https___n-hoch-drei.de_privacy-notice__lang_en.xml
http___gajeta-zg.hr_politika-privatnosti_1.xml
1.1 1.2 2.1 3.1 3.2 6.1 7.1 8.1 9.1 10.1 10.2 11.1 12.1 13.1 13.2 14.1 14.2 15.1 16.1 16.2 17.1 18.1 19.1 20.1 21.1 22.1 23.1 24.1 25.1 26.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 34.1 34.2 35.1 36.1 37.1 38.1 39.1 40.1 40.2 40.3 41.1 42.1 43.1 44.1 45.1 46.1 47.1 48.1 48.2 49.1 49.2 50.1 51.1 51.2 51.3 52.1 53.1 54.1 55.1 56.1 57.1 58.1 59.1 60.1 61.1 62.1 63.1 63.2 63.3 63.4 64.1 65.1 66.1 67.1 67.2 67.3 67.4 67.5 68.1 68.2 69.1 69.2 69.3 70.1 71.1 71.2 72.1 72.2 73.1 73.2 74.1 75.1 76.1 76.2 76.3 76.4 76.5 77.1 77.2 78.1 79.1 80.1 80.2 81.1 82.1 82.2 83.1 84.1 85.1 85.2 86.1 87.1 88.1 88.2 89.1 90.1 91.1 92.1 93.1 94.1 95.1 96.1 97.1 98.1 98.2 99.1 99.2 99.3 99.4 99.5 99.6 100.1 101.1 101.2 102.1 103.1 104.1 105.1 105.2 105.3 106.1 106.2 107.1 108.1 109.1 110.1 111.1 112.1 113.1 114.1 114.2 115.1 115.2 116.1 117.1 118.1 119.1 120.1 121.1 122.1 122.2 123.1 124.1 125.1 126.1 127.1 127.2 127.3 127.4 128.1 129.1 129.2 129.3 130.1 131.1 131.2 131.3 132.1 132.2 133.1 134.1 134.2 135.1 136.1 137.1 138.1 139.1 140.1 141.1 142.1 143.1 144.1 145.1 146.1 147.1 147.2 148.1 149.1 149.2 149.3 149.4 150.1 150.2 150.3 150.4 151.1 151.2 152.1 152.2 152.3 153.1 153.2 154.1 155.1 155.2 156.1 156.2 156.3 156.4 156.5 156.6 156.7 157.1 157.2 157.3 158.1 159.1 159.2 160.1 161.1 161.2 162.1 163.1 164.1 165.1 166.1 167.1 167.2
Name and contact details of the controller in accordance with Art. 4 (7) GDPR Company: ZENIT GmbH Address: Bismarckstr. 28, 45470 Mülheim an der Ruhr, Germany Email: info@zenit.de Data Protection Officer Name: Linda Claßen Company: ZENIT GmbH Address: Bismarckstr. 28, 45470 Mülheim an der Ruhr, Germany Email: datenschutz@zenit.de Security and protection of your personal data For us, our primary task is to preserve the confidentiality of the personal data you place at our disposal and to protect such data from unauthorised access. To this purpose, we apply the utmost care and state-of-the-art security standards in order to guarantee the maximum protection of your personal data. As a company governed by private law, we are subject to the provisions of the European Union’s General Data Protection Regulation (GDPR) and the rules of the Federal Data Protection Act (Bundesdatenschutzgesetz (BDSG)). We have installed technical and organisational mechanisms which ensure compliance with these data protection requirements both by ourselves as well as our external service providers. Definitions The legislator requires that all processing of personal data is lawful, fair and transparent for the data subject. To ensure this, we would like to inform you of specific legal definitions which also find application in this Privacy Notice. Personal data “Personal data” means any information relating to an identified or identifiable natural person (referred to hereinafter as ‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Processing “Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. Restriction of processing “Restriction of processing” means the marking of stored personal data with the aim of limiting their processing in the future. Profiling “Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements. Pseudonymisation “Pseudonymisation” means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person. Filing system “Filing system” means any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis. Controller “Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law. Processor “Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller. Recipient “Recipient” means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law are not to be regarded as recipients; the processing of such data by those public authorities takes place in compliance with the applicable data protection rules according to the purposes of the processing. Third party “Third party” means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data. Consent “Consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her. Lawfulness of processing The processing of personal data is only lawful if there is a legal basis for such processing. In accordance with Art. 6 (1) Sentence 1 Points (a) to (f) GDPR, processing is lawful only if and to the extent that at least one of the following applies: - The data subject has given consent to the processing of his/her personal data for one or more specific purposes. - Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. - Processing is necessary for compliance with a legal obligation to which the controller is subject. - Processing is necessary in order to protect the vital interests of the data subject or of another natural person. - Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. - Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Information on the