https___feelinmyskin.com_privacy-policy.xml
http___gajeta-zg.hr_politika-privatnosti_1.xml
1.1 1.2 2.1 3.1 4.1 5.1 6.1 7.1 8.1 8.2 9.1 10.1 10.2 11.1 12.1 13.1 14.1 15.1 16.1 17.1 18.1 19.1 20.1 21.1 22.1 23.1 24.1 24.2 25.1 26.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 34.1 35.1 36.1 37.1 38.1 39.1 40.1 41.1 42.1 43.1 44.1 45.1 46.1 47.1 48.1 49.1 50.1 51.1 52.1 53.1 54.1 55.1 56.1 57.1 57.2 57.3 58.1 59.1 60.1 61.1 62.1 63.1 64.1 65.1 66.1 67.1 68.1 69.1 70.1 71.1 72.1 73.1 74.1 75.1 76.1 77.1 78.1 79.1 80.1 81.1 82.1 83.1 84.1 84.2 85.1 86.1 87.1 87.2 88.1 89.1 90.1 90.2 90.3 91.1 92.1 93.1 94.1 95.1 96.1 96.2 97.1 98.1 98.2 99.1 100.1 101.1 102.1 102.2 103.1 104.1 105.1 106.1 106.2 107.1 108.1 109.1 110.1 110.2 111.1 112.1 113.1 114.1 115.1 116.1 117.1 118.1 119.1 120.1 120.2 120.3
This Privacy Policy is effective as of 01 October 2018. The provisions of the Privacy Policy have been adjusted to the requirements of the Regulation (EU) 2016/672 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC and the Act of 10 May 2018 on the protection of personal data. Terminology For the purpose of this document: ‘Personal Data Controller’ means András Munkácsi sole proprietor doing business as András Munkácsi, Marszałkowska 111, 00-102 Warszawa, NIP: 5252735407, REGON: 369197726; ‘personal data’ means information about an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by an identifier such as his or her name and surname, identification number, location data, internet identifier or one or more factors specifying his or her physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; ‘newsletter’ means the electronic form of a newsletter used to inform users about new products available on the website, new entries on the blog, updates relating to applications; ‘personal data breach’ means a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed; ‘recipient’ means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, regardless of whether it is a third party. Public authorities which may receive personal data in connection with a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by such public authorities must be in compliance with the data protection rules applicable to the purposes of the processing; ‘restriction of processing’ means the indication of stored personal data with the aim of limiting their processing in the future; ‘supervisory authority’ means an independent public authority which is established by a Member State pursuant to Article 51 of this Regulation and this authority is President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw; ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the personal data controller; ‘data confidentiality’ means a property ensuring that data is not made available to unauthorised entities; ‘processing’ means any operation or a set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; ‘Regulation’ means Regulation of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as: the ‘GDPR’); ‘website ’ means a website to be found at feelinmyskin.com; ‘act’ means Act of 10 May 2018 on personal data protection. ‘data erasure’ means erasure of personal data or its alteration which makes identification of the data subject impossible (‘anonymisation’), ‘authentication’ means an activity aiming at verification of the identity of the entity; ‘user’means a natural person who has full or limited capacity to perform legal acts, a legal person or an organisational unit with a legal personality, using the feelinmyskin.com website, “a person authorised to process data” by the Personal Data Controller (hereinafter the “Controller”) or another person whom the Controller has granted authorisation to process personal data in the IT system and the person who downloaded the Application and registered the User Account in the Application, i.e. the person to whom the Controller provides services electronically via the Application; ‘consent of the data subject’ means a voluntary, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, signifies his/her consent to the processing of personal data relating to him or her by way of a statement or a clear affirmative action; ‘application’ means the Feelin My Skin mobile application created by the Controller; ‘User Account’ means the set of resources and rights to which the User is entitled in connection with downloading the Application and registering in the Application; ‘data collected automatically’ means demographic data and data concerning the use of the Application which do not allow for unambiguous identification of the User. Personal