https___www.vallilastore.com_pages_privacy-statement_2.xml
http___gajeta-zg.hr_politika-privatnosti_1.xml
1.1 2.1 2.2 2.3 3.1 4.1 5.1 7.1 8.1 9.1 10.1 10.2 11.1 12.1 13.1 14.1 15.1 16.1 17.1 18.1 19.1 19.2 20.1 21.1 22.1 23.1 23.2 23.3 24.1 25.1 26.1 27.1 28.1 29.1 30.1 31.1 32.1 32.2 33.1 34.1 35.1 36.1 37.1 38.1 39.1 40.1 41.1 42.1 43.1 44.1 45.1 46.1 47.1 48.1 49.1 50.1 51.1 52.1 53.1 54.1 55.1 56.1 57.1 58.1 59.1 60.1 61.1 61.2 62.1 62.2 62.3 63.1 64.1 65.1 66.1 67.1 68.1 68.2 68.3 69.1 69.2 70.1 71.1 71.2 72.1 73.1 73.2 74.1 75.1 75.2 76.1 77.1 78.1 79.1 80.1 81.1 82.1 83.1 84.1 85.1 86.1 87.1 88.1 89.1 90.1 91.1 91.2 92.1 93.1 93.2 93.3 93.4 94.1 94.2 95.1 95.2 96.1 96.2 97.1 98.1 99.1 100.1 101.1 102.1 103.1 103.2 104.1 105.1 106.1 107.1 108.1 108.2 108.3 109.1 109.2 110.1 110.2 111.1 111.2 112.1 113.1 113.2 114.1 115.1 115.2 115.3 115.4 116.1 116.2
Privacy Statement for customers, potential customers and stakeholders This is a Privacy Statement for the personal data of Vallila's customers, potential customers and other stakeholders, where we inform about collecting and processing personal data. The privacy statement has been updated to comply with the EU Data Protection Regulation, which entered into force on 25 May 2018. To contact us about privacy issues, please contact us at: tietosuoja@vallilainterior.fi Oy Vallila Interior Ab (Finnish Company ID: 2425437-1) as well as the following companies belonging to the same corporation: Oy Vallila Collection Ab (Finnish Company ID: 2561625-8) and Oy Vallila Contract Ab (Finnish Company ID: 2561626-6) [hereinafter referred to as the “Controller”] Address: Nilsiänkatu 15, 00510 Helsinki E-mail: tietosuoja@vallilainterior.fi What do the terms we use mean? “Data subject” refers to the person whose personal data are being processed by Vallila in their personal data register in the role outlined in this Privacy Notice. “Personal data” refers to all the information on an identified or identifiable natural person (hereinafter referred to as the “data subject”), including name, address, e-mail, telephone number and transaction history. A natural person is considered identifiable when they can be directly or indirectly identified on the basis of their name, social security number, location, network identification information, or one or more physical, physiological, genetic, psychological, economic, cultural or social factor distinctive to them. “Customer” refers to data subjects who are consumers and contact persons from companies and other organisations (hereinafter referred to as the “company”) that have a customer relationship with the Controller. “Potential customers” as a term refers to data subjects that are consumers or contact persons from companies that the Controller is attempting to create a customer relationship with. “Stakeholders” as a term refers to consumers and company contract persons who the Controller has a cooperative relationship with (for example, representatives of companies that provide services to the Controller) or another type of connection (for example, representatives of the media as parties in communications work as well as societal decision-makers related to social relations work). What do we use your personal data for? The Controller processes the personal data of the data subjects for the following purposes (one or more simultaneously): - Care, analysis and development of customer and stakeholder relationships The Controller may use your personal data directly with you or with the company you represent to care for, analyse and develop the customer or stakeholder relationship you have formed. - Delivery of products and services The Controller may use your personal data for the delivery of products and services if, for example, you or the company you represent have bought a product or service from us, used our digital services, ordered our newsletter or taken part in our events. The personal data are used for the agreement between the Controller and the customer or to effectuate the rights and obligations based on another commitment. - Customer communications The Controller may use your personal data in its customer communications, for example to send you notifications about products and services, to notify about any changes to services and to ask for feedback about products and services. - Marketing The Controller may contact you in order to tell you about new products, services or benefits. The Controller may use personal information to tailor its offering and to offer relevant content. For example, this means that we might give you recommendations or show you tailored content or tailored advertisements in our own services and those of third parties. - Development of products and services The Controller may use your personal data for the development of its products and services, for example to improve its product selection to make it more interesting for