PRIVACY POLICY

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (Official Journal of the European Union L 119, 4.5.2016, p. 1, hereinafter: General Data Protection Regulation), which has been fully applicable since 25 May 2018 in the Republic of Croatia and all Member States of the European Union, as well as the Act on the Implementation of the General Data Protection Regulation (Official Gazette 42/18, hereinafter: the Act), the Labour Act (Official Gazette 93/14 and 127/17), the Occupational Safety Act (Official Gazette 71/14, 118/14 and 154/14), i.e. in accordance with the legal framework for the protection of personal data in the Republic of Croatia and the European Union and best European practice, KLOPA I CUGA d.o.o..

registered with the Commercial Court in TRGOVAČKI SUD U RIJECI (hereinafter: KLOPA I CUGA d.o.o.), as the controller of personal data of users of its services and customers, has drawn up the Privacy Policy for the personal data of service users and customers. The Privacy Policy is a unilaterally binding legal act based on the fundamental principles of personal data processing, regulating which user data are collected, how such data are processed, and for what purposes they are used. The Privacy Policy also informs service users and/or customers about their rights regarding the collection and further processing of personal data, all for the purpose of protecting their privacy in a broader sense.

The Privacy Policy is based on the following principles of personal data processing: the principle of lawfulness, transparency and best practice, the principle of limited processing and data minimisation, the principle of accuracy and completeness of personal data, the principle of storage limitation, the principle of integrity and confidentiality of data, the principle of accountability, the principle of trust and fair processing, the principle of purpose limitation, and the principle of processing in anonymised form.

The Privacy Policy applies to all services offered by KLOPA I CUGA d.o.o., with the aim of clearly and transparently informing users about the procedures for processing their personal data and their rights. Above all, users may at any time contact the Company with a request to amend, supplement and/or update the data relating to them, as well as withdraw the consent given and request the cessation of further processing of personal data.

For the processing of personal data, the controller is: KLOPA I CUGA d.o.o.

Contact details for personal data protection:

e-mail: [email protected]

Methods of collection and types of personal data collected

Directly from the users themselves, in such a way that users themselves provide data to KLOPA I CUGA d.o.o. as the controller, to the extent of the data relevant for providing appropriate services, sales, or another link between the user and KOOGLANA.HR. For the purpose of providing appropriate services, the user is obliged to provide KLOPA I CUGA d.o.o. with the following data necessary for establishing a contractual relationship for the provision of a particular service and/or the sale of certain products. The customer–user may provide data verbally or in writing at the headquarters of KLOPA I CUGA d.o.o., via an email sent to one of the email addresses of KLOPA I CUGA d.o.o., and through the website of KLOPA I CUGA d.o.o., KOOGLANA.HR.

From other publicly available sources of data about companies and natural persons on internet portals, telephone directories containing such data, and other publicly available services, only for the purposes for which they were originally collected.

Automatically by visiting the KLOPA I CUGA d.o.o. internet (web) site, applications and portal, which concerns data associated with online identifiers (internet protocol addresses and cookie identifiers, such as Google Analytics for tracking user and/or customer interactions).

A cookie is a small data file stored on a computer or mobile device when visiting a particular website. Cookies are used to provide a better user experience to each user and/or customer, to store user and/or customer preferences, to make the website work more efficiently, as well as to monitor and analyse the use and traffic of the KLOPA I CUGA d.o.o. website.

By disabling and/or blocking the storage of cookies, the user and/or customer can still browse the KLOPA I CUGA d.o.o. website. However, it is likely that certain options and/or functionalities of the website will not be available to such a user and/or customer, or that the time needed to access certain website functions will be longer than usual.

The respective online identifiers may leave traces that, in combination with other identifiers and information provided by internet service providers, may serve to identify the user and/or customer.

The quantity or scope of personal data collected by KLOPA I CUGA d.o.o. depends on the type of service that KLOPA I CUGA d.o.o. provides to its users and/or customers, as well as on the legal basis on which it collects the data. KLOPA I CUGA d.o.o. constantly ensures that only the minimum necessary scope of personal data required to achieve the legally defined purpose for which the data are processed is collected.

Data about potential users

KLOPA I CUGA d.o.o. also collects data about potential users and/or customers of its services and/or products. These data include basic information (first and last name, email address), as well as the interests of potential Users and/or Customers who contact the company with the wish to be informed and/or offered certain products and services.

A cookie is a small data file stored on a computer or mobile device when visiting a particular website. Cookies are used to provide a better user experience to each user and/or customer, to store user and/or customer preferences, to make the website work more efficiently, as well as to monitor and analyse the use and traffic of the KLOPA I CUGA d.o.o. website.

