2 Document Title and Identification 

This document defines the Practice Rules for the provision of the electronic identification service and the electronic identification scheme “Yettel eID” (“Practice Rules”). 

Yettel d.o.o. Belgrade is registered in the Register of Electronic Identification Service Providers and Identification Schemes and is responsible for publishing all Practice Rules that support the provision of the electronic identification service and issuance of the “Yettel eID” credential. The Service Policy and the Practice Rules represent the relevant policy and practice rules applicable to the provision of the electronic identification service and the “Yettel eID” scheme.

The Service Provider determines the General Terms and Conditions for the provision of the electronic identification service and the electronic identification scheme “Yettel eID” (hereinafter: General Terms and Conditions). The General Terms are incorporated into the following documents: 

● Service Policy; 

● Practice Rules.

The General Terms, Service Policy, and Practice Rules are publicly available documents. 

The Practice Rules describe the method of operation and the business and operational procedures applied by the Service Provider in the issuance and management of the electronic identification credential. 

2.1 Administration of the Practice Rules 

The Service Provider is responsible for periodically reviewing and updating the Practice Rules, as well as making extraordinary changes to the relevant provisions arising from potential changes in legal regulations or the technical characteristics of the “Yettel eID” electronic identification credential. 

The Practice Rules document is reviewed periodically and updated as needed. An internal procedure defines the review period, which must not be less frequent than once per calendar year. According to the internal procedure, the Practice Rules document may also be updated more frequently than once a year if conditions for such an update are met. Such conditions include, among others, extraordinary changes in legal regulations. 

2.1.1 Contact Person 

Contact information for the person at the Service Provider responsible for the Practice Rules document: Vladimir Boljanović, email: vladimir.boljanovic@yettel.rs 

3 Legal Basis 

The provision of the “Yettel eID” electronic identification service and identification scheme is aligned with: 

● The Law on Electronic Document, Electronic Identification and Trust Services in Electronic Business (“RS Official Gazette,” Nos. 94/17 and 52/21);

● The Regulation on closer conditions that the electronic identification schemes must fulfill for certain levels of reliability (“RS Official Gazette,” Nos. 60/2018 and 68/2024);

● The Rulebook on the Register of Electronic Identification Service Providers and Identification Schemes (“RS Official Gazette,” No. 67/2018);

● The Law on eGovernment (“RS Official Gazette,” No. 27/2018); and 

● The Law on Personal Data Protection (“RS Official Gazette,” No. 87/2018). 

4 Participants 

4.1 Service Provider 

Yettel d.o.o. Yettel d.o.o. Beograd, as an entity entered in the Register of Electronic Identification Service Providers and Electronic Identification Schemes in the Republic of Serbia, is a registered provider of the electronic identification service and the “Yettel eID” scheme.

The Service Provider ensures the technical and security conditions and establishes the hierarchical and organizational structure necessary for the secure and continuous provision of the service.

The Service Provider delivers the complete electronic identification service under the “Yettel eID” scheme, which includes the following components: 

● Registration and identity verification 

● Management of the electronic identification credential 

        ○ Issuance, distribution, and activation 

        ○ Suspension, revocation, and reactivation 

● Authentication

● Transmission of data on the authenticated user to the relying party. 

The Service Provider enables the “Yettel eID” credential to be issued electronically, without requiring the applicant’s physical presence (electronic procedure). 

4.2 User 

The user of the “Yettel eID” electronic identification means (hereinafter: the user) is a natural person, a citizen of the Republic of Serbia or a foreign national, who, upon successful completion of the issuance procedure for the “Yettel eID” means as described in this document, is enabled to use the “Yettel eID” for the legally mandated registration of pre-paid SIM cards issued by Yettel d.o.o. Belgrade.  

4.3 Relying Parties 

The relying party is Yettel d.o.o. Belgrade, which, based on the set of identity data received from the Yettel eID System, performs the registration of pre-paid SIM card users as a legally required precondition for the activation of the SIM card and the provision of services to the user.

The Yettel eID System forwards the set of data on the authenticated user to the relying party’s software solutions, including: first name, last name, unique master citizen number (JMBG) or identification document number or passport number, type of document (ID card or passport) and issuing country, date of expiry of the identification document (optional), date of issuance of the identification document (optional), issuing authority of the identification document (optional), verified email address or mobile phone number. 

5 Obligations and Responsibilities 

5.1 Obligations and Responsibilities of the Service Provider 

The Service Provider is required to carry out all procedures defined in these Practice Rules.  

