http___lull.hr_politika-o-privatnosti__1.xml
1.1 2.1 3.1 3.2 4.1 5.1 6.1 7.1 8.1 9.1 10.1 12.1 13.1 14.1 15.1 16.1 17.1 18.1 19.1 20.1 20.2 20.3 21.1 22.1 23.1 24.1 25.1 26.1 27.1 28.1 29.1 30.1 31.1 31.2 32.1 33.1 34.1 35.1 36.1 37.1 38.1 39.1 40.1 41.1 42.1 43.1 44.1 45.1 46.1 46.2 47.1 48.1 49.1 50.1 51.1 52.1 53.1 54.1 55.1 56.1 58.1 59.1 60.1 61.1 62.1 63.1 63.2 63.3 63.4 64.1 65.1 66.1 67.1 68.1 69.1 70.1 71.1 72.1 73.1 73.2 74.1 74.2 75.1 76.1 77.1 77.2 77.3 78.1 78.2 79.1 80.1 81.1 81.2 82.1 82.2 83.1 83.2 84.1 84.2 84.3 84.4 85.1 86.1 86.2 86.3 87.1 88.1 88.2 88.3 89.1 90.1 91.1 92.1 93.1 94.1 95.1 96.1 97.1 98.1 99.1 100.1 101.1 102.1 102.2 102.3 102.4 103.1 103.2 104.1 105.1 106.1 107.1 108.1 109.1 110.1 111.1 112.1 113.1 113.2 114.1 115.1 116.1 117.1 118.1 118.2 118.3 118.4 119.1 120.1 121.1 122.1 123.1 124.1 125.1 126.1 127.1 127.2 127.3 127.4 127.5 128.1 129.1 130.1 131.1 132.1 133.1 134.1 135.1 136.1 137.1 138.1 139.1 140.1 141.1 143.1 143.2 144.1 145.1 146.1 147.1 148.1 149.1 150.1 151.1 152.1 153.1 154.1 155.1 156.1 157.1 158.1 158.2 159.1 160.1 161.1 162.1 163.1 164.1 165.1 166.1 167.1 168.1 169.1 170.1 171.1 172.1 173.1 174.1 174.2 175.1 176.1 177.1 178.1 179.1 180.1 181.1 182.1 183.1 183.2 184.1 185.1 186.1 187.1 188.1 189.1 190.1 191.1 192.1 193.1 194.1 195.1 196.1 197.1 198.1 198.2 199.1 200.1 201.1 201.2 202.1 203.1 204.1 205.1 206.1 209.1 210.1 211.1 212.1 213.1 214.1 214.2 214.3 215.1 215.2 215.3 216.1 216.2 217.1 217.2 218.1 219.1 220.1
Privacy Policy INTRODUCTION Gatamo-International Trade and Service Ltd. (seated at: 7 Széchenyi square, 1051 Budapest, Company Registration Number: 01-09-303803, Tax Number: 261-358896-2-41) (hereinafter referred to as ” Data Controller, Data Processor”) hereby agrees to the present Policy. Pursuant to REGULATION No. 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of April 27, 2016, on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Regulation (EC) No 95/46 (General Data Protection Regulation), we hereby provide the following information. The present Privacy Policy shall govern the data management of the following websites: Amendments to the present Policy shall become effective upon their publication at the aforementioned website. DATA CONTROLLER AND CONTACT INFORMATION Name: Gatamo-International Trade and Service Ltd. Central Office: 7 Széchenyi square, 1051 Budapest E-mail: marketing@gatamo.com DEFINITION OF TERMS Personal Data: Any and all data related to an identified or identifiable natural person (“Data Subject”); a natural person may be identified, directly or indirectly, with special regards to one or more identifiers such as his/her name, number, location data, online identifier or identifiers related to the physical, physiological, genetic, intellectual, economic, cultural or social identity of a natural person; Data Processing: Any and all operations or sum of operations performed in an automated or non-automated way regarding personal data or data files, such as their collection, gathering, systemization, partition, storage, transformation or modification, query, inspection, use, communication, distribution or other forms of their publication, alignment or interconnection, restriction, deletion or destruction; Data Controller: A natural or legal person, public authority, agency or any other body that determines the purposes and means of processing personal data on its own or jointly with other entities; should the purposes and means of data processing be defined under EU law or national law of a member country, the data controller or the specific aspects regarding the designation of the data controller may also be defined under EU law or national law of a member country; Data Processor: A natural or legal person, public authority, agency, or any other body that processes personal data on behalf of the Data Controller; 5. “Recipient”: a natural or legal person, public authority, agency or any other body to which the personal data is disclosed, regardless of whether or not they are third parties. Public authorities with access to personal data under an individual assessment in accordance with the relevant provisions of EU law or national law shall not be considered recipients; the processing of such data by these public authorities shall be in compliance with the applicable data protection rules according to the purposes of data processing; Consent of Data Subject: A voluntary, explicit, and unambiguous declaration of the Data Subject’s will, based on adequate informing by expressing his consent to the processing of personal data that he is the subject of in a way that stipulates such pertinent declaration or consent without reasonable doubt; Personal Data Breach: Any damage to security resulting in accidental or unlawful destruction, loss, alteration, disclosure or unauthorized access to personal data transmitted, stored, or otherwise processed. PRINCIPLES OF PERSONAL DATA PROCESSING Any and all personal data: - shall be processed lawfully and fairly in a way that is transparent to the Data Subject (“lawfulness, fairness and transparency”); - shall be collected following a specified, unambiguous, and legitimate purpose and shall not be processed in a way incompatible with these purposes; pursuant to Article 89, Section (1), further data processing for purposes of public archiving, scientific, and historical research purposes or statistical purposes (“purpose limitation”) shall not be considered incompatible with the original purpose; - shall be appropriate and relevant to the purposes of data processing while being limited to the data necessary (“data minimisation”); - shall be accurate and up-to-date, if necessary; any and all reasonable measures shall be taken for the immediate deletion or correction of inaccurate personal data for the purposes of data processing (“data accuracy”); - shall be stored in a way that enables the identification of the Data Subjects only for the time needed to achieve the purposes of personal data processing. Any storage of personal data for an extended period of time may only take place, should the personal data be processed for purposes of public archiving, scientific and historical research purposes, or statistical purposes as stipulated under Article 89, Section 1, considering the rights and freedoms of Data Subjects