http___hr-itc.hr_uvjeti-koristenja-i-privatnost-podataka__1.xml
1.1 3.1 4.1 5.1 5.2 5.3 5.4 6.1 6.2 7.1 8.1 8.2 9.1 9.2 10.1 10.2 10.3 11.1 13.1 13.2 14.1 15.1 15.2 15.3 16.1 17.1 18.1 19.1 20.1 21.1 22.1 23.1 23.2 24.1 25.1 25.2 26.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 34.1 35.1 35.2 36.1 37.1 38.1 39.1 40.1 41.1 42.1 42.2 43.1 44.1 45.1 46.1 47.1 48.1 49.1 50.1 51.1 52.1 54.1 55.1 55.2 55.3 56.1 56.2 56.3 56.4 57.1 58.1 59.1 61.1 62.1 62.2 63.1 63.2 65.1 66.1 67.1 68.1 69.1 70.1 72.1 73.1 74.1 75.1 77.1 78.1 78.2 80.1 81.1 81.2 82.1 84.1 85.1 85.2 86.1 86.2 88.1 89.1 90.1 92.1 93.1 94.1 95.1 95.2 96.1 96.2 97.1 97.2 97.3 98.1 98.2 99.1 99.2 99.3 100.1 101.1 102.1 102.2 103.1 103.2 104.1 105.1 106.1 107.1 108.1 109.1 110.1 110.2 111.1 111.2 112.1 113.1 114.1 114.2 115.1 115.2 115.3 115.4
PHOEBE Data Management and Protection Policy Introduction The present document comprises the “PHOEBE Data Management and Protection Policy” (from now on referred to as ‘Policy’). This policy applies to all products/services, all projects and in general all operations of PHOEBE Research and Innovation Ltd, referred to as ‘PHOEBE’, ‘us’, ‘our’ and ‘we’. PHOEBE is a private company operating through its officers in Cyprus in the domains of information and communication technologies (ICT), including consulting services, technical solutions development, design/development/ operation of cyber-physical systems/solutions, design/development/operation of intelligent systems and artificial/computation intelligence -based solutions. The Policy describes how PHOEBE collects, uses, manages and protects the personal data and information of our customers, clients, partners, end-users, project stakeholders, pilot and test participants, and any other person with whom we interact in the course of performing our normal business and from whom we request any data. From now on, we will refer to all these persons collectively as ‘you’ or ‘your’. Your privacy and control over your personal data, whether provided directly to us or whether transferred to us through third-parties, are important to us and we therefore do our best to comply with the EU General Data Protection Regulation (from now on referred to as ‘EU GDPR’) or any subsequent update of the relevant EU regulations, as well as any other more strict rules enforced by law and regulations in the countries through which we operate. Please read this Policy carefully to understand how we collect, manage, process, and protect your personal data. In summary, our data management and protection practices are based on the following principles: privacy, control of data, lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability, in compliance with the EU GDPR. All our products, services, projects, social media accounts, etc., are covered by this Policy. In addition, they may provide their own extensions to the Policy, giving clarifications on the specific data they collect, how they process them and all other details related to the implementation of the Policy and the enforcing of your rights. Our products, services, projects, social media accounts, etc., may contain links to and from sites maintained by third parties. This Policy does not cover your activities on those third sites, any information you may provide to those sites, or information that may be collected about you by those sites. We do our best to ensure compliance with this Policy. If you have any question in relation with the present Policy and/or you need certain clarifications regarding your data and/or regarding how to enforce your rights on the data we manage and/or regarding the language (including simplicity and translations, etc) used in this document please contact PHOEBE Data Management and Protection Officer at management@phoebeinnovations.com. If you do not receive any response within 48 hours, please, use the contact form at: http://www.phoebeinnovations.com/contactus In case of any issue in relation with the implementation of this Policy and/or in relation with our processing of your personal data, we commit to take all reasonably possible measures to resolve it and if required to cooperate with the appropriate supervisory and regulatory authorities, including local data protection authorities, to seek for their advice and support. We shall not be liable for any incidental, consequential or punitive damages relating to this Policy. Data Collection and Processing Roles During performance of our business, we collect several types of data from you, depending on the context and type of interaction we have with you. In certain cases we act as the primary collector of your data, while in other cases we may act as a ‘processor’ of your data on behalf of the primary persons (third-parties) to which you have provided the data or even as a ‘third-party’ to which your data have been disclosed within certain context. The present Policy applies to all these cases. Policy Principles relating to processing of the personal data We commit to collecting and processing your data in accordance with all principles set out in the EU GDPR, namely: a) lawful, fair and transparent data processing; b) data collection for specified, explicit and legitimate purposes, without further processing in a manner that is incompatible with those purposes; c) adequate, relevant and limited data to what is necessary in relation to the purposes for which they are collected and processed; d) accurate data and, where applicable, kept up to date; we take every reasonable step to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay; e) data kept in a form which permits your identification for no longer than it is necessary for the purposes for which the data have been collected and processed in the first time; f) data collected and processed in a manner that ensures their appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage. To achieve that we utilise reasonable and appropriate technical and organisational measures. Lawfulness of data processing We strive to comply with all laws and regulations related to the collection and processing of personal data. To do so, we apply one or more of the following: a) We request