customers. The legal grounds for the processing of personal data can be found in following subsections of Article 6 of the EU’s General Data Protection Regulation (GDPR): - the data subject has given consent to the processing of their personal data for one or more specific purposes; - processing is necessary for the performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering into a contract; - processing is necessary for compliance with a legal obligation to which the controller is subject; and - processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data. The Controller processes your data to implement the agreement made with you or the company you represent (for example, undertaking an online shop or specialty purchases, digital service or office interior design project). The Controller’s legal rights related to doing business, such as the right to advance the sales of their products and services by certain means, and based on a legal right, the Controller may practice direct marketing and sales making use of your contact information, including processing personal data for profiling. Other legal benefits of the Controller that entitle them to the processing of your personal data include but are not limited to the assistance and other customer services for non-customers, development of their business as well as the investigation of possible cases of misuse and protection of property with video camera surveillance. If the processing of data is not based on a contractual need or a legal benefit, the Controller may ask for your consent for other types of personal data processing. In addition, the Controller may process your personal data as required by the legislation, for example based on the requirement to retain data in accounting law. What kinds of data can we process? The data collected by the Controller may include the following types of information and changes made thereto, among others: - Basic information about all data subjects - First and last name - Contact information (postal address, e-mail, telephone numbers) - Gender - Communications targeted at the data subject and activities related thereto - Direct marketing choices - Information on the use of the Controller’s digital services - Information on the cookies sent to the data subject’s primary devices (e.g. computers and mobile devices) as well as other equivalent functions and data collected with them, if the person is identifiable from the data - Possible recordings of customer service telephone calls as well as customer service-related e-mail and online conversations on social media channels, for example - Further information on company representatives - Title and/or job descriptions in their current and previous positions that relate to the work of the Controller - Data on those data subjects who have purchased the Controller’s products or services, those who give feedback on them and/or those who have made a complaint - Start and end date and type of the customer relationship or equivalent relationship - Campaigns and offers aimed at the customer and use thereof - Areas of interest and other information given by the customer - Contents of the feedback and complaints, related correspondence and follow-up - Data on data subjects who have taken part in the Controller’s events - Information related to diet (especially information that the user has given voluntarily) - Date of birth related to the events in cases in which the shipping company requires it, for example - Names and dates of birth of travel companions in cases in which the shipping company requires it, for example - Log-in information of customers of the Controller’s online services - The data subject’s log-in information - Activity in the online service after logging in What sources do we use to collect your personal data? The majority of data is received from you at the beginning of and during the customer or stakeholder relationship as well as from the programs you use for using our products and services. Personal data on potential customers collected for marketing purposes may be collected with the consent of the person in connection with various activities like competitions, surveys or events (by Vallila or its partners). The Controller also receives personal data and their updates from officials and organisations that offer credit and personal data acquisition and updating services as well as from public directories and other public sources of information, such as company websites and social media channels. The Controller collects personal data from data subjects for marketing purposes in connection with various activities, such as raffles, competitions, surveys or events (by the Controller or its partners). The Controller may analyse the data in its filing systems as well as combine it crosswise and with data obtained from third parties. The Controller also receives personal information