To the extent specified in the relevant chapters of the Practice Rules and the Service Policy, the Service Provider undertakes to: 

● adopt and implement the General Terms and Conditions for service provision, the Service Policy, and the Practice Rules, in accordance with applicable regulations as well as national and international standards in the field of electronic identification; 

● inform the credential user about the terms of service use, including any limitations of use and potential service fees; 

● adopt a privacy policy in accordance with the regulations of the Republic of Serbia; 

● establish appropriate policies and procedures to ensure that the credential user is informed in a timely and reliable manner about changes to the terms of service or the privacy policy; 

● retain data related to the issuance of the “Yettel eID” credential, including user identity verification data, for at least ten years following issuance; 

● maintain records and retain information on significant events related to its operational activities and the security conditions of the registered “Yettel eID” scheme; 

● maintain usage records of the “Yettel eID” credential and retain such records where necessary for audit purposes, information security incident investigations, or data retention obligations in accordance with the law; 

● provide a reliable time source synchronized with the reference time source designated by the ministry responsible for information society affairs, and ensure that accurate time information is embedded in the records referred to in items (5), (6), and (7) of this chapter; 

● ensure that its employees, engaged individuals, and subcontractors are trained and qualified for tasks related to the electronic identification service; 

● ensure a sufficient number of employees and subcontracted personnel to perform the service appropriately; 

● provide direct supervision and protection of facilities used for service provision, safeguarding against damage caused by weather conditions, unauthorized access, and other threats to service security; 

● ensure that only authorized employees, engaged personnel, or subcontractors have access to areas within service facilities where personal, cryptographic, or other confidential data are located or processed; 

● maintain a service termination plan to ensure user notification in the event of service discontinuation and to provide for the appropriate retention of data; 

● conduct periodic internal audits covering all aspects of service delivery to ensure alignment with the relevant policy; 

● inform the applicant for issuance of the “Yettel eID” credential about:  

        ○ the method of using the “Yettel eID” credential; 

        ○ regulations and rules applicable to the use of the electronic identification service; 

        ○ information about the assurance level of the “Yettel eID” scheme; 

        ○ risks of potential misuse or identity fraud; 

        ○ security measures the applicant should take when using the “Yettel eID” credential; 

● obtain consent for the processing of personal data; 

● verify the identity of the person during the issuance procedure of the “Yettel eID” credential based on a valid ID card, ID card for foreign nationals, or travel document. an ID card, foreigner ID card, or travel document used for identity verification must be issued by the competent authority of the Republic of Serbia or the issuing country for foreign nationals, and may be submitted electronically;

● during the issuance of the “Yettel eID” credential, the Service Provider shall take measures to ensure that the credential is delivered solely to the intended recipient, i.e., the user; 

● the Service Provider shall enable suspension and revocation of the credential and implement measures to prevent unauthorized suspension, revocation, or reactivation; 

● in the event of reissuance, identity verification must be repeated.  

● the Service Provider shall issue an electronic identification credential that contains one authentication element— a one-time password known exclusively to the user; 

● implement measures to ensure that only the credential user can use the electronic identification credential; 

● ensure reliable validation of the “Yettel eID” credential and its validity when disclosing the user's personal identification data; 

● implement security controls for validating the credential during the authentication process to prevent compromise of the authentication mechanism, such as disclosure of the authentication factor, unauthorized access, interception, or other threats; 

● establish an effective information security management system to manage risks related to information security; 

● implement appropriate technical controls to mitigate service security risks and protect the confidentiality, integrity, and availability of processed information; 

● ensure that electronic communication channels used to exchange personal or confidential information are protected against unauthorized access, interception, misuse, and other threats; 

● restrict access to cryptographic material, if used for credential issuance and authentication, to authorized individuals and applications explicitly requiring such access, and ensure that this material is never persistently stored in plain, unencrypted format; 

● maintain continuous information security and ensure the system is resilient to changes in risk level, incidents, and security breaches; 

● ensure that media containing personal, cryptographic, or other confidential information are securely stored, transmitted, and destroyed; 

5.2 Obligations and Responsibilities of the User 

Users shall: 

● review, understand, and comply with the General Terms and Conditions they agreed to during the issuance of the “Yettel eID” credential, as well as with the Service Policy and the Practice Rules published by the Service Provider; 

● allow the Service Provider to verify their identity;  

● provide accurate and precise information in all communications with the Service Provider and the registration authority; 

● refrain from compromising the integrity of the “Yettel eID” credential, breaching the confidentiality of the authentication factor, or generating invalid “Yettel eID” credentials. The user must keep the authentication factor (one-time password) confidential, maintain control over the password, and must not share it with any other person or entity. 

● use the issued “Yettel eID” electronic identification credential solely for legal and authorized purposes, in accordance with the General Terms and Conditions, Service Policy, and Practice Rules; 

● notify the Service Provider of any changes to previously submitted information, especially information related to name, surname, Unique Master Citizen Number (JMBG), identification document number or travel document number, document expiration date, email address, or mobile phone number; 

● discontinue use of the “Yettel eID” credential if any previously submitted information becomes invalid, particularly information related to name, surname, JMBG, identification document number or travel document number, document expiration date, email address, or mobile phone number; 

● use only one “Yettel eID” credential; 

● use secure devices and internet browsers for authentication using the credential; 

● take all necessary steps to prevent compromise, disclosure, or unauthorized use of their password; 

● notify the Service Provider as soon as possible and request suspension or revocation of the “Yettel eID” credential in the event of any incident affecting the integrity of the credential, or in case of suspected misuse or unauthorized use of Yettel eID; 

● inform the Service Provider if they are unable to authenticate or log into the Yettel eID system using their password. 