your clear consent to the processing of your personal data for one or more specific purposes, for which we give clear information beforehand; b) In the cases of contracts/agreements we sign with you, we only keep your personal data to the extent they are necessary for the performance of the contracts/agreements or in order to take steps at the request of you or another party of the contract/agreement prior to entering into the contract/agreement; c) We perform data processing if necessary for compliance with a legal obligation to which we are subject, or to protect the vital interests of you or other natural persons or when processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us or when processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of yours. Communication and Consent Requests We always request your consent to collect and process your personal data, in a clear manner, through a dedicated written declaration (either in paper or through electronic means). The communication and the request for a consent happen before any personal data are obtained, and contain the following details: (a) the identity and the contact details of our company, and of our Data Management and Protection Officer; (b) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing; (c) any third-party recipients or categories of recipients of the personal data; (d) where applicable, the fact that we intend to transfer personal data to a third country or international organisation, with reference to the appropriate or suitable safeguards and means by which they can obtain a copy of the data or where they have been made available. We make clear all legitimate interests pursued by our company or by the third party; (e) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that period; (f) the existence of your right to request from us access to and rectification or erasure of your personal data or restriction of processing concerning your data or to object to processing as well as the right to data portability; (g) the existence of your right to withdraw consent at any time; note, however, that this would not affect the lawfulness of processing based on your consent before its withdrawal; (h) your right to lodge a complaint with a supervisory/regulatory authority regarding the use of your personal data; (i) whether the provision of your personal data is a statutory or contractual requirement or a requirement necessary to enter into a contract, as well as whether you are obliged to provide the personal data and of the possible consequences of failure to provide such data; (j) the existence of any automated decision-making, including profiling, referred to in EU GDPR and meaningful information about the logic involved, as well as the significance and the envisaged consequences on you, of such processing. Where the personal data belong to a person below the age of 18 years, the consent must be given or authorised by the holder of parental responsibility over the person. We shall make reasonable efforts to verify in such cases that the consent is indeed given or authorised by the holder of parental responsibility over the person. Processing of special categories of personal data In general, we do not perform and we are not engaged in any processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation. In the cases where specific products, services, projects, necessitate the processing of data mentioned in the above paragraph, we take the following measures: a) We make sure that you have given explicit consent to the processing of those personal data for one or more specified purposes, except where the EU or Cyprus law provides that this action is prohibited anyway; b) We ensure the processing is necessary for the purposes of carrying out the obligations and exercising our or your specific rights or the processing is necessary to protect your vital interests or the vital interests of another person where you are physically or legally incapable of giving your consent. We do not process any personal data relating to criminal convictions and offences. Processing which does not require identification In the cases where the purposes for which we process personal data do not or do no longer require your identification, we do not maintain, acquire or process any additional information in order to be in position to identify you. In the above cases, we make all efforts to remove any possibility of us being able to identify you and we inform you accordingly, where this is possible. Your Rights in relation with this Policy Transparency and modalities: We take all appropriate measures to communicate to you all information related to the implementation of this Policy in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular when you are a child or belong to any other vulnerable group. We always provide the information in writing, including the electronic means where feasible. We are available to communicate all relevant information orally or by other feasible means, when you request it, provided that we can confirm your identity by other means. We will never refuse to act on your request for exercising your rights under any law or regulation, unless we can demonstrate that we are not in position to identify you. In such cases, we will provide to you information on actions taken, within one month of receipt of your request. All these will happen free of any charge, unless your requests are manifestly unfounded or excessive, in particular because of their repetitive character. In the latter cases we reserve the right to either charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested or refuse to act on your request. We will always take reasonable measures to authenticate you when you interact with us, so as to avoid any wrong disclosure of data. The above hold also in case your personal data have not been directly provided to us but we are processing it on behalf of third-parties. As an exception, we will not provide the information as above mentioned, in case it must remain confidential subject to an obligation of professional secrecy regulated by EU or the countries from which we operate. Right of access to