http___lull.hr_politika-o-privatnosti__1.xml
1.1 2.1 2.2 3.1 4.1 5.1 6.1 7.1 8.1 9.1 10.1 11.1 12.1 13.1 14.1 15.1 16.1 16.2 16.3 16.4 16.5 17.1 17.2 17.3 17.4 17.5 17.6 17.7 17.8 17.9 18.1 18.2 18.3 18.4 18.5 19.1 20.1 20.2 21.1 22.1 22.2 23.1 23.2 24.1 25.1 26.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 33.2 33.3 33.4 33.5 33.6 34.1 35.1 35.2 35.3 36.1 36.2 37.1 38.1 39.1 40.1 41.1 42.1 43.1 43.2 44.1 44.2 45.1 45.2 45.3 46.1 46.2 46.3 47.1 48.1 48.2 48.3 49.1 50.1 51.1 52.1 52.2 53.1 54.1 54.2 54.3 54.4 54.5 54.6 55.1 55.2 55.3 55.4 55.5 55.6 56.1 56.2 56.3 56.4 56.5 56.6 57.1 58.1 59.1 59.2 60.1 61.1 61.2 61.3 61.4 62.1 62.2 62.3 63.1 64.1 65.1 66.1 67.1 68.1 68.2 69.1 70.1 70.2 71.1 72.1 73.1 74.1 75.1 76.1 77.1 77.2 77.3 78.1 79.1 80.1 81.1 82.1 82.2 83.1 83.2 83.3 83.4 83.5 83.6 84.1 84.2 85.1 86.1 86.2 87.1 88.1 88.2 89.1 89.2 90.1 91.1 92.1 93.1 94.1 95.1 96.1 97.1 98.1 98.2 99.1 99.2 100.1 100.2 101.1 101.2 102.1 102.2 103.1 103.2 104.1 105.1 106.1 106.2 106.3 106.4 106.5 106.6 106.7 107.1 107.2 108.1 109.1 110.1 110.2 110.3 111.1 111.2 111.3 112.1 112.2 113.1 114.1 115.1 116.1 117.1 118.1 118.2 119.1 119.2 120.1 120.2 120.3 120.4 120.5 121.1 121.2 122.1 123.1 123.2 123.3 123.4 123.5 123.6 123.7 123.8 123.9 124.1 125.1 126.1 126.2 127.1 128.1 128.2 129.1 129.2 129.3 129.4 130.1 131.1 132.1 133.1 133.2 134.1 135.1 136.1 137.1 138.1 139.1 139.2 139.3 139.4 139.5 139.6 140.1 141.1 141.2 142.1 142.2 143.1 143.2 144.1 145.1 146.1 147.1 148.1 150.1 151.1 152.1
Data Privacy Policy We are pleased about your interest in our company. Data protection has a very high priority for the SPM GmbH and we take our position as controller within the meaning of the GDPR very seriously. By means of this data privacy policy, our company would like to inform the public in general and you in particular about the type, scope and purpose of the personal data collected, used and processed by us and to inform affected persons about the rights to which you are entitled. This data privacy policy take into account the requirements of the General Data Protection Regulation (GDPR) to be implemented by 25th of May 2018 at the latest, which already came into force on 25th of May 2016, as well as the german national Federal Data Protection Act (BDSG). Definitions Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her. Personal data means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. This includes in particular name, address(es), bank details, e-mail address, telephone or fax number or client IP address. Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. Restriction of processing means the marking of stored personal data with the aim of limiting their processing in the future. Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;. Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law. Third party means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data. Supervisory authority means an independent public authority which is established by a Member State pursuant to Article 51. Handling of personal data and data storage We use personal data in particular for the processing of orders, the delivery of goods and the provision of services as well as the processing of payment. We also use personal data fort he communication with the data subject, to update our data records and to maintain the data subject's customer account. We also use personal data to improve our platform, to prevent or detect misuse, in particular fraud, or to enable third parties to perform technical, logistical or other services on our behalf. The collection, storage and processing of personal data is particularly necessary because this is the only way we can provide the service requested by the data subject. The personal data is stored for the duration of the processing of the order and execution of the contract or to the extent required by legal regulations (e.g. tax regulations). Personal data are used for the justification of the contract, the content design and implementation or settlement of the contract(Art. 6 para. 1 lit. b) GDPR). In addition, personal data will only be processed if we have received the consent of the data subject (Art. 6 para. 1 lit. a) GDPR). This consent will be recorded. Furthermore, personal data will only be processed and collected by default to the extent necessary for the intended purpose. If the processing of the personal data of the data subject is based on a consent, he has the right to revoke this consent at any time. Art. 7 para. 3 GDPR is expressly referred to. Use of the website The use of the (publicy accessible) website of the (publicly accessible) website is generally possible without providing personal data. If parts of the website (e.g. the order