https___www.inploi.me_gdpr.xml
http___focuson.love_pravila-privatnosti__1.xml
1.1 1.2 1.3 2.1 2.2 2.3 3.1 3.2 4.1 4.2 5.1 6.1 6.2 6.3 7.1 7.2 8.1 9.1 10.1 10.2 10.3 10.4 10.5 11.1 11.2 11.3 12.1 13.1 14.1 15.1 15.2 16.1 16.2 16.3 17.1 17.2 17.3 18.1 18.2 19.1 20.1 20.2 21.1 21.2 21.3 22.1 22.2 22.3 22.4 23.1 24.1 25.1 25.2 25.3 26.1 27.1 28.1 29.1 30.1 30.2 31.1 32.1 33.1 33.2 34.1 35.1 35.2 36.1 37.1 38.1 39.1 40.1 40.2 40.3 41.1 41.2 41.3 42.1 42.2 43.1 44.1 45.1 46.1 47.1 48.1 48.2 49.1 50.1 51.1 52.1 52.2 52.3 53.1 53.2 54.1 55.1 56.1 57.1 57.2 58.1 59.1 60.1 61.1 62.1 63.1 63.2 64.1 64.2 65.1 65.2 65.3 66.1 67.1 68.1 68.2 68.3
Please note: This is not intended to be an exhaustive guide. We make no representations that the information contained in this article is error free, or that the interpretations of the law contained herein are accurate. Interested parties are advised to read the legislation comprehensively and obtain appropriate legal advice. At inploi we take data transparency and protection extremely seriously. The GDPR is a nifty piece of European Union legislation designed to provide formal regulations for doing just this, protecting the data of EU residents. Whilst the GDPR brings about extensive changes and added responsibilities for those who hold and process people’s data, we believe it is a welcome intervention and a step in the right direction to ensuring that people’s privacy is protected. We have set out to demystify it a little, to explain (in broad terms) what it is, what rights it grants to people, and how they are able to exercise those rights. This is a lightweight, easily understandable (hopefully) guide to a complex piece of legislation, for both individuals (“data subjects”) and companies/organisations (“data controllers”/’data processors”). The General Data Protection Regulation (GDPR) is a European Union regulation [(EU) 2016/679] intended to harmonise data privacy laws across the EU’s member states. It deals with the protection of natural persons (individuals) with regard to the processing of their personal data, and the movement of such data. The protections granted to individuals under the GDPR are broad, and apply to “all data subjects residing in the Union” – i.e. to all natural persons (human individuals) within the EU’s member states. The GDPR applies to any information concerning an identified or identifiable natural person. Specifically, ‘personal data’ means any information relating to a ‘data subject’ – someone who can be identified, directly or indirectly, using data including an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. This includes cookies, IP addresses, contact information, and RFID tags. Anonymous / anonymised information (provided it cannot be attributed to an individual using additional information) is not covered. The data of deceased persons is also not within its scope. The provisions of the GDPR are binding on all ‘data controllers’ – those who hold and process - the information of European data subjects – regardless of the their location, or the locations of their servers. The EU clearly lays out the rationale for the implementation of the Regulation: (6) “ Rapid technological developments and globalisation have brought new challenges for the protection of personal data. The scale of the collection and sharing of personal data has increased significantly. Technology allows both private companies and public authorities to make use of personal data on an unprecedented scale in order to pursue their activities. Natural persons increasingly make personal information available publicly and globally. Technology has transformed both the economy and social life, and should further facilitate the free flow of personal data within the Union and the transfer to third countries and international organisations, while ensuring a high level of the protection of personal data”. (7) “Those developments require a strong and more coherent data protection framework in the Union, backed by strong enforcement, given the importance of creating the trust that will allow the digital economy to develop across the internal market. Natural persons should have control of their own personal data. Legal and practical certainty for natural persons, economic operators and public authorities should be enhanced”. The regulation continues, saying: (11) “Effective protection of personal data throughout the Union requires the strengthening and setting out in detail of the rights of data subjects and the obligations of those who process and determine the processing of personal data, as well as equivalent powers for monitoring and ensuring compliance with the rules for the protection of personal data