Data Controller. Purposes, scope and grounds for processing The Personal Data Controller is András Munkácsi sole proprietor doing business as András Munkácsi, Marszałkowska 111, 00-102 Warszawa, NIP: 5252735407, REGON: 369197726. Contact with the Personal Data Controller regarding any matter relating to the user’s personal data protection is possible by sending an email to: gdpr@feelinmyskin.com, with a ‘Personal data’ note. The personal data of the user are processed exclusively for the following purposes: sending commercial and marketing information by means of a newsletter; maintaining contact by means of a contact form available on the website; acceptance and publication of the user’s comments regarding the content presented on the website provided by means of the form; establishment, exercise or defence of legal claims of the Personal Data Controller, including for the purposes of recovery and conducting court proceedings; The basis for processing of personal data of the users using the contact form and commenting on the content presented on the website is the user’s consent collected in compliance with Article 6(1)(a) of the GDPR. The basis for processing of personal data of the users using the newsletter for marketing and promotional purposes is the user’s voluntary consent, collected in accordance with Article 6(1)(a) of GDPR, the Act of 18 July 2002 on the provision of services by electronic means and the Act of 16 July 2004 – telecommunications law. The Personal Data Controller has the right to establish, exercise or defend his or her legal claims, pursuant to Article 6(1)(f) of GDPR, i.e. processing is necessary for the purposes of the legitimate interests pursued by the controller. The Personal Data Controller processes the following personal data of a user: Contact form: Name and surname, email address, IP address; comments: Name, email address, URL; IP address; newsletter: email address. Making the users’ personal data available The Personal Data Controller has the right to make the personal data of a user available, without his or her consent, only to authorised entities pursuant to specific provisions (i.e. courts, law-enforcement authorities). We neither make the personal data of our users available to other entities nor sell or lend them. Newsletter Receiving the newsletter by a user is possible only upon provision of an email address in the newsletter form and provision of a consent to personal data processing, to personal data processing for marketing purposes in line with the Act from 16 April 2004 – telecomunications law – as well as provision of consent for receiving commercial information by electronic means in accordance with the Act of 18 July 2002 – on the provision of electronic services. Resignation from receiving marketing and promotional information as well as commercial information by means of a newsletter is possible upon sending a request for removal of the address from the website’s database to the following email address gdpr@feelinmyskin.com from the email address provided in the course of registration to the newsletter; the note “Resignation from the newsletter subscription’ should be added. Comments Comments and opinions left by the user on the website – blog – are made available and distributed only based on the consent given by the user expressed by ticking a consent clause located below the form. Contact Form The personal data of the user collected by means of a contact form are processed only for the purposes of making and maintaining contact between the user and the Controller, to which the user consents by ticking a clause located under the contact form. Application The Controller collects personal data through the Feelin My Skin mobile application. The terms of using the Application, including technical data and requirements, are described in the Terms and Conditions of the Feelin My Skin mobile application. User Account in the Application After downloading the Application to a mobile device (smartphone, tablet), the User creates a User Account. When creating a User Account, the User enters his or her e-mail address and defines its password. The password for the User Account in the Application should consist of at least 8 characters, upper- and lower-case letters, numbers and special characters. The e-mail address provided by the User during the registration of the User Account must be confirmed by the User. The Controller will send an e-mail with a registration confirmation link to the User’s e-mail address provided upon creating a User account. The User must