process) are dependent on the provision of personal data in order to ensure the function or to be able to fulfil the data subject will be requested to enter the personal data at the appropriate place and can decide on the entry. Insofar as personal data is collected via forms on our pages (e. g. name, address or e-mail address), this is always done on a voluntary basis and with the express consent of the data subject, which will be recorded. You can contact us by e-mail, fax or telephone. We store the data transmitted to us and provided by you for processing the request. Every time a data subject accesses a page of our website and every time a file stored on the website is called up, access data about this process is stored in a log file. Each data record consists of: - the page from which the file was requested, - the name of the file, - the date and time of the request, - the amount of data transferred, - the access status (file transferred, file not found etc. )/http status code, - a description of the type of operating system and web browser used, - the client IP address. - Time zone difference to Greenwich Mean Time (GMT) The data is stored each time a data subject accesses a page of our offer and each time our website is accessed and is deleted as soon as it is no longer required for the purpose of collection or processing. The temporary storage of the personal data is carried out on the legal basis of Art. 6 para. 1 lit. f) GDPR. The legitimate interest lies in the provision of our website. The data subject may object to the processing at any time. Priciple of data avoidance, legality of personal data processing In addition, as far as we can possibly do, personal data will not be collected. In doing so, we adhere to the principle of data avoidance, which we take very seriously. We treat personal data confidentially and in accordance with legal data protection regulations. The scope of the personal data communicated to us is appropriate to the purpose and limited to what is necessary for the purpose of the processing. The processing of personal data is carried out for the performance of the contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. The same applies if the data subject voluntarily contacts us at their own request and initiative. Persons under the age of 16 Persons under the age of 16 should not transmit any personal data to us or consent to such data without the consent of their legal representative(s). Illegal acts by third parties In the case of concrete indications of an illegal action or if we are requested to do so by legal authorities, we will hand over the data available to the competent legal authorities for prosecution. Data transfer The stored data will not be transferred to third parties. The following exceptions apply: For the performance of the contract the data will be transferred to third parties, as far as this is necessary for the purpose of the execution of the contract. This applies in particular to the exchange of data between SPM GmbH and CWF GmbH (Crispenhofener Straße 1, 74679 Weissbach) and in the following cases: For the performance of the contract the data will be transferred on to the shipping company commissioned with the delivery, as far as this is necessary for the delivery of the ordered goods. For the processing of payments, the payment data required for this – insofar as this is necessary with regard to the type of payment and the extent of the transfer – shall be passed on to the credit institution commissioned with the payment and, if applicable, to the commissioned and selected payment service provider. Your personal data will only be processed within the EU. The personal data is also exchanged exclusively for the performance of the contract. The exchange of personal data serves for the performance of the the contract between SPM GmbH and the data subject. This includes in particular the company contact data and the data of the contact person of the contract partner. Data security All personal data on our website is protected by technical and organisational measures against loss, destruction, external access, modification and distribution. We would like to point out that data transmission over the Internet (e g. communication by e-mail or infiltration of the visitor's computer (e.g. the computer of the data subject) by third parties) may have security gaps. A complete protection of data against access by third parties is not possible for us. We are not responsible for personal data collected and processed by third parties. Communication of personal data We collect personal data if the data subject voluntarily provides it in connection with his order, when contacting us (e.g. via contact form or e-mail) and when