● The user shall bear liability for any damage arising from loss, unauthorized, or improper use of the “Yettel eID” electronic identification credential, or from non-compliance with the General Terms and Conditions. 

5.3 Obligations and Responsibilities of Relying Parties 

Relying parties are required to grant access to and enable the use of electronic services within their competence to users authenticated through the Yettel eID system using the “Yettel eID” electronic identification credential, based on identification and authentication performed using a basic assurance level electronic identification credential. 

Relying parties are required to familiarize themselves with the Service Policy and the Practice Rules. 

6 Permitted Use 

The “Yettel eID” basic assurance level electronic identification credential may be used for: 

● Legally required registration of Yettel pre-paid SIM card users prior to activation of services;

● Concluding a Subscriber Agreement for the use of electronic communications services with previously registered pre-paid users (transition to the post-paid billing system);

● Other services in accordance with the Law on Electronic Communications and the Law on Electronic Document, Electronic Identification, and Trust Services in Electronic Business. 

7 Identity Verification

During the issuance procedure for the “Yettel eID” electronic identification credential, the identity of the applicant must be verified and confirmed in accordance with the documented rules and procedures defined and implemented by the Service Provider.

The Service Provider conducts data authenticity and identity verification of the applicant through the following procedure:

● Verification of the submitted email address or mobile phone number, which will serve as the communication channel for delivery of the one-time password (OTP). This step ensures that the submitted email address or mobile number is valid, that the user has access to the submitted email address or mobile number, and that the user is aware of their registration.  

● Verification of the validity of the identification document using the submitted photo of the Serbian citizen ID card, foreigner ID card, or travel document. Based on the processed results of the submitted photographs and automated data extraction, the system checks whether the document is valid and whether the defined age requirement is met. The authenticity of the document is also verified.

● Reading of textual data from the document, both from the machine-readable zone (MRZ) and other parts of the document. Control digits from MRZ data are calculated and verified. Extracted data appearing in multiple fields are cross-checked for consistency. 

● Identity verification using a submitted facial photo by first checking for liveness of the person being identified, followed by a comparison of the facial image with the one found on the identification document. This identity check confirms that the applicant is indeed the holder and possessor of the identification document used in the procedure.

8 Registration Procedure

The registration procedure is implemented through the following steps:

● Reviewing the General Terms and Conditions and the Privacy Policy, and providing consent for the processing of personal data

● Submitting and verifying an email address or mobile phone number

● Selecting the issuing country and the type of identification document to be used for scheme registration

● Photographing the selected identification document for data processing and validating both the document and the extracted data

● Photographing the applicant’s face

● Activating the scheme and transmitting identification data. 

8.1 Reviewing the Terms and the Privacy Policy

The user of the credential must be familiar with the terms of use of the service, including all limitations on its use, as well as with the Privacy Policy, in accordance with the regulations of the Republic of Serbia.

The first step of the registration procedure is reviewing the General Terms and the Privacy Policy, and granting consent for the processing of personal data. Before entering the data collection process, the user must accept the defined terms.

8.2 Submission and Verification of the Email Address

The email address serves as one of the identifiers of the user’s “Yettel eID” credential.

This data is collected during the pre-creation phase of the scheme. The data must be verified and confirmed in order to serve as a valid scheme identifier. 

If the email address is used as a scheme identifier, it must be one that was previously verified during the Yettel account creation process. The user verifies the email address by clicking a verification link, confirming that they have access to the specified email account and that they are aware of their registration.  

The collected email address is then used as the identifier for the user’s “Yettel eID” credential and subsequently as the communication channel through which one-time passwords (OTPs) and other notifications from the Yettel system will be delivered.

The user’s email address is included in the set of data transmitted to the relying party, provided it was collected during the registration process.

8.3 Submission and Verification of the Mobile Phone Number

The mobile phone number (MSISDN) serves as one of the identifiers of the user’s “Yettel eID” credential.

The data must be verified and confirmed in order to serve as a valid scheme identifier. 

The user submits their mobile phone number, which will be used as a communication channel for delivery of one-time passwords (OTPs) and other notifications from the Yettel system.

Initially, the status of the submitted mobile phone number (MSISDN) is verified. If the number is active, the user receives an SMS message from the Yettel system containing a one-time password (OTP). By entering the received OTP, the user verifies the mobile phone number and confirms that they have access to it and are aware of their registration.  

The received OTP is valid for 120 seconds. If the user does not verify the mobile phone number within the defined timeframe, the registration process cannot continue with that OTP and a new verification code must be requested.

If the phone number is not active, the issuance of the scheme to the user is denied.

Alternatively, the user may prove possession of the SIM card and the inactive phone number exclusively by using the Yettel system to photograph the original packaging of the new SIM card. A barcode on the packaging is automatically scanned to extract the ICCID number, which serves as the unique identifier of that SIM card. The Yettel system then verifies the validity of the scanned ICCID number. If a valid MSISDN is associated with the ICCID number and the phone number is inactive, that MSISDN will be accepted as valid for user registration.

The user’s mobile phone number is included in the set of data transmitted to the relying party, provided it was collected during the registration process.

8.4 Selecting the Type of Identification Document

Before uploading photographs of the identification document, the user must select the issuing country and the type of document.