click on the activation link or copy it to the address bar of its web browser and then confirm it by pressing “Enter”. After that, a confirmation of the registration process completion will be displayed in the web browser and the User will be able to use all functionalities of the Application. Registration confirmation via the activation link, is necessary for creating a User Account and further use of the Application to be possible. The Application’s access to resources available on the User’s mobile device To function properly, the Application may require access to the resources available on the User’s mobile device. The User may, but does not have to, consent to the Application accessing the resources of its mobile device, however, refusing access to some of those resources may limit or prevent the use of certain functionalities of the Application. The User may withdraw the consent authorising the Application to access the resources on his or her mobile device at any time by changing the access settings on the device. The Application may require access to: the gallery, camera, calendar and notifications. Deletion of the User Account The User may delete the User Account by selecting a specific option in the Application settings. The Controller will notify the User about the deletion of the User Account by e-mail sent to the User’s e-mail address provided during the User Account registration. Collection of personal data by the Application The Controller collects the following personal data of the User: User’s name and surname User’s image (the so-called avatar) – optional contact details: e-mail address, website address, links to the User’s accounts on social media sites – optional User’s birth date – optional (publication of this information is at the User’s discretion) location information (town/city, country) – optional (publication of this information is at the User’s discretion) information about the User’s skin type – optional (publication of this information is at the User’s discretion) Users’ data will be processed through the Application for the following purposes: to provide services by electronic means and to enable the use of the services available within the Application, including registration and use of the Application, making the functionalities of the Application available to Users, maintaining contact, maintaining and operating the account in the Application (Article 6(1)(b) of the GDPR) and, in the case of data belonging to special categories of data, on the basis of the User’s consent (Article 9(2)(a) of the GDPR); to handle the electronic contact form made available within the Application on the basis of the Controller’s legitimate interest consisting in the handling of inquiries and requests, including responding to them (Article 6(1)(f) of the GDPR); to potentially establish, exercise or defend legal claims on the basis of Controller’s legitimate interest consisting in protecting its rights (Article 6(1)(f) of the GDPR); to allow the Controller to offer products or services directly on the basis of the Controller’s legitimate interest, consisting in particular in the sending of e-mail notifications about offers or content, which in some cases contain commercial information, and conducting other activities related to direct marketing of products or services, including contextual (i.e. not adjusted to the User’s preferences) and behavioural (i.e. adjusted to the User’s preferences) advertising (Article 6(1)(f) of the GDPR); whereby you will be invited to give your consent to receive commercial information by e-mail or other electronic means of communication; for analytical and statistical purposes on the basis of the Controller ‘s legitimate interest consisting in conducting analyses of User’s activity and their preferences in order to optimise services and products and improve the functionalities of the Application (Article 6(1)(f) of the GDPR); for archival purposes on the basis of the Controller’s legitimate interest consisting in securing information in the event of a legal need to prove facts which constitute the fulfilment of the Controller’s legitimate interest (Article 6(1)(f) of the GDPR). The Controller does not collect personal data without the User’s consent, only data without such qualities, in particular demographic data and data concerning the use of the Application. Data collected automatically do not allow for unambiguous identification of the User. Data collected automatically may be used by the Controller to improve the quality of the services provided, in particular in