https___www.aigo.it_en_informativa-privacy_1.xml
http___gajeta-zg.hr_politika-privatnosti_1.xml
1.1 2.1 3.1 4.1 4.2 4.3 5.1 6.1 7.1 8.1 9.1 10.1 10.2 11.1 11.2 12.1 13.1 13.2 13.3 13.4 14.1 15.1 16.1 17.1 17.2 18.1 19.1 20.1 21.1 22.1 23.1 24.1 25.1 25.2 26.1 27.1 28.1 28.2 29.1 30.1 31.1 32.1 33.1 34.1 35.1 36.1 37.1 38.1 38.2 39.1 40.1 41.1 42.1 43.1 44.1 45.1 46.1 47.1 48.1 49.1 49.2 49.3 50.1 51.1 51.2 52.1 52.2 53.1 53.2 54.1 55.1 56.1 57.1 58.1 59.1 60.1 61.1 62.1 63.1 64.1 65.1 66.1 67.1 68.1 68.2 69.1 70.1 71.1 72.1 73.1 74.1 75.1 76.1 76.2 77.1 78.1 79.1 79.2 80.1 81.1 82.1 83.1 84.1 84.2 85.1 86.1 86.2 87.1 88.1 89.1 90.1 91.1 92.1 93.1 94.1 95.1 95.2 96.1 97.1 98.1 99.1 100.1 101.1 102.1 103.1 104.1 105.1 106.1 107.1 108.1 109.1 110.1 110.2 111.1 112.1 113.1 114.1 115.1 116.1 117.1 118.1 119.1 120.1 121.1 122.1 123.1 123.2 124.1 124.2 124.3 125.1 125.2 126.1 127.1 127.2 128.1
PRIVACY POLICY Pursuant to Legislative Decree 196/03 and Regulation (EU) 2016/679 Dear User, In compliance with Legislative Decree 196/2003 and Regulation (EU) 2016/679 we inform you that AIGO Srl, through its website, processes your personal data. The Italian and European privacy legislation establishes specific protections for the processing of “personal” data, which may reveal a person’s racial or ethnic origin, religious, philosophical or other beliefs, political opinions, membership in political parties, trade unions, associations, or organisations of a religious, philosophical, or political nature, as well as those that could reveal their biometric data, state of health, sex life, or judicial data. The processing of such data is permitted only with the explicit consent of the data subject, or “if necessary to fulfil legal obligations and exercise the specific rights of the data controller or the data subject in the field of employment and social security and social protection law” (Article 9 of Regulation (EU) 679/2016; Article 26 of Legislative Decree 196/03). PURPOSES OF DATA PROCESSING AIGO Srl assures the interested parties that the personal data collected are complete, relevant, and not excessive, and will be collected exclusively for the purposes indicated below: - to download content; - to send your CV using the dedicated module “Work with us”; - to automatically send e-mail newsletters of an informational and promotional nature, without cost, concerning the activities of AIGO and its customers, in the name of and on behalf of AIGO and its customers. The newsletter will be sent by e-mail. You can authorise AIGO Srl to process your personal data by ticking the appropriate box. The provision of data is optional. Refusal to provide data will make it impossible to obtain the newsletter service. METHOD OF DATA PROCESSING Personal data are mainly processed by automated and electronic means, for the time strictly necessary to achieve the purposes for which they were collected, by entities specifically appointed for this purpose. Specific security measures are observed to prevent the loss of data, the unlawful or incorrect use of the data, as well as any unauthorised access, allowing access only to those in charge or their responsible appointees. The list of the appointed Managers is available at the registered office of the Data Controller. The personal data acquired will be recorded onto computerised media, and managed and stored on servers owned by the Data Controller or by third parties operating under contractual agreement with the Data Controller, located at the headquarters of the third parties and managed in a secure environment with controlled access. The logic underlying the processing of data is strictly related to the purposes listed above and the processing is based on the data gathered by AIGO Srl. In any case, the processing of personal data will be in accordance with the law and in compliance with principles of legitimacy and fairness. COMMUNICATION AND DISSEMINATION OF DATA The personal data of users may be processed for the purposes specified above, by employees or associates of the Data Controller serving as appointees or managers for the processing of the personal data. Such data may also be communicated to: - all those entities (including Public Authorities) who have access to personal