The identification document may be:

● A valid national ID card or travel document issued by the competent authority of the Republic of Serbia for domestic users

● A valid national ID card or travel document for foreign nationals

● A valid national ID card or travel document for diplomats

8.5 Photographing the Selected Identification Document

The user photographs both the front and back sides of the ID card or the first page of the travel document. 

After photographing, the system processes and automatically extracts data from the document. The machine-readable zone (MRZ) and textual data are read and then cross-checked for consistency and verification. The data read from the document include: first name, last name, Unique Master Citizen Number (JMBG), document number, place and country of birth, date of birth, nationality, place and country of issuance, issuing authority, date of issuance, and expiration date. The user’s image is also detected and extracted from the document. 

Based on the extracted data, the system checks whether all conditions are met. Document validity is also verified. If any of the defined conditions are not met, the user is prompted to retake the photograph or the process is terminated.

The system also detects potential fraudulent activity, and if any irregularity is identified, the scheme registration process is suspended and the user is notified of the unsuccessful registration.

In the case of registering a scheme for a person already present in the Yettel system, identity is further verified by comparing the JMBG extracted from the document with the JMBG obtained from the Yettel system for the same individual. If there is a mismatch, the process is terminated. 

In the case of pre-paid SIM registration for legal entities, the authorized person is additionally verified by comparing the JMBG from the document for domestic persons or the document number for foreign persons with the JMBG or document number retrieved from the Business Registers Agency (APR) system for the specified legal entity. If there is a mismatch, the process is terminated.

The data extracted from the identification document and included in the set of data transmitted to the Service Provider are:

● Name and last name

● JMBG, if the user is a citizen of a country whose nationals have a unique citizen number

● Identification document number and document type with the issuing country

● Document expiration date (optional)

● Document issuance date (optional)

● Issuing authority (optional)

● Date of birth (optional)

Photographs of the identification document are not included in the set of data transmitted to the Service Provider. 

8.6 Photographing the Applicant’s Face

The facial capture step requires the user to take a photo of their face. The resulting image is used for comparison with the user photo extracted from the identification document. A match between these two images is one of the conditions for successful completion of registration. 

This method of user identity verification confirms that the applicant is indeed the owner and holder of the identification document used in the procedure. 

The facial photograph is not included in the set of data transmitted to the Service Provider.

If any of the defined verification conditions are not met, the user is prompted to retake the photograph or the process is terminated.

8.7 User One-time Password

The one-time password (OTP) is a six-digit code delivered to the user via the verified email address or verified mobile phone number.

The OTP code is valid for 120 seconds, after which it becomes invalid. The OTP is single-use and may be used only once. Each activity (sending the OTP to the email address or mobile phone number, and verifying the OTP along with the result) is logged in the system’s activity tracking module. The system also tracks additional information such as:

● Type of verification (whether verification was performed via mobile phone number or email address)

● Execution time (timestamp) 

● IP address from which the OTP was used

● Browser information used during OTP submission

Upon receiving the code, the user enters the OTP into the form provided as part of the Yettel system process, triggering verification. If verification is successful, the system notifies the user and the registration process continues. If verification fails, the user is notified and may initiate a new OTP request. If the verification fails three consecutive times, the system notifies the user and terminates the process, marking the reason for termination as three failed OTP verification attempts. If the OTP code is not received, the user may request that a new OTP code be sent.

9 Conditions and Procedure for Issuing the “Yettel eID” Credential

In order for the “Yettel eID” credential to be issued, the following conditions must be met:

● The individual is of legal age, i.e., at least 18 years old.

● The individual has been positively identified and their identity confirmed. 

● The individual is either a citizen of the Republic of Serbia or a foreign national.

● The individual holds a valid ID card or travel document issued by a competent authority and has submitted appropriate photographs of the document during the registration process.

● The information provided by the individual during registration is truthful. 

● The individual does not already possess an issued, active, or suspended “Yettel eID” credential. 

● The individual has accepted the General Terms and Conditions, reviewed the Privacy Policy, and provided consent for the processing of personal data.

The Service Provider must reject any request for the issuance of an electronic identification credential if these conditions are not met. Rejection of the request may occur automatically upon detection of non-compliance with the conditions, or through operator intervention.

10 Activation

The moment of successful completion of the registration process is considered the moment of issuance of the “Yettel eID” electronic identification credential. The issued credential is immediately active and ready for use. As the scheme is registered as part of the legally required process of pre-paid SIM card user registration, once the scheme is activated, personal data will be transmitted to the relying party, i.e., Yettel d.o.o., Belgrade, for the purpose of completing the full process. 

The user will be informed of this at the beginning of the registration process and will provide their consent. Verification of the email address or mobile phone number—via OTP for active SIM cards or by scanning the ICCID code from the packaging of an inactive SIM card—in combination with user identification, shall be considered reliable confirmation of the user's consent to the described data transmission. 

11 User Notification

During the registration process and use of the “Yettel eID” credential, the user receives notifications electronically via the email address or mobile phone number that was submitted and verified during the registration process.