opening a customer account and the necessary registration. We collect and store all information that the data subject enters on our website or transmits to us in any other way. In addition, personal data will only be processed and collected by default to the extent necessary for the intended purpose. Necessity of data collection, cookies and use of Google (Universal) Analytics for web analysis The processing of personal data is necessary to protect the legitimate interests of the controller. These legitimate interests of the controller generally outweigh the interests of the data subject, because central functions of the website depend on the use of cookies. This also serves the recognition of the browser of the data subject in order to ensure the full functionality of the website for the customer. This ensures the better usability of the website. The cookies on the controller`s website are designed in such a way that the data subject can set via his browser settings whether he accepts cookies or excludes them for certain cases or in general. In this way, the interests of the data subject are protected. The data subject has the right to object at any time to the processing of his personal data in accordance with Art. 6 para. 1 lit. 1 f) GDPR. Art. 21 DSGVO is expressly referred to. This website uses Google Analytics, a web analytics service provided by Google, Inc. (“Google”). Google Analytics uses “cookies”, which are text files placed on the users’ computers, to help the website analyze how users use the site. The information generated by the cookie about the use of the website by users will be transmitted to and stored by Google on servers in the United States. The IP-anonymisation is activated on this website and the users’ IP address will be truncated within the area of Member States of the European Union or other parties to the Agreement on the European Economic Area. Only in exceptional cases the whole IP address will be first transferred to a Google server in the USA and truncated there. The IP-address that your browser conveys within the scope of Google Analytics will not be associated with any other data held by Google. The users can also prevent the collection of data generated by the cookie and data related to their use of the website (including their IP address) as well as the use of such data by Google by downloading and installing the browser plug-in that is available under: http://tools.google.com/dlpage/gaoptout?hl=en An opt-out cookie is stored on your mobile device. In case the users delete the cookies in this browser, they have to click the link again in order to deactivate Google Analytics. The use of Google Maps We use the “Google Maps” component on our website in combination with the so-called “Share function". “Google Maps” is a service of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA, hereinafter “Google.” Each time this component is called up, Google sets a cookie in order to process the user configuration and data when the page with the integrated “Google Maps” component is displayed. As a general rule, this cookie is not deleted by closing the browser, but rather expires after a certain time, as long as it is not previously manually deleted by you. If you do not agree with this processing of your data, you may choose to deactivate the “Google Maps” service and thereby prevent the transfer of data to Google. To do this, you must deactivate the Java Script function in your browser. However, we would like to point out that in this case you will not be able to use “Google Maps” or at least only to a limited extent. The use of “Google Maps” and the information obtained through “Google Maps” is according to Google’s Terms of use http://www.google.de/intl/de/policies/terms/regional.html as well as the additional Terms and Conditions for "Google Maps" https://www.google.com/intl/de_de/help/terms_maps.html Use of reCAPTCHA In order to protect input forms on our site, we use the “reCAPTCHA” service of Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA, hereinafter "Google." By means of this service it can be distinguished whether the corresponding input is of human origin or is created improperly by automated machine processing. To our knowledge, the referrer URL, the IP address, the behaviour of the website visitors, information about the operating system, browser and length of stay, cookies, display instructions and scripts, user input behaviour and mouse movements in the “reCAPTCHA” checkbox are conveyed to “Google.” The IP address provided as part of “reCAPTCHA” is not merged with other data from Google unless you are logged into your Google Account at the time the "reCAPTCHA" plug-in is used. If you want to prevent this transmission