data by virtue of legal or regulatory provisions. The communication of such data will in any case be subject to the fact that the rights of the interested party are guaranteed to be protected, and any further communication or dissemination without prior express authorisation is prohibited. RETENTION OF DATA AIGO Srl guarantees that the data collected will be kept only for the period strictly necessary for the aforesaid purposes, in a manner ensuring the proper provision of the services requested and offered through its website. IDENTIFICATION OF THE DATA CONTROLLER The Data Controller is AIGO Srl, Tax/VAT no. 10034470152, with registered office in Piazza Caiazzo 3, Milan, Italy; telephone +39 02 6699271 / fax: +39 02 6692648, e-mail: staff@aigo.it RIGHTS OF THE DATA SUBJECT The interested party has the right to request access to their personal data, as well as the updating, rectification or deletion of the data, its portability, and the right to request restriction or to object to the data processing (Articles 7 et seq. of Legislative Decree 196/03, 15-21 Regulation (EU) 679/2016). The interested party also has the right to revoke the consent given at any previous time, requesting the cancellation of their registration. To exercise the above rights, the interested party must send a written request to one of the following addresses: - AIGO S.r.l. Piazza Caiazzo 3, 20124 Milan, Italy, or aigopec@aigo.eu . The interested party also has the right to lodge a complaint with the Supervisory Authority in the event of a presumed or ascertained violation of their legitimate rights and interests (Article 77 of Regulation (EU) 679/2016). In any case, the Data Controller reserves the right to fully implement the above requests within and no later than the following terms: - to take delivery of the request for purposes of processing – 10 working days; - to process the request – 15 working days from taking delivery of the request. The Data Controller will communicate the completion of the requested procedure to the interested party in writing. CONSENT OF THE INTERESTED PARTY FOR THE PROCESSING, COMMUNICATION, AND DISSEMINATION OF THEIR PERSONAL DATA The interested party, by ticking the authorisation box for the processing of data, certifies their free consent for the Data Controller to proceed with the processing of their data as described above, as well as the communication of the data solely to expressly authorised and appointed entities. This consent is also extended to the processing and communication of personal data pursuant to articles 9 and 10 of Regulation (EU) 679/2016, for the purposes and within the limits expressly indicated in this privacy statement. REGULATION (EU) 2016/679 ARTICLE 15. Right of access by the data subject - The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, to have access to the personal data and the following information: - the purposes of the processing; - the categories of personal data concerned; - the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; - where possible, the envisaged period for which the data will be stored, or, if this is not possible, the criteria used to determine that period; - the existence of the right to request from the controller rectification or erasure of personal data, or restriction of processing personal data concerning the data subject, or to object to such processing; - the right to lodge a complaint with a supervisory authority; - where the data are not collected from the data subject, any available information as to their source; - the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4), and, at least in such cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject. - Where personal data are transferred to a third country or an international organisation, the data subject shall have the right to be informed of the existence of adequate safeguards pursuant to Article 46 relating to the transfer. - The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form. - The right to obtain a copy referred to in paragraph 3 shall not affect the rights and freedoms of others. ARTICLE 16. Rectification and cancellation The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement. ARTICLE 17. Right to erasure (“Right to be