https___www.iob.de__en_Privacy_20Policy_Privacy_20Policy.html.xml
http___gajeta-zg.hr_politika-privatnosti_1.xml
1.1 2.1 2.2 2.3 2.4 3.1 3.2 4.1 4.2 4.3 5.1 6.1 7.1 8.1 9.1 10.1 11.1 12.1 13.1 14.1 15.1 16.1 17.1 18.1 19.1 20.1 21.1 22.1 23.1 24.1 25.1 26.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 34.1 35.1 36.1 37.1 39.1 40.1 41.1 41.2 42.1 43.1 44.1 45.1 46.1 47.1 48.1 49.1 50.1 50.2 51.1 52.1 53.1 54.1 54.2 55.1 55.2 55.3 55.4 55.5 55.6 55.7 55.8 55.9 56.1 56.2 56.3 56.4 56.5 57.1 58.1 59.1 60.1 61.1 61.2 61.3 62.1 63.1 63.2 64.1 65.1 66.1 66.2 67.1 68.1 68.2 68.3 68.4 68.5 69.1 70.1 70.2 71.1 72.1 73.1 74.1 75.1 76.1 78.1 78.2 78.3 79.1 80.1 81.1 81.2 82.1 83.1 84.1 86.1 87.1 88.1 89.1 90.1 92.1 92.2 93.1 94.1 94.2 95.1 97.1 98.1 100.1 100.2 100.3 102.1 102.2 104.1 106.1 108.1 108.2 110.1 110.2 111.1 112.1 112.2 112.3 112.4 113.1 114.1 115.1 116.1 117.1 118.1 120.1 122.1 123.1 125.1 127.1 129.1 129.2 131.1 131.2 132.1 133.1 134.1 135.1 136.1 136.2 136.3 136.4 136.5 137.1 137.2 138.1 139.1 139.2 139.3 140.1 141.1 141.2 141.3 142.1 143.1 145.1 146.1 147.1 148.1 148.2 149.1 151.1 152.1 153.1 155.1 156.1 157.1 157.2 158.1 158.2 158.3 158.4 159.1 160.1 160.2 160.3 160.4 160.5 160.6 160.7 160.8 161.1 161.2 161.3 161.4 161.5 161.6 161.7 161.8 161.9 161.10 162.1 162.2 162.3 162.4 162.5 162.6 162.7 163.1 164.1 164.2
Privacy Policy Thank you for your interest in our online presence. The protection and security of your personal data is our highest priority. Personal data includes all types of data with which you can be identified as a person. We therefore strictly adhere to the legal provisions of the Federal Data Protection Act (BDSG-neu), the EU-General Data Protection Regulation (GDPR) and the Telemedia Act (TMG). We would like to point out that internet-based data transmission (e.g. communication by e-mail) can have security gaps and that complete protection of data against access by third parties is therefore impossible. It is therefore recommended to use the postal service when sending very sensitive data or information. In the following, we will inform you transparently and in comprehensible language about the data collection and its scope, for what your data will be used and what rights you have. If you have any questions regarding data protection, please contact us. You will find the contact details under point 1 of this data protection declaration. Responsible in terms of the data protection act Collection of general information Cookies 3.1 Technically necessary cookies that are set by our website Data security Contact form and use of our e-mail address Deletion or blocking of data Web analysis Social media plugins Your rights towards the person responsible for data processing 9.1 Right to information 9.2 Right of correction 9.3 Right to cancellation (right to be forgotten) 9.3.1 Information to third parties 9.3.2 Exceptions 9.4 Right to limit processing 9.5 Right to information 9.6 Right to data transferability 9.7 Right to object 9.8 Automated decisions in individual cases including profiling 9.9 Right to revoke the data protection consent 9.10 Right to complain to a supervisory authority Existence of automated decision making including profiling Requirement to provide personal data Legal basis of the processing Modification of our Privacy Policy Responsible in terms of the data protection act Industrial furnace construction GmbH Harald Wolf (CEO) Scheffelstrasse 10 69469 Weinheim Germany Phone: Email: iob@iob.de Collection of general information When you access our website, information of a general nature is automatically collected. This information (server log files) includes Browser type and version, operating system used, Website from which you visit us (referrer URL), Web page you visit (URLs called), Date and time of your access, Your Internet Protocol (IP) address, the Internet service provider of the accessing computer. This anonymous data is stored separately from any personal data you may have provided and thus does not allow any conclusions to be drawn about a specific person. This information is technically necessary and is mandatory when using the Internet. This information is required in order to (1) deliver the contents of our website correctly, (2) optimize the contents of our website as well as the advertising for it, (3) ensure the permanent functionality of our information technology systems and the technology of our website, as well as (4) to provide law enforcement agencies with the information necessary for prosecution in the event of a cyber attack. Anonymously collected data of this kind is statistically evaluated by us with the aim of optimizing our Internet presence and the technology behind it, as well as to increase data protection and data