and storage of data by “Google” about you and your behaviour on our website, you must log out of “Google” before you visit our site or before using the reCAPTCHA plug-in. The use of the “reCAPTCHA” service is according to the Google Terms of Use: https://www.google.com/intl/de/policies/privacy/. Use of YouTube components with enhanced data protection mode On our website we use components (videos) of YouTube, LLC 901 Cherry Ave., 94066 San Bruno, CA, USA, a company belonging to Google Inc., Amphitheatre Parkway, Mountain View, CA 94043, USA. To this end, we use the “ - enhanced data protection mode - ” option provided by YouTube. When you display a page that has an embedded video, a connection will be made to the YouTube server and the content will appear on the website via a communication to your browser. According to the information provided by YouTube, in “ - enhanced data protection mode -”, data is only transferred to the YouTube server, in particular which of our websites you have visited, if you watch the video. If you are logged onto YouTube at the same time, this information will be matched to your YouTube member account. You can prevent this from happening by logging out of your member account before visiting our website. Further information about data protection by YouTube is provided by Google under the following link: https://www.google.de/intl/de/policies/privacy/ Newsletter The principles concerning the collection and processing of personal data also apply in particular to registration for our newsletter. If the data subject registers for our newsletter, the data stored there by the data subject during registration within the input mask will be transmitted to us. These are your e-mail address, last name, first name, IP address, time and date of registration Reference is expressly made to Art. 6 para. 1 lit. a) and Art. 7 para. 4 GDPR, in particular lit. The data will be deleted as soon as they are no longer necessary to achieve the purpose and the data subject has unsubscribed from the newsletter. According to this, the data is stored for ten years from the last dispatch of information by e-mail for the purpose of proof in the event of queries regarding existing consents, taking into account the statute of limitations The use of the data to receive the information by e-mail can be revoked at any time with effect for the future by unsubscribing from the newsletter. Right to lodge a complaint with a supervisory authority, Art. 77 GDPR Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Art. 78 GDPR. Recht auf Auskunft, Art. 15 DSGVO The data subject has the right tot he following informations: - the purposes of the processing - the categories of personal data concerned - the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations - where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period - the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; - the right to lodge a complaint with a supervisory authority - where the personal data are not collected from the data subject, any available information as to their source - the existence of automated decision-making, including profiling, referred to in Art. 1 and 4 and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Art. 46 relating to the transfer. We provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, we may charge a reasonable fee based on administrative costs. Right to rectification, Art. 16 GDPR The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement. Right to erasure (‘right to be forgotten’), Art. 17 GDPR The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: - the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed - the data subject withdraws consent on which the processing is based according to Art. 6 Abs. 1 lit. a), or Art. 9 Abs. 2 lit. a), and where there is no other legal ground for the processing - the data subject objects to the processing pursuant to Art. 1 and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Art. - the personal data have been unlawfully processed - the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject - the personal data have been collected in relation to the offer of information society services referred to in Art. 8 Abs. 1 GDPR. After complete justification of the contract, the personal data will be blocked for further use and deleted after expiry of the storage periods under tax and commercial law, unless the data subject has expressly consented to further use of his data or we reserve the right to use data beyond this which is permitted by law. Please note that these are legally standardized retention periods. Because of the storage and processon oft he data for the execution of the contract, an objection or premature