on company representatives from their colleagues, meaning that a company’s primary contact person may give the Controller personal information about other individuals related to the use of the Controller’s products and services. Do we practice targeted marketing? Data processing may be used, for example, to create target groups interested in similar content and to target content to different groups for the purpose of creating the best possible customer experience. Who can we share your personal data with? The Controller does not give, sell or otherwise reveal your personal data to external, third parties unless otherwise noted in the text below. The Controller may distribute your personal data to third parties operating services for the Controller. For example, these services may include customer service, software services, research, marketing and event production. The Controller may distribute your personal data in order to collect payment for products and services and, for example, it can transfer or sell unpaid invoices to third parties offering collections services. The protection of your personal data is important to the Controller, which is why it does not allow these parties to use data for any other purpose apart from the offering of the services in question. It also requires that the parties protect users’ personal data in accordance with this Privacy Statement and the applicable legislation. The Controller distributes your personal data to partners that the Controller manages and carries out projects with. The Controller may share your personal data with carefully selected third parties for shared and independent direct marketing purposes. Data can be shared for these purposes only when the third party’s planned usage is not in conflict with the purposes of use defined in this Privacy Statement. The Controller can, using their discretion, share the personal data of those participating in the Controller’s events with other event participants if it is suitable given the nature of the event (for example, an event organised for stakeholders). The Controller may share your personal data during in connection with a company acquisition or other merger or acquisition or during the transfer of a service to another service provider. The Controller may share your personal data under the order of a court of law or an equivalent body. Do we transfer your data outside of the EU? In offering its services, the Controller may use resources and servers located in various regions of the world. Thus, the Controller may transfer your personal data outside of the country in which the service is being used and possibly to countries outside of the EU, in which the data protection legislation is different. In these cases, the Controller ensures that there is a legal basis for the data transfer and that the user’s personal data are protected, for example by using (as needed) the appropriate model contracts and processor contracts from officials and by requiring compliance with the appropriate technical and other data protection activities. How long will we process your data for? The Controller processes your personal data in this register for as long as the Controller has a valid basis for the processing of the data in accordance with section 2 of this Privacy Statement, and for a reasonable amount of time afterwards. The processing time of personal data of various groups of people are set with the following justifications: - Private consumer customers The Controller can process your personal data during your customer relationship and for three years following the end of the customer relationship. After this, the Controller can transfer your necessary personal data to a marketing register and process you as a potential customer again. - Business customer representatives The Controller can process your personal data as long as you are representing the Controller’s business customer and for three years following its end. After this, the Controller can transfer your necessary personal data to a marketing register and process you as a potential business customer representative again. - potential private consumer customers and potential business customer representatives The Controller can process your personal data indefinitely, until you become a customer or until you demand that your data are deleted from the Controller’s marketing register. - Stakeholder members The Controller can process your personal data for as long as you are a member of a stakeholder group, including representing a partner of the Controller or the media, and during the calendar year following the end of this membership. Is it necessary to give your personal data to us? In order for the Controller to be able to fulfil the contractual obligations related to our relationship, the Controller must receive and process personal data about you. Without the necessary personal data, we