forgotten”) - The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay, where one of the following grounds applies: - the personal data are no longer necessary for the purposes for which they were collected or otherwise processed; - the data subject withdraws the consent upon which the processing is based according to point (a) of Article 6(1) or point (a) of Article 9(2) and where there is no other legal ground for the processing; - the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for processing, or the data subject objects to the processing pursuant to Article 21(2); - the personal data have been processed unlawfully; - the personal data have to be erased for compliance with a legal obligation under EU or Member State law to which the controller is subject; - the personal data have been collected in relation to the provision of information society services referred to in Article 8(1). - Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to informcontrollers who are processing the personal data that the data subject has requested that any links to, or copy or replication of their personal data be erased. - Paragraphs 1 and 2 shall not apply to the extent that processing is necessary: - for exercising the right to freedom of expression and information; - for compliance with a legal obligation which requires processing by EU or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; - for reasons of public interest in the field of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3); - for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Article 89(1), in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or - for the establishment, exercise or defence of legal claims. ARTICLE 18. Right to restriction of processing - The data subject has the right to obtain from the controller the restriction of the processing when one of the following applies: - the accuracy of the personal data is contested by the data subject, and is restricted for the amount of time necessary for the controller to verify the accuracy of the personal data; - the processing is unlawful and the data subject opposes the erasure of the personal data and requests that their use be restricted instead; - the controller no longer needs the personal data for the purposes of the processing, but they are required for the data subject for the establishment or defence of legal claims; - the data subject has objected to the processing operation pursuant to Article 21(1) pending the verification whether the legitimate grounds of the data controller override those of the data subject. - Where processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise, or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the EU or of a Member State. - A data subject who has obtained restriction of processing pursuant to paragraph 1 shall be informed by the controller before the restriction of processing is lifted. ARTICLE 19. Notification obligation regarding rectification or erasure of personal data or restriction of processing The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1), and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it. ARTICLE 20. Right to data portability - The data subject shall have the right to receivethe personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used, and machine-readable format and have the right to transfer those data to another controller without hindrance from the controller to which the personal data have been provided, where: - the processing is based on consent pursuant to point (a) of Article 6(1), or point (a) of Article 9(2), or on a contract pursuant to point (b) of Article 6(1); and - the processing is carried out by automated means. - In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data directly transmitted from one controller to another, where technically feasible. - The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. - The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others. ARTICLE 22. Automated individual decision-making, including profiling - The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her, or similarly significantly affects him or her. - Paragraph 1 shall not apply where the decision: - is necessary for entering into, or performance of, a contract between