and equivalent sanctions for infringements in the Member States”. Enter the GDPR. The provisions of the GDPR are enforceable from the 25th of May 2018. As a regulation rather than a directive, it is immediately binding on national governments and they are not required to pass their own legislation. In short, yes. Britain remains a member of the EU until the 30th of March 2019, within which period it is subject to EU regulations. It also seems likely that there will be a period of ‘regulatory continuity’ after BREXIT during which time the laws of the EU will remain binding. It is unclear whether the UK will retain the provisions of the GDPR in national law following exit and the passing of the “Great Repeal Bill”. Many if not all provisions will almost certainly be retained. Nevertheless, any UK companies providing goods or services within the EU/to EU citizens will still have to comply. Individual countries are required to provide for an independent public authority to be responsible for monitoring the application of the GDPR, protecting the rights and freedoms of people, enforcing its provisions regarding the processing of data, and facilitating the free flow of information within the Union. In the UK this authority is the Information Commissioner's office. Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. There are 6 key overarching principles relating to the processing of personal data laid out in the GDPR. This processing shall be: Nevertheless, with the exception of particular circumstances (which are not covered in this document), it is prohibited to process certain data, including that which reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership. The processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a person's sex life or sexual orientation is also prohibited. Data on past criminal convictions also has specific protections. Consent is likely the most common avenue through which a controller can lawfully process data (and is arguably the most ‘clear-cut’). It is important that this consent is obtained explicitly. Consent must cover all processing activities carried out for the same purpose. When processing has multiple purposes, consent must be given for all of them. To demonstrate this consent it must be shown that: Specifically, consent must be given by: This act could include a written statement, an oral statement, the active ticking of a box, or conduct which clearly indicates in a specific context the data subject's acceptance of the proposed processing of his or her personal data. If consent is to be given by electronic means, the request must be clear and concise. The proposed processing for which consent is asked cannot be unnecessarily broad. Silence, pre-ticked boxes or inactivity/non-response does not constitute consent. Consent can be withdrawn by a subject at any time. It is necessary to consider whether processing for another purpose is compatible with the purposes for which it was originally collected, taking into account of: If it is compatible, having considered the above, then no separate legal basis from that which allowed the processing of the personal data in the first place is required. If it is not compatible, controllers must provide subjects with information about the new purpose and provide them with required information (see below – “what do you need to tell data subjects”). This does not apply insofar as a subject already has or has been provided with the information. Where personal data are collected from a data subject the controller must provide the subject with information (generally in the form of a Privacy/Data Policy) on: and In instances where personal data has not been obtained directly from the data subject, the controller must provide the subject the information above, in addition to information about the source of the personal data, within a reasonable period of time. Where the origin of the personal data cannot be provided to the data subject because various sources have been used, general information should be provided. This information must be provided within a reasonable time after obtaining such data but at the latest within one month, or, if the personal data are to be used for communications with the subject then at the time of the first communication to the subject. Data subjects are granted the right to obtain confirmation from the data controller as to whether personal data concerning them is being processed, what it is, where it is processed, and for what purposes. The information listed in “what information do you need to provide data subjects” must be given to subjects, in addition to a copy of all data held. The right to get the controller to rectify any