cannot offer you the products and services which the processing of personal data is required for, such as online shop purchases, for example. How can you use your rights regarding your personal data? As a data subject, you have various opportunities to affect the processing of your personal data. Normally, your request will be completed within a month. We ask that you contact us using the contact information provided in section 1 of this Privacy Statement for issues related to the use of your rights. Your rights include (the scope of the rights depends on the basis for processing of your personal data, meaning that not all of the rights below are necessarily at your disposal in all situations): - The right to gain access to the personal data collected about you. In practice, this happens in such a way that having received an appropriate and identified request from you, we provide you with a report of the personal data collected about you onto our personal data register. - The right to request the rectification or erasure of personal data collected about you. If you notice that there are mistakes or something is missing from your data, you can make a rectification request with us. - The right to request the erasure of personal data collected about you. We are obligated to erase your personal data from our personal data register upon your request if any one of the following justifications is fulfilled and if the erasure is not hindered by an obligation to retain data resulting from legislation or an official order: - The personal data are no longer needed for the purposes for which they were collected; - You revoke your consent, and there is no other legal basis for processing; - You object to the processing based on a particular personal situation and there is no justifiable reason for the processing, or you object to the processing of your personal data for direct marketing; - Your personal data have been processed illegally; - Your personal data must be erased in order to comply with a legal obligation applied to the Controller based on European Union law or Finnish legislation; or - Your personal data have been collected while offering information society services, for example when ordering of the Controller’s digital data services. - The right to request the restriction of processing of your personal data. You can request the Controller to restrict the processing of your personal data if: - You contest the validity of the personal data about you held by the Controller; - The processing is illegal and you demand the restriction of use as opposed to erasure; - The Controller no longer needs the personal data in question for purposes of processing, but you need them in order to draft, present or defend a legal claim; - You have objected to the processing of personal data while awaiting verification of whether or not the legal bases of the Controller override yours. - The right to object to the processing of personal data concerning you. If the Controller processes your data based on a legal benefit, you have the right to object to the processing of the personal data concerning you based on a particular, personal situation. Everyone included in the registers referred to in this Privacy Statement has the right to object to the processing of their personal data for direct marketing. - The right to transfer the data you have given from one system to another. If the automatic processing of your personal data is based on consent or agreement, you have the right to receive the personal data you have provided to the Controller in a structured, commonly used and digitally readable format as well as the right to transfer the data in question to another controller. - The right to withdraw consent. If all or some of your personal data are processed in this register based on your given consent, you have the right to withdraw your consent. - The right to make a complaint to supervisory authorities. If any disagreement between you and the Controller related to the processing of your personal data cannot be resolved amicably, you have the right to request that the issue be resolved by the Data Protection Authority. Which country’s legislation is applied to the processing of your data? We are a Finnish corporation. Finnish legislation and EU legislation directly applicable in Finland, such as the GDPR, are applied to this personal data register and the processing of the personal data therein. How can we update this privacy statement? We are constantly developing our business and it may also mean that changes to the processing of personal data are made. We update our Privacy Statement as needed to correspond to the changes in procedure. The changes may also be based on changes in the legislation. We recommend that you regularly familiarise yourself with the contents of the Privacy Statement. If we start to process your personal data for purposes other than those which your personal data were originally collected for, we will notify you of this and the updated Privacy Statement before further processing. We will notify you of any other changes to the Privacy Statement on our website.