the data subject and a data controller; - is authorised by EU or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the subject’s rights and freedoms and legitimate interests; - is based on the subject’s explicit consent. - In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measuresto safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision. - The decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Article 9(1), unless point (a) or (g) of Article 9(2) applies and suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests are in place. LEGISLATIVE DECREE 196/03 ARTICLE 7. Right of access to personal data and other rights - The interested party has the right to obtain confirmation of the existence or otherwise of personal data concerning him or her, even if not yet recorded, and their communication in intelligible form. - The interested party has the right to obtain indication of: - the origin of the personal data; - the purposes and methods of processing; - the logic applied in case of processing carried out with the aid of electronic tools; - the identity of the controller, the managers, and the designated representative pursuant to paragraph 2 of Article 5; - the entities or categories of entities to whom the personal data may be communicated or who may learn about them as appointed representatives in the territory of the State or as managers or agents. - The interested party has the right to obtain: - updating, rectification or, where the party has legitimate interests, the supplementing of the data; - the cancellation, transformation into anonymous form, or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which the data were collected or subsequently processed; - certification to the effect that the operations as per letters a) and b) have been notified, including as regards their contents, to the entities to whom or which the data were communicated or disseminated, unless this requirement proves impossible or involves a manifestly disproportionate effort compared with the right that is to be protected. - The interested party has the right to object, in whole or in part: - for legitimate reasons, to the processing of personal data concerning him or her, even if pertinent to the purpose of collection; - to the processing of personal data concerning him or her for purposes of sending advertising materials or direct selling or for the performance of market or commercial communication surveys. ARTICLE 8. Exercise of rights - The rights referred to in Article 7 can be exercised by means of a request addressed without formalities to the owner or manager, including through an agent, to which appropriate response must be provided without delay. - The rights referred to in Article 7 may not be exercised by request to the data controller or the person responsible or by an appeal pursuant to Article 145, if the processing of personal data is carried out: - on the basis of the provisions of Decree Law No. 143 of 3 May 1991 on money laundering, converted, with amendments, by Law No. 197 of 5 July 1991 and subsequent amendments; - on the basis of the provisions of Decree Law No. 419 of 31 December 1991 on support for victims of extortionate demands, converted, with amendments, by Law No. 172 of 18 February 1992 and subsequent amendments; - by parliamentary committees of inquiry established under Article 82 of the Constitution; - by a public body, other than public economic bodies, on the basis of an express legal provision, for purposes exclusively relating to monetary and currency policy, the payment system, the supervision of intermediaries and credit and financial markets, and the protection of their stability; - pursuant to Article 24(1)(f), limited to the period during which it could cause actual and concrete prejudice to the conduct of defensive investigations or to the exercise of a judicial right; - by providers of publicly available electronic communications services in relation to incoming telephone communications, unless this could result in an actual and concrete prejudice to the conduct of the defensive investigations referred to in Law no. 397 of 7 December 2000; - for reasons of justice, in judicial offices of all kinds and levels, or in the High Council of the Judiciary