Following successful registration and issuance of the “Yettel eID” credential, the process of legally required registration of the user of a pre-paid SIM card continues. Upon completion of that process, the user is notified by SMS and via the website where the registration was conducted that the process has been successfully completed.

In the event of a rejection of the request for issuance of the electronic identification credential due to noncompliance with the defined conditions or inability to clearly identify the applicant, the user is notified electronically that their request for issuance of the “Yettel eID” credential has been denied, with the reasons for the unsuccessful resolution of the request specified.

12 Authentication

The “Yettel eID” credential consists of a one-time password (OTP) delivered to the user’s registered and verified email address or to a previously linked and verified mobile phone number.

The user receives an email message at the registered email address containing a unique one-time code that must be entered into the appropriate user form in the Yettel system to confirm the user's identity. In addition to the unique code, the received email also includes a link to the Yettel system. The link integrates the OTP code and allows the code to be verified and the user redirected to the Yettel system automatically by clicking the link, without the need to manually enter the OTP code.

When the user selects mobile phone as the communication channel, an SMS message containing a unique one-time code is sent to the previously linked mobile number. The user must enter this code into the corresponding input field in the Yettel system to prove their identity.

Upon successful validation of the OTP code, a set of data on the identified user is forwarded to the relying party. This data set includes:

● Document type (ID card or travel document) and the issuing country

● Extracted data from the identification document: first name and last name, Unique Master Citizen Number (JMBG) or identification document number or travel document number, document expiration date (optional), date of issuance (optional), issuing authority (optional), email address or mobile phone number

This process is repeated each time the issued electronic identification scheme is used and enables controlled and authorized use of user data.

The Service Provider ensures that all user data are stored in a secure and reliable manner. It also ensures reliable validation of the “Yettel eID” credential and its authenticity when disclosing personal identification data of the user. 

13 Operational Requirements Related to the Lifecycle of the “Yettel eID” Credential

13.1 Request for Issuance of the “Yettel eID” Credential

13.1.1 Who May Submit a Request for Issuance of the “Yettel eID” Credential?

The applicant for the issuance of the “Yettel eID” credential must be a legal adult, either a citizen of the Republic of Serbia or a foreign national, holding a valid personal identification card or travel document issued by a competent authority.

The “Yettel eID” credential may be issued only to an individual who does not already possess a “Yettel eID” credential. During the issuance procedure, the user’s credential is uniquely identified by being linked to: 

● The Unique Master Citizen Number (JMBG), if the individual is from a country that uses such a citizen identifier, or to the identification document number

● The submitted and verified email address or mobile phone number

This ensures that one user may only be issued a single “Yettel eID” credential.

A “Yettel eID” credential cannot be issued to a person who previously held a “Yettel eID” credential that was suspended.

A “Yettel eID” credential may be reissued to an individual whose previously issued “Yettel eID” credential was revoked.

13.1.2 Process for Submitting a Request for Issuance of the “Yettel eID” Credential

The procedure for registration and issuance of the “Yettel eID” credential is carried out within the Yettel system and is integrated into the legally required registration process for pre-paid SIM card users.

The first step in the issuance process for the “Yettel eID” electronic identification credential involves the user’s contact information (email address or mobile phone number), which is later used as an identifier within the issued scheme. This information must be previously validated and confirmed. Specifically, in the case of an email address, it must be an address previously verified during the creation of the Yettel account. The user verifies the email address by clicking a verification link, confirming that they have access to the specified email account and that they are aware of their registration.  If a mobile phone number is used as the identifier, it must be verified and validated. The number is verified by sending a one-time password (OTP) to the submitted user phone number if it is active. If the phone number is inactive, the user may prove ownership of the SIM card and phone number exclusively by photographing the original packaging of the new SIM card through the Yettel system. The barcode on the packaging is automatically scanned to extract the ICCID number, which serves as the unique identifier of that SIM card. The Yettel system then verifies the validity of the scanned ICCID number. If a valid MSISDN is linked to that ICCID and the number is inactive, the MSISDN is considered valid for registering the user’s scheme. 

The issuance process begins with the user’s familiarization with the General Terms and the Privacy Policy. The user must give consent for the processing of personal data. 

The next steps in the issuance procedure of the “Yettel eID” credential involve data collection through the submitted photographs of the identification document. The user selects which identification document (personal ID card or travel document) to photograph and identifies the country of issuance. The user then photographs the front and back of the personal identification card or the first page of the travel document using the Yettel system. At that point, processing and analysis of the submitted identification document images begin to extract data and verify the document’s validity and the accuracy of the information. All data from the document is extracted, primarily: name, surname, Unique Master Citizen Number (JMBG), document number, and document expiration date. 

The applicant user also submits a photograph of their face through the Yettel system, which is then compared and verified against the photo extracted from the identification document.

Once the final step of the procedure is completed, the data is securely stored, marking the moment of issuance of the “Yettel eID” credential. Afterward, the credential becomes active, and the process of legally required registration of the user of the pre-paid SIM card continues with the transfer of the user’s identification data to the Yettel system responsible for activating pre-paid SIM cards. Upon successful activation, the user is notified via the website where the registration was completed and through an SMS message sent to the newly activated phone number.