security in order to ensure an optimum level of protection for the personal data processed by us. The anonymous data of the server log files are stored separately from all specified personal data. Cookies Our website uses so-called cookies. Cookies are text files that are stored on your computer in the Internet browser or by the Internet browser. Some elements of our website require that the calling browser can be identified even after a page change. For example, to store login information. The cookies we use are technically necessary cookies which are automatically deleted when the browser is closed. Some cookies remain stored on your device and enable recognition the next time you visit the site. The legal basis for data processing is Art. 6 para. 1 lit. f of the Data Protection Basic Regulation (GDPR), which enables us to process data in case of a legitimate interest. In this case, our legitimate interest is to offer you a technically error-free and functionally optimized website. You can set your browser so that you are informed about the setting of cookies and then allow these cookies only in individual cases. You can also generally exclude the acceptance of cookies or accept them only in certain cases. You can also set your browser so that cookies are deleted after closing the browser window. Each browser differs in the way it manages the cookie settings. These are described in the help menu of each browser, which explains how you can change your cookie settings. Please note that if you do not accept cookies, our website will not function properly. 3.1 Technically necessary cookies that are set by our website The cookies PHPSESSIDD and MOZILOID are so-called session cookies. These cookies contain a unique ID as anonymous user information, which is used to assign the user to the page accessed in order to ensure the basic functionality of this website. Session cookies are usually deleted again when the browser is closed. The cookie cookieconsent_status is set by the cookie banner and stores the visitor's decision about setting cookies. This cookie is usually deleted again when the browser is closed. Data security In order to protect the security of your data during transmission, we use state-of-the-art encryption methods via an SSL or TLS connection. This encryption prevents your sensitive personal data from being intercepted and viewed by unauthorized third parties. You can recognize an encrypted connection by the fact that the address line of the browser begins with "https://" and by the lock symbol in the browser line. Contact form and use of our e-mail address If you contact us by e-mail or contact form, the information you provide will be used and stored for the purpose of processing your inquiry and for possible follow-up questions. The mandatory data in the contact form can be recognized by the correspondingly marked input fields. Your data will be deleted after the processing is completed. Your data will not be passed on to third parties. A comparison of the data collected in this way with data that may have been collected by other components of our site is also not carried out. Deletion or blocking of data We adhere to the principles of data avoidance and data economy. We therefore only store your personal data for as long as this is necessary to achieve the purposes stated here or as required by the commercial and tax law storage and retention periods stipulated by the legislator. After the respective purpose has ceased to exist or these periods have expired, the corresponding data is routinely blocked or deleted in accordance with the statutory provisions, provided that it is no longer required for the fulfilment or initiation of a contract. Web analysis We do not use web analytics tools. Social media plugins No social media plug-ins are used on our websites. Your rights towards the person responsible for data processing In the following, we list the rights you have according to the basic data protection regulation towards the person responsible for data processing. The person responsible is named under point 1 of this data protection declaration. If we process personal data from you, you are a "data subject" within the meaning of the Basic Data Protection Regulation. If you would like to claim rights as a data subject, you can contact the data controller mentioned under point 1 of this data protection declaration at any time. 9.1 Right to information Any person affected by the processing of personal data has the right to obtain at any time and free of charge information from the data controller about the personal data stored about him/her and a copy of this information. You are also entitled to receive information about the following: - the processing purposes, - the