collection of personal data In the following section, we would like to inform you about the collection of personal data when using our website. Personal data are, for example, name, address, email addresses, user behaviour. If you contact us by email or via a contact form, we store the data you have provided (your email address, your name and your telephone number, if applicable) for the purpose of answering your enquiries. We delete such data once their storage is no longer necessary or their processing is restricted in the case that legal obligations concerning their retention are in place. Collection of personal data when visiting our website When using our website for information purposes only, i.e. if you do not register or otherwise transmit information to us, we collect only those data that your browser transmits to our server. If you wish to browse our website, we collect the following data as required for technical reasons in order to provide you with our website and to ensure its stability and security (the legal basis for this is Art. 6 (1) Sentence 1 Point (f) GDPR): - IP address - Date and time of the request - Time difference to GMT (Greenwich Mean Time) - Content of the request (specific page) - Access status/HTTP status code - Data volume transmitted - Website from which the request was sent - Browser - Operating system and interface - Language and version of the browser software Use of cookies (1) In addition to the data listed above, cookies are stored on your computer when you use our website. Cookies are small text files which are stored on your hard disk and assigned to the browser you have used; they deliver specific information to the party that placed the cookie. Cookies cannot run programmes or transfer viruses to your computer. Their purpose is to improve the overall efficiency and user friendliness of websites. (2) This website uses the following types of cookie, of which the scale and operating mode are explained below: – Transient cookies (see a.) – Persistent cookies (see b.) - Transient cookies are automatically deleted when you close the browser. This type especially includes session cookies. These cookies store what is known as a session ID, with which various requests from your browser can be assigned to the same session. This enables your computer to be recognised again when you return to our website. The session cookies are deleted when you log off or close the browser. - Persistent cookies are automatically deleted after a pre-set duration, which can differ depending on the cookie. You can delete such cookies in your browser’s security settings. (3) You can configure your browser settings according to your preferences and, for example, block the acceptance of third-party cookies or of all cookies in general. “Third-party cookies” are cookies set by a third party, i.e. they are not set by the website you are actually visiting at that moment. We would like to point out that by deactivating cookies you might not be able to use in full all our website’s functions. Other functions and offers on our website (1) Apart from use of our website for solely information purposes, we offer various services that may be of interest to you and you may use. In this case, you must as a rule provide further personal data, which we use to provide the respective service and for which the data processing principles apply as described above. (2) In some cases, we use external service providers for processing your data. We select and appoint them with due care; they are bound by our instructions and monitored on a regular basis. (3) We may also disclose your personal data to third parties when staging special offers/competitions or for entering contracts or for similar services together with third parties. Further information in this context is supplied when you provide your personal data or can be found at the end of the description of the service offered. (4) Insofar as our service providers or partners are domiciled in a country outside the European Economic Area (EEA), information regarding the consequences of such circumstances is provided in the description of the service offered. Newsletters (1) If you wish, you can subscribe to our free newsletter via our website (https://nrweuropa.de/). When registering for our newsletter, the data from the input form are transmitted to us. During the registration process, we request your consent to the processing of your data and draw your attention to the privacy notice shown on the website. No data are disclosed to third parties in connection with the processing of data for the dispatch of newsletters. Data are used exclusively for the purpose of dispatching the newsletter. (2) Once the user has issued his/her consent, the legal basis for data processing following the user’s registration for the