13.1.3 Processing of the Yettel eID Credential Issuance Request

The Yettel eID credential issuance request is processed automatically within the registration procedure based on the submitted data. The email address or mobile phone number is verified automatically. The submitted photos of the identification document are processed, and the system reads the data from the documents. Based on the data and the photo analysis, the system verifies the validity and authenticity of the document and the data. It compares the submitted photo of the user’s face with the facial image extracted from the identification document.

13.1.4 Approval or Rejection of the Request

Based on the processed and validated data, the Yettel system automatically decides whether the request for the issuance of the Yettel eID credential will be approved or rejected.

If the request for the issuance of the Yettel eID credential is approved, the procedure for the legally prescribed registration of the prepaid SIM card user continues. Upon its completion, the user is notified via SMS and on the registration website that the process has been successfully completed.

Conversely, if the request for the issuance of the Yettel eID credential is rejected, the user is notified electronically that the request has been rejected, along with the reasons for the unsuccessful resolution of the request.

13.1.5 Processing Time

The issuance process for the Yettel eID credential is fully automated and tailored to provide an optimal user experience, requiring only a few minutes for registration and Yettel eID credential issuance.

13.2 Issuance of the Yettel eID Credential

13.2.1 Activities of the Service Provider and the Registration Authority during Yettel eID Credential Issuance

In order for the “Yettel eID” credential to be issued, the following conditions must be met:

● The individual is of legal age, i.e., at least 18 years old.

● The individual has been positively identified and their identity confirmed. 

● The individual is either a citizen of the Republic of Serbia or a foreign national.

● The individual holds a valid ID card or travel document issued by a competent authority and has submitted appropriate photographs of the document during the registration process

● The information provided by the individual during registration is truthful. 

● The individual does not already possess an issued, active, or suspended “Yettel eID” credential. 

● The individual has accepted the General Terms and Conditions, reviewed the Privacy Policy, and provided consent for the processing of personal data.

The Service Provider or the registration authority must reject the credential issuance request if the specified conditions are not met. Rejection of the request may occur automatically upon detection of non-compliance with the conditions, or through operator intervention.

13.2.2 User Notification of Issued Yettel eID Credential

Following successful registration and issuance of the “Yettel eID” credential, the process of legally required registration of the user of a pre-paid SIM card continues. Upon completion of that process, the user is notified by SMS and via the website where the registration was conducted that the process has been successfully completed.

13.3 Modification of the Yettel eID Credential

In situations where any of the user’s data changes, particularly name, surname, Unique Master Citizen Number (JMBG), identification document or passport number, email address or mobile phone number, or the expiration date of the identification document, the user must contact the service provider via the Yettel system within the shortest time possible to update the data. The user submits and verifies the email address or mobile phone number. The user then photographs the identification document or travel document issued by a competent authority of the Republic of Serbia or another country. The user also photographs their face so that the image can be compared with the facial image extracted from the document. This re-verifies the user’s identity and authorizes the modification of user data within their scheme.

13.4 Suspension, Revocation, and Reactivation of the “Yettel eID” Credential

The “Yettel eID” electronic identification credential may be suspended or revoked.  

The Service Provider shall take all necessary measures to prevent unauthorized suspension, revocation, or reactivation.  

13.4.1 Suspension

Suspension of the “Yettel eID” credential may be requested by the user, an authorized person of the Service Provider, a data protection authority, a court, a public prosecutor’s office, criminal investigation authorities, or any relying party in cases of suspected identity fraud or misuse of the credential (e.g., violation of the General Terms and Conditions).

13.4.1.1 Suspension Following Three Consecutive Invalid OTP Code Attempts 

If there are three consecutive failed attempts to authenticate using an invalid OTP code sent to the user’s email address or mobile phone number, the issued “Yettel eID” credential will be automatically suspended and further authentication will not be possible.

13.4.1.2 Suspension Due to Violation of the General Terms and Conditions     

If the user fails to comply with the General Terms and Conditions for the provision of the electronic identification service, the Service Provider may suspend the issued “Yettel eID” credential and must state the reason for the suspension. During the suspension period, the “Yettel eID” credential is inactive and cannot be used by the user.

In the case of proven serious violations of the General Terms and Conditions or abuse of the “Yettel eID” credential by the user, Yettel has the right to issue a prior warning and partially suspend service provision if the user violates the provisions defined in this section, and to fully suspend the service if the user continues to violate these provisions after receiving the warning. Yettel shall exercise the rights referred to in this Article in a manner that does not violate the secrecy of electronic communications.

13.4.2 Revocation

The user may request revocation of their “Yettel eID” credential due to suspected unauthorized use or for other reasons by notifying the Service Provider and submitting a revocation request through the Yettel system. The moment the revocation request is confirmed as received is considered the moment of revocation of the “Yettel eID” credential. 

The electronic identification credential “Yettel eID” may also be revoked upon request from an authorized person of the Service Provider, a data protection authority, a court, a public prosecutor’s office, a criminal investigation authority, or any relying party, in the event of suspected identity fraud.  

A user whose “Yettel eID” credential has been revoked may no longer use the revoked credential for authentication and cannot reactivate it. 