or other self-governing bodies, or in the Ministry of Justice; - under Article 53, without prejudice to Law No. 121 of 1 April 1981. - The Guarantor, also upon notification by the interested party, in the cases referred to in paragraph 2, letters a), b), d), e) and f), shall provide in the manner referred to in Articles 157, 158 and 159 and, in the cases referred to in letters c), g) and h) of the same paragraph, shall provide in the manner referred to in Article 160. - The exercise of the rights referred to in Article 7, when it does not concern objective data, may take place unless it concerns the rectification or integration of personal data of an evaluative nature, relating to judgments, opinions, or other subjective evaluations, or it concerns the indication of conduct to be implemented or decisions being taken by the data controller. ARTICLE 9. Modalities of operation - The request addressed to the owner or manager may be sent by registered letter, fax or e-mail. The Guarantor can identify another suitable system with reference to new technological solutions. Where it concerns the exercise of the rights referred to in article 7, paragraphs 1 and 2, the request may also be made orally and in this case is noted in summary form by the manager or their agent. - In exercising the rights referred to in Article 7, the interested party may confer, in writing, by delegation or power of attorney, with natural persons, entities, associations, or bodies. The person concerned may also be assisted by a person of his or her choice. - The rights referred to in Article 7 concerning personal data relating to deceased persons may be exercised by those who have an interest of their own, or act to protect the person concerned, or for family reasons worthy of protection. - The identity of the interested party is verified on the basis of suitable elements of evaluation, or also by means of available deeds or documents, or by producing or attaching a copy of an identification document. The person acting on behalf of the interested party shall produce or attach a copy of the power of attorney or proxy, which shall have been signed by the data subject in the presence of an agent for the processing, or shall be signed and produced jointly with a copy of an identification document, which shall not have to be certified true pursuant to law. - The request referred to in Article 7(1) and (2) shall be made freely and without constraint and may be renewed, subject to the existence of justified reasons, at intervals of not less than ninety days.
1.1 2.1 3.1 3.2 4.1 5.1 6.1 7.1 8.1 9.1 10.1 11.1 12.1 13.1 14.1 15.1 16.1 17.1 18.1 19.1 20.1 21.1 22.1 22.2 23.1 24.1 24.2 25.1 26.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 34.1 35.1 36.1 37.1 38.1 38.2 39.1 40.1 40.2 41.1 42.1 43.1 44.1 45.1 46.1 47.1 48.1 49.1 50.1 51.1 52.1 53.1 54.1 55.1 56.1 57.1 57.2 57.3 58.1 59.1 60.1 61.1 62.1 63.1 64.1 65.1 66.1 67.1 68.1 69.1 69.2 70.1 71.1 72.1 73.1 74.1 75.1 76.1 77.1 78.1 79.1 80.1 81.1
OPĆA POLITIKA O ZAŠTITI OSOBNIH PODATAKA - Općenito Opća politika zaštite osobnih podataka opisuje svrhu i ciljeve prikupljanja, obrade i upravljanja osobnim podacima od strane GAJETA d.o.o. Cankareva 6, 10000 Zagreb, OIB: 38448070359 (u daljnjem tekstu Voditelj obrade) te osigurava adekvatnu razinu zaštite osobnih podataka u skladu s Općom uredbom o zaštiti podataka ( Uredba EU 2016/679 ) i Zakonom o provedbi Opće uredbe o zaštiti podataka ( NN 42/2018 ). Cilj jest uspostaviti primjerene procese zaštite i upravljanja osobnim podacima ispitanika, a primjenjuje se na sve obrade osobnih podataka, osim u slučaju gdje se obrađuju anonimizirani podaci ili su obrade takve prirode da se radi o statističkim analizama iz kojih nije moguće identificirati pojedinca. Pojmovi * osobni podaci - su svi podaci koji se odnose na pojedinca (ispitanika) čiji je identitet utvrđen ili se može utvrditi Pojedinac čiji se identitet može utvrditi jest osoba koje se može identificirati izravno ili neizravno, osobito uz pomoć identifikatora kao što su ime, identifikacijski broj, podaci o lokaciji, mrežni identifikator ili uz pomoć jednog ili više čimbenika svojstvenih za fizički, fiziološki, genetski, mentalni, ekonomski, kulturni ili socijalni identitet tog