1.1 2.1 3.1 3.2 4.1 5.1 6.1 7.1 8.1 9.1 10.1 11.1 12.1 13.1 14.1 15.1 16.1 17.1 18.1 19.1 20.1 21.1 22.1 22.2 23.1 24.1 24.2 25.1 26.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 34.1 35.1 36.1 37.1 38.1 38.2 39.1 40.1 40.2 41.1 42.1 43.1 44.1 45.1 46.1 47.1 48.1 49.1 50.1 51.1 52.1 53.1 54.1 55.1 56.1 57.1 57.2 57.3 58.1 59.1 60.1 61.1 62.1 63.1 64.1 65.1 66.1 67.1 68.1 69.1 69.2 70.1 71.1 72.1 73.1 74.1 75.1 76.1 77.1 78.1 79.1 80.1 81.1
OPĆA POLITIKA O ZAŠTITI OSOBNIH PODATAKA - Općenito Opća politika zaštite osobnih podataka opisuje svrhu i ciljeve prikupljanja, obrade i upravljanja osobnim podacima od strane GAJETA d.o.o. Cankareva 6, 10000 Zagreb, OIB: 38448070359 (u daljnjem tekstu Voditelj obrade) te osigurava adekvatnu razinu zaštite osobnih podataka u skladu s Općom uredbom o zaštiti podataka ( Uredba EU 2016/679 ) i Zakonom o provedbi Opće uredbe o zaštiti podataka ( NN 42/2018 ). Cilj jest uspostaviti primjerene procese zaštite i upravljanja osobnim podacima ispitanika, a primjenjuje se na sve obrade osobnih podataka, osim u slučaju gdje se obrađuju anonimizirani podaci ili su obrade takve prirode da se radi o statističkim analizama iz kojih nije moguće identificirati pojedinca. Pojmovi * osobni podaci - su svi podaci koji se odnose na pojedinca (ispitanika) čiji je identitet utvrđen ili se može utvrditi Pojedinac čiji se identitet može utvrditi jest osoba koje se može identificirati izravno ili neizravno, osobito uz pomoć identifikatora kao što su ime, identifikacijski broj, podaci o lokaciji, mrežni identifikator ili uz pomoć jednog ili više čimbenika svojstvenih za fizički, fiziološki, genetski, mentalni, ekonomski, kulturni ili socijalni identitet tog pojedinca. * obrada podataka - svaki postupak ili skup postupaka koji se obavljaju na osobnim podacima ili na skupovima osobnih podataka, bilo automatiziranim ili neautomatiziranim sredstvima kao što su prikupljanje, bilježenje, organizacija, strukturiranje, pohrana, prilagodna, izmjena, pronalaženje, vršenje uvida, uporaba, otkrivanje prijenosom, širenjem ili stavljanje na raspolaganje na drugi način, usklađivanje ili kombiniranje, ograničavanje, brisanje ili uništavanje. * izrada profila - svaki oblik automatizirane obrade i upotrebe osobnih podataka radi ocjene određenih osobnih aspekata povezanih s pojedincem radi analize ili predviđanje aspekata u vezi s radnim učinkom, ekonomskim stanjem, zdravljem, osobnim sklonostima, interesima, lokacijom, kretanjem tog pojedinca * voditelj obrade - fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje samo ili zajedno s drugima određuje svrhe i sredstva obrade osobnih podataka, kada su svrhe i sredstva takve obrade utvrđeni pravom Unije ili pravom države članice * izvršitelj obrade - fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje obrađuje podatke u ime voditelja obrade * primatelj - fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo kojem se otkrivaju osobni podaci, neovisno o tome da li je on treća strana * treća strana - fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje nije ispitanik, voditelj obrade, izvršitelj obrade ni osobe koje su ovlaštene za obradu osobnih podataka koji se na njega odnose * privola - svako dobrovoljno, posebno, informirano i nedvosmisleno izražavanje želja ispitanika kojim on izjavom ili jasnom potvrdnom radnjom daje pristanak za obradu osobnih podataka koji se na njega odnose * povreda osobnih podataka - kršenje sigurnosti koje dovodi do slučajnog ili nezakonitog uništenja, gubitka, izmjene, neovlaštenog otkrivanja ili pristupa osobnim podacima koji su preneseni, pohranjeni ili na drugi način obrađivani * nadzorno tijelo - u Republici Hrvatskoj - Agencija za zaštitu osobnih podataka * usluga informacijskog društva - usluga definirana čl. 1 st. 1 točkom 2 Direktive 2015/1535 Europskog parlamenta i Vijeća - svaka usluga informacijskog društva, to jest svaka usluga koja se obično pruža uz naknadu, na daljinu, elektroničkim sredstvima te na osobni zahtjev primatelja usluga - Načela obrade podataka Načela obrade podataka su osnovna pravila kojih se pridržavamo prilikom obrade osobnih podataka ispitanika, a to su: * zakonitost i poštenost - obrađujemo osobne podatke ispitanika sukladno važećim zakonima i poštujući sva prava ispitanika * transparentnost - pružamo ispitanicima sve potrebne informacije te na zahtjev osiguravamo uvid u njihove osobne podatke koje obrađujemo. Ispitanik će ujedno biti, prije samog prikupljanja osobnih podataka, upoznat sa svrhom obrade i svojim pravima * ograničenje svrhe - osobne podatke prikupljamo u posebne, jasne i zakonite svrhe te iste ne obrađujemo u svrhe za koje privola nije dana, osim za obrade koje