and their protection and subject to the implementation of appropriate technical and organizational measures (“storage limitation”); - shall be managed in a way that ensures adequate security of personal data, including the protection against unauthorized or unlawful use, unintentional loss, destruction, or corruption of data by the implementation of appropriate technical or organizational measures (“integrity and confidentiality”). The Controller shall be responsible to ensure compliance with the aforementioned, as well as to demonstrate such compliance (“accountability”). DATA PROCESSING, MESSAGE SENDING, CONNECTION ESTABLISHMENT - Nature of data collection, scope and purpose of data processed: - Data Subjects: Any and all subjects of messages sent/inquiring through the website. - Data processing duration, deadline of data deletion: The data processing is performed until the matter has been resolved. - Identity of potential data controllers authorized to gain access to personal data: Personal data may be handled by the data controller in compliance with the aforementioned principles. - Description of rights of Data Subjects regarding the data processing: - The Data Subject may request access to personal data related to him/her as well as their correction, deletion, or limitation from the data controller. - The Data Subject may object to the processing of such personal data. - The Data Subject has the right to data transferring and to withdraw his/her contribution at any time. - You may initiate the deletion or modification of your personal data in the following ways: - By post to 1054 Budapest, Alkotmány street 16. - Via e-mail at the e-mail address marketing@gatamo.com - Legal basis for data processing: the consent of the Data Subject pursuant to Article 6, Section (1) subsection (a) of the Information Act 5. Section (1) - We hereby inform You that - the data processing shall be based on Your consent. - You are required to provide personal data in order for us to be able to respond to the message - failure to provide data prevents us from fulfilling Your request as a consequence. CONTRACTED DATA PROCESSORS Hosting Provider - Activity performed by a data processor: Hosting Service - Name and contact information of the data processor: Name: Gatamo-International Trade and Service Ltd. E-mail: marketing@gatamo.com Mailing Address: 7 Széchenyi square, 1051 Budapest - Nature of data processing and the scope of data processed: Any and all personal data provided by the Data Subject. - Data Subjects: Any and all Data Subjects using the website. - Data processing purpose: Availability and proper operation of the website. - Data processing duration, deadline of data deletion: Until the termination of the agreement, concluded between the Data Controller and the Hosting Provider, or the submission of a deletion request by the Data Subject to the hosting service provider. - Legal basis for data processing: the User’s consent pursuant to the Information Act 5. Section (1), Article 6 subsection (a), and Article 13/A of Act No. CVIII. of 2001 on certain aspects of electronic commercial services and information community services Section (3). PROCESSING OF COOKIES - Nature of data processing and the scope of data processed: Unique identification number, dates and times - Data Subjects: Any and all Data Subjects visiting the website. - Data processing purpose: Identification of users and tracking of visitors. - Data processing duration, deadline of data deletion: - Identity of potential data controllers authorized to gain access to personal data: The data controller does not process any personal data by the use of cookies. - Description of rights of Data Subjects regarding the data processing: The Data Subjects may delete the cookies from the browser, usually by visiting the Privacy Protection section of the Tools/Preferences menu. - Legal basis for data processing: No consent of the Data Subject is required, should the sole purpose of the use of cookies be to provide communication services through an electronic communication network or if it is essential to the service provider to provide services related to the information community explicitly requested by the subscriber or user. USE OF GOOGLE ADWORDS CONVERSION TRACKING - The online ad program “Google AdWords”, as well as the Google conversion tracking feature within its framework, shall be used by the data controller. Google conversion tracking is provided as an analytics service of Google Inc. (1600 Amphitheater Parkway, Mountain View, CA 94043, USA; “Google”). - When a user reaches a website through a Google ad, a conversion tracking cookie is be placed on his/her computer. Such cookies have limited validity and do not contain any personal data, therefore they do not allow for the User to be identified by them. - When the user browses certain pages of the website while the cookie has not yet expired, both Google and the data controller may see that the User clicked on the ad. - Every Google AdWords customer receives a different cookie, therefore it is not allowed for them to be tracked through the AdWords clients’ websites. - The data – obtained through the use conversion tracking cookies – are designed to produce conversion statistics for customers choosing the services of AdWords conversion tracking. Customers are thus informed about the number of users clicking on their ad and subsequently redirected to the conversion-tagged page. However, they shall not gain access to any data that could identify any user. - Should You not wish to participate in the conversion tracking, You may decline this option by disabling the placing of cookies into your browser. Upon this case, You shall not be included under the conversion tracking statistics. - For more information and to reach Google’s Privacy Policy, please visit www.google.de/policies/privacy/ USING GOOGLE ANALYTICS - The present website uses the Google Analytics application, a web analytics service of Google Inc. (“Google”). Google Analytics uses “cookies”, i.e. text files, which are placed on Your computer to help analyze the use of a website visited by the User. - The data created by the use of cookies related to the website used by the User are usually placed in and stored at one of Google’s US servers. By activating the IP anonymization