newsletter is Art. 6 (1) Sentence 1 Point (a) GDPR. (3) The purpose of collecting the user’s email address and other personal data is to deliver the newsletter. (4) The data are deleted from the mailing list as soon as they are no longer necessary for fulfilling the purpose for which they were collected. (5) The user concerned may cancel his/her newsletter subscription at any time. To unsubscribe, please send an email to hz(at)zenit.de. Children In general, our web presence is intended for adults. Persons under 18 years of age should not transmit any personal data to us without the consent of their parents or guardians. Rights of the data subject (1) Withdrawal of consent Insofar as the processing of your personal data is based on your given consent, you have the right to withdraw such consent at any time. Withdrawing your consent does not affect the lawfulness of processing based on your consent before its withdrawal. You may contact us at any time to exercise your right to withdraw your consent. (2) Right to confirmation You have the right to obtain confirmation from the controller as to whether or not we are processing personal data concerning you. You may request such confirmation from us at any time using the contact details provided above. (3) Right of access Where your personal data are being processed, you have the right of access to information at any time about the personal data being processed and on any of the following: - The processing purposes. - The categories of personal data concerned. - The recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular in the case of recipients in third countries or international organisations. - Where possible, the envisaged period for which the personal data will be stored or, if this is not possible, the criteria used to determine that period. - The existence of the right to request from the controller rectification or erasure of the personal data or a right to restriction of processing of personal data concerning the data subject or to object to such processing. - The right to lodge a complaint with a supervisory authority. - Where the personal data are not collected from the data subject, any available information as to their source. - The existence of automated decision-making, including profiling, as referred to in Art. 22 (1) and (4) GDPR and – at least in those cases – authoritative information on the logic involved as well as the significance and envisaged consequences of such processing for the data subject. Where personal data are transferred to a third country or an international organisation, you have the right to be informed of the appropriate safeguards in accordance with Art. 46 GDPR relating to such transfer. We will provide a copy of the personal data which are the subject of such processing. For all further copies requested, we are entitled to demand a reasonable fee based on our administrative costs. If such a copy is requested electronically, the information will be provided in a commonly used electronic format unless stated otherwise. The right to obtain a copy in accordance with (3) may not adversely affect the rights and freedoms of others. (4) Right to rectification You have the right to obtain from us the rectification without undue delay of inaccurate personal data concerning you. Taking into account the processing purposes, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement. (5) Right to erasure (“right to be forgotten”) You have the right to obtain from us the erasure without undue delay of personal data concerning you and we are obliged to erase such personal data without undue delay, where any of the following grounds applies: - The personal data are no longer necessary for the purposes for which they were collected or otherwise processed. - The data subject withdraws his/her consent on which the processing is based in accordance with Art. 6 (1) Sentence 1 Point (a) or Art. 9 (2) Point (a) GDPR and there are no other legal grounds for the processing. - The data subject objects to the processing in accordance with Art. 21 (1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing in accordance with Art. - The personal data have been processed unlawfully. - Erasure of the personal data is necessary in order to comply with a legal obligation in accordance with Union or Member State law to which the controller is subject. - The personal data have been collected in relation to the offer of information society services in accordance with Art. Where the controller has made the personal data public and is obliged in accordance with (1) to erase such data, the controller, taking into account the technology available and the cost of implementation, is to take reasonable steps, including technical measures, to inform controllers who are processing the personal data that a data