
• Restriction — you may request that we limit the processing of your data.
• Objection — you may object to the processing of your data, particularly for marketing.
• Data Portability — you may request to receive your data in a structured, machine-readable format.

To exercise any of these rights, please contact us at hello@money-motion.eu.

If you believe that your rights are not being respected, you have the right to file a complaint with the Croatian Personal Data Protection Agency (https://azop.hr/).

12. Notice of Photography

By attending our Events, you enter an area where photography and video recording may occur. Images and recordings may be used for promotional purposes, including on our website, social media, and in press releases.

The legal basis of processing in relation to visitors is a legitimate interest, while in relation to our workers, students and volunteers, the legal basis of processing is the fulfilment of obligations arising from regulations on occupational safety. If you do not wish to be photographed, please inform a member of our team or contact us at hello@money-motion.eu.

For promotional actions, all material may be used globally for promotional purposes of the Events.

Television crews and photographers will be filming at the Events locations and we especially emphasize that drones will be present to record the entire event. There will be a special notice about filming and taking photos at the entrance to the venue where the Event is taking place.

When taking photos and recording and using the drone to record lectures and/or short video clips or the atmosphere, data such as your physiognomy, movement, hair colour, eye colour are processed.

Also, the video surveillance system is used to protect property as well as for security reasons.

Sponsors and exhibitors may capture photo and video materials within their designated areas for their own promotional purposes. In such cases, sponsors and exhibitors act as independent data controllers and are solely responsible for ensuring compliance with applicable data protection laws, including providing appropriate notice and respecting data subject rights. The Organizer does not control, supervise, or assume responsibility for recordings made by sponsors and exhibitors or for any subsequent use of such materials. Any concerns or complaints relating to sponsor and exhibitor recordings — including, without limitation, close-up filming of identifiable individuals, interviews conducted without appropriate consent, recording of sensitive situations, or failure to adequately address an objection or request — must be directed to the respective sponsor and exhibitor as the responsible party. Visitors may notify the Organizer for informational purposes at hello@money-motion.eu; however, the Organizer shall not be liable for the acts or omissions of sponsors and exhibitors acting in their own capacity.

Notwithstanding the above, sponsors and exhibitors are contractually required to comply with the Organizer's applicable policies and procedures, including the Code of Conduct, and to ensure that their activities at the Events are conducted in a lawful, professional, and respectful manner.

13. Cookies Policy

The Events may use cookies on their websites to enhance site functionality and gather analytics data. You may choose to disable cookies in your browser settings, though certain features may be affected.

Cookies are small files that we send to your computer that can be accessed later. They can be temporary or permanent. Thanks to cookies, you can easily search our pages. Cookies show us what interests you and other visitors on our website, which helps us improve it.

For more information on our cookie usage, please refer to our Cookie Policy.

14. The Money Motion App

The Money Motion App (referred to as: "the App") is intended to facilitate networking, communication, and professional interaction among participants of our Events. Through the App, users may view other participants, schedule meetings, and access Event-related content and Event information in order to enhance their overall Event experience.

The use of the App is governed by a separate PRIVACY NOTICE FOR MONEY MOTION MOBILE APPLICATION specific to the App, which is available here.

By accessing and using the App, users acknowledge that its primary purpose is to enable professional networking, engagement, and participation in event activities within a secure digital environment, and agree to comply with all applicable rules, policies, and the Code of Conduct.

The Money Motion App includes an integrated reporting feature that enables users to report conduct that may violate the Code of Conduct or applicable laws directly through the App.

All reports submitted via the App are collected, received, and processed by GOODTOGO d.o.o., Zagreb, Zavrtnica 17, OIB: 21447846241, the company operating the App, on its secure internal servers. GOODTOGO d.o.o. may provide the Organizer with reports immediately upon receipt or on the same day, where necessary, and the Organizer may access and review such reports at any time as required.

Reports may be submitted also to: hello@money-motion.eu and should include, where possible, relevant details such as date, time, involved parties, and supporting documentation (e.g., screenshots).

All reports will be handled confidentially and reviewed promptly, and appropriate measures may be taken, including temporary or permanent suspension of access to the App or other actions deemed necessary to protect participants and ensure a safe environment.

15. Updates to this Privacy Policy

This Privacy Policy may be updated periodically to reflect changes in legal requirements or business practices. We encourage you to review this policy regularly on our websites to stay informed about how we protect your personal data.

This Policy shall enter into force upon publication on the website.

16. Contact Information

If you have any questions or concerns about this Privacy Policy or the handling of your personal data, please contact us at hello@money-motion.eu or:

Short Notice Productions d.o.o., Zagreb
Slavonska avenija 6
10 000 Zagreb