on the website, Google abbreviates the IP address of the User within the EU member countries, or in other countries participating in the Agreement on the European Economic Area beforehand. - The transfer of the entire IP address to a Google server in the US and its abbreviation thereat may only be performed in exceptional cases. On behalf of the operator of the present website, Google shall use these data to evaluate the User’s use of the Website, as well as to create reports for the website operator related to the activity of the website, and to perform additional services related to the use of the website and the Internet. - In the framework of Google Analytics, the IP address transmitted by the User’s browser may not be linked to any other Google data of the User. The storage of cookies may be prevented on the User’s side by selecting the correct browser settings; however, please note that not all of the website’s features may be fully available in this case. You may also prevent Google from collecting and processing cookie data related to the use of the website by the User (including your IP address) by downloading and installing the browser plug-in available at the domain listed below. https://tools.google.com/dlpage/gaoptout?hl=hu NEWSLETTERS, DM ACTIVITY - Pursuant to Act No. XLVIII of 2008 on the fundamental terms and limitations of economic advertising activities, Section 6. §, the User may give an explicit and prior consent to the Service Provider to contact him/her with advertisements and other messages by using the contact information submitted at the registration. - The Customer may also, considering the the provisions of the present Policy, consent to the Service Provider’s processing of personal data for the purpose of sending promotional offers. - The Service Provider may not send unsolicited advertisements and the User may, without limitation or cause, unsubscribe from the sending of promotional offers. In this case, the Service Provider shall remove any and all personal data of the User – essential for the sending of promotional offers – from its database and shall not contact the User with further promotional offers. You may unsubscribe from the ads by following the link in the message. - Nature of data collection, scope and purpose of data processed: - Data Subjects: Any and all subscribers signed up for the newsletter. - The purpose of data processing: to send electronic messages (e-mail, sms, push notifications) to the Data Subject, provide information on the current news, products, promotions, new features, etc. - Data processing time, deadline of data deletion: data shall be processed until the consent statement is withdrawn, i.e. until the unsubscription. - Identity of potential data controllers authorized to gain access to personal data, recipients of personal data: Personal data may be handled by the sales and marketing staff of the Data Controller, in compliance with the aforementioned principles. - Description of rights of Data Subjects regarding the data processing: - The Data Subject may request access to personal data related to him/her as well as their correction, deletion, or limitation from the data controller, - and may object to the processing of such personal data, as well as - the right to data transferring and to withdraw his/her contribution at any time. - The Data Subject may initiate the proceedings to access of his/her personal data, their deletion, modification, limitation of their use, their transferability and object against the processing of your personal data in the following ways: - By post to 1054 Budapest, Alkotmány street 16. - Via e-mail at the e-mail address marketing@gatamo.com. - The Data Subject may unsubscribe from the newsletter free of charge at any time. - Legal basis for data processing: the consent of the Data Subject pursuant to Article 6, Section (1) subsection (a) of the Information Act. Section (1), and Act No. XLVIII of 2008 on the fundamental terms and limitations of economic advertising activities, Article 6. Section § (5): The advertiser, the advertisement provider or the publisher of the advertisement – in a scope specified under the consent – shall keep a database of the personal data of any and all persons consenting to their terms. The data included in the pertinent database – related to the recipient of the advertisement – may only be processed pursuant to the statement of consent, until such consent is withdrawn, and may only be transferred to a third party with the prior consent of the Data Subject. - We hereby inform You that - the data processing shall be based on Your consent. - You shall submit Your personal data in order to be eligible to receive a newsletter from us. - Failure to submit your personal prevents us from sending You a newsletter. SOCIAL MEDIA WEBSITES - Nature of data collection and the scope of data processed: Registered user name and public profile pictore of the User at social media websites such as Facebook / Google+ / Twitter / Pinterest / Youtube / Instagram etc. - Data Subjects: Any and all Data Subjects registered on Facebook / Google+ / Twitter / Pinterest / Youtube / Instagram etc. social media websites and who “liked” the website. - Purpose of data collection: Sharing or “liking” the website’s content, products, promotions, or the website itself on social media pages. - Duration of data processing, Deadline of data deletion, Identity of potential data controllers authorized to gain access to personal data, Description of rights of Data Subjects regarding the data processing: The Data Subject may receive more information regarding the source of the data, their processing, nature of submission, and legal basis thereto at the pertinent social media websites. Data processing takes place at the social media websites; therefore, the regulations of the respective social media websites shall apply regarding the duration and nature of data processing, as well as the data deletion and modification options. - The legal basis for data processing: the voluntary consent of the Data Subject to the processing of his/her personal data at social media websites. COMPLAINT MANAGEMENT - Nature of data collection, scope and purpose of data processed: - Data Subjects: Any and all Data Subjects buying the product and exercising his/her right