subject has requested the erasure by such controllers of any links to or copy or replication of such personal data. The right to erasure (“right to be forgotten”) does not apply insofar as the processing is necessary for: - Exercising the right of freedom of expression and information. - Compliance with a legal obligation which requires the processing under Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. - Reasons of public interest in the area of public health in accordance with Art. 9 (2) Points (h) and (i) and Art. - Archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89 (1) GDPR insofar as the right referred to in (1) is likely to render impossible or seriously impair the achievement of the objectives of such processing. - Establishing, exercising or defending legal claims. (6) Right to restriction of processing You have the right to obtain from us the restriction of processing of your personal data where any of the following applies: - The accuracy of the personal data is contested by the data subject for a period enabling the controller to verify the accuracy of the personal data. - The processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead. - The controller no longer requires the personal data for the purposes of the processing, but the data subject requires such data in order to establish, exercise or defend legal claims. - The data subject has objected to processing in accordance with Art. 21 (1) GDPR, pending the verification whether the legitimate grounds of the controller override those of the data subject. Where the processing has been restricted in accordance with the above conditions, such personal data may, with the exception of their storage, only be processed with the data subject’s consent or for establishing, exercising or defending legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. To exercise your right to restriction of processing, you may contact us at any time using the contact details provided above. (7) Right to data portability You have the right to receive the personal data concerning you, which you have provided to us as controller, in a structured, commonly used and machine-readable format and you have the right to transmit such data to another controller without hindrance from the controller to which the personal data have been provided, insofar as: - The processing is based on consent in accordance with Art. 6 (1) Sentence 1 Point (a) or Art. 9 (2) Point (a) or on a contract in accordance with Art. 6 (1) Sentence 1 Point (b) GDPR. - The processing is carried out by automated means. In exercising your right to data portability in accordance with (1), you have the right to have your personal data transmitted directly from one controller to another, where technically feasible. The exercise of the right to data portability is without prejudice to the right to erasure (“right to be forgotten”). This right does not apply for processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. (8) Right to object You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6 (1) Sentence 1 Point (e) or (f) GDPR, including profiling based on those provisions. The controller will no longer process such personal data unless he or she demonstrates compelling and legitimate grounds for such processing which override the interests, rights and freedoms of the data subject or such processing is necessary for establishing, exercising or defending legal claims. Where personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this includes profiling insofar as it is related to such direct marketing. If you object to processing for direct marketing purposes, your personal data will no longer be processed for such purposes. In connection with the use of information society services and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications. You have the right, on grounds relating to your particular situation, to object to the processing of personal data concerning you for scientific or historical research purposes or statistical purposes in accordance with Art. 89 (1), unless such processing is necessary for the performance of a task in the public interest. You may exercise the right to object at any time by contacting the controller responsible. (9) Automated individual decision-making, including profiling You have the right not to be subject to a decision based solely on automated data processing, including profiling, which produces legal effects concerning you or significantly affects you in a similar way. This does not apply for such a decision if any of the following applies: - It is necessary for entering into or performance of a contract between the data subject and the controller. - It is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms as well as his/her legitimate interests. - It is based on the data subject’s