your data You have the right to obtain from us confirmation as to whether or not we process personal data of yours. Where that is the case, you have the right to access to the personal data and all the information which is being requested when we ask for your consent (see Communication and Consent Requests in this Policy) We shall provide a copy of your personal data undergoing processing. For any further copies you request, we may charge a reasonable fee based on administrative costs. Rectification and erasure You have the right to request and obtain from us the rectification of inaccurate personal data concerning you, without undue delay, even if this will cause us having incomplete personal data records for the purposes we need it. You have the right to request and obtain from us the erasure of any of your personal data, without undue delay. We undertake the obligation to erase your personal data without undue delay where: (a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; and/or (b) you withdraw your consent on which the processing is based, and where there is no other legal ground for the processing; and/or (c) you objects to the processing and there are no overriding legitimate grounds for the processing; and/or (d) your personal data have to be erased for compliance with a legal obligation in the EU or any other country from which we operate; Pursuant to paragraphs above, where we have made your personal data public, we will take into account the available technology and the cost of implementation and we will take reasonable steps, including technical measures, to inform third-parties which are processing the personal data that you have requested the erasure of any links to, or copy or replication of your personal data. However, we will not erase the data if they are processed: (a) for exercising the right of freedom of expression and information; (b) for compliance with a legal obligation which requires processing by the EU or other country from which we operate or for the performance of a task carried out in the public interest or in the exercise of official authority vested in PHOEBE; (c) for reasons of public interest in the area of public health in accordance with the EU GDPR; (d) for the establishment, exercise or defense of legal claim Right to restriction of processing You have the right to request and obtain from us restriction of processing of your personal data where: (a) you contest the accuracy of your personal data, for a period enabling us to verify the accuracy of the personal data; (b) the processing is unlawful and you oppose the erasure of your personal data and requests the restriction of their use instead; (c) we no longer need the personal data for the purposes of the processing, but you require them for the establishment, exercise or defense of legal claims; Where processing has been restricted, your personal data will, with the exception of storage, only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of EU or any other country. In all above cases, you will be informed by us before any restriction of processing is lifted. Communication - Notifications We undertake to communicate any rectification or erasure of your personal data or restriction of processing carried out in accordance with this Policy, to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. We will inform you about those recipients if you request it. Right to data portability You have the right to receive the personal data concerning you, and which you have provided to us, in a structured, commonly used and machine-readable format and you have the right to transmit those data to a third-party without hindrance from us, where the processing is based on prior consent or contractual relation and the processing is carried out by automated means. Where technically feasible, we undertake to transmit the data directly to the a third-party appointed by you. The above right is applied if not adversely affecting the rights and freedoms of others. Right to object You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data, including automated processing and profiling. We undertake to then stop processing your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims. We do not process personal data for direct marketing purposes. We always seek for clear consent. Rights related to a utomated individual decision-making, including profiling You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. The above right does not apply if: (a) the decision is necessary for entering into or for the performance of a contract/agreement between you and us; (b) the processing is authorized by an EU or other country’s law to which we are subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; (c) it is based on your explicit consent. Right to lodge a complaint with a supervisory authority We understand that you have the right to lodge a complaint with a supervisory authority, if you consider that the processing of personal data relating to you infringes the EU GDPR. PHOEBE Rights and Responsibilities/Obligations Taking into account the nature, scope, context and purposes of processing data, we implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with the EU GDPR. The measures we take are reviewed frequently and they are updated where and at the extent necessary. When it comes to electronic data processing, we take all proportionate measures to safeguard your data by preventing unauthorized access and implementing the widely adopted security measures for the product/service/project in consideration. Taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of the data processing, we implement appropriate technical and organisational measures, such as pseudonymization, which are designed to implement data-protection principles, such as data minimization, in an effective manner and to integrate the necessary safeguards into the processing in order to meet the requirements of the EU GDPR and protect your rights. We implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. The measures we take, ensure that by default personal data are not made accessible, without your clear consent. Where we process data