13.4.3 Reactivation

In certain situations, the “Yettel eID” credential may be reactivated.

13.4.3.1 Reactivation of the “Yettel eID” credential suspended due to login attempts using an invalid OTP code 

If the “Yettel eID” credential was suspended due to three consecutive failed login attempts using an invalid OTP code, reactivation is possible by submitting a reactivation request through the Yettel system.

In this reactivation procedure, the user undergoes identity verification again through a process similar to registration, which begins with being reintroduced to the General Terms and Conditions and the Privacy Policy. The user provides and verifies their email address or mobile phone number, then photographs an identification document or travel document issued by a competent authority of the Republic of Serbia or another country. Finally, the user photographs their face so that the image may be compared to the facial photo extracted from the identification document.

13.4.3.2 Reactivation of the “Yettel eID” credential suspended due to violation of the General Terms and Conditions 

Reactivation of a “Yettel eID” credential suspended due to non-compliance with the General Terms and Conditions for the provision of electronic identification services occurs automatically upon expiration of the 90-day suspension period or upon expiration of the suspension period resulting from serious non-compliance with the General Terms and Conditions. 

13.4.3.3 Reactivation of a revoked “Yettel eID” credential 

A revoked “Yettel eID” electronic identification credential cannot be reactivated. However, the user of the revoked credential may at any time initiate a new request for issuance of a “Yettel eID” electronic identification credential in accordance with the issuance procedures described in this document. 

14 Administration of the General Terms and Conditions, Privacy Policy, and Practice Rules 

The Service Provider shall adopt and implement the General Terms and Conditions for the provision of the electronic identification service and the “Yettel eID” electronic identification scheme (hereinafter: General Terms and Conditions), the Service Policy, and the Practice Rules, in accordance with domestic and international regulations and standards in the field of electronic identification, as well as the Privacy Policy in accordance with the regulations of the Republic of Serbia.  

The Service Provider shall publish the General Terms and Conditions, the Service Policy, the Practice Rules, and the Privacy Policy on the Service Provider’s website (https://www.yettel.rs/).  

During the credential issuance procedure for “Yettel eID,” the Service Provider shall ensure that the applicant is familiar with and confirms acceptance of the General Terms and Conditions, which define the service usage terms, method of using the credential, regulations and rules applicable to the use of the service, all usage limitations, information on the assurance level of the “Yettel eID” scheme, information on the risks of possible misuse or misrepresentation, and the measures the user should take to ensure secure use of the “Yettel eID” credential, as well as information about any applicable service usage fees.  

The Service Provider shall inform the applicant about the Privacy Policy and obtain the user’s consent for the processing of personal data, and shall act in full compliance with the law governing the protection of personal data.  

The Service Provider has the right to unilaterally amend the General Terms and Conditions, the Service Policy, the Practice Rules, and the Privacy Policy, and shall publish notice of any amendments on the Service Provider’s website (https://www.yettel.rs/).    

The Service Provider is responsible for periodic review and updating, as well as extraordinary amendments to the relevant provisions resulting from changes in legal regulations or in the technical characteristics of the “Yettel eID” electronic identification credential. 

Periodic review and updates of the documents must be carried out at least once per calendar year. 

15 Recordkeeping and Data Retention 

Records of issued “Yettel eID” credentials and data related to identity verification are securely stored for a minimum of 10 years from the date of issuance, for the purposes of audits, investigation of information security breaches, and legal data retention requirements. 

The Service Provider maintains records on the use of the electronic identification credential and retains such records for audit purposes, security incident investigations, and data retention needs in accordance with the law. 

The set of collected data may include:  

● First name  

● Last name 

● Document type (ID card or travel document) and issuing country

● Unique Master Citizen Number (JMBG) or identification document number or travel document number 

● Document expiration date (optional)

● Document issuance date (optional)

● Issuing authority (optional)

● Date of birth (optional)

● Email address or mobile phone number 

● Place of residence (optional, if voluntarily disclosed by the user) 

● History of requested data and the user data forwarded to relying parties or services

The Service Provider logs and retains information about significant events related to its operational activities and the security conditions of the registered “Yettel eID” scheme. 

Reliable time information, sourced from the reference time source designated by the ministry responsible for information society affairs, is embedded in all records related to the provision of the “Yettel eID” electronic identification service and scheme. 

All records are archived and stored in a secure manner, which implies protection against unauthorized access, modification, and deterioration of the characteristics of the storage media over time.  

16 Organizational Requirements 

The Service Provider shall ensure an adequate number of authorized staff members, engaged personnel, and contractors to properly perform the service. This includes tasks such as establishing, developing, and operating the Yettel eID portal and supporting infrastructure; reviewing submitted credential issuance requests; conducting identity verification and user registration; performing credential revocation, suspension, and reactivation; providing user support; preparing instructions and training; maintaining records; administering the General Terms and Conditions, the Service Policy, and the Practice Rules; and related duties. 

The Service Provider shall ensure that all authorized personnel and contractors are technologically and professionally competent, trained, and qualified to perform duties related to the “Yettel eID” electronic identification service and scheme. 