explicit consent. The controller takes suitable measures to safeguard the data subject’s rights, freedoms and legitimate interests, which include at least the right to obtain human intervention on the part of the controller, to express his/her point of view and to contest the decision. The data subject may exercise this right at any time vis-à-vis the controller responsible. (10) Right to lodge a complaint with a supervisory authority Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes this regulation. (11) Right to an effective judicial remedy Without prejudice to any other administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR, you have the right to an effective judicial remedy if you consider that your rights under this Regulation have been infringed as a result of the processing of your personal data in non-compliance with this Regulation. Use of Matomo (formerly Piwik) (1) This website uses the Matomo web analysis tool for the purpose of improving our website and analysing its use on a regular basis. The statistics gathered enable us to improve our web presence and make it more interesting for you as a user. The legal basis for using Matomo is Art. 6 (1) Sentence 1 Point (f) GDPR. (2) Cookies are stored on your computer for such analysis purposes. The controller stores information collected in this way solely on his/her server in Germany. You can control such analysis by deleting existing cookies and blocking the storage of cookies in general. We would, however, like to point out that if you block the storage of cookies you might not be able to use in full all the functions of this website. You can prevent the storage of cookies by adjusting your browser settings. Blocking the use of Matomo is possible by unticking the following box and in so doing activating the opt-out plugin [Matomo iFrame]. (3) This website uses Matomo with the “AnonymizeIP” extension. As a result, IP addresses are further processed in truncated form, meaning that they cannot be linked to a particular individual. The IP address transmitted to us from your browser by Matomo is not aggregated with other data we collect. (4) Matomo is an open source project. Information on data privacy is available under: https://matomo.org/privacy-policy/. Use of Google Maps (1) We use Google Maps on this website. This enables us to show you interactive maps directly on the website and allows you comfortable use of the map function. (2) When you visit our website, Google receives the information that you have retrieved the corresponding subpage on our website. In addition, the data listed in “Collection of personal data when visiting our website” of this Privacy Notice are transmitted to Google, regardless of whether Google provides a user account via which you are logged in or no user account exists. If you are logged into Google, your data are directly attributed to your account. If you do not want such attribution with your profile in Google, you must logout before activating the button. Google stores your data as a user profile and uses them for advertising, market research and/or demand-oriented design of its website. The purpose of such data analysis is especially (even for users who are not logged in) to provide demand-oriented advertising and to inform other social network users of your activities on our website. You have the right to object to the creation of such user profiles, whereby you must contact Google directly in order to exercise this right. (3) Further information on the purpose and scope of data collection and processing through the plugin provider can be found in their data privacy notice. There you will also find further information about your rights in this context and possibilities to adjust your server settings in order to protect your privacy: www.google.de/intl/de/policies/privacy. Google processes your personal data in the USA too and has subscribed to the EU-US Privacy Shield, www.privacyshield.gov/EU-US-Framework. Use of social media plugins (1) We do not currently use social media plugins on this website. Our social media accounts are linked under “Social Media” only. Processors We use external service providers (processors), for example for the dispatch of goods, newsletters or for payment processing. We have concluded a separate agreement for data processing with these service providers in order to protect your personal data. Contact: ZENIT GmbH Data Protection Officer Send email Copyright Unless stated otherwise, all copyrights and rights of use for texts, graphics, images, designs and source codes lie with ZENIT GmbH. The non-commercial production, use and distribution of copies in electronic or printed form are permitted, provided that the contents remain unchanged, the source code (www.zenit.de) is indicated and no rights of third parties are affected.