inaccurate personal data concerning data subjects. Data subjects are entitled have their data erased, ceasing its further dissemination, and to have third parties halt processing that data. Where the controller has made personal data public and is obliged to subsequently erase it the controller must take reasonable steps to inform other controllers processing that data that the subject has requested the erasure of that data, including a request to erase any links to, copies of, or replications of those personal data. Data subjects have the right to receive the personal data concerning them, which they have previously provided, in a 'commonly used and machine readable format' and have the right to transmit that data to another controller. Where personal data are processed for direct marketing purposes, the data subject has the right to object to processing of personal data for such marketing, which includes profiling to the extent that it is related to such marketing. Personal data should no longer be used for such purposes in this case. This right must be brought to the attention of users explicitly and stated separately from other information. The protection of data must be integral to the building of systems and the processing of information. The controller must implement appropriate technical and organisational safeguards including data protection policies to affect this. Controllers should hold and process only the data necessary for the completion of their duties (data minimisation), as well as limiting the access to personal data to those needing to conduct processing. Regardless of severity, the controller must document all data breaches detailing the facts of what happened, its effects, and what was done to address it. This must be kept to demonstrate compliance to any supervisory authority. When a data breach is likely to “result in a risk to the rights and freedoms of individuals” the controller must within 72 hours of first having become aware of the breach notify the supervisory authority [the ICO]. When necessary, notifications must include: In instances likely to result in a risk to the rights and freedoms of individuals the data subject must also be informed “without undue delay”, unless: Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to the analysis or prediction of aspects concerning performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements. The controller should use appropriate mathematical/statistical procedures for profiling, implementing technical and organisational measures to ensure, in particular, that factors which result in inaccuracies in personal data are corrected and that the risk of errors and discrimination are minimised. Data subjects have the right not to be subject to a decision based solely on automated processing, including profiling, unless amongst other things, this is based on explicit consent. E-recruiting and the electronic evaluation of a subjects performance at work are explicitly identified in this provision. Regardless, the subject has the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest a decision based on such profiling. Every data subject has the right to lodge a complaint with a supervisory authority, in the member state of residence, of work, or of alleged infringement if the subject considers the data processing to infringe the GDPR. In circumstances when it is necessary to provide information to data subjects (e.g. following a request for data/information) this should be done: Information must be provided without undue delay, within one month of the receipt of the request. This can be extended to two months in certain circumstances. It must be made clear to subjects how they can exercise their rights. The provision of information must be done free of charge, unless requests for information are manifestly unfounded or excessive. In this case, a reasonable fee may be charged or a request refused. If the controller does not provide the information the subject must be informed why not and told about the possibility to lodge a complaint. The controller should only use external processors provided that sufficient guarantees have been provided that they will implement appropriate technical and organisational measures, and satisfied the controller that the manner of processing will meet the requirements of the GDPR and ensure the protection of the rights of the data subject. External processors are not allowed to engage other processors without the written authorisation of the controller. Agreements/contracts with these parties must set out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects, and the obligations and rights of the controller. The GDPR lays out