deletion is not possible Right to restriction of processing, Art. 18 GDPR The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies: Der Betroffene hat das Recht, von uns die Einschränkung der Verarbeitung zu verlangen, wenn eine der folgenden Voraussetzungen gegeben ist: - the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data - the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead - the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims - the data subject has objected to processing pursuant to Art. 1 pending the verification whether the legitimate grounds of the controller override those of the data subject. Notification obligation regarding rectification or erasure of personal data or restriction of processing, Art. 19 GDPR The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with At. 16. Art. 1 and Art. 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it. Right to data portability, Art. 20 GDPR The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where: - the processing is based on consent pursuant to Art. 6 Abs. 1 lit. a) or Art 9 Abs. 2 lit. a) or on a contract pursuant to Art. 6 Abs. 1 lit. b) and - the processing is carried out by automated means. In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible. The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Art. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others. Right to object, Art. 21 GDPR The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on Art. 6 Abs. 1 lit. e) or f) GDPR, including profiling based on those provisions. We will no longer process the personal data unless we demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes. Automated individual decision-making, including profiling, Art. 22 DSGVO The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. This shall not apply if the decision: - is necessary for entering into, or performance of, a contract between the data subject and a data controller; - is necessary for entering into, or performance of, a contract between the data subject and a data controller; - is based on the data subject's explicit consent. Decisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in Art. 9 Abs. 1 GDPR, unless Art. 9 Abs. 2 lit. a) or g) GDPR applies and suitable measures to safeguard the data subject's rights and freedoms and legitimate interests are in place. In the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision. Right to an effective judicial remedy against a controller or processor, Art. 79 GDPR Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation. Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has his or her habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of its public powers. Contact and controller SPM GmbH, represtented by the CEO Stefan Köberlein, Carsten Franz, Jürgen Wolpert, Stephan Kranich Crispenhofener Straße 1 74679 Weissbach Germany Website: http://www.s-p-m.de Email: contact form Date of state: 25.05.2018
1.1 2.1 3.1 4.1 5.1 6.1 7.1 8.1 9.1 10.1 11.1 12.1 13.1 14.1 15.1 16.1 17.1 18.1 19.1 20.1 21.1 22.1 23.1 24.1 25.1 26.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 33.2 34.1 35.1 36.1 37.1 38.1 39.1 39.2 39.3 39.4 40.1 41.1 42.1 42.2 43.1 43.2 43.3 43.4 44.1 45.1 46.1 47.1 47.2 48.1 48.2 49.1 49.2 50.1 51.1 52.1 53.1 54.1 54.2 55.1 56.1 57.1 57.2 58.1 59.1 60.1 61.1 61.2 61.3 61.4 61.5 61.6 61.7 62.1 62.2 63.1 64.1 64.2 65.1 65.2 65.3 66.1 67.1 67.2 68.1 68.2 69.1 70.1 70.2 71.1 71.2 71.3 71.4 71.5 72.1 73.1 74.1 75.1 75.2 76.1 77.1 78.1 79.1 80.1 81.1 82.1 83.1 84.1 85.1 86.1 87.1 87.2 87.3 87.4 88.1
FOR A RELAXING HOME Pravila privatnosti: – Zaštita osobnih podataka i politika privatnosti Definicije Prema Uredbi (EU) 2016/679 Europskog parlamenta i vijeća od 27. travnja 2016. o zaštiti pojedinaca u vezi s obradom osobnih podataka i o slobodnom kretanju takvih podataka te o stavljanju izvan snage Direktive 95/46/EZ (dalje u tekstu: Opća uredba o zaštiti podataka), osobni podaci su svi podaci koji se odnose na pojedinca čiji je identitet utvrđen ili se može utvrditi („ispitanik”); pojedinac čiji se identitet može utvrditi jest osoba koja se može identificirati izravno ili neizravno, osobito uz pomoć identifikatora kao što su ime, identifikacijski broj, podaci o lokaciji, mrežni identifikator ili uz pomoć jednog ili više čimbenika svojstvenih za fizički, fiziološki, genetski, mentalni, ekonomski, kulturni ili socijalni identitet tog pojedinca. Obrada podataka znači svaki postupak ili skup postupaka koji se obavljaju na osobnim podacima ili na skupovima osobnih podataka, bilo automatiziranim bilo neautomatiziranim sredstvima kao što su prikupljanje, bilježenje, organizacija, strukturiranje, pohrana, prilagodba ili izmjena, pronalaženje, obavljanje