pojedinca. * obrada podataka - svaki postupak ili skup postupaka koji se obavljaju na osobnim podacima ili na skupovima osobnih podataka, bilo automatiziranim ili neautomatiziranim sredstvima kao što su prikupljanje, bilježenje, organizacija, strukturiranje, pohrana, prilagodna, izmjena, pronalaženje, vršenje uvida, uporaba, otkrivanje prijenosom, širenjem ili stavljanje na raspolaganje na drugi način, usklađivanje ili kombiniranje, ograničavanje, brisanje ili uništavanje. * izrada profila - svaki oblik automatizirane obrade i upotrebe osobnih podataka radi ocjene određenih osobnih aspekata povezanih s pojedincem radi analize ili predviđanje aspekata u vezi s radnim učinkom, ekonomskim stanjem, zdravljem, osobnim sklonostima, interesima, lokacijom, kretanjem tog pojedinca * voditelj obrade - fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje samo ili zajedno s drugima određuje svrhe i sredstva obrade osobnih podataka, kada su svrhe i sredstva takve obrade utvrđeni pravom Unije ili pravom države članice * izvršitelj obrade - fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje obrađuje podatke u ime voditelja obrade * primatelj - fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo kojem se otkrivaju osobni podaci, neovisno o tome da li je on treća strana * treća strana - fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje nije ispitanik, voditelj obrade, izvršitelj obrade ni osobe koje su ovlaštene za obradu osobnih podataka koji se na njega odnose * privola - svako dobrovoljno, posebno, informirano i nedvosmisleno izražavanje želja ispitanika kojim on izjavom ili jasnom potvrdnom radnjom daje pristanak za obradu osobnih podataka koji se na njega odnose * povreda osobnih podataka - kršenje sigurnosti koje dovodi do slučajnog ili nezakonitog uništenja, gubitka, izmjene, neovlaštenog otkrivanja ili pristupa osobnim podacima koji su preneseni, pohranjeni ili na drugi način obrađivani * nadzorno tijelo - u Republici Hrvatskoj - Agencija za zaštitu osobnih podataka * usluga informacijskog društva - usluga definirana čl. 1 st. 1 točkom 2 Direktive 2015/1535 Europskog parlamenta i Vijeća - svaka usluga informacijskog društva, to jest svaka usluga koja se obično pruža uz naknadu, na daljinu, elektroničkim sredstvima te na osobni zahtjev primatelja usluga - Načela obrade podataka Načela obrade podataka su osnovna pravila kojih se pridržavamo prilikom obrade osobnih podataka ispitanika, a to su: * zakonitost i poštenost - obrađujemo osobne podatke ispitanika sukladno važećim zakonima i poštujući sva prava ispitanika * transparentnost - pružamo ispitanicima sve potrebne informacije te na zahtjev osiguravamo uvid u njihove osobne podatke koje obrađujemo. Ispitanik će ujedno biti, prije samog prikupljanja osobnih podataka, upoznat sa svrhom obrade i svojim pravima * ograničenje svrhe - osobne podatke prikupljamo u posebne, jasne i zakonite svrhe te iste ne obrađujemo u svrhe za koje privola nije dana, osim za obrade koje su uvjetovane zakonom ili su neophodne za kvalitetnu isporuku usluge ili dostave * ograničenje pohrane - osobne podatke ispitanika čuvamo u obliku koji omogućava identifikaciju ispitanika samo onoliko dugo koliko je to potrebno u svrhu ili svrhe radi kojih se osobni podaci obrađuju. Mi možemo pohraniti osobne podatke na duži vremenski period, ukoliko nam to nalaže posebni zakonski propis ili legitimni interes ( npr. sudski spor) * smanjenje količine podataka - osobne podatke obrađujemo na način da su primjereni, relevantni i ograničeni u odnosu na svrhu ili svrhe za koje se obrađuju. * točnost - osobni podaci koje obrađujemo moraju biti točni i po potrebi ažurirani * cjelovitost i pouzdanost - osobne podatke obrađujemo na način kojim se osigurava odgovarajuća sigurnost osobnih podataka, uključujući zaštitu od neovlaštene ili nezakonite obrade te od slučajnog gubitka, uništenja ili oštećenja, primjenom odgovarajućih tehničkih i organizacijskih mjera. - Zakonitost obrade Obrada osobnih podataka je zakonita samo ako je ispunjen jedan od niže navedenih uvjeta: * ispitanik je dao privolu za obradu svojih osobnih podataka u jednu ili više svrha * obrada je nužna za izvršavanje ugovora u kojem je ispitanik stranka ili kako bi se poduzele radnje na zahtjev ispitanika prije sklapanja