to file a quality complaint or a claim. - Data processing duration, deadline of data deletion: The data processing shall continue until the end of the guarantee/warranty period stipulated under the contract. Copies of the complaint minutes, transcripts, and replies to the pertinent complaint raised, pursuant to Act No. CLV of 1997 on consumer protection, Article 17/A. Section (7) shall be retained for 5 years. - Identity of potential data controllers authorized to gain access to personal data, recipients of personal data: Personal data may be handled by the sales and marketing staff of the Data Controller, in compliance with the aforementioned principles. - Description of rights of Data Subjects regarding the data processing: - The Data Subject may request access to personal data related to him/her, as well as their correction, deletion, or limitation from the data controller, - may object to the processing of such personal data, as well as - the right to data transferring and to withdraw his/her consent at any time. - The Data Subject may initiate the proceedings to access his/her personal data, their deletion, modification, limitation of their use, their transferability and object against the processing of your personal data in the following ways: - By post to 1054 Budapest, Alkotmány street 16. - Via e-mail at the e-mail address marketing@gatamo.com. - Legal basis for data processing: consent of the Data Subject pursuant to Article 6, Section (1) subsections (b) and (c), of the Information Act 5. Section (1), Act No. CLV. of 1997 on consumer protection, Article 17/A. Section (7). - We hereby inform You that - The submission of personal data is based on a contractual obligation. - The processing of personal data constitutes a precondition to the conclusion of the contract. - You shall provide Your personal data in order to enable us to manage your complaint. - Failure to submit Your personal data prevents us from managing Your complaint delivered to us as a consequence. DATA TRANSFER TO THE SUBCONTRACTOR - Nature of data processing and the scope of data processed: Contact name, contact phone number, contact email address, delivery address. - Data Subjects: Any and all Data Subjects ordering a product from the data controller. - Data processing purpose: Performance of subcontracting tasks. - Data processing duration, deadline of data deletion: The data processing shall last until the termination of the agreement between the Data Controller and the subcontractor, or until the submission of the request for deletion by the Data Subject to the subcontractor. - Identity of potential data controllers authorized to gain access to personal data: Personal data may be processed by the following entities, in compliance with the aforementioned principles: Name: Gatamo-International Trade and Service Ltd. Central Office: 7 Széchenyi square, 1051 Budapest E-mail: marketing@gatamo.com - Legal basis for data processing: consent of the Data Subject pursuant to Article 6, Section (1) subsections (b) and (c), of the Information Act 5. Section (1). - Description of rights of Data Subjects regarding the data processing: - The Data Subject may request access to personal data related to him/her as well as their correction, deletion, or limitation from the data controller, - and may object to the processing of such personal data, as well as - the right to data transferring and to withdraw his/her consent at any time. CUSTOMER RELATIONS AND OTHER DATA PROCESSING - Should the Data Subject have any questions that may arise during the use of the Data Controller’s services or encounter any problems, he/she may contact the Data Controller via the means listed at the website (telephone, e-mail, social media pages, etc.). - The Data Processor shall delete the received e-mails, messages, data provided over the phone, through Facebook, etc., along with the name and email address of the Data Subject as well as other voluntarily submitted personal data, by no later than 2 years from the date of disclosure. - We shall inform You regarding data processing operations not listed under the present Policy at the submission of such pertinent data. - The Service Provider shall provide information, communicate or transfer data, or provide documentation on the basis of a special authority request or in case of a request of other bodies pursuant to the relevant provisions of the applicable law. - Upon such cases, the Service Provider shall – having indicated the exact purpose and scope of the data – disclose personal data only limited to the necessary scope needed to fulfill the aim of the pertinent request. DATA SUBJECT RIGHTS - Right of access You shall be entitled to receive feedback from the Data Controller regarding Your personal data being processed and, if such processing is in progress, to be granted access to Your personal data and the data stipulated under the Directive. - Right to Rectification You shall be entitled to request the Data Controller to rectify any inaccurate personal data related to You without undue delay. Considering the purpose of data processing, you shall be entitled to request the supplementation of incomplete personal data – including but not limited to, by means of a supplementary statement. - Right to Deletion You shall be entitled to request that the Data Controller shall, without undue delay, delete any and all personal data related to You, and the data controller is obliged to delete any and all personal data related to You without undue delay, should specific conditions be fulfilled. - Right of Erasure (Right to “be forgotten”) If the Data Controller has disclosed the personal data and is required to erase it, he shall take any and all reasonable measures, considering the accessible technical measures and the cost of their implementation – including any and all technical measures – in order to inform the Data Controllers processing the pertinent data that You have requested the erasure of links redirecting to the personal data in question, or of their copies, or of their duplicates. - Right to Restriction of Data Processing You shall be entitled to request that your Data Controller restricts your data processing, should one of the following conditions be met: - You dispute the accuracy of your personal data – upon this case, the restriction