1.1 2.1 3.1 3.2 4.1 5.1 6.1 7.1 8.1 9.1 10.1 11.1 12.1 13.1 14.1 15.1 16.1 17.1 18.1 19.1 20.1 21.1 22.1 22.2 23.1 24.1 24.2 25.1 26.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 34.1 35.1 36.1 37.1 38.1 38.2 39.1 40.1 40.2 41.1 42.1 43.1 44.1 45.1 46.1 47.1 48.1 49.1 50.1 51.1 52.1 53.1 54.1 55.1 56.1 57.1 57.2 57.3 58.1 59.1 60.1 61.1 62.1 63.1 64.1 65.1 66.1 67.1 68.1 69.1 69.2 70.1 71.1 72.1 73.1 74.1 75.1 76.1 77.1 78.1 79.1 80.1 81.1
OPĆA POLITIKA O ZAŠTITI OSOBNIH PODATAKA - Općenito Opća politika zaštite osobnih podataka opisuje svrhu i ciljeve prikupljanja, obrade i upravljanja osobnim podacima od strane GAJETA d.o.o. Cankareva 6, 10000 Zagreb, OIB: 38448070359 (u daljnjem tekstu Voditelj obrade) te osigurava adekvatnu razinu zaštite osobnih podataka u skladu s Općom uredbom o zaštiti podataka ( Uredba EU 2016/679 ) i Zakonom o provedbi Opće uredbe o zaštiti podataka ( NN 42/2018 ). Cilj jest uspostaviti primjerene procese zaštite i upravljanja osobnim podacima ispitanika, a primjenjuje se na sve obrade osobnih podataka, osim u slučaju gdje se obrađuju anonimizirani podaci ili su obrade takve prirode da se radi o statističkim analizama iz kojih nije moguće identificirati pojedinca. Pojmovi * osobni podaci - su svi podaci koji se odnose na pojedinca (ispitanika) čiji je identitet utvrđen ili se može utvrditi Pojedinac čiji se identitet može utvrditi jest osoba koje se može identificirati izravno ili neizravno, osobito uz pomoć identifikatora kao što su ime, identifikacijski broj, podaci o lokaciji, mrežni identifikator ili uz pomoć jednog ili više čimbenika svojstvenih za fizički, fiziološki, genetski, mentalni, ekonomski, kulturni ili socijalni identitet tog pojedinca. * obrada podataka - svaki postupak ili skup postupaka koji se obavljaju na osobnim podacima ili na skupovima osobnih podataka, bilo automatiziranim ili neautomatiziranim sredstvima kao što su prikupljanje, bilježenje, organizacija, strukturiranje, pohrana, prilagodna, izmjena, pronalaženje, vršenje uvida, uporaba, otkrivanje prijenosom, širenjem ili stavljanje na raspolaganje na drugi način, usklađivanje ili kombiniranje, ograničavanje, brisanje ili uništavanje. * izrada profila - svaki oblik automatizirane obrade i upotrebe osobnih podataka radi ocjene određenih osobnih aspekata povezanih s pojedincem radi analize ili predviđanje aspekata u vezi s radnim učinkom, ekonomskim stanjem, zdravljem, osobnim sklonostima, interesima, lokacijom, kretanjem tog pojedinca * voditelj obrade - fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje samo ili zajedno s drugima određuje svrhe i sredstva obrade osobnih podataka, kada su svrhe i sredstva takve obrade utvrđeni pravom Unije ili pravom države članice * izvršitelj obrade - fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje obrađuje podatke u ime voditelja obrade * primatelj - fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo kojem se otkrivaju osobni podaci, neovisno o tome da li je on treća strana * treća strana - fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje nije ispitanik, voditelj obrade, izvršitelj obrade ni osobe koje su ovlaštene za obradu osobnih podataka koji se na njega odnose * privola - svako dobrovoljno, posebno, informirano i nedvosmisleno izražavanje želja ispitanika kojim on izjavom ili jasnom potvrdnom radnjom daje pristanak za obradu osobnih podataka koji se na njega odnose * povreda osobnih podataka - kršenje sigurnosti koje dovodi do slučajnog ili nezakonitog uništenja, gubitka, izmjene, neovlaštenog otkrivanja ili pristupa osobnim podacima koji su preneseni, pohranjeni ili na drugi način obrađivani * nadzorno tijelo - u Republici Hrvatskoj - Agencija za zaštitu osobnih podataka * usluga informacijskog društva - usluga definirana čl. 1 st. 1 točkom 2 Direktive 2015/1535 Europskog parlamenta i Vijeća - svaka usluga informacijskog društva, to jest svaka usluga koja se obično pruža uz naknadu, na daljinu, elektroničkim sredstvima te na osobni zahtjev primatelja usluga - Načela obrade podataka Načela obrade podataka su osnovna pravila kojih se pridržavamo prilikom obrade osobnih podataka ispitanika, a to su: * zakonitost i poštenost - obrađujemo osobne podatke ispitanika sukladno važećim zakonima i poštujući sva prava ispitanika * transparentnost - pružamo ispitanicima sve potrebne informacije te na zahtjev osiguravamo uvid u njihove osobne podatke koje obrađujemo. Ispitanik će ujedno biti, prije samog prikupljanja osobnih podataka, upoznat sa svrhom obrade i svojim pravima * ograničenje svrhe - osobne podatke prikupljamo u posebne, jasne i zakonite svrhe te iste ne obrađujemo u svrhe za koje privola nije dana, osim za obrade koje su uvjetovane zakonom ili su neophodne za kvalitetnu isporuku usluge ili dostave * ograničenje pohrane - osobne podatke ispitanika čuvamo u obliku koji