PRIVACY POLICY

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (Official Journal of the European Union L 119, 4.5.2016, p. 1., hereinafter: General Data Protection Regulation), which has been fully applicable since 25 May 2018 in the Republic of Croatia and all Member States of the European Union, as well as the Act on the Implementation of the General Data Protection Regulation (Official Gazette No. 42/18, hereinafter: the Act), the Labour Act (Official Gazette No. 93/14 and 127/17), the Occupational Safety Act (Official Gazette No. 71/14, 118/14 and 154/14), i.e. in accordance with the legal framework for personal data protection in the Republic of Croatia and the European Union and the best European practice, KLOPA I CUGA D.O.O.

registered at the Commercial Court in Rijeka (hereinafter: KLOPA I CUGA D.O.O.), as the controller of personal data of its service users and customers, has drawn up the Privacy Policy on the protection of personal data of service users and customers. The Privacy Policy is a unilaterally binding legal act based on the fundamental principles of personal data processing, which regulates which user data is collected, how such data is processed, and for what purposes it is used. The Privacy Policy also informs service users and/or customers about their rights in the collection and further processing of personal data, all for the purpose of protecting their privacy in a broader sense.

The Privacy Policy is based on the following principles of personal data processing: the principle of lawfulness, transparency and best practice, the principle of limited processing and data minimisation, the principle of accuracy and completeness of personal data, the principle of limited storage, the principle of data integrity and confidentiality, the principle of accountability, the principle of trust and fair processing, the principle of purpose limitation (opportuneness), and the principle of processing in an anonymised form.

The Privacy Policy applies to all services offered by KLOPA I CUGA D.O.O., with the aim of clearly and transparently informing users about the procedures for processing their personal data and their rights. Above all, users may at any time contact the company with a request for modification, supplementation and/or updating of their personal data, as well as withdraw their consent and request the cessation of further processing of personal data.

For the processing of personal data the responsible entity is: KLOPA I CUGA D.O.O.

Contact details for personal data protection:

e-mail: [email protected]

Methods of collection and types of personal data collected

Directly from users themselves, in such a way that users personally provide data to KLOPA I CUGA D.O.O. as the controller, within the scope of data relevant for providing appropriate services, sales, or any other connection between the user and KOOGLANA.HR. For the purpose of providing appropriate services, the user is obliged to provide KLOPA I CUGA D.O.O. with the following data necessary to establish a contractual relationship for the provision of a particular service and/or the sale of certain products. The customer – user may provide data orally or in writing at the headquarters of KLOPA I CUGA D.O.O., via e-mail sent to one of the e-mail addresses of KLOPA I CUGA D.O.O., and through the website KOOGLANA.HR.

From other publicly available sources of data about legal entities and natural persons on internet portals, telephone directories containing such data, and other publicly available services, but only for the purposes for which they were originally collected.

Automatically, by visiting the KLOPA I CUGA D.O.O. website, applications and portals, whereby the data relates to network identifiers (IP addresses and cookie identifiers, such as Google Analytics for tracking user and/or customer interactions).

A cookie is a small data file stored on a computer or mobile device when visiting a particular website. Cookies are used to provide a better user experience for each user and/or customer, to save preferences of users and/or customers, to ensure the website works more efficiently, as well as to track and examine the use and traffic of the KLOPA I CUGA D.O.O. website.

By disabling and/or blocking the storage of cookies, the user and/or customer may still browse the KLOPA I CUGA D.O.O. website. However, certain features and/or functionalities of the website may not be available to such a user and/or customer, or access to certain website functions may take longer than usual.

The relevant network identifiers may leave traces which, in combination with other identifiers and information provided by Internet service providers, may serve to identify the user and/or customer.

The amount and scope of personal data collected by KLOPA I CUGA D.O.O. depends on the type of service provided to users and/or customers, as well as on the legal basis on which the data is collected. KLOPA I CUGA D.O.O. constantly ensures that only the minimum necessary amount of personal data is collected for achieving the legally determined purpose for which the data is processed.