uvida, uporaba, otkrivanje prijenosom, širenjem ili stavljanjem na raspolaganje na drugi način, usklađivanje ili kombiniranje, ograničavanje, brisanje ili uništavanje. Pravna osnova obrade podataka Pravne osnove za zakonitu obradu osobnih podataka sukladno Općoj uredbi o zaštiti podataka i Zakonu o provedbi Opće uredbe o zaštiti podataka su sljedeće: Načela Prilikom obrade osobnih podataka LULL Studio d.o.o. kao voditelj obrade poštuje sljedeća načela: (a) zakonitosti, poštenosti i transparentnosti; (b) ograničavanja svrhe; (c) smanjenja količine podataka; (d) točnost; (e) ograničenje pohrane; (f) cjelovitosti i povjerljivosti; (g) pouzdanosti. Podaci koji se pružaju ispitaniku Kupcu kao ispitaniku se pružaju sljedeće informacije u smislu odredbe čl. 13. Opće uredbe o zaštiti podataka: (a) identitet i kontaktni podaci voditelja obrade: LULL Studio d.o.o., Ulica Augusta Piazze 10, 10000 Zagreb, Hrvatska, [email protected], Tel: 00 385 99 497 5592, (b) kontaktni podaci službenika za zaštitu podataka: [email protected] (c) svrha obrade radi kojih se upotrebljavaju osobni podaci kao i pravna osnova za obradu: izvršavanje ugovora, izvršavanja dostave kupljenog proizvoda, zaštita ključnih interesa ispitanika, dostava newslettera, u svrhu osiguravanja podrške kupcima i marketing (d) primatelji ili kategorije primatelja osobnih podataka: posrednici i/ili suradnici koji su u ugovornom odnosu sa LULL Studio d.o.o. (e) LULL Studio d.o.o. neće dostavljati osobne podatke na teritorij treće zemlje ili međunarodne organizacije, osim uz Vašu izričitu privolu. (f) razdoblje u kojem će osobni podaci biti pohranjeni/kriteriji kojima se utvrdilo to razdoblje: pet godina računajući od dostave osobnih podataka LULL Studio d.o.o. (g) ispitanik ima pravo od LULL Studio d.o.o. zatražiti pristup osobnim podacima i ispravak ili brisanje osobnih podataka ili ograničavanje obrade koji se odnose na ispitanika ili prava na ulaganje prigovora na obradu takvih te prava na prenosivost podataka; (h) ako se obrada temelji na danoj privoli ispitanika, ispitanik je ovlašten u bilo kojem trenutku povući privolu, a da to ne utječe na zakonitost obrade koja se temeljila na privoli prije nego što je ona povučena; (i) pravo je ispitanika podnijeti prigovor nadzornom tijelu; (j) pružanje osobnih podataka nije uvjet nužan za sklapanje ugovora te ispitanik nema obvezu pružanja osobnih podataka i nema posljedica ako se takvi podaci ne pruže, ali nedostavljanje potrebnih podataka može utjecati na mogućnost i/ili kvalitetu ispunjenja ugovora; (k) ne postoji automatizirano donošenje odluka. Podaci koji se odnose na djecu Sukladno Općoj uredbi o zaštiti podataka djeca zaslužuju posebnu zaštitu u svakom pogledu, pa tako i u pogledu zaštite osobnih podataka. Sukladno članku 19., stavku 1. Zakona o provedbi Opće uredbe o zaštiti podataka, djecom se smatraju sve osobe mlađe od 16 godina, te LULL Studio d.o.o. ne traži niti prikuplja osobne podatke djece ili o njima bez suglasnosti nositelja roditeljske odgovornosti. Stoga će LULL Studio d.o.o. poduzeti sve razumne napore, kako bi podatke koje dobije od djece obrađivalo samo uz suglasnost nositelja roditeljske odgovornosti. Ako LULL Studio d.o.o. sazna da su mu poslani osobni podaci djece, ali bez valjane suglasnosti nositelja roditeljske odgovornosti, LULL Studio d.o.o. će u razumnoj mjeri nastojati učiniti sljedeće: Kada i kako Lull.hr prikuplja podatke korisnika? Osobni podaci se prikupljaju izravno od pojedinca – podaci dostavljeni za potrebe sklapanja ili izvršenja ugovora, kreiranjem korisničkog računa na Internet stranici LULL Studio d.o.o., neposredno, telefonskim razgovorom sa pojedincem. LULL Studio d.o.o. prikuplja osobne podatke Kupaca samo u mjeri koji su nužni za ispunjenje svoje obveze sukladno zahtjevima Kupca, odnosno za koje postoji legitimni interes te za koje ima privolu Kupca u svrhu informiranja, podrške kupcima i marketing u mjeri u kojoj je to važno za poslovanje LULL Studio d.o.o.. LULL Studio d.o.o. se obvezuje štititi osobne podatke Kupaca u skladu sa Općom uredbom o zaštiti osobnih podataka te se obvezuje da osobne podatke neće ni na koji način ustupiti trećim osobama bez pristanka Kupca (osim nužnih podataka za koje postoji legitimni interes u svrhu izvršavanja dostave kupljenog proizvoda) niti će ih koristiti u neodređene svrhe. Obrada osobnih podataka koja se temelji na legitimnom interesu ili predstavlja ugovornu obvezu obavlja se održavanjem najviši standarda sigurnosti i poslovanja. Kupac u svakom trenutku može izjaviti prigovor na obradu svojih osobnih podataka na temelju svoje specifične situacije. Kupac ima pravo zatražiti nadopunu, ispravak ili izmjenu netočnih osobnih podataka. Od ovog se izuzimaju slučajevi u kojima je LULL Studio d.o.o. po