jointly with other organisations (e.g. in project consortia), we make sure that our agreements with them determine transparently our respective responsibilities for compliance with the data management and protection policies of each organisation and the EU GDPR, in particular as regards the exercising of your rights and our respective duties to provide the information related to the exercising of these rights. In all these cases, we inform you about the details of the arrangement we have with these other organisations, as well as the contact details to use in relation with the data management and protection policy and the EU GDPR. Although our company is not obliged to appoint a Data Protection Officer according to the EU GDPR regulation, we took the initiative and appointed a Data Management and Protection Officer. The relevant contact details can be found at the beginning of this document. We mandate the Data Management and Protection Officer to be addressed in addition to us or instead of us by, in particular, supervisory authorities and you, on all issues related to personal data processing, for the purposes of ensuring compliance with this Policy and the EU GDPR. In the cases we process data on behalf of third-parties, we provide sufficient guarantees to these third-parties that we implement appropriate technical and organisations measures in such a manner that processing will meet the requirements of the EU GDPR and ensure the protection of the rights of their data subjects. We never engage another processor in your data processing without your prior specific or general written authorization or of the third-party on behalf of which we process the data. In the case of general written authorization, we undertake to inform you or the responsible third-party of any intended changes concerning the addition or replacement of third-parties processing the data, thereby giving to these persons the opportunity to object to such changes. When we process data on behalf of third-parties, we always enter into contract/agreement or other legal act under the laws of the countries through which we operate, that is binding on us with regard to the third-parties and that sets out the subject-matter and duration of the data processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the third-parties on behalf of which we process the data. The respective contract or other legal act shall make it clear that we: (a) process the personal data only on documented instructions from the third-party, including with regards to transfers of personal data to a third country or an international organisation; (b) ensure that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality; (c) take all measures required pursuant to supporting these third-parties in their obligations arising from the EU GDPR; (d) assist the third-party by appropriate technical and organisational measures, insofar as this is possible, for the fulfillment of their obligation to respond to requests for exercising the rights of persons to which the data belong, as laid down in EU GDPR; (e) assist the third-party in ensuring compliance with the obligations pursuant to the content of EU GDPR, taking into account the nature of processing and the information available to us; (f) at the choice of the third-party on behalf of which we process the data, delete or return all the personal data to them after the end of the provision of services relating to processing, and delete existing copies unless an EU law or the law of a country through which we operate, requires storage of that personal data; (g) take actions to immediately inform the third-party if, in our opinion, an instruction they give us, infringes the EU GDPR or the data protection provisions of the countries through which we operate. Where we engage another party for carrying out specific processing activities on behalf of us or a third-party, we take measures so as the same data protection obligations as set out in the contract or other legal act we participate in as referred to above are imposed on that other party by way of a sub-contract or other legal act. Security of Data Processing Taking into account the state-of-the-art, the costs of implementation and the nature, scope, context and purposes of the data processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, we are implementing appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alias as appropriate: the pseudonymization and encryption of the personal data; the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services; the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident; a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing. In assessing the appropriate level of security, we take into account, in particular, the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted, stored or otherwise processed. We take all necessary steps to ensure that any natural person acting under our authority, who has access to personal data, does not process them except on direct instructions from us (or from a third-party if we give such consent). In the case of a personal data breach, we shall without undue delay and, where feasible, not later than 72 hours after having become aware of it (or longer if the delay can be duly justified by us), notify the personal data breach to the supervisory authority competent in accordance with the EU GDPR, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of any natural persons. When the personal data breach is likely to result in a high risk to your rights and freedoms, we shall communicate the personal data breach, using clear and plain language, to you without undue delay. If such communication would involve disproportionate effort, we will instead communicate publicly in a way we believe you will be informed in an equally effective manner. Where a type of processing in particular using new technologies, and taking into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to your rights, we undertake, prior to the processing, to carry out an assessment of the impact of the envisaged processing operations on the protection of your personal data. In any case, such impact assessment