omogućava identifikaciju ispitanika samo onoliko dugo koliko je to potrebno u svrhu ili svrhe radi kojih se osobni podaci obrađuju. Mi možemo pohraniti osobne podatke na duži vremenski period, ukoliko nam to nalaže posebni zakonski propis ili legitimni interes ( npr. sudski spor) * smanjenje količine podataka - osobne podatke obrađujemo na način da su primjereni, relevantni i ograničeni u odnosu na svrhu ili svrhe za koje se obrađuju. * točnost - osobni podaci koje obrađujemo moraju biti točni i po potrebi ažurirani * cjelovitost i pouzdanost - osobne podatke obrađujemo na način kojim se osigurava odgovarajuća sigurnost osobnih podataka, uključujući zaštitu od neovlaštene ili nezakonite obrade te od slučajnog gubitka, uništenja ili oštećenja, primjenom odgovarajućih tehničkih i organizacijskih mjera. - Zakonitost obrade Obrada osobnih podataka je zakonita samo ako je ispunjen jedan od niže navedenih uvjeta: * ispitanik je dao privolu za obradu svojih osobnih podataka u jednu ili više svrha * obrada je nužna za izvršavanje ugovora u kojem je ispitanik stranka ili kako bi se poduzele radnje na zahtjev ispitanika prije sklapanja ugovora * obrada je nužna radi poštovanja pravnih obveza voditelja obrade * obrada je nužna za potrebe legitimnih interesa voditelja obrade ili treće strane, osim kada su od tih interesa jači interesi ili temeljna prava i slobode ispitanika koji zahtjevaju zaštitu obrade osobnih podataka, osobito ako je ispitanik dijete. Pod legitimnim interesom smatrane su obrade koje služe npr. da bi se unaprijedio i modernizirao proces razvoja proizvoda i usluga, ponudili proizvodi i usluge koje bi ispitaniku olakšali poslovanje sa voditeljem obrade ili npr. u svrhu sudskih sporova * obrada je nužna kako bi se zaštitili ključni interesi ispitanika ili druge fizičke osobe * obrada je nužna za izvršavanje zadaća od javnog interesa ili pri izvršavanju službene ovlasti voditelja obrade - Prava ispitanika U trenutku prikupljanja podataka ispitaniku ćemo pružiti sljedeće informacije: identitet i kontakt podatke voditelja obrade, svrhe obrade radi kojih se prikupljaju osobni podaci, pravnu osnovu za obradu, legitimne interese, primatelje ili kategorije primatelja osobnih podataka, ukoliko isti postoje, namjeru prijenosa osobnih podataka trećim zemljama, ukoliko ista postoji, razdoblje pohrane podataka ili kriterije koji definiraju to razdoblje, sva prava ispitanika, potencijalno postojanje automatiziranog donošenja odluka što podrazumijeva i izradu profila (smislene informacije o kojoj logici obrade je riječ, potencijalnim posljedicama i važnosti same obrade za ispitanika). U slučaju da se osobni podaci ne prikupljanju od ispitanika, navodimo i izvor osobnih podataka. * pravo na pristup - ispitanik ima pravo dobiti potvrdu obrađuju li se njegovi osobni podaci te ako se takvi podaci obrađuju, pristup osobnim podacima i svrsi obrade, * pravo na ispravak - ispitanik ima pravo bez nepotrebnog odgađanja ishoditi ispravak netočnih osobnih podataka koji se odnose na njega. Uzimajući u obzir svrhe obrade, ispitanik ima pravo dopuniti nepotpune osobne podatke, među ostalima i davanjem dodatne izjave. * pravo na brisanje ("pravo na zaborav")- ispitanik ima pravo ishoditi brisanje osobnih podataka koji se na njega odnose, a mi imamo obvezu obrisati osobne podatke bez nepotrebnog odgađanja ako je ispunjen jedan od sljedećih uvjeta: - osobni podaci više nisu nužni u odnosu na svrhe za koje su prikupljeni ili na drugi način obrađeni - ispitanik povuče privolu na kojoj se obrada temelji, a ne postoji druga pravna osnova za obradu, ispitanik uloži prigovor na obradu, a legitimni razlozi za realizaciju prava na brisanje su veći od legitimnog interesa nas kao voditelja obrade za obradu i/ili čuvanje podataka - osobni podaci su nezakonito obrađeni - osobni podaci moraju se brisati radi poštovanja pravne obveze propisane pravom Unije ili pravom Republike Hrvatske - osobni podaci su prikupljeni u vezi s ponudom usluge informacijskog društva izravno djetetu ispod dobne granice od 16 godina * pravo na ograničenje obrade - ispitanik ima pravo od nas tražiti ograničenje obrade osobnih podataka u slučaju da se osporava njihova točnost, kada je obrada nezakonita ( a ispitanik se protivi brisanju osobnih podataka te umjesto toga traži ograničenje njihove uporabe), te u slučaju kada je ispitanik uložio prigovor na obradu osobnih podataka očekujući potvrdu nadilaze li legitimni razlozi voditelja obrade razloge ispitanika * pravo na prijenos podataka - ispitanik ima pravo zaprimiti svoje osobne podatke koji se na njega odnose, a koje nam je dao temeljem svoje privole, u strukturiranom, uobičajeno upotrebljavanom i strojno čitljivom formatu te ima pravo tražiti prijenos tih podataka drugom voditelju obrade, ukoliko je tehnički izvedivo. * pravo na prigovor - ispitanik ima pravo na temelju