categories of personal data processed, - the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular in the case of recipients in third countries or international organizations - if possible, the planned duration for which the personal data will be stored or, if this is not possible, the criteria for determining this duration, - the existence of a right of rectification or erasure of personal data concerning him or her or of a right to have the processing limited by the controller or to object to such processing, - the existence of a right of appeal to a supervisory authority (responsible is the state data protection commissioner of the federal state in which we have our headquarters; addresses and links can be found here), - if the personal data is not collected from the data subject: All available information about the origin of the data, - the existence of automated decision making including profiling in accordance with Article 22, paragraphs 1 and 4 FADP and - at least in these cases - meaningful information about the logic involved and the scope and intended effects of such processing on the data subject Furthermore, the data subject has the right of information as to whether personal data have been transferred to a third country or to an international organization. If this is the case, the data subject shall also have the right to obtain information on the appropriate safeguards in relation to the transfer. 9.2 Right of correction Any person affected by the processing of personal data has the right to demand the immediate correction of incorrect personal data concerning him. Furthermore, the data subject shall have the right to request the completion of incomplete personal data, including by means of a supplementary declaration, having regard to the purposes of the processing. 9.3 Right to cancellation (right to be forgotten) Every data subject shall have the right to obtain from the controller the erasure without delay of personal data relating to him or her where one of the following reasons applies and insofar as the processing is not necessary - The personal data have been collected or otherwise processed for purposes for which they are no longer necessary - The data subject withdraws the consent on which the processing was based in accordance with Art. 6, paragraph 1, letter a, GDPR or Art. 9, paragraph 2, letter a, GDPR, and there is no other legal basis for the processing - The data subject lodges an objection to the processing pursuant to Art. 21(1) DPA and there are no overriding legitimate reasons for the processing, or the data subject lodges an objection to the processing pursuant to Art. - The personal data were processed unlawfully - The deletion of the personal data is necessary to comply with a legal obligation under Union law or the law of the Member States to which the controller is subject - The personal data has been collected in relation to information society services offered, in accordance with art. 8, paragraph 1 of the DPA If any of the above reasons apply and a data subject wishes to have personal data stored by us deleted, he/she may contact the person responsible under point 1 at any time. The request for deletion will be complied with immediately. 9.3.1 Information to third parties If the data controller has made public the personal data concerning you and is obliged to delete them in accordance with Art. 17 para. 1 DPA, he shall take reasonable measures, including technical measures, taking into account the available technology and the implementation costs, to inform data controllers who process the personal data that you, as a data subject, have requested them to delete all links to these personal data or copies or replications of these personal data. The person in charge mentioned in point 1 will take the necessary steps in each individual case. 9.3.2 Exceptions The right to deletion does not exist insofar as the processing is necessary - to exercise the right to freedom of expression and information; in order to comply with a legal obligation requiring processing under Union or national law to which the controller is subject or in order to perform a task carried out in the public interest or in the exercise of official authority vested in the controller;] - for reasons of public interest in the field of public health pursuant to Article 9 paragraph 2 letters h and i and Article 9 paragraph 3 DPA; - to assert, exercise or defend legal claims 9.4 Right to limit processing Any person concerned by the processing of personal data has the right to obtain from the controller the restriction of the processing if one of the following conditions is met: - The accuracy of the personal data is disputed by the data subject for a period enabling the controller