su uvjetovane zakonom ili su neophodne za kvalitetnu isporuku usluge ili dostave * ograničenje pohrane - osobne podatke ispitanika čuvamo u obliku koji omogućava identifikaciju ispitanika samo onoliko dugo koliko je to potrebno u svrhu ili svrhe radi kojih se osobni podaci obrađuju. Mi možemo pohraniti osobne podatke na duži vremenski period, ukoliko nam to nalaže posebni zakonski propis ili legitimni interes ( npr. sudski spor) * smanjenje količine podataka - osobne podatke obrađujemo na način da su primjereni, relevantni i ograničeni u odnosu na svrhu ili svrhe za koje se obrađuju. * točnost - osobni podaci koje obrađujemo moraju biti točni i po potrebi ažurirani * cjelovitost i pouzdanost - osobne podatke obrađujemo na način kojim se osigurava odgovarajuća sigurnost osobnih podataka, uključujući zaštitu od neovlaštene ili nezakonite obrade te od slučajnog gubitka, uništenja ili oštećenja, primjenom odgovarajućih tehničkih i organizacijskih mjera. - Zakonitost obrade Obrada osobnih podataka je zakonita samo ako je ispunjen jedan od niže navedenih uvjeta: * ispitanik je dao privolu za obradu svojih osobnih podataka u jednu ili više svrha * obrada je nužna za izvršavanje ugovora u kojem je ispitanik stranka ili kako bi se poduzele radnje na zahtjev ispitanika prije sklapanja ugovora * obrada je nužna radi poštovanja pravnih obveza voditelja obrade * obrada je nužna za potrebe legitimnih interesa voditelja obrade ili treće strane, osim kada su od tih interesa jači interesi ili temeljna prava i slobode ispitanika koji zahtjevaju zaštitu obrade osobnih podataka, osobito ako je ispitanik dijete. Pod legitimnim interesom smatrane su obrade koje služe npr. da bi se unaprijedio i modernizirao proces razvoja proizvoda i usluga, ponudili proizvodi i usluge koje bi ispitaniku olakšali poslovanje sa voditeljem obrade ili npr. u svrhu sudskih sporova * obrada je nužna kako bi se zaštitili ključni interesi ispitanika ili druge fizičke osobe * obrada je nužna za izvršavanje zadaća od javnog interesa ili pri izvršavanju službene ovlasti voditelja obrade - Prava ispitanika U trenutku prikupljanja podataka ispitaniku ćemo pružiti sljedeće informacije: identitet i kontakt podatke voditelja obrade, svrhe obrade radi kojih se prikupljaju osobni podaci, pravnu osnovu za obradu, legitimne interese, primatelje ili kategorije primatelja osobnih podataka, ukoliko isti postoje, namjeru prijenosa osobnih podataka trećim zemljama, ukoliko ista postoji, razdoblje pohrane podataka ili kriterije koji definiraju to razdoblje, sva prava ispitanika, potencijalno postojanje automatiziranog donošenja odluka što podrazumijeva i izradu profila (smislene informacije o kojoj logici obrade je riječ, potencijalnim posljedicama i važnosti same obrade za ispitanika). U slučaju da se osobni podaci ne prikupljanju od ispitanika, navodimo i izvor osobnih podataka. * pravo na pristup - ispitanik ima pravo dobiti potvrdu obrađuju li se njegovi osobni podaci te ako se takvi podaci obrađuju, pristup osobnim podacima i svrsi obrade, * pravo na ispravak - ispitanik ima pravo bez nepotrebnog odgađanja ishoditi ispravak netočnih osobnih podataka koji se odnose na njega. Uzimajući u obzir svrhe obrade, ispitanik ima pravo dopuniti nepotpune osobne podatke, među ostalima i davanjem dodatne izjave. * pravo na brisanje ("pravo na zaborav")- ispitanik ima pravo ishoditi brisanje osobnih podataka koji se na njega odnose, a mi imamo obvezu obrisati osobne podatke bez nepotrebnog odgađanja ako je ispunjen jedan od sljedećih uvjeta: - osobni podaci više nisu nužni u odnosu na svrhe za koje su prikupljeni ili na drugi način obrađeni - ispitanik povuče privolu na kojoj se obrada temelji, a ne postoji druga pravna osnova za obradu, ispitanik uloži prigovor na obradu, a legitimni razlozi za realizaciju prava na brisanje su veći od legitimnog interesa nas kao voditelja obrade za obradu i/ili čuvanje podataka - osobni podaci su nezakonito obrađeni - osobni podaci moraju se brisati radi poštovanja pravne obveze propisane pravom Unije ili pravom Republike Hrvatske - osobni podaci su prikupljeni u vezi s ponudom usluge informacijskog društva izravno djetetu ispod dobne granice od 16 godina * pravo na ograničenje obrade - ispitanik ima pravo od nas tražiti ograničenje obrade osobnih podataka u slučaju da se osporava njihova točnost, kada je obrada nezakonita ( a ispitanik se protivi brisanju osobnih podataka te umjesto toga traži ograničenje njihove uporabe), te u slučaju kada je ispitanik uložio prigovor na obradu osobnih podataka očekujući potvrdu nadilaze li legitimni razlozi voditelja obrade razloge ispitanika * pravo na prijenos podataka - ispitanik ima pravo zaprimiti svoje osobne podatke koji se na njega odnose, a koje nam je dao temeljem svoje privole, u strukturiranom, uobičajeno upotrebljavanom i strojno čitljivom formatu te ima pravo tražiti prijenos tih podataka drugom voditelju obrade, ukoliko