extends over a period of time that allows for the data controller to verify the accuracy of personal data; - the data processing is unlawful, and You are opposed to the erasure of the data, requesting to restrict their processing instead; - the Data Controller no longer needs the pertinent personal data for the purposes of data processing, but You request them for the purpose of submitting, enforcing, or protecting Your legal claims; - You have objected against the data processing – upon this case, the restriction extends over a period of time that allows to establish whether the legitimate reasons of the data controller prevail over your legitimate reasons. - Right to Data Portability You shall be entitled to receive personal data related to You that is disclosed by a Data Controller in a fragmented, widely used, computer-readable format, as well as to transfer such data to another data controller without the interference of the Data Controller by whom these personal data have been disclosed to You (…) - Right to Object You shall be entitled to object to the processing of your personal data for any reason relating to your own situation at any time (…), including the profiling based on the aforementioned provisions. - Right to Object under Direct Business Acquisition If Your personal data is processed for the purposes of direct business acquisition, You shall be entitled to object against the processing of any personal data relating to such processing at any time, including the profiling, should it be related to the direct business acquisition. Should You object to personal data processing for direct business acquisition purposes, Your personal data may no longer be processed for the pertinent purpose. - Automated Decision-Making in Individual Cases, including Profiling You shall be entitled to exclude the scope of any decision, as well as its effects, based solely on automated data processing – including the profiling – which would give rise to legal or other significant consequences related to You. The previous paragraph shall not apply, should the decision be: - essential for the conclusion or fulfillment of a contract between You and the Data Controller; - allowed to be made under EU law or the law of its member countries applicable to the Data Controller, the relevant provisions of which also stipulate proper measures to protect your rights and freedoms and legitimate interests; or - based on your explicit consent. DEADLINE OF TAKING MEASURES The Data Controller shall inform You of any measures taken in response to the aforementioned requests without undue delay, in any case by no later than 1 month after the delivery of the request. This deadline may be extended to a period of 2 months, if applicable. The Data Controller shall inform You regarding the extension of the deadline, along with the indication of the cause of the delay, by no later than 1 month after the receipt of the request. Should the Data Controller fail to take measures upon Your request, he shall notify You without undue delay, by no later than 1 month after the receipt of the request, regarding the reasons of failure to take measures, as well as whether you may file a complaint with a supervisory authority and exercise Your right to appeal in a court of law. SECURITY OF DATA PROCESSING The Data Controller and the Data Processor shall take appropriate technical and organizational measures to consider the current state of science and technology and the costs of implementation, the nature, scope, circumstances and objectives of data processing, and the risk of varying probability potentially affecting the natural persons’ rights and freedoms to guarantee an adequate level of data security, including, but not limited to, where appropriate: - the pseudonymization and encryption of personal data; - to ensure the integrity, availability, and confidentiality of systems and services, as well as their continued privacy used for personal data processing; - the ability to restore access to personal data and the availability of data within reasonable time upon the case of physical or technical incidents; - the procedure for the regular testing, assessment, and evaluation of the effectiveness of the technical and organizational measures taken to guarantee the security of data processing. Data security measure of the Data Controller: Continuous automatic backup from the server to the Google Drive service INFORMING THE Data Subject OF DATA SECURITY BREACHES If the data security breach is likely to pose a high risk to the rights and freedoms of natural persons, the Data Controller shall inform the Data Subject of the data security breach without undue delay. Information provided to the Data Subject should be clearly and easily understood and the nature of the data security breach shall be disclosed, along with the name and contact details of the Data Protection Officer or other contact person providing additional information; the potential consequences of a data security breach shall be described; measures taken or planned by the Data Controller to remedy the data security breach, including, where appropriate, measures to mitigate any adverse consequences of a data security breach shall be disclosed, as well. The Data Subject does not need to be informed, should any of the following conditions be met: - the Data Controller has implemented appropriate technical and organizational protection measures and has applied those measures to the data affected by the data security breach, in particular, measures – such as the use of encryption – that make it impossible for unauthorized persons to gain access to decypher the pertinent personal data; - following the data security breach, the Data Controller has taken further measures to ensure that the high-risk factors potentially affecting the rights and freedoms of the Data Subject shall not reoccur in the future; - providing information would require disproportionate effort. Upon such cases, the Data Subjects shall be informed by means of publicly disclosed information, or a similar measure shall be taken to ensure that such informing of the Data Subjects is performed equally effectively. Should the Data Controller have not yet informed the Data Subject of the data security breach, the supervisory authority may itself, after