to verify the accuracy of the personal data - The processing is unlawful, the data subject refuses to have the personal data deleted and instead requests that the use of the personal data be restricted - The data controller no longer needs the personal data for the purposes of the processing, but the data subject needs them in order to assert, exercise or defend legal claims - The data subject has lodged an objection to the processing in accordance with Art. 21 Paragraph 1 DPA and it is not yet clear whether the legitimate reasons given by the controller outweigh those of the data subject If one of the above-mentioned conditions is met and a data subject wishes to request the restriction of personal data stored with us, he/she may at any time contact the data controller mentioned under point 1. He will arrange for the restriction of the processing. 9.5 Right to information If you have asserted the right to rectification, erasure or limitation of processing vis-à-vis the data controller, the latter is obliged to notify all recipients to whom the personal data concerning you have been disclosed of such rectification, erasure or limitation of processing, unless this proves impossible or involves a disproportionate effort. You have the right, vis-à-vis the data controller, to be informed of these recipients. 9.6 Right to data transferability Any person concerned by the processing of personal data has the right to obtain, in a structured, standard and machine-readable format, the personal data relating to him which have been supplied by the data subject to a controller. He/she also has the right to have these data communicated to another controller without hindrance by the controller to whom the personal data have been made available, provided that the processing is based on the consent pursuant to Art. 6, paragraph 1, letter a of the DPA or Art. 9, paragraph 2, letter a of the DPA or on a contract pursuant to Art. 6, paragraph 1, letter b of the DPA, and provided that the processing is carried out by means of automated procedures, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Furthermore, when exercising their right to data transfer in accordance with Art. 20 Paragraph 1 GDPR, the person concerned has the right to request that the personal data be transferred directly from one person responsible to another, as far as this is technically feasible and provided that this does not affect the rights and freedoms of other persons. 9.7 Right to object Every person affected by the processing of personal data has the right to object at any time, for reasons arising from his or her particular situation, to the processing of personal data concerning him or her that is carried out on the basis of Art. 6, paragraph 1, letters e or f of the DPA, with effect for the future. This also applies to profiling based on these provisions. In the event of an objection, we will no longer process the personal data unless we can prove compelling reasons for processing worthy of protection that outweigh the interests, rights and freedoms of the person concerned or the processing serves to assert, exercise or defend legal claims. If we process personal data for the purpose of direct marketing, the data subject shall have the right to object at any time to the processing of personal data for the purpose of such marketing. This also applies to profiling, insofar as it is connected with such direct marketing. If the data subject objects to us processing for the purposes of direct marketing, we will no longer process the personal data for these purposes. The data subject shall be free to exercise his right of objection in relation to the use of information society services, notwithstanding Directive 2002/58/EC, by means of automated procedures involving technical specifications. 9.8 Automated decisions in individual cases including profiling Every data subject shall have the right not to be subject to a decision based solely on automated processing (including profiling) which produces legal effects concerning him or her or significantly affects him or her in a similar way, except where the decision (1 ) is necessary for the conclusion or performance of a contract between the data subject and the controller, or (2) is authorised by Union or national legislation to which the controller is subject and that legislation provides for adequate measures to safeguard the rights and freedoms and legitimate interests of the data subject, or (3) is made with the explicit consent of the data subject. Where the decision is (1) necessary for the conclusion or performance of a contract between the data subject and the controller, or (2) is taken with the express consent of the data subject, we shall take appropriate measures to safeguard the rights and freedoms and legitimate interests of the data subject, including at least the right to obtain the intervention of the controller, to express his point of view and to challenge the decision. 