valjanom nalogu ovlaštenih državnih tijela, u skladu sa zakonom, dužan dostaviti ili dopustiti uvid u osobne podatke Kupaca. Podaci koje prikuplja LULL Studio d.o.o. su ime, prezime, adresa dostave, broj telefona i adresa e-pošte. Prilikom kupovine u Lull.hr fizičkoj i internetskoj trgovini tražimo od Vas određene osobne podatke koje su nužne za ispunjenje usluge i kupovinu. Pružanje osobnih podataka u svrhu prodaje nužno je za izvršavanje ugovora te ako ih ne pružite, to će utjecati na ispravno izvršenje ugovora ili ga čak onemogućiti. Tako prikupljene podatke koristimo samo za obradu traženih informacija i upita korisnika te u svrhu osiguravanja kvalitetnog korisničkog iskustva. Podaci su dostupni samo djelatnicima kojima su nužni za ispunjenje ugovora. Kupci i korisnici internetske stranice www.lull.hr suglasni su da u skladu sa Općom uredbom o zaštiti osobnih podataka te u skladu s traženim upitom obrađujemo osobne podatke te prihvaćaju sve rizike koji nastaju korištenjem internetske stranice. Informatički sustav koji koristi LULL Studio d.o.o. zaštićen je tehničkim mjerama od neovlaštenog pristupa, izmjene, širenja, gubljenja i brisanja podataka Kupaca. LULL Studio d.o.o. prikuplja e-mail adrese korisnika koje koristi za slanje newslettera odnosno elektroničkih poruka koje sadrže promotivne poruke, ponude i vijesti iz svijeta mobilne tehnologije. LULL Studio d.o.o. uz privolu Kupca može koristiti osobne podatke za informiranje o novim i akcijskim proizvodima te dostavu promotivnih materijala, newslettera te unapređenja odnosa s Kupcima. Ukoliko pristup podacima u svrhe marketinške obrade imaju treći pružatelji usluga, oni su detaljno opisani u ovim Uvjetima. LULL Studio d.o.o. je voditelj obrade osobnih podataka u skladu sa zakonom i propisima o zaštiti osobnih podataka. LULL Studio d.o.o. kao voditelj obrade osobnih podataka određuje svrhu i sredstva obrade osobnih podataka i odgovorna je za čuvanje i korištenje osobnih podataka u papirnatom i/ili elektronskom obliku. Temeljem članka 37. Opće uredbe o zaštiti podataka LULL Studio d.o.o. kao voditelj obrade osobnih podataka, imenovao je službenika za zaštitu osobnih podataka kojeg možete kontaktirati putem e-adrese [email protected] U slučaju povrede osobnih podataka LULL studio d.o.o. bez nepotrebnog odgađanja i, ako je izvedivo, najkasnije 72 sata nakon saznanja o toj povredi, izvješćuje nadzorno tijelo nadležno o povredi osobnih podataka, osim ako nije vjerojatno da će povreda osobnih podataka prouzročiti rizik za prava i slobode pojedinaca. Ako izvješćivanje nije učinjeno unutar 72 sata, mora biti popraćeno razlozima za kašnjenje. Tko su subjekti s kojima Lull.hr može dijeliti osobne podatke? Prilikom kreiranja Lull.hr računa na Lull.hr trgovini potrebno je unijeti svoje podatke (e-mail, ime i prezime). Prilikom prijave putem društvenih mreža, odnosno Google i Facebook računa, LULL Studio d.o.o. ne zadržava podatke prikupljene takvom prijavom. Lull.hr surađuje s pružateljima usluga trećim stranama kako bi se mogle provesti aktivnosti slanja e-pošte, oglašavanja i analiziranja upotrebe naših web mjesta i aplikacija te praćenja učinkovitosti kampanja. Osobne podatke dijelimo samo u onoj mjeri potrebnoj za izvršavanje usluge u naše ime. U nastavku možete provjeriti tko su davatelji usluga trećih strana potrebnih za suradnju: https://www.google.com/analytics/terms/gb.html, Opći pregled o načelima sigurnosti i privatnosti Google Analytics: https://support.google.com/analytics/answer/6004245?hl=en, kao i Googleova Pravila privatnosti: https://policies.google.com/privacy?hl=en. Ove internetske stranice upotrebljavaju Google Analytics za analizu protoka posjetitelja neovisno o vrsti uređaja, a koji se temelji na korisničkom identifikacijskom broju (ID). Možete onemogućiti praćenje Vašeg korištenja više uređaja u svom Google računu pod „Moje informacije“ („My information“), „Osobne informacije“ („Personal information“). Pristup bazi Kupaca s osobnim podacima Kupaca uz LULL Studio d.o.o. u svrhu sklapanja ili izvršavanja ugovora, odnosno kupovine u Lull.hr trgovini i dostavu proizvoda imaju: • Plavi pixel d.o.o., specijalizirana tvrtka za izradu web trgovina s kojom LULL Studio d.o.o. ima sklopljen ugovor o zaštiti podataka. Politika kolačića „Kolačić“ je dio informacija spremljenih na računalo, mobitel ili tablet korisnika (dalje u tekstu: „uređaj“), koje mogu biti dostavljene neposredno od strane internetske stranice koju posjetite (kolačići od prve strane) ili u suradnji i za potrebe internetske stranice od treće strane (kolačići treće strane). Kolačići u pravilu spremaju postavke korisnika, postavke za internetsku stranicu i sl. Nakon što ponovno korisnik otvori internetsku stranicu, internetski preglednik