the contents of such agreements explicitly in article 30. Controllers must keep a copy of processing activities under their responsibility, including: Processors should maintain a similar register of information. However, employers employing under 250 persons are exempt from this requirement, unless the processing is not occasional, includes sensitive categories, or is likely to result in a risk to the rights and freedoms of subjects. Taking into account ‘state of the art’ procedures, costs of implementation, context, and purposes of processing in addition to the risk to the rights of subjects, technological and operational security features must be implemented, including, as appropriate: Particular consideration should be given to the consequences of data loss/breach when determining appropriate measures. The appointment of a DPO is only mandatory for controllers and processors whose core activities consist of processing operations which require regular and systematic monitoring of data subjects on a large scale or of special categories of data or data relating to criminal convictions and offences. They must be suitably qualified and not do any task that could relate in a conflict of interest. Supervisory authorities have particular remedies available to them in order to address contraventions of the GDPR. Their application of these shall be determined on a case by case basis, and include: Administrative fines can be imposed in addition to or instead of other remedial measures. These can be up to a maximum of €20m or 4% of global annual turnover in the preceding financial year (whichever is the greater). When deciding whether to impose a fine (and its amount), regard should be given to: So the bottom line is that whilst it is unlikely the ICO will act vindictively and without due warning and an appreciation of circumstances, the GDPR has got to be taken seriously – not only because of the punitive measures which may result from breach, but because it is a broadly sensible regulation that is intended to secure and protect people’s data – including yours! For organisations / “data controller” contemplating how to become compliant with the GDPR the Information Conditioners Office has put together a handy document which is thoroughly recommended: 12 Steps to Take Now. We hope that you have found this document useful! Please refer to inploi’s Privacy Policy for a comprehensive outline of our privacy and data practices including what data we collect about you, how and why we utilise your data, and what rights you have with regards to that data. To discuss this, or anything related to the GDPR, your Privacy, our data practices or to ask a question/make a complaint please write to us privacy@inploi.me or submit a support request via the website at www.inploi.me/contact.
1.1 2.1 3.1 5.1 7.1 10.1 11.1 12.1 13.1 13.2 13.3 14.1 15.1 15.2 16.1 17.1 17.2 18.1 18.2 18.3 19.1 20.1 20.2 20.3 21.1 22.1 23.1 23.2 24.1 25.1 26.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 34.1 35.1 36.1 37.1 38.1 39.1 39.2 40.1 41.1 42.1 43.1 44.1 45.1 46.1 47.1 49.1 51.1 52.1 53.1 54.1 55.1 56.1 57.1 59.1 61.1 62.1 63.1 64.1 65.1 66.1 67.1 67.2 68.1 69.1 69.2 70.1 71.1 71.2 72.1 72.2 72.3 72.4 73.1 74.1 75.1 75.2 75.3 75.4 76.1 76.2 77.1 77.2 78.1 79.1 79.2 79.3 79.4 79.5 79.6 80.1 81.1 81.2 82.1 82.2 82.3 82.4 82.5 82.6 83.1 83.2 83.3 84.1 84.2 84.3 84.4 84.5 84.6 85.1 86.1 87.1 88.1 88.2 89.1 90.1 90.2 91.1 92.1 93.1 94.1 95.1 96.1 97.1 98.1 99.1 100.1 100.2 101.1 102.1 103.1 104.1 104.2
Pravne informacije Srđan j.d.o.o. Ulica Matka Laginje 11 Hrvatska Banka: Erste & Steiermärkische bank d.d. E-mail: contact@focuson.love Puni naziv pravnog subjekta: SRĐAN jednostavno društvo s ograničenom odgovornošću za fotografiju, dizajn i usluge Autorska prava Sav sadržaj internetske ove stranice (slike, video, tekstovi, dokumenti) podlježe zaštićenim autorskim pravima Srđan j.d.o.o. Sadržaj nije dozvoljeno kopirati bez pismene suglasnosti. Osnova stranice je bazirana na WordPress platformi koji podlježe GPL licenciranju, WordPress tema je rađena po narudžbi Srđan j.d.o.o. Pravila privatnosti Korištenje internetskih stranica Srđan j.d.o.o. moguće je bez ikakvih naznaka osobnih podataka; međutim, ako posjetitelj želi koristiti posebne usluge poduzeća putem naše internetske stranice, obrada osobnih podataka može postati neophodna. Ako je obrada osobnih podataka neophodna i nema zakonske osnove za takvu obradu, općenito prihvaćamo suglasnost od posjetitelja. Obrada osobnih podataka, kao što su ime, adresa, adresa e-pošte ili telefonski broj nositelja podataka uvijek je u skladu s Općom uredbom o zaštiti podataka (GDPR) i sukladno specifičnoj zaštiti podataka propisa koji