svoje posebne situacije u svakom trenutku uložiti prigovor na obradu osobnih podataka koji se odnose na njega. Mi u takvoj situaciji više ne smijemo obrađivati osobne podatke, osim ako dokažemo da postoje legitimni razlozi za daljnju obradu koji nadilaze interese, prava i slobode ispitanika ili radi postavljanja, ostvarivanja ili obrane pravnih zahtjeva. Nadalje, ako se osobni podaci obrađuju za potrebe izravnog marketinga, ispitanik u svakom trenutku ima pravo uložiti prigovor na obradu osobnih podataka koji se odnose na njega, što uključuje i izradu profila u mjeri koja je povezana s takvim izravnim marketingom. Dodatno, ispitanik ima pravo zatražiti da se na njega ne odnosi odluka koja se temelji isključivo na automatiziranoj obradi, uključujući izradu profila, koja proizvodi učinke na njega ili na sličan način značajno na njega utječu, osim ako je ta odluka: - dopuštena zakonom - potrebna za izvršavanje odluka između ispitanika i voditelja obrade - temeljena na izričitoj privoli ispitanika Ispitanik svoja prava može ostvariti u svakom trenutku na način da nas kontaktira na: GAJETA d.o.o. Cankareva 6, 10000 Zagreb, e-mail: Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite. Ispitaniku će biti pružene informacije o poduzetim radnjama najkasnije u roku od mjesec dana od dana zaprimanja zahtjeva. Ukoliko je obrada zahtjeva složena ili se radi o velikom broju zahtjeva, taj rok se može produžiti za još dva mjeseca, ali će u tome slučaju ispitanik biti izvješten o razlozima eventualnog produljenja roka. Također, ukoliko se ne postupi po zahtjevu ispitanika u roku od mjesec dana od primitka zahtjeva, o odluci će ispitanik biti izvješten uz navođenje razloga za takvu odluku te njegovoj mogućnosti podnošenja pritužbe Agenciji za zaštitu osobnih podataka, Martićeva 14, 10000 Zagreb. U slučaju da su zahtjevi ispitanika očito neutemeljeni ili pretjerani, osobito zbog njihovog učestalog ponavljanja, možemo naplatiti razumnu naknadu na temelju administrativnih troškova ili odbiti postupati po zahtjevu ispitanika. - Sigurnost i obveze U nekim poslovnim procesima se pojavljujemo kao voditelji obrade, u tome slučaju samostalno određujemo svrhu i način obrade osobnih podataka, međutim, u nekim poslovnim procesima smo u ulozi izvršitelja obrade, u kojem situacijama obrađujemo osobne podatke u ime voditelja obrade. U skladu s time kontinuirano provodimo odgovarajuće tehničke i organizacijske mjere zaštite kako bi zaštitili osobne podatke ispitanika, u kojoj god da se ulozi nalazimo. Osobne podatke čuvamo u skladu sa našim integriranim standardima sigurnosti, a gdje je to primjenjivo, koristimo kriptografske metode zaštite podataka te unapređujemo sigurnosne mjere u svrhu sprječavanja povrede osobnih podataka ispitanika. Ne dopuštamo neovlašteno prikupljanje, obradu ili korištenje osobnih podataka te primjenjujemo pravilo ograničavanja pristupa podacima samo na one podatke koji su potrebni za obavljanje pojedinih poslovnih zadataka, sukladno našim internim odlukama. Osobne podatke štitimo od neovlaštenog pristupa, korištenja, izmjene te gubitka neovisno od toga da li su isti pohranjeni u papirnatom ili elektroničkom obliku. - Povreda osobnih podataka U slučaju da dođe do povrede osobnih podataka, svi naši radnici imaju dužnost obavijestiti odgovorne osobe o povredi bez odgode, a mi kao voditelji obrade smo dužni, bez nepotrebnog odgađanja i, ako je izvedivo, najkasnije 72 sata nakon saznanja o toj povredi, izvijestiti nadzorno tijelo odnosno Agenciju za zaštitu osobnih podataka. U slučaju da se nalazimo u ulozi izvršitelja obrade, o povredi obavještavamo u tome slučaju voditelja obrade podataka. Ukoliko je riječ o povredi osobnih podataka koja će vjerojatno prouzročiti visok rizik za prava i slobode pojedinaca, o povredi ćemo obavijestiti i ispitanika, osim ako: - su poduzete odgovarajuće tehničke i organizacijske mjere zaštite i te su mjere primijenjene na osobne podatke obuhvaćene povredom osobnih podataka, posebno one koje osobne podatke čine nerazumljivima bilo osobi koja im nije ovlaštena pristupiti, kao što je enkripcija - su poduzete naknadne mjere kojima se osigurava da više nije vjerojatno da će doći do visokog rizika za prava i slobode ispitanika - bi se time zahtijevao nerazmjeran napor, u kojem slučaju mora postojati javna obavijest ili slična mjera kojom se ispitanici obavještavaju na jednako djelotvoran način Ispitanik ima pravo podnijeti pritužbu nadzornom tijeku - Agenciji za zaštitu osobnih podataka u slučaju - povrede njegovih osobnih podatka ili - ako drži da se njegova prava grubo krše sukladno Općom uredbom o zaštiti osobnih podataka - Završne odredbe Ova Opća politika stupa na snagu danom donošenja, a dostupna je u poslovnim prostorijama na oglasnoj ploči GAJETA d.o.o. Zagreb, 25.05.2018. godine GAJETA d.o.o. kojeg zastupa direktor Jasminka Jović