je tehnički izvedivo. * pravo na prigovor - ispitanik ima pravo na temelju svoje posebne situacije u svakom trenutku uložiti prigovor na obradu osobnih podataka koji se odnose na njega. Mi u takvoj situaciji više ne smijemo obrađivati osobne podatke, osim ako dokažemo da postoje legitimni razlozi za daljnju obradu koji nadilaze interese, prava i slobode ispitanika ili radi postavljanja, ostvarivanja ili obrane pravnih zahtjeva. Nadalje, ako se osobni podaci obrađuju za potrebe izravnog marketinga, ispitanik u svakom trenutku ima pravo uložiti prigovor na obradu osobnih podataka koji se odnose na njega, što uključuje i izradu profila u mjeri koja je povezana s takvim izravnim marketingom. Dodatno, ispitanik ima pravo zatražiti da se na njega ne odnosi odluka koja se temelji isključivo na automatiziranoj obradi, uključujući izradu profila, koja proizvodi učinke na njega ili na sličan način značajno na njega utječu, osim ako je ta odluka: - dopuštena zakonom - potrebna za izvršavanje odluka između ispitanika i voditelja obrade - temeljena na izričitoj privoli ispitanika Ispitanik svoja prava može ostvariti u svakom trenutku na način da nas kontaktira na: GAJETA d.o.o. Cankareva 6, 10000 Zagreb, e-mail: Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite. Ispitaniku će biti pružene informacije o poduzetim radnjama najkasnije u roku od mjesec dana od dana zaprimanja zahtjeva. Ukoliko je obrada zahtjeva složena ili se radi o velikom broju zahtjeva, taj rok se može produžiti za još dva mjeseca, ali će u tome slučaju ispitanik biti izvješten o razlozima eventualnog produljenja roka. Također, ukoliko se ne postupi po zahtjevu ispitanika u roku od mjesec dana od primitka zahtjeva, o odluci će ispitanik biti izvješten uz navođenje razloga za takvu odluku te njegovoj mogućnosti podnošenja pritužbe Agenciji za zaštitu osobnih podataka, Martićeva 14, 10000 Zagreb. U slučaju da su zahtjevi ispitanika očito neutemeljeni ili pretjerani, osobito zbog njihovog učestalog ponavljanja, možemo naplatiti razumnu naknadu na temelju administrativnih troškova ili odbiti postupati po zahtjevu ispitanika. - Sigurnost i obveze U nekim poslovnim procesima se pojavljujemo kao voditelji obrade, u tome slučaju samostalno određujemo svrhu i način obrade osobnih podataka, međutim, u nekim poslovnim procesima smo u ulozi izvršitelja obrade, u kojem situacijama obrađujemo osobne podatke u ime voditelja obrade. U skladu s time kontinuirano provodimo odgovarajuće tehničke i organizacijske mjere zaštite kako bi zaštitili osobne podatke ispitanika, u kojoj god da se ulozi nalazimo. Osobne podatke čuvamo u skladu sa našim integriranim standardima sigurnosti, a gdje je to primjenjivo, koristimo kriptografske metode zaštite podataka te unapređujemo sigurnosne mjere u svrhu sprječavanja povrede osobnih podataka ispitanika. Ne dopuštamo neovlašteno prikupljanje, obradu ili korištenje osobnih podataka te primjenjujemo pravilo ograničavanja pristupa podacima samo na one podatke koji su potrebni za obavljanje pojedinih poslovnih zadataka, sukladno našim internim odlukama. Osobne podatke štitimo od neovlaštenog pristupa, korištenja, izmjene te gubitka neovisno od toga da li su isti pohranjeni u papirnatom ili elektroničkom obliku. - Povreda osobnih podataka U slučaju da dođe do povrede osobnih podataka, svi naši radnici imaju dužnost obavijestiti odgovorne osobe o povredi bez odgode, a mi kao voditelji obrade smo dužni, bez nepotrebnog odgađanja i, ako je izvedivo, najkasnije 72 sata nakon saznanja o toj povredi, izvijestiti nadzorno tijelo odnosno Agenciju za zaštitu osobnih podataka. U slučaju da se nalazimo u ulozi izvršitelja obrade, o povredi obavještavamo u tome slučaju voditelja obrade podataka. Ukoliko je riječ o povredi osobnih podataka koja će vjerojatno prouzročiti visok rizik za prava i slobode pojedinaca, o povredi ćemo obavijestiti i ispitanika, osim ako: - su poduzete odgovarajuće tehničke i organizacijske mjere zaštite i te su mjere primijenjene na osobne podatke obuhvaćene povredom osobnih podataka, posebno one koje osobne podatke čine nerazumljivima bilo osobi koja im nije ovlaštena pristupiti, kao što je enkripcija - su poduzete naknadne mjere kojima se osigurava da više nije vjerojatno da će doći do visokog rizika za prava i slobode ispitanika - bi se time zahtijevao nerazmjeran napor, u kojem slučaju mora postojati javna obavijest ili slična mjera kojom se ispitanici obavještavaju na jednako djelotvoran način Ispitanik ima pravo podnijeti pritužbu nadzornom tijeku - Agenciji za zaštitu osobnih podataka u slučaju - povrede njegovih osobnih podatka ili - ako drži da se njegova prava grubo krše sukladno Općom uredbom o zaštiti osobnih podataka - Završne odredbe Ova Opća politika stupa na snagu danom donošenja, a dostupna je u poslovnim prostorijama na oglasnoj ploči GAJETA d.o.o. Zagreb, 25.05.2018. godine GAJETA d.o.o. kojeg zastupa direktor Jasminka Jović