having considered whether the privacy incident is likely to pose a high risk, inform the Data Subject. DATA SECURITY BREACH REPORTING TO THE COMPETENT AUTHORITIES The data security breach shall be reported by the Data Controller to the supervisory authority competent as stipulated under Article 55 without undue delay and, if possible, by no later than 72 hours after the data security breach has been acknowledged by the Data Controller, unless the data security breach is unlikely to pose a risk to the rights and freedoms of natural persons. Should the report not be submitted within 72 hours as stipulated above, the reasons explaining the delay shall also be attached thereto. COMPLAINT OPTIONS You may lodge a complaint against a potential breach of law of the Data Controller with the National Data Protection and Information Authority: National Data Protection and Information Freedom Authority 1125 Budapest, Szilágyi Erzsébet fasor 22 / C. Mailing address: 1530 Budapest, Mailbox: 5. E-mail: ugyfelszolgalat@naih.hu CONCLUSION During the preparation of the present Policy, we have observed the following legal acts and regulations: - REGULATION (EEC) No. 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of April 27, 2016, on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Regulation (EC) No 95/46 (General Data Protection Regulation) law on information self-determination and freedom of information (hereinafter referred to as: Information Act) - Act No. CVIII of 2001 on certain aspects of electronic commercial services and information community services (with specific regards 13/A. Article) - Act No. XLVII. of 2008 on the prohibition of unfair commercial practices against consumers; - Act No. XLVIII of 2008 on the basic conditions and limitations of commercial advertising activity (with special regards to Article 6.) - Act No. XC of 2005 on the freedom of electronic Information – Act C of 2003 on electronic communications (with special regards to Article 155.) - Opinion No. 16/2011 on the EASA / IAB Recommendation on the best practice of behavior-based online advertising - Recommendation of the National Data Protection and Information Freedom Authority on the data protection requirements of prior informing - REGULATION No. 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Regulation (EC) No 95/46 (General Data Protection Regulation).
1.1 2.1 3.1 4.1 5.1 6.1 7.1 8.1 9.1 10.1 11.1 12.1 13.1 14.1 15.1 16.1 17.1 18.1 19.1 20.1 21.1 22.1 23.1 24.1 25.1 26.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 33.2 34.1 35.1 36.1 37.1 38.1 39.1 39.2 39.3 39.4 40.1 41.1 42.1 42.2 43.1 43.2 43.3 43.4 44.1 45.1 46.1 47.1 47.2 48.1 48.2 49.1 49.2 50.1 51.1 52.1 53.1 54.1 54.2 55.1 56.1 57.1 57.2 58.1 59.1 60.1 61.1 61.2 61.3 61.4 61.5 61.6 61.7 62.1 62.2 63.1 64.1 64.2 65.1 65.2 65.3 66.1 67.1 67.2 68.1 68.2 69.1 70.1 70.2 71.1 71.2 71.3 71.4 71.5 72.1 73.1 74.1 75.1 75.2 76.1 77.1 78.1 79.1 80.1 81.1 82.1 83.1 84.1 85.1 86.1 87.1 87.2 87.3 87.4 88.1
FOR A RELAXING HOME Pravila privatnosti: – Zaštita osobnih podataka i politika privatnosti Definicije Prema Uredbi (EU) 2016/679 Europskog parlamenta i vijeća od 27. travnja 2016. o zaštiti pojedinaca u vezi s obradom osobnih podataka i o slobodnom kretanju takvih podataka te o stavljanju izvan snage Direktive 95/46/EZ (dalje u tekstu: Opća uredba o zaštiti podataka), osobni podaci su svi podaci koji se odnose na pojedinca čiji je identitet utvrđen ili se može utvrditi („ispitanik”); pojedinac čiji se identitet može utvrditi jest osoba koja se može identificirati izravno ili neizravno, osobito uz pomoć identifikatora kao što su ime, identifikacijski broj, podaci o lokaciji, mrežni identifikator ili uz pomoć jednog ili više čimbenika svojstvenih za fizički, fiziološki, genetski, mentalni, ekonomski, kulturni ili socijalni identitet tog pojedinca. Obrada podataka znači svaki postupak ili skup postupaka koji se obavljaju na osobnim podacima ili na skupovima osobnih podataka, bilo automatiziranim bilo neautomatiziranim sredstvima kao što su prikupljanje, bilježenje, organizacija, strukturiranje, pohrana, prilagodba ili izmjena, pronalaženje, obavljanje uvida, uporaba, otkrivanje prijenosom, širenjem ili stavljanjem na raspolaganje na drugi način, usklađivanje ili kombiniranje, ograničavanje, brisanje ili uništavanje. Pravna osnova obrade podataka Pravne osnove za zakonitu obradu osobnih podataka sukladno Općoj uredbi o zaštiti podataka i Zakonu o provedbi Opće uredbe o zaštiti podataka su sljedeće: Načela Prilikom obrade osobnih podataka LULL Studio d.o.o. kao voditelj obrade poštuje sljedeća načela: (a) zakonitosti, poštenosti i transparentnosti; (b) ograničavanja svrhe; (c) smanjenja količine podataka; (d) točnost; (e) ograničenje pohrane; (f) cjelovitosti i povjerljivosti; (g) pouzdanosti. Podaci koji se pružaju ispitaniku Kupcu kao ispitaniku se pružaju sljedeće informacije u smislu odredbe čl. 13. Opće uredbe o zaštiti podataka: (a) identitet i kontaktni podaci voditelja obrade: LULL Studio d.o.o., Ulica Augusta Piazze 10, 10000 Zagreb, Hrvatska, [email protected], Tel: 00 385 99 497 5592, (b) kontaktni podaci službenika za zaštitu podataka: [email protected] (c) svrha obrade radi kojih se upotrebljavaju osobni podaci kao i pravna osnova za obradu: izvršavanje ugovora, izvršavanja dostave kupljenog proizvoda, zaštita ključnih interesa ispitanika, dostava newslettera, u svrhu osiguravanja podrške kupcima i marketing (d) primatelji ili kategorije primatelja osobnih podataka: posrednici i/ili suradnici koji su u ugovornom odnosu sa LULL Studio d.o.o. (e) LULL Studio d.o.o. neće dostavljati osobne podatke na teritorij treće zemlje ili međunarodne organizacije, osim uz Vašu izričitu privolu. (f) razdoblje u kojem će osobni podaci biti pohranjeni/kriteriji kojima se utvrdilo to razdoblje: pet godina računajući od dostave osobnih podataka LULL Studio d.o.o. (g) ispitanik ima pravo od LULL Studio d.o.o. zatražiti pristup osobnim podacima i ispravak ili brisanje osobnih podataka ili ograničavanje obrade koji se odnose na ispitanika ili prava na ulaganje prigovora na obradu takvih te prava na prenosivost podataka; (h) ako se obrada temelji na danoj privoli ispitanika, ispitanik je ovlašten u bilo kojem trenutku povući privolu, a da to ne utječe na zakonitost obrade koja se temeljila na privoli prije nego