will in particular be undertaken in the case of: (a) a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person; (b) processing on a large scale of special categories of data as referred to in Article 9(1) of the EU GDPR or of personal data relating to criminal convictions and offences referred to in Article 10 of EU GDPR; (c) a systematic monitoring of a publicly accessible area on a large scale. Where necessary, we undertake to carry out a review to assess if processing is performed in accordance with the data protection impact assessment at least when there is a change of the risk represented by processing operations. Changes to Our Privacy Policy We reserve the right to modify or revise this Policy from time to time and especially when such modifications are subject to complying with updated laws and regulations from EU and/or the countries through which we operate. Although we do our best to notify you in the case of major changes applied to this Policy, we do expect you to take actions and stay informed about the most up to date version of the Policy, by periodically checking at our website: http://www.phoebeinnovations.com/dmpp. All changes/updates/revisions to the Policy will be clearly annotated in the latest version, with information also on the “last modified date”, so that we make it easy for you to know whether an update has been performed and the content of that update. At each time, only the latest version of the Policy remains applicable. We do our best for the Policy updates to be backward compatible, that is, to avoid voiding any of the rights and obligations assumed in previous versions, without offering sufficient treatment. In the case the changes affect your data protection rights, you have the right to contact us immediately and request to enforce any of your rights.
1.1 2.1 3.1 4.1 4.2 4.3 5.1 6.1 6.2 7.1 8.1 8.2 8.3 8.4 8.5 9.1 10.1 10.2 11.1 12.1 13.1 14.1 14.2 14.3 14.4 15.1 16.1 16.2 16.3 16.4 16.5 16.6 17.1 18.1 18.2 18.3 18.4 18.5 18.6 18.7 18.8 18.9 18.10 18.11 19.1 20.1 21.1 21.2 21.3 21.4 22.1 23.1 23.2 24.1 25.1 26.1 27.1 28.1 29.1 30.1 30.2 31.1 32.1 33.1 34.1 35.1 36.1 37.1 38.1 38.2 38.3 39.1 39.2 40.1 40.2 41.1 42.1 43.1 44.1 44.2 45.1 46.1 46.2 47.1 48.1 49.1 50.1 51.1 52.1 53.1 54.1 55.1 56.1 57.1 58.1 58.2 59.1 60.1 60.2 61.1 62.1 63.1 63.2 64.1 65.1 66.1 67.1 68.1 69.1 70.1 71.1 72.1 73.1 74.1 75.1 76.1 77.1 78.1 79.1 80.1 81.1 82.1 83.1 84.1 84.2 85.1 86.1 87.1 88.1 89.1 90.1 91.1 92.1 93.1 94.1 94.2 95.1 96.1 97.1 98.1 99.1 100.1 101.1 102.1 102.2 103.1 104.1 105.1 106.1 107.1 108.1
Uvijeti korištenja Pravne obavijesti Sadržaji objavljeni na internet stranicama HR-ITC d.o.o., vlasništvo su HR-ITC d.o.o. i mogu se upotrebljavati samo u nekomercijalne svrhe, pri čemu se moraju poštivati i sva navedena upozorenja o autorskim pravima, što znači da se ne smiju prepisivati, umnožavati ili na bilo koji drugi način dijeliti. HR-ITC d.o.o., nije odgovoran za privremenu nedostupnost ili nepotpunu funkcionalnost internet stranica, eventualnu netočnost podataka niti za eventualnu štetu nastalu zbog upotrebe netočnih ili nepotpunih informacija. HR-ITC d.o.o., niti bilo koja druga pravna ili fizička osoba koja je sudjelovala u nastanku i izradi ovih internet stranica, nije odgovorna ni za kakvu štetu koja bi mogla proizaći iz pristupa informacijama, upotrebe ili nemogućnosti upotrebe informacija na tim internet stranicama ili bilo kakve pogreške ili nedostatka u njihovom sadržaju. Također, HR-ITC d.o.o. zadržava pravo izmjene sadržaja. Intelektualno vlasništvo: Svi sadržaji objavljeni na ovim internetskim stranicama HR-ITC d.o.o. kao što su tekstovi, grafički sadržaji, zaštitni znakovi (logotipi), ikonice, sličice, audio i video zapisi, digitalni sadržaji, programski paketi (softver) i ostali nenavedeni sadržaji objavljeni na ovim stranicama, vlasništvo su ili HR-ITC d.o.o. ili trgovca ili dobavljača programskih paketa (softvera) te su zaštićeni domaćim i međunarodnim pravima o zaštiti autorskih prava i prava intelektualnog vlasništva te njihova neovlaštena uporaba nije dopuštena. Ovim istovremeno pristajete na zabranu reprodukcije, umnožavanja ili distribucije dizajna ili podloge internetskih stranica HR-ITC d.o.o., pojedinačnih elemenata stranica, dizajna, logotipa te marke HR-ITC d.o.o. bez izričitoga pisanog odobrenja HR-ITC d.o.o. Dostupnost: Iako vam HR-ITC d.o.o. nastoji dati najbolju moguću ponudu usluga, HR-ITC d.o.o. ne može jamčiti da će usluge na internetskim stranicama HR-ITC d.o.o. odgovarati vašim potrebama. HR-ITC d.o.o. također ne može jamčiti da će usluga biti bez pogrešaka. Ukoliko dođe do pogreške, molimo vas da je prijavite na e-poštu: info@hr-itc.hr kako bismo je otklonili na najbrži mogući način. Pristup na HR-ITC d.o.o. Internet stranicu ponekad može biti nedostupan zbog radova, održavanja ili uvođenja novih sadržaja. Ostale Internet stranice: HR-ITC d.o.o. Internet stranica uključuje poveznice na druge internetske stranice, a materijali su na tim stranicama izvan kontrole HR-ITC d.o.o. i stoga nije odgovoran za sadržaj na tim stranicama. Cijena: Prema cijenama po kojima ste dogovorili uslugu biti će vam izrađen račun. Izmjene: Molimo vas primite na znanje da HR-ITC d.o.o. može u svako vrijeme, bez prethodne najave, ažurirati ili izmijeniti podatke pohranjene na svim svojim internetskim stranicama. HR-ITC d.o.o. zadržava pravo na izmjenu ovih Uvjeta i pravila. Sve promjene primijenit će se na korištenje svih mrežnih stranica HR-ITC d.o.o. Ukoliko se ne slažete s navedenim pravilima korištenja i ne želite ih prihvatiti, molimo vas obratite se našem djelatnicima na info@hr-itc.hr sa svojim primjedbama. Pomoć: Provodimo istraživanja kako bismo dodatno unaprijedili naše usluge. Iznimno bismo cijenili vaš doprinos navedenim istraživanjima pitanjima, komentarima, prigovorima i pohvalama. Molimo vas kontaktirajte HR-ITC d.o.o. na telefonskom broju +385 (0)33 721 172 svakim radnim danom od 08.00 do 16.00 sati, pošaljite e-poštu na info@hr-itc.hr ili nam pišite na adresu HR-ITC d.o.o., Matije Gupca 51, 33000 Virovitica. Molimo vas vodite računa o tome da slanje privatnih poruka elektroničkom poštom može biti nesigurno i podložno