ugovora * obrada je nužna radi poštovanja pravnih obveza voditelja obrade * obrada je nužna za potrebe legitimnih interesa voditelja obrade ili treće strane, osim kada su od tih interesa jači interesi ili temeljna prava i slobode ispitanika koji zahtjevaju zaštitu obrade osobnih podataka, osobito ako je ispitanik dijete. Pod legitimnim interesom smatrane su obrade koje služe npr. da bi se unaprijedio i modernizirao proces razvoja proizvoda i usluga, ponudili proizvodi i usluge koje bi ispitaniku olakšali poslovanje sa voditeljem obrade ili npr. u svrhu sudskih sporova * obrada je nužna kako bi se zaštitili ključni interesi ispitanika ili druge fizičke osobe * obrada je nužna za izvršavanje zadaća od javnog interesa ili pri izvršavanju službene ovlasti voditelja obrade - Prava ispitanika U trenutku prikupljanja podataka ispitaniku ćemo pružiti sljedeće informacije: identitet i kontakt podatke voditelja obrade, svrhe obrade radi kojih se prikupljaju osobni podaci, pravnu osnovu za obradu, legitimne interese, primatelje ili kategorije primatelja osobnih podataka, ukoliko isti postoje, namjeru prijenosa osobnih podataka trećim zemljama, ukoliko ista postoji, razdoblje pohrane podataka ili kriterije koji definiraju to razdoblje, sva prava ispitanika, potencijalno postojanje automatiziranog donošenja odluka što podrazumijeva i izradu profila (smislene informacije o kojoj logici obrade je riječ, potencijalnim posljedicama i važnosti same obrade za ispitanika). U slučaju da se osobni podaci ne prikupljanju od ispitanika, navodimo i izvor osobnih podataka. * pravo na pristup - ispitanik ima pravo dobiti potvrdu obrađuju li se njegovi osobni podaci te ako se takvi podaci obrađuju, pristup osobnim podacima i svrsi obrade, * pravo na ispravak - ispitanik ima pravo bez nepotrebnog odgađanja ishoditi ispravak netočnih osobnih podataka koji se odnose na njega. Uzimajući u obzir svrhe obrade, ispitanik ima pravo dopuniti nepotpune osobne podatke, među ostalima i davanjem dodatne izjave. * pravo na brisanje ("pravo na zaborav")- ispitanik ima pravo ishoditi brisanje osobnih podataka koji se na njega odnose, a mi imamo obvezu obrisati osobne podatke bez nepotrebnog odgađanja ako je ispunjen jedan od sljedećih uvjeta: - osobni podaci više nisu nužni u odnosu na svrhe za koje su prikupljeni ili na drugi način obrađeni - ispitanik povuče privolu na kojoj se obrada temelji, a ne postoji druga pravna osnova za obradu, ispitanik uloži prigovor na obradu, a legitimni razlozi za realizaciju prava na brisanje su veći od legitimnog interesa nas kao voditelja obrade za obradu i/ili čuvanje podataka - osobni podaci su nezakonito obrađeni - osobni podaci moraju se brisati radi poštovanja pravne obveze propisane pravom Unije ili pravom Republike Hrvatske - osobni podaci su prikupljeni u vezi s ponudom usluge informacijskog društva izravno djetetu ispod dobne granice od 16 godina * pravo na ograničenje obrade - ispitanik ima pravo od nas tražiti ograničenje obrade osobnih podataka u slučaju da se osporava njihova točnost, kada je obrada nezakonita ( a ispitanik se protivi brisanju osobnih podataka te umjesto toga traži ograničenje njihove uporabe), te u slučaju kada je ispitanik uložio prigovor na obradu osobnih podataka očekujući potvrdu nadilaze li legitimni razlozi voditelja obrade razloge ispitanika * pravo na prijenos podataka - ispitanik ima pravo zaprimiti svoje osobne podatke koji se na njega odnose, a koje nam je dao temeljem svoje privole, u strukturiranom, uobičajeno upotrebljavanom i strojno čitljivom formatu te ima pravo tražiti prijenos tih podataka drugom voditelju obrade, ukoliko je tehnički izvedivo. * pravo na prigovor - ispitanik ima pravo na temelju svoje posebne situacije u svakom trenutku uložiti prigovor na obradu osobnih podataka koji se odnose na njega. Mi u takvoj situaciji više ne smijemo obrađivati osobne podatke, osim ako dokažemo da postoje legitimni razlozi za daljnju obradu koji nadilaze interese, prava i slobode ispitanika ili radi postavljanja, ostvarivanja ili obrane pravnih zahtjeva. Nadalje, ako se osobni podaci obrađuju za potrebe izravnog marketinga, ispitanik u svakom trenutku ima pravo uložiti prigovor na obradu osobnih podataka koji se odnose na njega, što uključuje i izradu profila u mjeri