se primjenjuju na Srđan j.d.o.o. Pomoću ove izjave o zaštiti podataka, naše poduzeće želi informirati javnost o prirodi, opsegu i svrsi osobnih podataka koje prikupljamo, upotrebljavamo i obrađujemo. Nadalje, podnositelji podataka su putem ove izjave o zaštiti podataka obaviješteni o pravima na koja imaju pravo. Kao kontrolor, Srđan j.d.o.o. je implementirao brojne tehničke i organizacijske mjere kako bi se osigurala najpotpunija zaštita osobnih podataka obrađenih putem ove internetske stranice. Međutim, prijenosi podataka temeljeni na Internetu mogu načelno imati sigurnosne praznine pa apsolutna zaštita možda neće biti zajamčena. Iz tog razloga, svaki subjekt podataka je slobodan prenijeti osobne podatke nama putem alternativnih sredstava, npr. putem telefona. - Definicije Deklaracija o zaštiti podataka Srđan j.d.o.o. temelji se na pojmovima koje koristi europski zakonodavac za donošenje Opće uredbe o zaštiti podataka (GDPR). Naša izjava o zaštiti podataka trebala bi biti čitljiva i razumljiva za široku javnost, kao i za naše klijente i poslovne partnere. Da bismo to osigurali, želimo početi objašnjavanjem korištene terminologije. U ovoj izjavi o zaštiti podataka koristimo, između ostalog, sljedeće pojmove: Osobni podaci Osobni podaci podrazumijevaju sve podatke koji se odnose na identificiranu ili prepoznatljivu fizičku osobu (“subjekt podataka”). Identificirana fizička osoba je ona koja se može izravno ili neizravno identificirati, posebice pozivanjem na identifikator kao što je ime, identifikacijski broj, podaci o lokaciji, online identifikator ili jedan ili više čimbenika specifičnih za fizičke, fiziološke, genetskog, mentalnog, ekonomskog, kulturnog ili društvenog identiteta te fizičke osobe. Subjekt podataka Subjekt podataka je svaka fizička osoba identificirana ili prepoznatljiva, čiji osobni podaci obrađuje kontrolor odgovoran za obradu. Obrada Obrada je svaka radnja ili skup postupaka koji se obavljaju na osobnim podacima ili skupovima osobnih podataka, bilo da se radi o automatiziranim sredstvima, kao što su prikupljanje, snimanje, organizacija, strukturiranje, pohrana, prilagodba ili izmjena, pretraživanje, objavljivanje prijenosom, širenjem ili na drugi način stavljanjem na raspolaganje, ažuriranjem ili kombinacijom, ograničavanjem, brisanjem ili uništenjem. Ograničenje obrade Ograničenje obrade označava pohranjene osobne podatke s ciljem ograničavanja njihove obrade u budućnosti. Profiliranje Profiliranje znači bilo koji oblik automatizirane obrade osobnih podataka koji se sastoji od korištenja osobnih podataka za procjenu određenih osobnih aspekata koji se odnose na fizičku osobu, posebno za analizu ili predviđanje aspekata koji se odnose na radno mjesto fizičke osobe na poslu, ekonomskoj situaciji, zdravlju, osobnim preferencijama , interesima, pouzdanosti, ponašanja, lokacije ili pokreta. Pseudonimizacija Pseudonimizacija je obrada osobnih podataka na takav način da se osobni podaci više ne mogu pripisati određenom predmetu podataka bez korištenja dodatnih informacija, pod uvjetom da se takve dodatne informacije vode odvojeno i podliježu tehničkim i organizacijskim mjerama kako bi se osigurala da se osobni podaci ne pripisuju identificiranoj ili prepoznatljivoj fizičkoj osobi. Kontrolor ili kontrolor odgovoran za obradu Kontrolor ili kontrolor odgovoran za obradu je fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje sama ili zajedno s drugima određuje svrhe i sredstva obrade osobnih podataka; ako su svrhe i sredstva takve obrade određeni zakonom Unije ili države članice, kontrolor ili posebni kriteriji za njegovo imenovanje mogu biti predviđeni zakonima Unije ili države članice. Procesor Procesor je fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje obrađuje osobne podatke u ime kontrolora. Primatelj Primatelj je fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo na koje se otkrivaju osobni podaci, bez obzira na to jesu li treća strana ili ne. Međutim, javne vlasti koje mogu primiti osobne podatke u okviru određenog ispitivanja u skladu s pravom Unije ili države članice ne smatraju se primateljima; obrada takvih podataka od strane tih javnih tijela mora biti u skladu s važećim pravilima o zaštiti podataka u skladu s namjenama obrade. Treća strana Treća strana je fizička ili pravna osoba, javni organ, agencija ili tijelo koje nije predmet subjekta, kontrolor, procesor i osobe koje su pod izravnim nadzorom nadređenog ili procesora ovlaštene za obradu osobnih podataka. Pristanak Suglasnost subjekta podataka je svaka slobodno dana informacija ili želja subjekta podataka koji svojim izjavama ili jasnim afirmativnim radnjama, označava suglasnost s obradom osobnih podataka koji se odnose na njega. - Naziv