the event of an error in the Application. In the situation described above, data collected automatically will concern the error in the Application, including the condition of the User’s mobile device at the time of the error occurrence, identification of the User’s mobile device, physical location of the User’s mobile device at the time of the occurrence of error. The User is not able to change or delete data collected automatically. Application data on the User’s mobile device The following data are stored on the User’s mobile device: an encrypted unique Application identifier – it is stored on the device until the Application is removed. The identifier of the Application and information about the brand, model and hardware identifier of the mobile device are sent to the Controller in the process of device registration in the Application and are used to unambiguously identify the Application and the mobile device. Communication between the Mobile Application and the Controller is conducted using encryption mechanisms. Information clauses Consent given by a user for the processing of his or her personal data is voluntary and can be withdrawn at any time. Withdrawal of the consent does not affect the lawfulness of the processing already conducted based on the consent given by the user before its withdrawal. Withdrawal of the consent results in erasure of the user’s email address from the address database maintained by the Personal Data Controller, used for sending out marketing and commercial information. The user has the right to obtain access to his or her personal data and upon the user’s request, the Personal Data Controller will provide a copy of the personal data which are subject to processing. The user has the right to demand that the Personal Data Controller rectify inaccurate personal data concerning him or her without undue delay and complete personal data which are incomplete. The user has the right to have his or her data erased (‘right to be forgotten’), whereas the Personal Data Controller is obliged to erase them without undue delay in a situation when: a) the personal data are no longer necessary in relation to the purposes for which they have been collected, b) the data subject has withdrawn consent which constitutes the basis for processing, c) the data subject objects to the processing regarding his or her personal data, d) the personal data have been unlawfully processed, e) the personal data have to be erased for compliance with a legal obligation specified in the provisions of law. The user has the right to obtain restriction of the processing of his or her personal data provided that the user contests the accuracy of the processed data, the processing is unlawful and the user opposes data erasure, the Personal Data Controller no longer needs the user’s data, but they are required by the user for the establishment, exercise or defence of legal claims as well as when the user objects to the processing. The user has the right to object at any time to the processing of personal data concerning him or her and the personal data controller must discontinue processing the personal data unless the controller demonstrates compelling legitimate grounds for continued processing. The user also has the right to transfer data and the Personal Data Controller is obliged to make those data available to the user in a structured, commonly used and machine-readable format. The user has the right to transmit the received data to another entity without hindrance from the Personal Data Controller in accordance with the provisions of this Regulation. The user’s personal data will be processed by the Personal Data Controller for the following periods: for the period determined by the consent given by the user for the processing of his or her personal data and within 30 days from the day of consent withdrawal or sending a request to the Personal Data Controller’s address to erase the data, unless the requirement to process data arises from specific rules about which the Controller will inform the user within 30 days from the receipt of the request. The user has the right to lodge a complaint with a supervisory authority: The President of the Personal Data Protection Office – ul. Stawki 2, 00-193, Warsaw, in case of establishment of a personal data breach by the Personal Data Controller or of processing of the personal data of the user which does not comply with the personal data protection rules. The Personal Data Controller ensures that he or she makes their best endeavours to process the personal data with the