neovlaštenom pristupu trećih ili pogrešnoj dostavi. Svaka poruka zaprimljena elektroničkom poštom smatrat će se nepovjerljivom te HR-ITC d.o.o. ne odgovara za sigurnost i privatnost takvih poruka, zadržavajući pritom pravo da iste reproducira, upotrijebi, raspolaže i distribuira trećima bez ograničenja. Nadalje, slobodni smo upotrebljavati ideje, nacrte, stručna znanja ili tehnike sadržane u takvim porukama za bilo koju svrhu, uključujući primjerice marketing usluga sadržanih u takvim porukama. Isključenje odgovornosti: Ovime prihvaćate i podvrgavate se hrvatskom materijalnom pravu kao isključivo mjerodavnom za tumačenje, primjenu i pravne učinke svih dopuštenja, isključenja i uvjeta upotrebe ove internetske stranice. Hrvatski sudovi isključivo su nadležni za sve zahtjeve i sporove koji nastanu kao rezultat upotrebe predmetnih internetskih stranica ili u vezi s njima. HR-ITC d.o.o. ne jamči da su materijali sadržani na predmetnim stranicama primjereni ili korisnički dostupni na određenim lokacijama, odnosno ne odgovara za pristup istima s teritorija država gdje je njihov sadržaj zakonom zabranjen. Smatrat će se da je pristup internetskim stranicama s navedenih lokacija poduzet samovoljno uz odgovornost korisnika prema mjerodavnom pravu. Sve informacije dostupne na internetskim stranicama isključivo su informativnog karaktera, ne smiju se koristiti u komercijalne svrhe niti distribuirati trećima. Informacije o uslugama s ovih internetskih stranica podložne su određenim ograničenjima u vezi sa subjektima kojima takve informacije mogu biti dostupne. Informacije koje HR-ITC d.o.o. objavljuje na ovim internetskim stranicama smatraju se točnima i pouzdanima u vrijeme njihovog unošenja, međutim HR-ITC d.o.o. ne jamči za točnost, istinitost ili pouzdanost bilo kojih podataka pohranjenih na ovim internetskim stranicama. HR-ITC d.o.o. ne jamči, izričito ili prešutno, uključujući jamstva u pogledu utrživosti, odnosno podobnosti za određenu svrhu, niti preuzima bilo kakvu odgovornost za potpunost ili korisnost bilo koje od izloženih informacija, sustava, proizvoda ili procesa. Informacije dostupne na internetskim stranicama ne smiju se smatrati temeljem za donošenje značajnih osobnih, financijskih ili poslovnih odluka, te ste suglasni da nas nećete smatrati odgovornima za neostvarivanje svojih očekivanja u vezi s tim. Do zakonom predviđenih ograničenja, HR-ITC d.o.o. neće odgovarati za bilo kakvu izravnu ili neizravnu, slučajnu, nematerijalnu ili materijalnu štetu, gubitke ili troškove nastale kao rezultat upotrebe ili nemogućnosti upotrebe koje od informacija dostupnih na ovim internetskim stranicama. U tom smislu predlažemo konzultacije s odgovarajućim stručnjakom koji će moći dati savjet posebno prilagođen vašoj konkretnoj situaciji. Privatnost podataka Uvodne odredbe Sukladno Uredbi (EU) 2016/679 Europskog parlamenta i vijeća od 27. travnja 2016. o zaštiti pojedinaca u vezi s obradom osobnih podataka i o slobodnom kretanju takvih podataka te o stavljanju izvan snage Direktive 95/46/EZ (Službeni list Europske unije L 119, 4.5.2016., str. 1., u daljnjem tekstu: Opća uredba o zaštiti podataka), koja je u punoj primjeni od dana 25. svibnja 2018. godine u Republici Hrvatskoj i svim zemljama članicama Europske unije, kao i Zakonu o provedbi Opće uredbe o zaštiti podataka (Narodne novine broj 42/18, u daljnjem tekstu: Zakon) odnosno sukladno pravnom okviru zaštite osobnih podataka u Republici Hrvatskoj i Europskoj uniji te najboljoj europskoj praksi, društvo HR-ITC društvo s ograničenom odgovornošću za međunarodni transport i trgovinu, sa sjedištem u Republici Hrvatskoj, Virovitica, Matije Gupca 51, upisano u sudski registar Trgovačkog suda u Zagrebu pod matičnim brojem subjekta upisa (MBS): 0854387, osobni identifikacijski broj (OIB): 31587016821 (u daljnjem tekstu: Društvo), kao voditelj obrade osobnih podataka korisnika svojih usluga i kupaca, izradilo je Politiku o zaštiti privatnosti korisnika usluga i kupaca. Politika o zaštiti privatnosti je jednostrano obvezujući pravni akt zasnovan na temeljnim načelima u obradi osobnih podataka, kojim se regulira koji podaci korisnika i/ili kupaca se prikupljaju, na koji način se takvi podaci obrađuju, u koje se svrhe upotrebljavaju. Politika o zaštiti privatnosti ujedno upoznaje korisnike usluga i/ili kupce s njihovim pravima u prikupljanju i daljnjoj obradi osobnih podataka, sve u svrhu zaštite njihove privatnosti u širem smislu. Politika o zaštiti privatnosti temelji se na sljedećim načelima obrade osobnih podataka: načelu zakonitosti, transparentnosti i najbolje prakse, načelu ograničene obrade i smanjenju količine podataka, načelu točnosti i potpunosti osobnih podataka, načelu ograničene pohrane, načelu cjelovitosti i povjerljivosti podataka, načelu odgovornosti, načelu povjerenja i poštene obrade, načelu oportunosti (svrhe obrade), načelu obrade u neimenovanom (anonimiziranom) obliku. Politika o zaštiti privatnosti se primjenjuje na sve usluge koje nudi Društvo, pri čemu je cilj Politike na jasan i transparentan način upoznati korisnike i/ili kupce s postupcima obrade njihovih osobnih podataka i njihovim pravima. Prije svega, korisnici i/ili kupci mogu se u svakom trenutku obratiti Društvu sa zahtjevom za izmjenu ili dopunu i/ili ažuriranje podataka koji se na njih odnose, kao i sa zahtjevom za očitovanje o tome u koje svrhe žele ili ne žele da se njihovi podaci obrađuju. Za obradu osobnih podataka odgovorno je Društvo: HR-ITC društvo s ograničenom odgovornošću za međunarodni transport i trgovinu, sa sjedištem u Republici Hrvatskoj, Virovitica Matije Gupca 51, upisano u sudski registar Trgovačkog suda u Zagrebu pod matičnim brojem subjekta upisa (MBS): 0854387, osobni identifikacijski broj (OIB): 31587016821. Kontakt podaci službenika za zaštitu osobnih podataka: e-mail: mario@hr-itc.hr Način prikupljanja i vrste podataka koji se prikupljaju Pojedine usluge koje Društvo pruža zahtijevaju prikupljanje osobnih podataka korisnika i/ili kupaca, pri čemu se prikupljaju osnovni podaci na sljedeće načine: Izravno od strane samih korisnika i/ili kupaca na način da ih korisnici i/ili kupci sami dostave uz privolu Društvu kao voditelju obrade u određenom opsegu