što je ona povučena; (i) pravo je ispitanika podnijeti prigovor nadzornom tijelu; (j) pružanje osobnih podataka nije uvjet nužan za sklapanje ugovora te ispitanik nema obvezu pružanja osobnih podataka i nema posljedica ako se takvi podaci ne pruže, ali nedostavljanje potrebnih podataka može utjecati na mogućnost i/ili kvalitetu ispunjenja ugovora; (k) ne postoji automatizirano donošenje odluka. Podaci koji se odnose na djecu Sukladno Općoj uredbi o zaštiti podataka djeca zaslužuju posebnu zaštitu u svakom pogledu, pa tako i u pogledu zaštite osobnih podataka. Sukladno članku 19., stavku 1. Zakona o provedbi Opće uredbe o zaštiti podataka, djecom se smatraju sve osobe mlađe od 16 godina, te LULL Studio d.o.o. ne traži niti prikuplja osobne podatke djece ili o njima bez suglasnosti nositelja roditeljske odgovornosti. Stoga će LULL Studio d.o.o. poduzeti sve razumne napore, kako bi podatke koje dobije od djece obrađivalo samo uz suglasnost nositelja roditeljske odgovornosti. Ako LULL Studio d.o.o. sazna da su mu poslani osobni podaci djece, ali bez valjane suglasnosti nositelja roditeljske odgovornosti, LULL Studio d.o.o. će u razumnoj mjeri nastojati učiniti sljedeće: Kada i kako Lull.hr prikuplja podatke korisnika? Osobni podaci se prikupljaju izravno od pojedinca – podaci dostavljeni za potrebe sklapanja ili izvršenja ugovora, kreiranjem korisničkog računa na Internet stranici LULL Studio d.o.o., neposredno, telefonskim razgovorom sa pojedincem. LULL Studio d.o.o. prikuplja osobne podatke Kupaca samo u mjeri koji su nužni za ispunjenje svoje obveze sukladno zahtjevima Kupca, odnosno za koje postoji legitimni interes te za koje ima privolu Kupca u svrhu informiranja, podrške kupcima i marketing u mjeri u kojoj je to važno za poslovanje LULL Studio d.o.o.. LULL Studio d.o.o. se obvezuje štititi osobne podatke Kupaca u skladu sa Općom uredbom o zaštiti osobnih podataka te se obvezuje da osobne podatke neće ni na koji način ustupiti trećim osobama bez pristanka Kupca (osim nužnih podataka za koje postoji legitimni interes u svrhu izvršavanja dostave kupljenog proizvoda) niti će ih koristiti u neodređene svrhe. Obrada osobnih podataka koja se temelji na legitimnom interesu ili predstavlja ugovornu obvezu obavlja se održavanjem najviši standarda sigurnosti i poslovanja. Kupac u svakom trenutku može izjaviti prigovor na obradu svojih osobnih podataka na temelju svoje specifične situacije. Kupac ima pravo zatražiti nadopunu, ispravak ili izmjenu netočnih osobnih podataka. Od ovog se izuzimaju slučajevi u kojima je LULL Studio d.o.o. po valjanom nalogu ovlaštenih državnih tijela, u skladu sa zakonom, dužan dostaviti ili dopustiti uvid u osobne podatke Kupaca. Podaci koje prikuplja LULL Studio d.o.o. su ime, prezime, adresa dostave, broj telefona i adresa e-pošte. Prilikom kupovine u Lull.hr fizičkoj i internetskoj trgovini tražimo od Vas određene osobne podatke koje su nužne za ispunjenje usluge i kupovinu. Pružanje osobnih podataka u svrhu prodaje nužno je za izvršavanje ugovora te ako ih ne pružite, to će utjecati na ispravno izvršenje ugovora ili ga čak onemogućiti. Tako prikupljene podatke koristimo samo za obradu traženih informacija i upita korisnika te u svrhu osiguravanja kvalitetnog korisničkog iskustva. Podaci su dostupni samo djelatnicima kojima su nužni za ispunjenje ugovora. Kupci i korisnici internetske stranice www.lull.hr suglasni su da u skladu sa Općom uredbom o zaštiti osobnih podataka te u skladu s traženim upitom obrađujemo osobne podatke te prihvaćaju sve rizike koji nastaju korištenjem internetske stranice. Informatički sustav koji koristi LULL Studio d.o.o. zaštićen je tehničkim mjerama od neovlaštenog pristupa, izmjene, širenja, gubljenja i brisanja podataka Kupaca. LULL Studio d.o.o. prikuplja e-mail adrese korisnika koje koristi za slanje newslettera odnosno elektroničkih poruka koje sadrže promotivne poruke, ponude i vijesti iz svijeta mobilne tehnologije. LULL Studio d.o.o. uz privolu Kupca može koristiti osobne podatke za informiranje o novim i akcijskim proizvodima te dostavu promotivnih materijala, newslettera te unapređenja odnosa s Kupcima. Ukoliko pristup podacima u svrhe marketinške obrade imaju treći pružatelji usluga, oni su detaljno opisani u ovim Uvjetima. LULL Studio d.o.o. je voditelj obrade osobnih podataka u skladu sa zakonom i propisima o zaštiti osobnih podataka. LULL Studio d.o.o. kao voditelj obrade osobnih podataka određuje svrhu i sredstva obrade osobnih podataka i odgovorna je za čuvanje i korištenje osobnih podataka u papirnatom i/ili elektronskom obliku. Temeljem članka 37. Opće uredbe o zaštiti podataka LULL Studio d.o.o. kao voditelj obrade osobnih podataka, imenovao je službenika za zaštitu osobnih podataka kojeg možete kontaktirati putem e-adrese [email protected] U slučaju povrede osobnih podataka LULL studio d.o.o. bez nepotrebnog odgađanja i, ako je izvedivo, najkasnije 72 sata nakon saznanja o toj povredi, izvješćuje nadzorno tijelo nadležno o povredi osobnih podataka, osim ako nije vjerojatno da će povreda osobnih podataka prouzročiti rizik za prava i slobode pojedinaca. Ako izvješćivanje nije učinjeno unutar 72 sata, mora biti popraćeno razlozima za kašnjenje. Tko su subjekti s kojima Lull.hr može dijeliti osobne podatke? Prilikom kreiranja Lull.hr računa na Lull.hr trgovini potrebno je unijeti svoje podatke (e-mail, ime i prezime). Prilikom prijave putem društvenih mreža, odnosno Google i Facebook računa, LULL Studio d.o.o. ne zadržava podatke prikupljene takvom prijavom. Lull.hr surađuje s pružateljima usluga trećim stranama kako bi se mogle provesti aktivnosti slanja e-pošte, oglašavanja i analiziranja upotrebe naših web mjesta i aplikacija te praćenja učinkovitosti kampanja. Osobne podatke dijelimo samo u onoj mjeri potrebnoj za izvršavanje usluge u naše ime. U nastavku možete provjeriti tko su davatelji usluga trećih strana potrebnih za suradnju: https://www.google.com/analytics/terms/gb.html, Opći pregled o načelima sigurnosti i privatnosti Google Analytics: https://support.google.com/analytics/answer/6004245?hl=en, kao i Googleova Pravila privatnosti: https://policies.google.com/privacy?hl=en. Ove internetske stranice upotrebljavaju Google Analytics za analizu protoka posjetitelja neovisno o vrsti uređaja, a koji se temelji na korisničkom identifikacijskom broju (ID). Možete onemogućiti praćenje Vašeg korištenja više uređaja u svom Google računu pod „Moje informacije“ („My information“), „Osobne informacije“ („Personal information“). Pristup bazi Kupaca s osobnim podacima Kupaca uz LULL Studio d.o.o. u svrhu sklapanja ili izvršavanja ugovora, odnosno kupovine u Lull.hr trgovini i dostavu proizvoda imaju: • Plavi pixel d.o.o., specijalizirana tvrtka za izradu web trgovina s kojom LULL Studio d.o.o. ima sklopljen ugovor o zaštiti podataka. Politika kolačića „Kolačić“ je dio informacija spremljenih na računalo, mobitel ili tablet korisnika (dalje u tekstu: „uređaj“), koje mogu biti dostavljene neposredno od strane internetske stranice koju posjetite (kolačići od prve strane) ili u suradnji i za potrebe internetske stranice od treće strane (kolačići treće strane). Kolačići u pravilu spremaju postavke korisnika, postavke za internetsku stranicu i sl. Nakon što ponovno korisnik otvori internetsku stranicu, internetski preglednik korisnika šalje natrag kolačiće koji pripadaju ovoj web stranici. To omogućuje stranici da prikaže informacije prilagođene potrebama korisnika. Kolačići mogu imati širok raspon informacija, uključujući i dio osobnih informacija. Takve informacije mogu biti spremljene jedino ako to korisnik omogući. Sama internetska stranica ne može dobiti pristup informacijama koje im korisnik ne dopusti te ne mogu pristupiti niti jednoj drugoj datoteci na računalu korisnika. Kako bi stranice Lull.hr ispravno radile, one moraju na računalo korisnika spremiti malenu količinu kolačića (Cookies). Prema Općoj uredbi o zaštiti podataka, Zakonu o provedbi Opće uredbe o zaštiti podataka i Zakonu o elektroničkim komunikacijama, LULL Studio d.o.o. prije spremanja Cookiea mora zatražiti pristanak (privolu) korisnika. Ukoliko korisnik ne pristane na pohranu kolačića postoji mogućnost da stranica neće moći koristiti neke od funkcionalnosti koje daje LULL Studio d.o.o. web trgovina. Zadaća kolačića kojem ste dopustili da se pohrani na Vaše računalo je spremanje Vaših postavki, postavki web stranice, Vašeg preferiranog jezika ili adrese. Kada nakon nekog vremena opet posjetite istu stranicu internet preglednik kojim se koristite šalje informacije prilagođene Vašim potrebama. Ovisno o definiranoj zadaći kolačići spremaju širok spektar informacija koji između ostalih uključuju i osobne podatke. Međutim, isključivo vi odlučujete koje informacije će kolačići spremati. U postavkama Vašeg internet preglednika možete sami birati hoćete li zahtjeve za spremanje kolačića odobriti ili odbiti. Onemogućavanjem kolačića možda nećete moći koristiti neke od funkcionalnosti na stranicama koje posjećujete. Stalni kolačići ostaju na računalu nakon zatvaranja programa internet preglednika. Stalni kolačići ostat će na računalu ili mobilnom uređaju danima, mjesecima, čak i godinama te imaju svrhu pohraniti stalne podatke kao što su npr. korisničko ime i lozinka da se ne morate svaki puta iznova prijavljivati. Privremeni kolačići nestaju s računala nakon što zatvorite internet preglednik. Uz njihovu pomoć se pohranjuju privremeni podaci kao što su podaci koje dajete kad ste u online kupnji. Kolačići od prve strane mogu biti stalni ili privremeni, a pohranjuju podatke koje ćete ponovo koristiti prilikom sljedećeg posjeta stranicama sa kojih su pohranjeni na Vaše računalo. Kolačići treće strane ili tzv. reklamni kolačići pohranjuju se na Vaše računalo ako koristite reklame i oglase na stranici koju posjećujete a ona vas preusmjeri na treću stranu. Ovaj način služi za praćenje korištenja Interneta u marketinške svrhe. Lull.hr koristi kolačiće u svrhu poboljšanja korisničkog iskustva, u svrhu funkcioniranja stranice u kontekstu sigurnosti i u svrhu radnji koje posjetitelj stranice odabere samostalno (web forma za slanje poruka ili traženje usluga). Privremeni kolačići se brišu kada napustite internetski preglednik. Njihova jedina svrha je unaprijediti korisničko iskustvo za vrijeme posjete stranici. Stalni kolačići nemaju ograničenja i ostaju u Vašem pregledniku dok ih ručno ne obrišete. Prikupljeni podaci se koriste isključivo u statističke svrhe. Ovo su primjeri trećih strana koje pružaju usluge analize i marketinške obrade podataka Za više informacije o svrsi i opsegu prikupljanja podataka i obradi istih od strane pružatelja dodatka, molimo da pogledate izjave o zaštiti privatnosti ovih pružatelja koji su niže navedeni. Kako korisnici mogu ažurirati, urediti ili obrisati svoje osobne podatke? LULL Studio d.o.o. – internet trgovina. prikuplja podatke korisnika u skladu Općom uredbom o zaštiti osobnih podataka i Zakonom o provedbi Opće uredbe o zaštiti podataka. Svaki korisnik može u svakom trenutku može: LULL Studio d.o.o. može odbiti provođenja zahtjeva ukoliko se time ugrožava privatnost korisnika ili drugih korisnika, ako primjena zahtjeva je suprotna zakonu, u izuzecima radi zaštite javnog interesa (npr. sprječavanje ili otkrivanje zločina), pravnih obveza ili prava i sloboda drugih. Zahtjeve za pristup, ispravljanje ili brisanje podataka možete uputiti na: [email protected]lull.hr ili na adresu sjedišta Ulica Augusta Piazze 10, Zagreb, 10000 Zagreb, Hrvatska. Obrada takvog zahtjeva može biti tehnički i vremenski složen proces te je u složenim slučajevima ili u slučaju većeg broja zahtjeva potrebno duže vrijeme potrebno za obradu podataka o čemu ćemo vas obavijestiti na zakonit i siguran način. Kako čuvamo sigurnost Vaših podataka? U svrhu očuvanja sigurnosti, integriteta i dostupnosti osobnih podataka kupaca, podatke osiguravamo nizom sigurnosnih mjera koje uključuju enkripciju, autentifikaciju i strogo ograničeni pristup podacima. Neke od mjera koje koristimo uključuju: Sigurnosne mjere koje se provode imaju za cilj: Koliko dugo zadržavamo Vaše osobne podatke? Osobne podatke pohranjujemo i obrađujemo onoliko dugo koliko je potrebno za izvršenje određene legitimne svrhe, osim ako važećim propisima nije za pojedinu svrhu predviđeno duže vrijeme čuvanja. U slučaju davanja privole za marketing, podatke čuvamo pet godina računajući od dostave osobnih podataka LULL Studio d.o.o. Povlačenje privole ne utječe na zakonitost obrade na temelju privole prije njezina povlačenja. Povlačenje dostavlja se u pisanom obliku. Osobni podaci koji više nisu potrebni se ili nepovratno anonimiziraju ili se uništavaju na siguran način. Kontakti