utmost respect for the privacy of data subjects as well as with the utmost care for the security of the processed personal data and in particular, the Controller ensures that all measures of physical, technological, organisational protection specified by law and aiming at securing personal data filling systems have been taken. User responsibility The User is responsible for the accuracy and factual correctness of the personal data he or she provides. In order to ensure the protection of the User’s personal data, the User is obliged to protect the login and password which are used to operate his or her User Account. The Users using the Application bear responsibility for making their login and password available to third parties. Information on payment The personal data of Users making payments via the mobile application, to the extent necessary for the payment execution, are entrusted to App Store for iOS devices or Google Play for Android devices. Google Analytics The feelinmyskin.com website uses the Google Analytics plugin (a tool created by Google Inc.). Google Analytics is a service that analyzes Internet services using the so-called “Cookies”, text files that are saved on the website User’s computer and enable feelinmyskin.com to analyze the use of the website by Users. The feelinmyskin.com website uses Google Analytics to analyze how Users use the website and to constantly improve the service. The information obtained from the cookie files about the way the User uses the feelinmyskin.com website is transferred and saved on the Google Inc. servers located in the United States. The feelinmyskin.com website uses Google Analytics with the following settings: IP anonymisation – this means that the Users’ IP addresses of the feelinmyskin.com website are processed after being shortened to exclude the possibility of referring them to a specific User. The IP address is not collated with other Google data; Disabled Advertising and Remarketing options – which means that the feelinmyskin.com website will not send personalized ads to the Users and will not display advertisements of the website when User uses Google search engine; Disabled Demographics and Interest Reports options – which means that the feelinmyskin.com website does not collect information about sex and age of the User and does not combine this information with information about their interests; Disabled User-ID – which means that the feelinmyskin.com internet service does not allow to combine data from interactions with multiple devices and different sessions with unique User identifiers; the website does not use the User-ID function and does not allow assigning one or more sessions (along with all activity in these sessions) to a unique and permanent identifier; Disabled option to share data with Google Inc. – feelinmyskin.com website does not provide Users’ data collected from cookies: to other Google services used to analyze online behaviors and trends that are intended to improve Google’s tools; for the purposes of comparative analysis involving the use of data to create tools and materials helpful in the marketing activities of a given industry; for Google technical support – Google support does not receive access to collected data; to Google’s marketing and sales specialists to improve the effectiveness of using Google tools through feelinmyskin.com. The maximum period of User’s data storage by the feelinmyskin.com website is 26 months. The user can prevent the saving of cookies by setting the appropriate settings in the browser software. Changing those settings may cause the User to lose the access to some of the functions of the feelinmyskin.com website. In order to disable Google Analytics tracking, the User can install a browser extension available at the following address: tools.google.com/dlpage/gaoptout.
1.1 2.1 3.1 3.2 4.1 5.1 6.1 7.1 8.1 9.1 10.1 11.1 12.1 13.1 14.1 15.1 16.1 17.1 18.1 19.1 20.1 21.1 22.1 22.2 23.1 24.1 24.2 25.1 26.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 34.1 35.1 36.1 37.1 38.1 38.2 39.1 40.1 40.2 41.1 42.1 43.1 44.1 45.1 46.1 47.1 48.1 49.1 50.1 51.1 52.1 53.1 54.1 55.1 56.1 57.1 57.2 57.3 58.1 59.1 60.1 61.1 62.1 63.1 64.1 65.1 66.1 67.1 68.1 69.1 69.2 70.1 71.1 72.1 73.1 74.1 75.1 76.1 77.1 78.1 79.1 80.1 81.1