9.9 Right to revoke the data protection consent Any person affected by the processing of personal data has the right to withdraw his or her consent to the processing of personal data at any time. Revocation of consent shall not affect the lawfulness of the processing carried out on the basis of the consent until revocation. 9.10 Right to complain to a supervisory authority Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State in which you are resident, your place of work or the place of the suspected infringement, if you consider that the processing of personal data concerning you is in breach of the DPA. The supervisory authority to which the complaint has been submitted shall inform the complainant of the status and the results of the complaint, including the possibility of a judicial remedy in accordance with Article 78 of the Basic Data Protection Regulation. Existence of automated decision making including profiling As a responsible company, we avoid automatic decision making or profiling. Requirement to provide personal data We would like to inform you that the provision of personal data is partly required by law (e.g. tax regulations) or can also result from contractual regulations (e.g. information on the contractual partner). Sometimes it may be necessary for the conclusion of a contract that you provide us with personal data, which must subsequently be processed by us. For example, you are obliged to provide us with personal data if we conclude a contract with you. Failure to provide us with personal data would mean that the contract with you could not be concluded. The person responsible can inform you on a case-by-case basis whether the provision of the personal data is required by law or contract or is necessary for the conclusion of the contract, whether there is an obligation to provide the personal data and what the consequences would be if the personal data were not provided. For this purpose, please contact the person responsible mentioned under point 1. Legal basis of the processing Art. 6 para. 1 letter a GDPR serves as a legal basis for processing operations for which we obtain consent for a specific processing purpose. If the processing of personal data is necessary for the performance of a contract to which the data subject is a party, as is the case, for example, with processing operations necessary for the supply of goods or the rendering of another service or consideration, the processing is based on Art. 6 para. 1 lit. b GDPR. The same shall apply to such processing operations which are necessary for the implementation of pre-contractual measures, for example in cases of inquiries about our products or services. If our company is subject to a legal obligation which makes the processing of personal data necessary, for example to fulfil tax obligations, the processing is based on Art. 6 Para. 1 lit. c GDPR. In rare cases, the processing of personal data may be necessary to protect vital interests of the data subject or another natural person. This would be the case, for example, if a visitor to our company was injured and his name, age, health insurance data or other vital information had to be passed on to a doctor, hospital or other third party. In this case, the processing would be based on Art. 6 para. 1 lit. d GDPR. Finally, processing operations could be based on Art. 6 para. 1 lit. f GDPR. Processing operations which are not covered by any of the above legal bases are based on this legal basis if the processing is necessary to safeguard our legitimate interests or those of a third party, provided that the interests, fundamental rights and freedoms of the data subject do not prevail. We are permitted to carry out such processing operations in particular because they have been specifically mentioned by the European legislator. In this respect, it took the view that a legitimate interest could be assumed if the data subject is a customer of the data controller (Recital 47 Sentence 2 GDPR). Modification of our Privacy Policy We reserve the right to adapt this data protection declaration if necessary, so that it always complies with current legal requirements or to implement changes to our services in the data protection declaration, e.g. when introducing new services. The new data protection declaration will then apply to your next visit.