i adresa kontrolora Kontrolor u svrhu Opće uredbe o zaštiti podataka (GDPR), ostalih zakona o zaštiti podataka koji se primjenjuju u državama članicama Europske unije i drugim odredbama vezanim uz zaštitu podataka: Srđan j.d.o.o. Ulica Matka Laginje 11 Hrvatska E-pošta: contact@focuson.love Internet lokacija: http://focuson.love - Ime i adresa službenika za zaštitu podataka Službenik za zaštitu osobnih podataka je: Srđan Hulak Srđan j.d.o.o. Ulica Matka Laginje 11 Hrvatska E-pošta: contact@focuson.love Internet lokacija: http://focuson.love Svaki subjekt podataka može u bilo kojem trenutku kontaktirati našeg službenika za zaštitu podataka sa svim pitanjima i prijedlozima vezanim uz zaštitu podataka. - Koje podatke prikupljamo o vama i kako? Prikupljamo informacije o vama kada popunite bilo koji od obrasca na našoj internetskoj stranici, odnosno slanjem upita.Podaci o korištenju web stranica prikupljeni su pomoću kolačića. Ako ste mlađi od 16 godina, morate dobiti pristanak roditelja prije nego što ispunite bilo koji obrazac na našoj internetskoj stranici. Prilikom slanja obrasca na našoj web stranici koristimo davatelja softvera treće strane za automatizirano prikupljanje i obradu podataka. Davatelj neće koristiti vaše podatke za bilo koju svrhu i zadržat će ih samo u skladu s našim pravilima o zadržavanju podataka. - Kolačići Kolačići su tekstualne datoteke stavljene na vaše računalo kako bi prikupile standardne informacije o zapisnicima interneta i informacijama o ponašanju posjetitelja. Te se informacije zatim koriste za praćenje korištenja internetske stranice posjetitelja i izradu statističkih izvješća o aktivnostima internetskog mjesta. Za više informacija posjetite www.aboutcookies.org ili www.allaboutcookies.org. Možete postaviti svoj preglednik da ne prihvaća kolačiće, a gore navedene internetske stranice vam pružaju informacije kako ukloniti kolačiće iz preglednika. Imajte na umu da u nekim slučajevima neke od značajki na našoj internetskoj stranici možda neće funkcionirati zbog toga. Kolačići mogu biti “Prva strana”, tj. postavljeni od strane nas ili “Treća strana” – postavljeni od druge tvrtka za obavljanje te funkcije, na primjer Google Analytics ili naši kolačići za oglašavanje. Neke od tih trećih strana upotrebljavaju vlastite anonimne kolačiće za praćenje broja osoba koje su vidjele određeni oglas ili za praćenje koliko je ljudi više puta vidjelo. Tvrtke koje generiraju te kolačiće imaju vlastita pravila o privatnosti i nemamo pristup za čitanje ili pisanje tih kolačića. Ove organizacije mogu koristiti svoje kolačiće kako bi anonimno ciljali oglašavanje na drugim internetskim stranicama, na temelju vašeg posjeta ovoj internetskoj stranici. Naše korištenje kolačića Koristimo sljedeće kolačiće: – Strogo neophodni kolačići: pomažu internetskoj stranici da funkcionira i poboljšava izgled i dojam internetske stranice. Oni također pomažu poboljšati navigaciju na našoj internetskoj stranici i omogućiti vam da se vratite na stranice koje ste prethodno posjetili. Ova vrsta kolačića traje samo za vrijeme trajanja posjete internetskoj stranici. Kada napustite internetsku stranicu, oni se automatski brišu. – Analitički kolačići: omogućuju nam da prepoznamo i brojimo broj posjetitelja i da vidimo kako se posjetitelji kreću na našoj internetskoj stranici kada ih upotrebljavaju. To nam pomaže poboljšati način na koji naša internetska stranica funkcionira, na primjer, tako da korisnici lakše pronalaze ono što traže i što ih zanima. – Kolačići za funkcionalnost: koriste se za prepoznavanje kada se vratite na našu internetsku stranicu. To nam omogućuje prilagodbu našeg sadržaja, personalizaciju i memoriranje vaših preferencija (na primjer, vaš izbor jezika ili regije). - Odredbe o zaštiti podataka o primjeni i upotrebi usluge Google Analytics Na ovoj internetskoj stranici kontrolor je integrirao komponentu usluge Google Analytics. Google Analytics usluga je web-analiza. Web-analiza prikuplja i analizira podatke o ponašanju posjetitelja na interetskim stranicama. Usluga web analize prikuplja, između ostalog, podatke o interetskoj stranici s koje je osoba došla (tzv. Referrer), koje su podstranice bile posjećene ili koliko su često i za koje vrijeme pregledane podstranice. Web-analiza se uglavnom koristi za optimizaciju internetske stranice i za provođenje analize troškova i koristi internet oglašavanja. Operator komponente usluge Google Analytics jest Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, Sjedinjene Američke Države. Svrha komponente usluge Google Analytics jest analizirati promet na našoj internetskoj stranici. Google prikuplja prikupljene podatke i informacije, između ostalog, kako bi procijenio upotrebu naše