OPĆA POLITIKA O ZAŠTITI OSOBNIH PODATAKA - Općenito Opća politika zaštite osobnih podataka opisuje svrhu i ciljeve prikupljanja, obrade i upravljanja osobnim podacima od strane GAJETA d.o.o. Cankareva 6, 10000 Zagreb, OIB: 38448070359 (u daljnjem tekstu Voditelj obrade) te osigurava adekvatnu razinu zaštite osobnih podataka u skladu s Općom uredbom o zaštiti podataka ( Uredba EU 2016/679 ) i Zakonom o provedbi Opće uredbe o zaštiti podataka ( NN 42/2018 ). Cilj jest uspostaviti primjerene procese zaštite i upravljanja osobnim podacima ispitanika, a primjenjuje se na sve obrade osobnih podataka, osim u slučaju gdje se obrađuju anonimizirani podaci ili su obrade takve prirode da se radi o statističkim analizama iz kojih nije moguće identificirati pojedinca. Pojmovi * osobni podaci - su svi podaci koji se odnose na pojedinca (ispitanika) čiji je identitet utvrđen ili se može utvrditi Pojedinac čiji se identitet može utvrditi jest osoba koje se može identificirati izravno ili neizravno, osobito uz pomoć identifikatora kao što su ime, identifikacijski broj, podaci o lokaciji, mrežni identifikator ili uz pomoć jednog ili više čimbenika svojstvenih za fizički, fiziološki, genetski, mentalni, ekonomski, kulturni ili socijalni identitet tog pojedinca. * obrada podataka - svaki postupak ili skup postupaka koji se obavljaju na osobnim podacima ili na skupovima osobnih podataka, bilo automatiziranim ili neautomatiziranim sredstvima kao što su prikupljanje, bilježenje, organizacija, strukturiranje, pohrana, prilagodna, izmjena, pronalaženje, vršenje uvida, uporaba, otkrivanje prijenosom, širenjem ili stavljanje na raspolaganje na drugi način, usklađivanje ili kombiniranje, ograničavanje, brisanje ili uništavanje. * izrada profila - svaki oblik automatizirane obrade i upotrebe osobnih podataka radi ocjene određenih osobnih aspekata povezanih s pojedincem radi analize ili predviđanje aspekata u vezi s radnim učinkom, ekonomskim stanjem, zdravljem, osobnim sklonostima, interesima, lokacijom, kretanjem tog pojedinca * voditelj obrade - fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje samo ili zajedno s drugima određuje svrhe i sredstva obrade osobnih podataka, kada su svrhe i sredstva takve obrade utvrđeni pravom Unije ili pravom države članice * izvršitelj obrade - fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje obrađuje podatke u ime voditelja obrade * primatelj - fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo kojem se otkrivaju osobni podaci, neovisno o tome da li je on treća strana * treća strana - fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje nije ispitanik, voditelj obrade, izvršitelj obrade ni osobe koje su ovlaštene za obradu osobnih podataka koji se na njega odnose * privola - svako dobrovoljno, posebno, informirano i nedvosmisleno izražavanje želja ispitanika kojim on izjavom ili jasnom potvrdnom radnjom daje pristanak za obradu osobnih podataka koji se na njega odnose * povreda osobnih podataka - kršenje sigurnosti koje dovodi do slučajnog ili nezakonitog uništenja, gubitka, izmjene, neovlaštenog otkrivanja ili pristupa osobnim podacima koji su preneseni, pohranjeni ili na drugi način obrađivani * nadzorno tijelo - u Republici Hrvatskoj - Agencija za zaštitu osobnih podataka * usluga informacijskog društva - usluga definirana čl. 1 st. 1 točkom 2 Direktive 2015/1535 Europskog parlamenta i Vijeća - svaka usluga informacijskog društva, to jest svaka usluga koja se obično pruža uz naknadu, na daljinu, elektroničkim sredstvima te na osobni zahtjev primatelja usluga - Načela obrade podataka Načela obrade podataka su osnovna pravila kojih se pridržavamo prilikom obrade osobnih podataka ispitanika, a to su: * zakonitost i poštenost - obrađujemo osobne podatke ispitanika sukladno važećim zakonima i poštujući sva prava ispitanika * transparentnost - pružamo ispitanicima sve potrebne informacije te na zahtjev osiguravamo uvid u njihove osobne podatke koje obrađujemo. Ispitanik će ujedno biti, prije samog prikupljanja osobnih podataka, upoznat sa svrhom obrade i svojim pravima * ograničenje svrhe - osobne podatke prikupljamo u posebne, jasne i zakonite svrhe te iste ne obrađujemo u svrhe za koje privola nije dana, osim za obrade koje su uvjetovane zakonom ili su neophodne za kvalitetnu isporuku usluge ili dostave * ograničenje pohrane - osobne podatke ispitanika čuvamo u obliku koji omogućava identifikaciju ispitanika samo onoliko dugo koliko je to potrebno u svrhu ili svrhe radi kojih se osobni podaci obrađuju. Mi možemo pohraniti osobne podatke na duži vremenski period, ukoliko nam to nalaže posebni zakonski propis ili legitimni interes ( npr. sudski spor) * smanjenje količine podataka - osobne podatke obrađujemo na način da su primjereni, relevantni i ograničeni u odnosu na svrhu ili svrhe za koje se obrađuju. * točnost - osobni podaci koje obrađujemo moraju biti točni i po