koja je povezana s takvim izravnim marketingom. Dodatno, ispitanik ima pravo zatražiti da se na njega ne odnosi odluka koja se temelji isključivo na automatiziranoj obradi, uključujući izradu profila, koja proizvodi učinke na njega ili na sličan način značajno na njega utječu, osim ako je ta odluka: - dopuštena zakonom - potrebna za izvršavanje odluka između ispitanika i voditelja obrade - temeljena na izričitoj privoli ispitanika Ispitanik svoja prava može ostvariti u svakom trenutku na način da nas kontaktira na: GAJETA d.o.o. Cankareva 6, 10000 Zagreb, e-mail: Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite. Ispitaniku će biti pružene informacije o poduzetim radnjama najkasnije u roku od mjesec dana od dana zaprimanja zahtjeva. Ukoliko je obrada zahtjeva složena ili se radi o velikom broju zahtjeva, taj rok se može produžiti za još dva mjeseca, ali će u tome slučaju ispitanik biti izvješten o razlozima eventualnog produljenja roka. Također, ukoliko se ne postupi po zahtjevu ispitanika u roku od mjesec dana od primitka zahtjeva, o odluci će ispitanik biti izvješten uz navođenje razloga za takvu odluku te njegovoj mogućnosti podnošenja pritužbe Agenciji za zaštitu osobnih podataka, Martićeva 14, 10000 Zagreb. U slučaju da su zahtjevi ispitanika očito neutemeljeni ili pretjerani, osobito zbog njihovog učestalog ponavljanja, možemo naplatiti razumnu naknadu na temelju administrativnih troškova ili odbiti postupati po zahtjevu ispitanika. - Sigurnost i obveze U nekim poslovnim procesima se pojavljujemo kao voditelji obrade, u tome slučaju samostalno određujemo svrhu i način obrade osobnih podataka, međutim, u nekim poslovnim procesima smo u ulozi izvršitelja obrade, u kojem situacijama obrađujemo osobne podatke u ime voditelja obrade. U skladu s time kontinuirano provodimo odgovarajuće tehničke i organizacijske mjere zaštite kako bi zaštitili osobne podatke ispitanika, u kojoj god da se ulozi nalazimo. Osobne podatke čuvamo u skladu sa našim integriranim standardima sigurnosti, a gdje je to primjenjivo, koristimo kriptografske metode zaštite podataka te unapređujemo sigurnosne mjere u svrhu sprječavanja povrede osobnih podataka ispitanika. Ne dopuštamo neovlašteno prikupljanje, obradu ili korištenje osobnih podataka te primjenjujemo pravilo ograničavanja pristupa podacima samo na one podatke koji su potrebni za obavljanje pojedinih poslovnih zadataka, sukladno našim internim odlukama. Osobne podatke štitimo od neovlaštenog pristupa, korištenja, izmjene te gubitka neovisno od toga da li su isti pohranjeni u papirnatom ili elektroničkom obliku. - Povreda osobnih podataka U slučaju da dođe do povrede osobnih podataka, svi naši radnici imaju dužnost obavijestiti odgovorne osobe o povredi bez odgode, a mi kao voditelji obrade smo dužni, bez nepotrebnog odgađanja i, ako je izvedivo, najkasnije 72 sata nakon saznanja o toj povredi, izvijestiti nadzorno tijelo odnosno Agenciju za zaštitu osobnih podataka. U slučaju da se nalazimo u ulozi izvršitelja obrade, o povredi obavještavamo u tome slučaju voditelja obrade podataka. Ukoliko je riječ o povredi osobnih podataka koja će vjerojatno prouzročiti visok rizik za prava i slobode pojedinaca, o povredi ćemo obavijestiti i ispitanika, osim ako: - su poduzete odgovarajuće tehničke i organizacijske mjere zaštite i te su mjere primijenjene na osobne podatke obuhvaćene povredom osobnih podataka, posebno one koje osobne podatke čine nerazumljivima bilo osobi koja im nije ovlaštena pristupiti, kao što je enkripcija - su poduzete naknadne mjere kojima se osigurava da više nije vjerojatno da će doći do visokog rizika za prava i slobode ispitanika - bi se time zahtijevao nerazmjeran napor, u kojem slučaju mora postojati javna obavijest ili slična mjera kojom se ispitanici obavještavaju na jednako djelotvoran način Ispitanik ima pravo podnijeti pritužbu nadzornom tijeku - Agenciji za zaštitu osobnih podataka u slučaju - povrede njegovih osobnih podatka ili - ako drži da se njegova prava grubo krše sukladno Općom uredbom o zaštiti osobnih podataka - Završne odredbe Ova Opća politika stupa na snagu danom donošenja, a dostupna je u poslovnim prostorijama na oglasnoj ploči GAJETA d.o.o. Zagreb, 25.05.2018. godine GAJETA d.o.o. kojeg zastupa direktor Jasminka Jović