1.1 2.1 3.1 3.2 4.1 5.1 6.1 7.1 8.1 9.1 10.1 11.1 12.1 13.1 14.1 15.1 16.1 17.1 18.1 19.1 20.1 21.1 22.1 22.2 23.1 24.1 24.2 25.1 26.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 34.1 35.1 36.1 37.1 38.1 38.2 39.1 40.1 40.2 41.1 42.1 43.1 44.1 45.1 46.1 47.1 48.1 49.1 50.1 51.1 52.1 53.1 54.1 55.1 56.1 57.1 57.2 57.3 58.1 59.1 60.1 61.1 62.1 63.1 64.1 65.1 66.1 67.1 68.1 69.1 69.2 70.1 71.1 72.1 73.1 74.1 75.1 76.1 77.1 78.1 79.1 80.1 81.1
OPĆA POLITIKA O ZAŠTITI OSOBNIH PODATAKA - Općenito Opća politika zaštite osobnih podataka opisuje svrhu i ciljeve prikupljanja, obrade i upravljanja osobnim podacima od strane GAJETA d.o.o. Cankareva 6, 10000 Zagreb, OIB: 38448070359 (u daljnjem tekstu Voditelj obrade) te osigurava adekvatnu razinu zaštite osobnih podataka u skladu s Općom uredbom o zaštiti podataka ( Uredba EU 2016/679 ) i Zakonom o provedbi Opće uredbe o zaštiti podataka ( NN 42/2018 ). Cilj jest uspostaviti primjerene procese zaštite i upravljanja osobnim podacima ispitanika, a primjenjuje se na sve obrade osobnih podataka, osim u slučaju gdje se obrađuju anonimizirani podaci ili su obrade takve prirode da se radi o statističkim analizama iz kojih nije moguće identificirati pojedinca. Pojmovi * osobni podaci - su svi podaci koji se odnose na pojedinca (ispitanika) čiji je identitet utvrđen ili se može utvrditi Pojedinac čiji se identitet može utvrditi jest osoba koje se može identificirati izravno ili neizravno, osobito uz pomoć identifikatora kao što su ime, identifikacijski broj, podaci o lokaciji, mrežni identifikator ili uz pomoć jednog ili više čimbenika svojstvenih za fizički, fiziološki, genetski, mentalni, ekonomski, kulturni ili socijalni identitet tog pojedinca. * obrada podataka - svaki postupak ili skup postupaka koji se obavljaju na osobnim podacima ili na skupovima osobnih podataka, bilo automatiziranim ili neautomatiziranim sredstvima kao što su prikupljanje, bilježenje, organizacija, strukturiranje, pohrana, prilagodna, izmjena, pronalaženje, vršenje uvida, uporaba, otkrivanje prijenosom, širenjem ili stavljanje na raspolaganje na drugi način, usklađivanje ili kombiniranje, ograničavanje, brisanje ili uništavanje. * izrada profila - svaki oblik automatizirane obrade i upotrebe osobnih podataka radi ocjene određenih osobnih aspekata povezanih s pojedincem radi analize ili predviđanje aspekata u vezi s radnim učinkom, ekonomskim stanjem, zdravljem, osobnim sklonostima, interesima, lokacijom, kretanjem tog pojedinca * voditelj obrade - fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje samo ili zajedno s drugima određuje svrhe i sredstva obrade osobnih podataka, kada su svrhe i sredstva takve obrade utvrđeni pravom Unije ili pravom države članice * izvršitelj obrade - fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje obrađuje podatke u ime voditelja obrade * primatelj - fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo kojem se otkrivaju osobni podaci, neovisno o tome da li je on treća strana * treća strana - fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje nije ispitanik, voditelj obrade, izvršitelj obrade ni osobe koje su ovlaštene za obradu osobnih podataka koji se na njega odnose * privola - svako dobrovoljno, posebno, informirano i nedvosmisleno izražavanje želja ispitanika kojim on izjavom ili jasnom potvrdnom radnjom daje pristanak za obradu osobnih podataka koji se na njega odnose * povreda osobnih podataka - kršenje sigurnosti koje dovodi do slučajnog ili nezakonitog uništenja, gubitka, izmjene, neovlaštenog otkrivanja ili pristupa osobnim podacima koji su preneseni, pohranjeni ili na drugi način obrađivani * nadzorno tijelo - u Republici Hrvatskoj - Agencija za zaštitu osobnih podataka * usluga informacijskog društva - usluga definirana čl. 1 st. 1 točkom 2 Direktive 2015/1535 Europskog parlamenta i Vijeća - svaka usluga informacijskog društva, to jest svaka usluga koja se obično pruža uz naknadu, na daljinu, elektroničkim sredstvima te na osobni zahtjev primatelja usluga - Načela obrade podataka Načela obrade podataka su osnovna pravila kojih se pridržavamo prilikom obrade osobnih podataka ispitanika, a to su: * zakonitost i poštenost - obrađujemo osobne podatke ispitanika sukladno važećim zakonima i poštujući sva prava ispitanika * transparentnost - pružamo ispitanicima sve potrebne informacije te na zahtjev osiguravamo uvid u njihove osobne podatke koje obrađujemo. Ispitanik će ujedno biti, prije samog prikupljanja osobnih podataka, upoznat sa svrhom obrade i svojim pravima * ograničenje svrhe - osobne podatke prikupljamo u posebne, jasne i zakonite svrhe te iste ne obrađujemo u svrhe za koje privola nije dana, osim za obrade koje su uvjetovane zakonom ili su neophodne za kvalitetnu isporuku usluge ili dostave * ograničenje pohrane - osobne podatke ispitanika čuvamo u obliku koji omogućava identifikaciju ispitanika samo onoliko dugo koliko je to potrebno u svrhu ili svrhe radi kojih se osobni podaci obrađuju. Mi možemo pohraniti