potrebi ažurirani * cjelovitost i pouzdanost - osobne podatke obrađujemo na način kojim se osigurava odgovarajuća sigurnost osobnih podataka, uključujući zaštitu od neovlaštene ili nezakonite obrade te od slučajnog gubitka, uništenja ili oštećenja, primjenom odgovarajućih tehničkih i organizacijskih mjera. - Zakonitost obrade Obrada osobnih podataka je zakonita samo ako je ispunjen jedan od niže navedenih uvjeta: * ispitanik je dao privolu za obradu svojih osobnih podataka u jednu ili više svrha * obrada je nužna za izvršavanje ugovora u kojem je ispitanik stranka ili kako bi se poduzele radnje na zahtjev ispitanika prije sklapanja ugovora * obrada je nužna radi poštovanja pravnih obveza voditelja obrade * obrada je nužna za potrebe legitimnih interesa voditelja obrade ili treće strane, osim kada su od tih interesa jači interesi ili temeljna prava i slobode ispitanika koji zahtjevaju zaštitu obrade osobnih podataka, osobito ako je ispitanik dijete. Pod legitimnim interesom smatrane su obrade koje služe npr. da bi se unaprijedio i modernizirao proces razvoja proizvoda i usluga, ponudili proizvodi i usluge koje bi ispitaniku olakšali poslovanje sa voditeljem obrade ili npr. u svrhu sudskih sporova * obrada je nužna kako bi se zaštitili ključni interesi ispitanika ili druge fizičke osobe * obrada je nužna za izvršavanje zadaća od javnog interesa ili pri izvršavanju službene ovlasti voditelja obrade - Prava ispitanika U trenutku prikupljanja podataka ispitaniku ćemo pružiti sljedeće informacije: identitet i kontakt podatke voditelja obrade, svrhe obrade radi kojih se prikupljaju osobni podaci, pravnu osnovu za obradu, legitimne interese, primatelje ili kategorije primatelja osobnih podataka, ukoliko isti postoje, namjeru prijenosa osobnih podataka trećim zemljama, ukoliko ista postoji, razdoblje pohrane podataka ili kriterije koji definiraju to razdoblje, sva prava ispitanika, potencijalno postojanje automatiziranog donošenja odluka što podrazumijeva i izradu profila (smislene informacije o kojoj logici obrade je riječ, potencijalnim posljedicama i važnosti same obrade za ispitanika). U slučaju da se osobni podaci ne prikupljanju od ispitanika, navodimo i izvor osobnih podataka. * pravo na pristup - ispitanik ima pravo dobiti potvrdu obrađuju li se njegovi osobni podaci te ako se takvi podaci obrađuju, pristup osobnim podacima i svrsi obrade, * pravo na ispravak - ispitanik ima pravo bez nepotrebnog odgađanja ishoditi ispravak netočnih osobnih podataka koji se odnose na njega. Uzimajući u obzir svrhe obrade, ispitanik ima pravo dopuniti nepotpune osobne podatke, među ostalima i davanjem dodatne izjave. * pravo na brisanje ("pravo na zaborav")- ispitanik ima pravo ishoditi brisanje osobnih podataka koji se na njega odnose, a mi imamo obvezu obrisati osobne podatke bez nepotrebnog odgađanja ako je ispunjen jedan od sljedećih uvjeta: - osobni podaci više nisu nužni u odnosu na svrhe za koje su prikupljeni ili na drugi način obrađeni - ispitanik povuče privolu na kojoj se obrada temelji, a ne postoji druga pravna osnova za obradu, ispitanik uloži prigovor na obradu, a legitimni razlozi za realizaciju prava na brisanje su veći od legitimnog interesa nas kao voditelja obrade za obradu i/ili čuvanje podataka - osobni podaci su nezakonito obrađeni - osobni podaci moraju se brisati radi poštovanja pravne obveze propisane pravom Unije ili pravom Republike Hrvatske - osobni podaci su prikupljeni u vezi s ponudom usluge informacijskog društva izravno djetetu ispod dobne granice od 16 godina * pravo na ograničenje obrade - ispitanik ima pravo od nas tražiti ograničenje obrade osobnih podataka u slučaju da se osporava njihova točnost, kada je obrada nezakonita ( a ispitanik se protivi brisanju osobnih podataka te umjesto toga traži ograničenje njihove uporabe), te u slučaju kada je ispitanik uložio prigovor na obradu osobnih podataka očekujući potvrdu nadilaze li legitimni razlozi voditelja obrade razloge ispitanika * pravo na prijenos podataka - ispitanik ima pravo zaprimiti svoje osobne podatke koji se na njega odnose, a koje nam je dao temeljem svoje privole, u strukturiranom, uobičajeno upotrebljavanom i strojno čitljivom formatu te ima pravo tražiti prijenos tih podataka drugom voditelju obrade, ukoliko je tehnički izvedivo. * pravo na prigovor - ispitanik ima pravo na temelju svoje posebne situacije u svakom trenutku uložiti prigovor na obradu osobnih podataka koji se odnose na njega. Mi u takvoj situaciji više ne smijemo obrađivati osobne podatke, osim ako dokažemo da postoje legitimni razlozi za daljnju obradu koji