podataka koji je bitan za pružanje odgovarajućih usluga. U svrhu pružanja odgovarajućih usluga korisnik i/ili kupac je dužan dostaviti Društvu sljedeće podatke koji su istome potrebni za zasnivanje ugovornog odnosa radi pružanja pojedine usluge: a) ime i prezime; b) tvrtka; c) adresa; d) kontakt broj telefona i/ili mobitela; e) kontakt podatke elektroničke pošte (e-mail adresa); Iz drugih izvoraodnosno od naših poslovnih partnera ili iz javno dostupnih izvora (primjerice, podaci dostupni uvidom u telefonski imenik i druge javno dostupne servise); Automatski posjetom našim mrežnim (web) stranicama, pri čemu se radi o podacima koji su pridruženi mrežnim identifikatorima (adrese internetskih protokola te identifikatori kolačića, kao što su Google Analytics za praćenje interakcije korisnika i/ili kupaca). Kolačić je mala podatkovna datoteka koja se pohranjuje na računalo ili mobilni uređaj pri posjetu određenoj web-stranici. Kolačići se upotrebljavaju radi pružanja boljeg korisničkog iskustva svakom korisniku i/ili kupcu, spremanje preferencija korisnika i/ili kupaca, s ciljem da bi web-stranice radile učinkovitije, kao i za praćenje i ispitivanje korištenja te posjećenosti web-stranice Društva. Kolačići se također upotrebljavaju za praćenje uporabe interneta i izradu korisničkih profila, a potom za prikaz prilagođenih internetskih oglasa na temelju preferencija korisnika i/ili kupca. Isključivanjem i/ili blokiranjem spremanja kolačića korisnik i/ili kupac i dalje može pregledavati web-stranice Društva. Međutim, postoji vjerojatnost da pojedine mogućnosti i/ili funkcionalnosti web-stranice neće biti dostupne takvom korisniku i/ili kupcu, odnosno da će vrijeme potrebno za pristup pojedinim funkcijama web-stranice biti duže od uobičajenog. Predmetni mrežni identifikatori mogu ostaviti tragove koji, u kombinaciji sa drugim identifikatorima i informacijama koje pružaju poslužitelji internetskih usluga, mogu poslužiti za identifikaciju korisnika i/ili kupca. Također, u navedenu svrhu prikupljamo i obrađujemo sljedeće podatke: a) podatke o IP adresi; b) podatke o korištenju pojedinih aplikacija; c) podatke o navikama korisnika i/ili kupaca – navedene podatke kreiramo u svrhu profiliranja korisnika i/ili kupaca. Količina, odnosno opseg osobnih podataka koje Društvo prikuplja ovise o vrsti usluge koju Društvo pruža svojim korisnicima i/ili kupcima, kao i o pravnoj osnovi na temelju koje isto prikuplja podatke. Društvo neprestano vodi brigu o prikupljanju samo nužnog opsega osobnih podataka koji je potreban za postizanje zakonom utvrđene svrhe u koju se podaci obrađuju. U koje svrhe se osobni podaci prikupljaju i dalje obrađuju Osobne podatke Društvo prikuplja kako bi moglo pružati, održavati, štititi i poboljšati svoje usluge vezane za kupnju određenih proizvoda, kako bi razumjelo načine na koje korisnici i/ili kupci koriste pružene usluge i upotrebljavaju mrežne (web) stranice Društva te u svrhu izvršavanja ugovornih obveza Društva. Takve podatke Društvo prikuplja podatke na temelju privole koju je dao korisnik i/ili kupac u jednu ili više točno određenih svrha, kao i u jednom od sljedećih slučajeva. Izvršenje ugovornih obveza Društvo prikuplja i dalje obrađuje osobne podatke korisnika i/ili kupaca u svrhu sklapanja i izvršenja ugovora, rješavanja prigovora korisnika i/ili kupaca te drugih radnji koje su povezane sa sklapanjem i izvršenjem ugovora u skladu s mjerodavnim propisima. Pravnu osnovu za obradu osobnih podataka korisnika i/ili kupaca u naprijed navedene svrhe predstavlja nužnost sklapanja ugovora, odnosno, u slučaju da korisnik i/ili kupac uskrati davanje bitnih podataka, Društvo neće biti u mogućnosti sklopiti ugovor i /ili poduzeti pojedine radnje vezane uz izvršenje sklopljenog ugovora. Ispunjavanje zakonskih obveza Društvo je obvezno na temelju podnesenog pisanog zahtjeva korisnika i/ili kupaca na gore naznačenu adresu službenika za zaštitu osobnih podataka istima omogućiti pristup osobnim podacima koje obrađuje o njima, ispravak netočnih osobnih podataka, brisanje osobnih podataka ili ograničenje obrade osobnih podataka, kao i upoznati ih s mogućnošću prigovora na obradu osobnih podataka te pravom na prenosivost podataka. Izravna promidžba (marketing) Kontakt podaci korisnika i/ili kupaca mogu se koristiti za slanje promidžbenih obavijesti o uslugama Društva ako je korisnik i/ili kupac dao privolu za takvu obradu ili ako postoji legitimni interes Društva za takvim radnjama, osim ako su od tih interesa jači interesi ili temeljna prava i slobode korisnika i/ili kupca koji zahtijevaju zaštitu osobnih podataka. Društvo može koristi kontakt podatke i osobno se obratiti korisnicima i/ili kupcima čije osobne podatke već posjeduje, na temelju legitimnog interesa za slanje promidžbenih obavijesti o svim uslugama koje pruža, koristeći sve dostupne kanale za promidžbu, osim ako se korisnik i/ili kupac ne usprotivi takvoj obradi. Kako bi korisnik i/ili kupac mogao dobivati obavijesti koje odgovaraju njegovim željama i navikama, neophodno je da Društvo koristi određene podatke korisnika i/ili kupaca za izradu personaliziranih promidžbenih obavijesti, sve dok se korisnik i/ili kupac izrijekom ne usprotivi takvoj obradi podataka, odnosno povuče svoju ranije danu prijavu za obradu. Pravna osnova za obradu osobnih podataka u navedene svrhe je legitimni interes Društva, osim ako su od tog interesa jači interes ili temeljna prava i slobode koji zahtijevaju zaštitu podataka. Interne svrhe Društvo koristi određene podatke korisnika i/ili kupaca isključivo za potrebe vlastitih evidencija, u svrhu zaštite legitimnih interesa korisnika i/ili kupaca i/ili Društva. Primjerice, navedeno uključuje korištenje osobnih podataka u svrhu kreiranja ponuda koje zadovoljavaju potrebe i želje korisnika i/ili kupaca, istraživanje i analizu tržišta. Podaci o potencijalnim korisnicima Društvo je također ovlašteno prikupljati podatke o potencijalnim korisnicima i/ili kupcima svojih usluga i/ili proizvoda. Ovi podaci uključuju osnovne podatke (ime i prezime, adresa elektroničke pošte), ali i interese potencijalnih korisnika i/ili kupaca koji se obraćaju Društvu sa željom da ih se informira i /ili im se ponudi određene