By disabling and/or blocking the storage of cookies, the user and/or customer can still browse the KLOPA I CUGA d.o.o. website. However, it is likely that certain options and/or functionalities of the website will not be available to such a user and/or customer, or that the time needed to access certain website functions will be longer than usual.

The respective online identifiers may leave traces that, in combination with other identifiers and information provided by internet service providers, may serve to identify the user and/or customer.

The quantity or scope of personal data collected by KLOPA I CUGA d.o.o. depends on the type of service that KLOPA I CUGA d.o.o. provides to its users and/or customers, as well as on the legal basis on which it collects the data. KLOPA I CUGA d.o.o. constantly ensures that only the minimum necessary scope of personal data required to achieve the legally defined purpose for which the data are processed is collected.

What types of personal data are collected?

The data most commonly provided by the Customer – User are:

first and last name

address

Personal Identification Number (OIB)

contact telephone and/or mobile number

email contact details (email address)

identity card details

bank account details and card number for the purpose of settling payment obligations

Where are personal data processed?

KLOPA I CUGA d.o.o. processes Users’ – Customers’ personal data in the Republic of Croatia.

Where are the collected data stored?

Data are processed in such a way that all or part of the information about Customers – Users – Data Subjects are stored in the databases of the controller.

Obligations of the controller regarding the security of processing

TECHNICAL AND INTEGRATED DATA PROTECTION

The Controller implements technical and organisational measures to ensure an appropriate level of security.

The Controller also takes measures to ensure that any individual acting under the responsibility of the Controller who has access to personal data does not process those data except in accordance with the Controller’s instructions.

Taking into account the nature, scope, context and purposes of processing, as well as risks of varying likelihood and severity for the rights and freedoms of individuals, the Controller implements appropriate technical and organisational measures in accordance with Security Policies to ensure and be able to demonstrate that processing is carried out in accordance with the General Regulation.

Purpose of collection and further processing of data

KLOPA I CUGA d.o.o. collects and further processes personal data of users and/or customers for the purpose of concluding and performing contracts, completing purchases or service interventions on equipment, delivering ordered products, advising and assisting in the use of products, providing appropriate additional and/or extended warranties for products, resolving user and/or customer complaints, and other actions related to the conclusion and performance of contracts in accordance with applicable regulations.

The processing of personal data of users and/or customers for the aforementioned purposes is necessary and constitutes the legal basis for concluding contracts; that is, if the user and/or customer refuses to provide essential data, the company will not be able to conclude a contract and/or undertake certain actions related to the performance of the concluded contract.

Organisation of prize games

KLOPA I CUGA d.o.o. occasionally organises prize games, and data are used for notifications about the prize won.

Direct promotion (marketing)

Contact details of users and/or customers may be used to send promotional notices about products and services of KLOPA I CUGA d.o.o. if the Customer – User has given consent.

Video recordings

KLOPA I CUGA d.o.o. uses surveillance cameras to protect persons and property.

Retention period of personal data

Depending on the purpose and legal basis on which personal data of users and/or customers are collected, KLOPA I CUGA d.o.o. is in certain cases obliged to retain personal data for the period prescribed for a particular purpose by the applicable regulations or until the purpose for which they were collected ceases. Upon the expiry of the statutory period obliging KLOPA I CUGA d.o.o. to retain certain personal data or upon the cessation of the purpose, such data are deleted.

In cases where the basis for the collection and processing of data is the consent of the user and/or customer, personal data are retained for 10 years.

Data processed on the basis of the consent of users and/or customers may also be deleted before the expiry of the period stated in this Policy if such deletion is requested by the user and/or customer, or when the user and/or customer objects to such processing in writing via the internet to the published email address: [email protected].

Methods of exercising rights

They may exercise their rights if they believe there has been an irregularity in the processing of their personal data via the contact details or by email at [email protected]. The user and/or customer also has the right to lodge a complaint with the national supervisory authority.

Under what conditions and for what reasons personal data are forwarded to third parties

KLOPA I CUGA d.o.o. forwards Customers’–Users’ personal data to third parties (including competent authorities) in the following cases:

for the purpose of fulfilling the legal obligations of KLOPA I CUGA d.o.o. when such processing is necessary to protect the vital interests of Customers – Users

for the purpose of fulfilling contractual obligations, performing work on behalf of the Customer – User for which it is necessary to engage a third party – a processor

Processing of personal data in the context of employment

Employees’ personal data may be collected, processed, used and disclosed to third parties only if provided by law or if necessary for the exercise of rights and obligations arising from the employment relationship, or in connection with the employment relationship.

The Controller shall, for the purpose of exercising rights and obligations arising from the employment relationship, collect, process, use and disclose to third parties only those personal data that are necessary for the stated purpose, and shall disclose such data only at the request of courts and other state or public authorities.