The Service Provider shall provide initial training to its employees, as well as periodic training to maintain continuity and up-to-date knowledge, including in the event of procedural changes. Documentation for training purposes shall be prepared and made available to authorized personnel. 

17 Physical Access 

The Service Provider shall implement appropriate physical control mechanisms at its premises. The premises of the Service Provider are located at Omladinskih brigada 90, Belgrade. They are secure and situated in a location suitable for carrying out high-security operations. The Service Provider shall ensure direct supervision and protection of the facilities used to provide the service against damage caused by weather conditions, unauthorized access, and other factors that may affect the security of the service. 

The Service Provider shall ensure that only authorized employees or subcontractors have access to areas within the facilities used to provide the service where personal, cryptographic, or other confidential data is stored or processed. 

18 Termination Plan 

Before discontinuing the provision of the “Yettel eID” electronic identification service and scheme, the Service Provider shall: 

● Notify “Yettel eID” credential users of its intent to cease providing the service; 

● Revoke all issued “Yettel eID” credentials without requiring user consent; 

● Notify all affected users of the revocation of their credentials; 

● Ensure continued retention of records and data in accordance with applicable regulations, the Service Policy, and the Practice Rules; 

● Where possible, implement appropriate succession measures to allow for the reissuance of credentials at the same level of assurance by a successor who continues providing the service and adheres to the same or substantially equivalent Service Policy and Practice Rules.   

19 Internal Audits 

To ensure that the service complies with the relevant policy, the Service Provider shall conduct periodic internal audits covering all aspects and procedures of the electronic identification service and the “Yettel eID” electronic identification scheme. Internal audits must be conducted no less than once per calendar year. 

20 Information security 

The Service Provider shall establish an information security management system for managing risks related to information security. 

The Service Provider shall implement technical and security controls for managing risks associated with the “Yettel eID” electronic identification service and scheme to protect the confidentiality, integrity, and availability of processed information.  

The Service Provider shall ensure continuous information security and system resilience against risk level changes, incidents, and security breaches. 

21 Network Security Controls 

The Service Provider shall ensure the protection of electronic communication channels used for exchanging personal or confidential information against unauthorized access, interception, use, or other security breaches. The Service Provider shall apply a high level of network security, including systems for managing network traffic flows (firewall devices) and systems for attack prevention and protection. 

22 Protection of Cryptographic Material 

The Service Provider shall restrict access to cryptographic material to authorized individuals and applications for which such access is explicitly required, and shall ensure that such material is never continuously stored in plain, unencrypted format; 

The Service Provider shall ensure that media containing personal, cryptographic, or other confidential information is securely stored, transmitted, and destroyed. 

23 Personal Data Protection 

The collection, processing, and use of personal data is carried out in accordance with the Law on Personal Data Protection and for the purpose of providing the electronic identification service and the “Yettel eID” identification scheme.  

The “Yettel eID” credential is issued exclusively to individuals who have reviewed and accepted the General Terms and Conditions for the provision of the electronic identification service and the “Yettel eID” identification scheme and the Privacy Policy and who have confirmed their consent to the processing of personal data. 

By accepting the General Terms and Conditions and the Privacy Policy, the user confirms their consent for the Service Provider to maintain records on the user and use of the “Yettel eID” credential, for the purpose of providing the electronic identification service. 

The set of user personal data collected may include:  

● First name,  

● Last name, 

● Document type (ID card or travel document) and issuing country,

● Unique Master Citizen Number (JMBG) or identification document number or travel document number, 

● Document expiration date (optional),

● Document issuance date (optional),

● Issuing authority (optional),

● Date of birth (optional),

● Email address or mobile phone number, history of requested data and the user data forwarded to relying parties or services.

The Service Provider transmits the set of user data to the relying party. The set of data may include the first and last name, type of document (ID card or travel document) and the country of issuance, the Unique Master Citizen Number (JMBG), or the identification document number or travel document number, the expiration date of the identification document (optional), the issue date of the identification document (optional), the issuing authority of the identification document (optional), the date of birth (optional), and the email address or mobile phone number.  

The Service Provider guarantees to the user that their personal data will be used in accordance with the applicable personal data protection regulations, and that the integrity and confidentiality of personal data will in no way be compromised. 

Neither the Service Provider nor the relying party has knowledge of the user's password. The user’s one-time password is generated upon request using a pseudo-random number algorithm and is not stored in plain text, but processed using a cryptographic method. It is valid for 120 seconds and delivered exclusively to the user via a verified communication channel, verified email address or mobile phone number. 

For the purposes of personal data protection regulations, the data controller and processor is the Service Provider – Yettel d.o.o., Belgrade, Omladinskih brigada 90, 11073 Belgrade, contact phone +381 639000, email address dpo@yettel.rs. 

Contact details of the data protection officer and processing manager are: Daniel Šušnjar, email address daniel.sunjar@yettel.rs and dpo@yettel.rs.

The user whose personal data is being processed has the right to request access, rectification, erasure, portability, and restriction of processing, as well as to object to the processing of personal data relating to them, provided that the conditions prescribed by the personal data protection legislation are met.