osobne podatke na duži vremenski period, ukoliko nam to nalaže posebni zakonski propis ili legitimni interes ( npr. sudski spor) * smanjenje količine podataka - osobne podatke obrađujemo na način da su primjereni, relevantni i ograničeni u odnosu na svrhu ili svrhe za koje se obrađuju. * točnost - osobni podaci koje obrađujemo moraju biti točni i po potrebi ažurirani * cjelovitost i pouzdanost - osobne podatke obrađujemo na način kojim se osigurava odgovarajuća sigurnost osobnih podataka, uključujući zaštitu od neovlaštene ili nezakonite obrade te od slučajnog gubitka, uništenja ili oštećenja, primjenom odgovarajućih tehničkih i organizacijskih mjera. - Zakonitost obrade Obrada osobnih podataka je zakonita samo ako je ispunjen jedan od niže navedenih uvjeta: * ispitanik je dao privolu za obradu svojih osobnih podataka u jednu ili više svrha * obrada je nužna za izvršavanje ugovora u kojem je ispitanik stranka ili kako bi se poduzele radnje na zahtjev ispitanika prije sklapanja ugovora * obrada je nužna radi poštovanja pravnih obveza voditelja obrade * obrada je nužna za potrebe legitimnih interesa voditelja obrade ili treće strane, osim kada su od tih interesa jači interesi ili temeljna prava i slobode ispitanika koji zahtjevaju zaštitu obrade osobnih podataka, osobito ako je ispitanik dijete. Pod legitimnim interesom smatrane su obrade koje služe npr. da bi se unaprijedio i modernizirao proces razvoja proizvoda i usluga, ponudili proizvodi i usluge koje bi ispitaniku olakšali poslovanje sa voditeljem obrade ili npr. u svrhu sudskih sporova * obrada je nužna kako bi se zaštitili ključni interesi ispitanika ili druge fizičke osobe * obrada je nužna za izvršavanje zadaća od javnog interesa ili pri izvršavanju službene ovlasti voditelja obrade - Prava ispitanika U trenutku prikupljanja podataka ispitaniku ćemo pružiti sljedeće informacije: identitet i kontakt podatke voditelja obrade, svrhe obrade radi kojih se prikupljaju osobni podaci, pravnu osnovu za obradu, legitimne interese, primatelje ili kategorije primatelja osobnih podataka, ukoliko isti postoje, namjeru prijenosa osobnih podataka trećim zemljama, ukoliko ista postoji, razdoblje pohrane podataka ili kriterije koji definiraju to razdoblje, sva prava ispitanika, potencijalno postojanje automatiziranog donošenja odluka što podrazumijeva i izradu profila (smislene informacije o kojoj logici obrade je riječ, potencijalnim posljedicama i važnosti same obrade za ispitanika). U slučaju da se osobni podaci ne prikupljanju od ispitanika, navodimo i izvor osobnih podataka. * pravo na pristup - ispitanik ima pravo dobiti potvrdu obrađuju li se njegovi osobni podaci te ako se takvi podaci obrađuju, pristup osobnim podacima i svrsi obrade, * pravo na ispravak - ispitanik ima pravo bez nepotrebnog odgađanja ishoditi ispravak netočnih osobnih podataka koji se odnose na njega. Uzimajući u obzir svrhe obrade, ispitanik ima pravo dopuniti nepotpune osobne podatke, među ostalima i davanjem dodatne izjave. * pravo na brisanje ("pravo na zaborav")- ispitanik ima pravo ishoditi brisanje osobnih podataka koji se na njega odnose, a mi imamo obvezu obrisati osobne podatke bez nepotrebnog odgađanja ako je ispunjen jedan od sljedećih uvjeta: - osobni podaci više nisu nužni u odnosu na svrhe za koje su prikupljeni ili na drugi način obrađeni - ispitanik povuče privolu na kojoj se obrada temelji, a ne postoji druga pravna osnova za obradu, ispitanik uloži prigovor na obradu, a legitimni razlozi za realizaciju prava na brisanje su veći od legitimnog interesa nas kao voditelja obrade za obradu i/ili čuvanje podataka - osobni podaci su nezakonito obrađeni - osobni podaci moraju se brisati radi poštovanja pravne obveze propisane pravom Unije ili pravom Republike Hrvatske - osobni podaci su prikupljeni u vezi s ponudom usluge informacijskog društva izravno djetetu ispod dobne granice od 16 godina * pravo na ograničenje obrade - ispitanik ima pravo od nas tražiti ograničenje obrade osobnih podataka u slučaju da se osporava njihova točnost, kada je obrada nezakonita ( a ispitanik se protivi brisanju osobnih podataka te umjesto toga traži ograničenje njihove uporabe), te u slučaju kada je ispitanik uložio prigovor na obradu osobnih podataka očekujući potvrdu nadilaze li legitimni razlozi voditelja obrade razloge ispitanika * pravo na prijenos podataka - ispitanik ima pravo zaprimiti svoje osobne podatke koji se na njega odnose, a koje nam je dao temeljem svoje privole, u strukturiranom, uobičajeno upotrebljavanom i strojno čitljivom formatu te ima pravo tražiti prijenos tih podataka drugom voditelju obrade, ukoliko je tehnički izvedivo. * pravo na prigovor - ispitanik ima pravo na temelju svoje posebne situacije u svakom trenutku uložiti prigovor na obradu