proizvode i usluge. Pravna osnova za prikupljanje u opisanom slučaju je privola korisnika i/ili kupca. Vremensko trajanje čuvanja i obrade osobnih podataka Ovisno o svrsi i pravnoj osnovi temeljem koje je prikupljaju osobni podaci korisnika i/ili kupaca, Društvo je u pojedinim slučajevima obvezno čuvati osobne podatke u vremenskom trajanju (razdoblju) koje za pojedinu svrhu propisuju mjerodavni propisi ili prestankom svrhe u koju su prikupljeni. Protekom zakonskog roka koji obvezuje Društvo na čuvanje pojedinih osobnih podataka ili prestankom svrhe isti se brišu. U slučajevima kada osnovu za prikupljanje i obradu podataka čini legitimni interes Društva ili privola korisnika i/ili kupca, osobni podaci se čuvaju u sljedećim vremenskim razdobljima: a) podaci o postojećim korisnicima i/ili kupcima: za vrijeme trajanja ugovornog odnosa i 12 mjeseci nakon prestanka; b) podaci o potencijalnim korisnicima i/ili kupcima: 3 mjeseca; Podaci koji se obrađuju temeljem legitimnog interesa Društva i/ili privole korisnika i/ili kupaca mogu se brisati i prije proteka roka navedenog u ovoj Politici, u slučaju da takvo brisanje zahtijeva korisnik i/ili kupac odnosno kada se korisnik i/ili kupac usprotivi takvoj obradi. Prava korisnika/kupaca Pravo na pristup osobnim podacima Društvo se kao voditelj obrade obvezuje na temelju podnesenog pisanog zahtjeva korisnika i/ili kupca, koji zahtjev može biti i u obliku elektroničke pošte, omogućiti pristup osobnim podacima koje obrađuje o njima, informirati ih o svrsi obrade osobnih podataka u koju se obrađuju, o vrsti osobnih podataka koji se obrađuju, o primateljima ili kategorijama primatelja kojima su osobni podaci otkriveni ili će im biti otkriveni, o predviđenom vremenskom razdoblju obrade ili o kriterijima koji se koriste za utvrđivanje tog razdoblja. Pravo na ispravak netočnih podataka Društvo će kao voditelj obrade omogućiti ispravak netočnih osobnih podataka u svakom pojedinom slučaju kada se utvrdi da prikupljeni osobni podaci o korisniku i/ili kupcu nisu točni ili je došlo do promjene podataka korisnika i/ili kupca. Pravo na brisanje osobnih podataka Društvo će izvršiti brisanje osobnih podataka korisnika i/ili kupca u sljedećim slučajevima: a) kada osobni podaci korisnika i/ili kupca više nisu nužni za ispunjenje svrhe obrade, odnosno prestankom svrhe obrade; b) kada korisnik i/ili kupac povuče privolu kao pravni temelj za obradu podataka, a ne postoji druga pravna osnova za obradu podataka; c) kada korisnik i/ili kupac uloži prigovor na obradu podataka (vidi više pod naslovom Pravo na ulaganje prigovora) d) kada su osobni podaci nezakonito obrađeni; e) kada se osobni podaci moraju brisati radi ispunjenja pravnih obveza iz prava Europske unije ili prave države članice kojem podliježe voditelj obrade podataka; f) kada su osobni podaci prikupljeni u vezi s ponudom usluga informacijskog društva u odnosu na privolu djeteta. Pravo na ograničenje obrade podataka Ograničenje obrade osobnih podataka Društvo će osigurati u slučajevima kada korisnik i/ili kupac osporava točnost podataka, kada je obrada nezakonita a korisnik i/ili kupac se protivi brisanju podataka te umjesto toga traži ograničenje njihove uporabe, kada voditelj obrade više ne treba osobne podatke za potrebe obrade ali korisnik i/ili kupac traži podatke za ostvarenje pravnih zahtjeva, kao i u slučaju kada korisnik i/ili kupac uloži prigovor na obradu osobnih podataka temeljenu na legitimnom interesu Društva, uključujući i izradu profila korisnika i/ili kupaca. Pravo na ulaganje prigovora Korisnik i/ili kupac ima pravo na ulaganje prigovora na obradu osobnih podataka koji se odnose na njega ako se podaci obrađuju za potrebe legitimnog interesa voditelja obrade. U tom slučaju Društvo će, kao voditelj obrade, prestati obrađivati osobne podatke, osim ako dokaže da postoje uvjerljivi legitimni razlozi za obradu osobnih podataka u odnosu na prava korisnika i/ili kupca, odnosno u slučaju kada obrada podataka služi radi postavljanja, ostvarivanja ili obrane pravnih zahtjeva. Ukoliko se osobni podaci korisnika i/ili kupca obrađuju za potrebe izravnog marketinga korisnik ima pravo u svakom trenutku uložiti prigovor na obradu za potrebe izravnog marketinga, osobito ako se osobni podaci koriste u svrhu izrade profila. Gdje se osobni podaci obrađuju Osobne podatke korisnika i/ili kupaca Društvo obrađuje u Republici Hrvatskoj. Pod kojim uvjetima se osobni podaci prosljeđuju trećima Osobne podatke korisnika i/ili kupaca Društvo prosljeđuje trećim osobama (uključujući nadležna tijela) samo u sljedećim slučajevima: a) privole korisnika i/ili kupca; b) radi ispunjenja zakonskih obveza Društva; c) kada je takva obrada nužna radi zaštite ključnih interesa korisnika i/ili kupaca. Upravljanje privolama Aktivna uloga korisnika i/ili kupca u zaštiti privatnosti ogleda se u davanju privola kao dobrovoljnog, posebno informiranog i nedvosmislenog izražavanja želja ispitanika kojima on izjavom ili jasnom potvrdnom radnjom daje pristanak za obradu osobnih podataka. Upravljanje privolama podrazumijeva mogućnost da korisnik i/ili kupac aktivnom i nedvosmislenom radnjom ovlasti Društvo na prikupljanje i obradu pojedinih osobnih podataka u jednu ili više svrha (privola ispitanika), odnosno da na jednak način povuče ranije danu privolu radi prikupljanja i obrade osobnih podataka, u jednu ili više svrha. Kome se obratiti U slučaju bilo kakvih pitanja o zaštiti osobnih podataka od strane Društva, korisnici i/ili kupci se mogu obratiti službeniku za zaštitu osobnih podataka putem elektroničke pošte na e-mail adresu navedenu u ovoj Politici o zaštiti privatnosti ili pisanim putem na sljedeću adresu: HR-ITC d.o.o. n/r Službenika za zaštitu podataka Matije Gupca 51 Virovitica Izmjene i dopune Politike o zaštiti privatnosti Društvo zadržava pravo izmijeniti i dopuniti ovu Politiku u bilo kojem trenutku, bez davanja bilo kakve posebne obavijesti zainteresiranim osobama. Iz navedenog razloga preporuča se svim zainteresiranima da redovito provjeravaju sadržaj web-stranica Društva radi informiranosti oko ažurnog sadržaja ove Politike. U Virovitici, svibanj 2018. godine. HR-ITC d.o.o. HR-ITC d.o.o. Matije Gupca 51 Virovitica info@hr-itc.hr