internetske stranice i pružio online izvještaje koji prikazuju aktivnosti na našim internetskim stranicama i pružaju druge usluge vezane uz korištenje naše internetske stranice za nas. Google Analytics postavlja kolačić na sustav informacijske tehnologije ispitanika. Definicija kolačića je gore objašnjena. Kolačić se koristi za pohranjivanje osobnih podataka, kao što su vrijeme pristupa, mjesto s koje je pristup napravljen i učestalost posjeta naših web stranica od strane subjekta. Svakim posjetom na našem Internet stranicama, takvi osobni podaci, uključujući IP adresu internetskog pristupa koji koristi subjekt podataka, prenijet će se Googleu u Sjedinjenim Američkim Državama. Ovi osobni podaci pohranjuju Google u Sjedinjenim Američkim Državama. Google može prenijeti ove osobne podatke prikupljene tehničkim postupkom trećim stranama. Subjekt podataka može, kao što je gore navedeno, u bilo kojem trenutku spriječiti postavljanje kolačića putem naše internetske stranice odgovarajućom prilagodbom korištenog internet preglednika i time trajno uskraćivati postavljanje kolačića. Takvo prilagođavanje korištenim internetskim preglednikom također bi spriječilo Google Analytics postavljanje kolačića na informacijsku tehnologiju predmetnog subjekta. Osim toga, kolačići koji Google Analytics već upotrebljava mogu se izbrisati u bilo kojem trenutku putem internetskog preglednika ili drugih softverskih programa. Osim toga, subjekt podataka ima mogućnost prigovora zbirci podataka koje generira Google Analytics, koji se odnosi na upotrebu ove internetske stranice, kao i obrada tih podataka od strane Googlea i mogućnost da se spriječi. U tu svrhu, subjekt podataka mora preuzeti dodatni preglednik ispod veze https://tools.google.com/dlpage/gaoptout i instalirati ga. Ovaj dodatak preglednika govori Google Analyticsu putem JavaScript-a, da se svi podaci i informacije o posjetima internetskih stranica ne prenose u Google Analytics. Instalacija dodataka preglednika smatra se prigovorom Google-u. Ako je informacijski sustav subjekta kasnije izbrisan, formatiran ili novo instaliran, subjekt podataka mora ponovno instalirati dodatke preglednika kako bi onemogućio Google Analytics. Ako je dodatni preglednik deinstalirao subjekt podataka ili bilo koja druga osoba koja se može pripisati svojoj nadležnosti ili je onemogućena, moguće je izvršiti ponovnu instalaciju ili ponovno aktiviranje dodataka preglednika. Dodatne informacije i primjenjive odredbe o zaštiti podataka od Googlea mogu se preuzeti na adresi https://www.google.com/intl/en/policies/privacy/ i http://www.google.com/analytics/terms/us.html Google Analytics dodatno se objašnjava na sljedećoj poveznici: https://www.google.com/analytics/ - Pristup vašim informacijama, ispravak, prenosivost i brisanje podataka Što je zahtjev za pristup podacima? Ovo je vaše pravo da zatražite kopiju podataka koje držimo o vama. Ako želite kopiju nekih ili svih vaših osobnih podataka, pošaljite nam e-mail na: contact@focuson.love ili nam pišite na adresu: Srđan Hulak, Srđan j.d.o.o., Ulica Matka Laginje 11, 51 500 Krk. Odgovoriti ćemo na vaš zahtjev u roku od 30 dana od primitka zahtjeva. Želimo osigurati da su vaši osobni podaci točni i ažurni. Možete zatražiti da ispravimo ili uklonimo informacije za koje smatrate da su netočne, e-mailom na: contact@focuson.love ili pisanjem na gore navedenu adresu Prijenos podataka Također je vaše pravo da dobijete osobne podatke koje ste nam dali, u strukturiranom, uobičajenom obliku i strojno čitljivom formatu i imaju pravo prenijeti te podatke drugom kontroloru bez odgode od trenutnog kontrolora ako: (a) Obrada temelji se na pristanku ili na ugovoru, i (b) Obrada se provodi automatiziranim sredstvima. Pravo na brisanje (Pravo na zaborav) Ukoliko želite da se u potpunosti izbrišemo sve informacije koje se odnose na vas, pošaljite nam Zahtjev za brisanje podataka na sljedeće načine: Email: contact@focuson.love U pisanom obliku: Srđan Hulak, Srđan j.d.o.o., Ulica Matka Laginje 11, 51 500 Krk. - Završne odredbe Naša internetska stranica sadrži poveznice na druge internetske stranice. Ovo pravilo o privatnosti odnosi se samo na ovu internetsku stranicu. focuson.love nije odgovorno za sadržaj i pravila o privatnosti drugih internetskih stranica. Ako smatrate da su vaši osobni podaci obrađeni na način koji ne zadovoljava GDPR, imate pravo podnijeti žalbu nadležnom nadzornom tijelu. Nadzorno tijelo će vas izvijestiti o napretku i ishodu vaše žalbe. Nadzorno tijelo u Republici Hrvatskoj je Agencija za zaštitu osobnih podataka. Redovito pregledavamo našu politiku privatnosti i postavljamo sva ažuriranja na ovu internetsku stranicu. Ova pravila o privatnosti posljednji put su ažurirana 24.05.2018.