osobnih podataka koji se odnose na njega. Mi u takvoj situaciji više ne smijemo obrađivati osobne podatke, osim ako dokažemo da postoje legitimni razlozi za daljnju obradu koji nadilaze interese, prava i slobode ispitanika ili radi postavljanja, ostvarivanja ili obrane pravnih zahtjeva. Nadalje, ako se osobni podaci obrađuju za potrebe izravnog marketinga, ispitanik u svakom trenutku ima pravo uložiti prigovor na obradu osobnih podataka koji se odnose na njega, što uključuje i izradu profila u mjeri koja je povezana s takvim izravnim marketingom. Dodatno, ispitanik ima pravo zatražiti da se na njega ne odnosi odluka koja se temelji isključivo na automatiziranoj obradi, uključujući izradu profila, koja proizvodi učinke na njega ili na sličan način značajno na njega utječu, osim ako je ta odluka: - dopuštena zakonom - potrebna za izvršavanje odluka između ispitanika i voditelja obrade - temeljena na izričitoj privoli ispitanika Ispitanik svoja prava može ostvariti u svakom trenutku na način da nas kontaktira na: GAJETA d.o.o. Cankareva 6, 10000 Zagreb, e-mail: Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite. Ispitaniku će biti pružene informacije o poduzetim radnjama najkasnije u roku od mjesec dana od dana zaprimanja zahtjeva. Ukoliko je obrada zahtjeva složena ili se radi o velikom broju zahtjeva, taj rok se može produžiti za još dva mjeseca, ali će u tome slučaju ispitanik biti izvješten o razlozima eventualnog produljenja roka. Također, ukoliko se ne postupi po zahtjevu ispitanika u roku od mjesec dana od primitka zahtjeva, o odluci će ispitanik biti izvješten uz navođenje razloga za takvu odluku te njegovoj mogućnosti podnošenja pritužbe Agenciji za zaštitu osobnih podataka, Martićeva 14, 10000 Zagreb. U slučaju da su zahtjevi ispitanika očito neutemeljeni ili pretjerani, osobito zbog njihovog učestalog ponavljanja, možemo naplatiti razumnu naknadu na temelju administrativnih troškova ili odbiti postupati po zahtjevu ispitanika. - Sigurnost i obveze U nekim poslovnim procesima se pojavljujemo kao voditelji obrade, u tome slučaju samostalno određujemo svrhu i način obrade osobnih podataka, međutim, u nekim poslovnim procesima smo u ulozi izvršitelja obrade, u kojem situacijama obrađujemo osobne podatke u ime voditelja obrade. U skladu s time kontinuirano provodimo odgovarajuće tehničke i organizacijske mjere zaštite kako bi zaštitili osobne podatke ispitanika, u kojoj god da se ulozi nalazimo. Osobne podatke čuvamo u skladu sa našim integriranim standardima sigurnosti, a gdje je to primjenjivo, koristimo kriptografske metode zaštite podataka te unapređujemo sigurnosne mjere u svrhu sprječavanja povrede osobnih podataka ispitanika. Ne dopuštamo neovlašteno prikupljanje, obradu ili korištenje osobnih podataka te primjenjujemo pravilo ograničavanja pristupa podacima samo na one podatke koji su potrebni za obavljanje pojedinih poslovnih zadataka, sukladno našim internim odlukama. Osobne podatke štitimo od neovlaštenog pristupa, korištenja, izmjene te gubitka neovisno od toga da li su isti pohranjeni u papirnatom ili elektroničkom obliku. - Povreda osobnih podataka U slučaju da dođe do povrede osobnih podataka, svi naši radnici imaju dužnost obavijestiti odgovorne osobe o povredi bez odgode, a mi kao voditelji obrade smo dužni, bez nepotrebnog odgađanja i, ako je izvedivo, najkasnije 72 sata nakon saznanja o toj povredi, izvijestiti nadzorno tijelo odnosno Agenciju za zaštitu osobnih podataka. U slučaju da se nalazimo u ulozi izvršitelja obrade, o povredi obavještavamo u tome slučaju voditelja obrade podataka. Ukoliko je riječ o povredi osobnih podataka koja će vjerojatno prouzročiti visok rizik za prava i slobode pojedinaca, o povredi ćemo obavijestiti i ispitanika, osim ako: - su poduzete odgovarajuće tehničke i organizacijske mjere zaštite i te su mjere primijenjene na osobne podatke obuhvaćene povredom osobnih podataka, posebno one koje osobne podatke čine nerazumljivima bilo osobi koja im nije ovlaštena pristupiti, kao što je enkripcija - su poduzete naknadne mjere kojima se osigurava da više nije vjerojatno da će doći do visokog rizika za prava i slobode ispitanika - bi se time zahtijevao nerazmjeran napor, u kojem slučaju mora postojati javna obavijest ili slična mjera kojom se ispitanici obavještavaju na jednako djelotvoran način Ispitanik ima pravo podnijeti pritužbu nadzornom tijeku - Agenciji za zaštitu osobnih podataka u slučaju - povrede njegovih osobnih podatka ili - ako drži da se njegova prava grubo krše sukladno Općom uredbom o zaštiti osobnih podataka - Završne odredbe Ova Opća politika stupa na snagu danom donošenja, a dostupna je u poslovnim prostorijama na oglasnoj ploči GAJETA d.o.o. Zagreb, 25.05.2018. godine GAJETA d.o.o. kojeg zastupa direktor Jasminka Jović