nadilaze interese, prava i slobode ispitanika ili radi postavljanja, ostvarivanja ili obrane pravnih zahtjeva. Nadalje, ako se osobni podaci obrađuju za potrebe izravnog marketinga, ispitanik u svakom trenutku ima pravo uložiti prigovor na obradu osobnih podataka koji se odnose na njega, što uključuje i izradu profila u mjeri koja je povezana s takvim izravnim marketingom. Dodatno, ispitanik ima pravo zatražiti da se na njega ne odnosi odluka koja se temelji isključivo na automatiziranoj obradi, uključujući izradu profila, koja proizvodi učinke na njega ili na sličan način značajno na njega utječu, osim ako je ta odluka: - dopuštena zakonom - potrebna za izvršavanje odluka između ispitanika i voditelja obrade - temeljena na izričitoj privoli ispitanika Ispitanik svoja prava može ostvariti u svakom trenutku na način da nas kontaktira na: GAJETA d.o.o. Cankareva 6, 10000 Zagreb, e-mail: Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite. Ispitaniku će biti pružene informacije o poduzetim radnjama najkasnije u roku od mjesec dana od dana zaprimanja zahtjeva. Ukoliko je obrada zahtjeva složena ili se radi o velikom broju zahtjeva, taj rok se može produžiti za još dva mjeseca, ali će u tome slučaju ispitanik biti izvješten o razlozima eventualnog produljenja roka. Također, ukoliko se ne postupi po zahtjevu ispitanika u roku od mjesec dana od primitka zahtjeva, o odluci će ispitanik biti izvješten uz navođenje razloga za takvu odluku te njegovoj mogućnosti podnošenja pritužbe Agenciji za zaštitu osobnih podataka, Martićeva 14, 10000 Zagreb. U slučaju da su zahtjevi ispitanika očito neutemeljeni ili pretjerani, osobito zbog njihovog učestalog ponavljanja, možemo naplatiti razumnu naknadu na temelju administrativnih troškova ili odbiti postupati po zahtjevu ispitanika. - Sigurnost i obveze U nekim poslovnim procesima se pojavljujemo kao voditelji obrade, u tome slučaju samostalno određujemo svrhu i način obrade osobnih podataka, međutim, u nekim poslovnim procesima smo u ulozi izvršitelja obrade, u kojem situacijama obrađujemo osobne podatke u ime voditelja obrade. U skladu s time kontinuirano provodimo odgovarajuće tehničke i organizacijske mjere zaštite kako bi zaštitili osobne podatke ispitanika, u kojoj god da se ulozi nalazimo. Osobne podatke čuvamo u skladu sa našim integriranim standardima sigurnosti, a gdje je to primjenjivo, koristimo kriptografske metode zaštite podataka te unapređujemo sigurnosne mjere u svrhu sprječavanja povrede osobnih podataka ispitanika. Ne dopuštamo neovlašteno prikupljanje, obradu ili korištenje osobnih podataka te primjenjujemo pravilo ograničavanja pristupa podacima samo na one podatke koji su potrebni za obavljanje pojedinih poslovnih zadataka, sukladno našim internim odlukama. Osobne podatke štitimo od neovlaštenog pristupa, korištenja, izmjene te gubitka neovisno od toga da li su isti pohranjeni u papirnatom ili elektroničkom obliku. - Povreda osobnih podataka U slučaju da dođe do povrede osobnih podataka, svi naši radnici imaju dužnost obavijestiti odgovorne osobe o povredi bez odgode, a mi kao voditelji obrade smo dužni, bez nepotrebnog odgađanja i, ako je izvedivo, najkasnije 72 sata nakon saznanja o toj povredi, izvijestiti nadzorno tijelo odnosno Agenciju za zaštitu osobnih podataka. U slučaju da se nalazimo u ulozi izvršitelja obrade, o povredi obavještavamo u tome slučaju voditelja obrade podataka. Ukoliko je riječ o povredi osobnih podataka koja će vjerojatno prouzročiti visok rizik za prava i slobode pojedinaca, o povredi ćemo obavijestiti i ispitanika, osim ako: - su poduzete odgovarajuće tehničke i organizacijske mjere zaštite i te su mjere primijenjene na osobne podatke obuhvaćene povredom osobnih podataka, posebno one koje osobne podatke čine nerazumljivima bilo osobi koja im nije ovlaštena pristupiti, kao što je enkripcija - su poduzete naknadne mjere kojima se osigurava da više nije vjerojatno da će doći do visokog rizika za prava i slobode ispitanika - bi se time zahtijevao nerazmjeran napor, u kojem slučaju mora postojati javna obavijest ili slična mjera kojom se ispitanici obavještavaju na jednako djelotvoran način Ispitanik ima pravo podnijeti pritužbu nadzornom tijeku - Agenciji za zaštitu osobnih podataka u slučaju - povrede njegovih osobnih podatka ili - ako drži da se njegova prava grubo krše sukladno Općom uredbom o zaštiti osobnih podataka - Završne odredbe Ova Opća politika stupa na snagu danom donošenja, a dostupna je u poslovnim prostorijama na oglasnoj ploči GAJETA d.o.o. Zagreb, 25.05.2018. godine GAJETA d.o.o. kojeg zastupa direktor Jasminka Jović