Data about potential users

KLOPA I CUGA D.O.O. also collects data about potential users and/or customers of its services and/or products. This data includes basic information (name and surname, e-mail address), as well as the interests of potential users and/or customers who contact the company with the wish to be informed and/or offered certain products and services.

Types of personal data collected

The data most often provided by the Customer – User are:

• First and last name
• Address
• Personal identification number (OIB)
• Contact phone number and/or mobile number
• E-mail address
• Data from an identity card
• Bank account details and card number for payment obligations

Where is personal data processed?

Personal data of Users – Customers are processed by KLOPA I CUGA D.O.O. in the Republic of Croatia.

Where is the collected data stored?

The data is processed so that all or part of the information about Customers – Users – Data Subjects is stored in the controller’s databases.

Obligations of the controller regarding data security

TECHNICAL AND INTEGRATED DATA PROTECTION

The controller implements technical and organisational measures to ensure an appropriate level of security.

The controller also takes measures to ensure that each individual acting under the responsibility of the controller who has access to personal data does not process such data unless instructed by the controller.

Taking into account the nature, scope, context, and purposes of the processing, as well as the risks of varying likelihood and severity for the rights and freedoms of individuals, the controller implements appropriate technical and organisational measures in accordance with Security Policies to ensure and be able to demonstrate that the processing is carried out in accordance with the General Regulation.

Purpose of data collection and further processing

KLOPA I CUGA D.O.O. collects and further processes the personal data of users and/or customers for the purpose of concluding and executing contracts, completing purchases or service interventions, delivering ordered products, providing advice and assistance on product use, providing appropriate additional and/or extended product warranties, resolving customer complaints, and other actions related to the conclusion and execution of contracts in accordance with applicable regulations.

The processing of personal data of users and/or customers for the aforementioned purposes is a necessity and a legal basis for concluding contracts; in cases where the user and/or customer refuses to provide essential data, the company will not be able to conclude the contract and/or undertake certain actions related to the execution of the concluded contract.

Organization of prize competitions

KLOPA I CUGA D.O.O. occasionally organizes prize competitions, and data is used for notifications about won prizes.

Direct marketing

Contact details of users and/or customers may be used for sending promotional notices about the products and services of KLOPA I CUGA D.O.O., if the Customer – User has given consent.

Video recordings

KLOPA I CUGA D.O.O. uses surveillance cameras for the protection of people and property.

Retention period of personal data

Depending on the purpose and legal basis for which personal data of users and/or customers is collected, KLOPA I CUGA D.O.O. is, in certain cases, obliged to keep personal data for the period prescribed by applicable regulations, or until the purpose for which they were collected ceases. Upon expiry of the statutory period obliging KLOPA I CUGA D.O.O. to keep certain personal data, or when the purpose ceases, the data is deleted.

In cases where the basis for data collection and processing is the consent of the user and/or customer, personal data is retained for 10 years.

Data processed on the basis of the consent of the user and/or customer may also be deleted before the expiry of the period specified in this Policy, if such deletion is requested by the user and/or customer, or if the user and/or customer objects to such processing in writing via the published e-mail address: [email protected].

Ways of exercising rights

Users may exercise their rights if they believe that irregularities have occurred in the processing of their personal data, through the contact details or via e-mail at [email protected]. The user and/or customer also has the right to file a complaint with the national supervisory authority.

Under what conditions and for what reasons are personal data disclosed to third parties

KLOPA I CUGA D.O.O. discloses personal data of Customers – Users to third parties (including competent authorities) in the following cases:

• for the fulfilment of legal obligations of KLOPA I CUGA D.O.O., when such processing is necessary for the protection of the vital interests of Customers – Users
• for the fulfilment of contractual obligations, the execution of work on behalf of Customers – Users, for which it is necessary to engage a third party – processor

Processing of personal data in the context of employment

Employee personal data may be collected, processed, used, and disclosed to third parties only if required by law or if necessary for the exercise of rights and obligations arising from the employment relationship, or in connection with the employment relationship.

For the purpose of exercising rights and obligations arising from the employment relationship, the controller will collect, process, use, and disclose to third parties only those personal data necessary for the stated purpose, and such data will be disclosed only upon request of courts and other state or public authorities.