korisnika šalje natrag kolačiće koji pripadaju ovoj web stranici. To omogućuje stranici da prikaže informacije prilagođene potrebama korisnika. Kolačići mogu imati širok raspon informacija, uključujući i dio osobnih informacija. Takve informacije mogu biti spremljene jedino ako to korisnik omogući. Sama internetska stranica ne može dobiti pristup informacijama koje im korisnik ne dopusti te ne mogu pristupiti niti jednoj drugoj datoteci na računalu korisnika. Kako bi stranice Lull.hr ispravno radile, one moraju na računalo korisnika spremiti malenu količinu kolačića (Cookies). Prema Općoj uredbi o zaštiti podataka, Zakonu o provedbi Opće uredbe o zaštiti podataka i Zakonu o elektroničkim komunikacijama, LULL Studio d.o.o. prije spremanja Cookiea mora zatražiti pristanak (privolu) korisnika. Ukoliko korisnik ne pristane na pohranu kolačića postoji mogućnost da stranica neće moći koristiti neke od funkcionalnosti koje daje LULL Studio d.o.o. web trgovina. Zadaća kolačića kojem ste dopustili da se pohrani na Vaše računalo je spremanje Vaših postavki, postavki web stranice, Vašeg preferiranog jezika ili adrese. Kada nakon nekog vremena opet posjetite istu stranicu internet preglednik kojim se koristite šalje informacije prilagođene Vašim potrebama. Ovisno o definiranoj zadaći kolačići spremaju širok spektar informacija koji između ostalih uključuju i osobne podatke. Međutim, isključivo vi odlučujete koje informacije će kolačići spremati. U postavkama Vašeg internet preglednika možete sami birati hoćete li zahtjeve za spremanje kolačića odobriti ili odbiti. Onemogućavanjem kolačića možda nećete moći koristiti neke od funkcionalnosti na stranicama koje posjećujete. Stalni kolačići ostaju na računalu nakon zatvaranja programa internet preglednika. Stalni kolačići ostat će na računalu ili mobilnom uređaju danima, mjesecima, čak i godinama te imaju svrhu pohraniti stalne podatke kao što su npr. korisničko ime i lozinka da se ne morate svaki puta iznova prijavljivati. Privremeni kolačići nestaju s računala nakon što zatvorite internet preglednik. Uz njihovu pomoć se pohranjuju privremeni podaci kao što su podaci koje dajete kad ste u online kupnji. Kolačići od prve strane mogu biti stalni ili privremeni, a pohranjuju podatke koje ćete ponovo koristiti prilikom sljedećeg posjeta stranicama sa kojih su pohranjeni na Vaše računalo. Kolačići treće strane ili tzv. reklamni kolačići pohranjuju se na Vaše računalo ako koristite reklame i oglase na stranici koju posjećujete a ona vas preusmjeri na treću stranu. Ovaj način služi za praćenje korištenja Interneta u marketinške svrhe. Lull.hr koristi kolačiće u svrhu poboljšanja korisničkog iskustva, u svrhu funkcioniranja stranice u kontekstu sigurnosti i u svrhu radnji koje posjetitelj stranice odabere samostalno (web forma za slanje poruka ili traženje usluga). Privremeni kolačići se brišu kada napustite internetski preglednik. Njihova jedina svrha je unaprijediti korisničko iskustvo za vrijeme posjete stranici. Stalni kolačići nemaju ograničenja i ostaju u Vašem pregledniku dok ih ručno ne obrišete. Prikupljeni podaci se koriste isključivo u statističke svrhe. Ovo su primjeri trećih strana koje pružaju usluge analize i marketinške obrade podataka Za više informacije o svrsi i opsegu prikupljanja podataka i obradi istih od strane pružatelja dodatka, molimo da pogledate izjave o zaštiti privatnosti ovih pružatelja koji su niže navedeni. Kako korisnici mogu ažurirati, urediti ili obrisati svoje osobne podatke? LULL Studio d.o.o. – internet trgovina. prikuplja podatke korisnika u skladu Općom uredbom o zaštiti osobnih podataka i Zakonom o provedbi Opće uredbe o zaštiti podataka. Svaki korisnik može u svakom trenutku može: LULL Studio d.o.o. može odbiti provođenja zahtjeva ukoliko se time ugrožava privatnost korisnika ili drugih korisnika, ako primjena zahtjeva je suprotna zakonu, u izuzecima radi zaštite javnog interesa (npr. sprječavanje ili otkrivanje zločina), pravnih obveza ili prava i sloboda drugih. Zahtjeve za pristup, ispravljanje ili brisanje podataka možete uputiti na: [email protected]lull.hr ili na adresu sjedišta Ulica Augusta Piazze 10, Zagreb, 10000 Zagreb, Hrvatska. Obrada takvog zahtjeva može biti tehnički i vremenski složen proces te je u složenim slučajevima ili u slučaju većeg broja zahtjeva potrebno duže vrijeme potrebno za obradu podataka o čemu ćemo vas obavijestiti na zakonit i siguran način. Kako čuvamo sigurnost Vaših podataka? U svrhu očuvanja sigurnosti, integriteta i dostupnosti osobnih podataka kupaca, podatke osiguravamo nizom sigurnosnih mjera koje uključuju enkripciju, autentifikaciju i strogo ograničeni pristup podacima. Neke od mjera koje koristimo uključuju: Sigurnosne mjere koje se provode imaju za cilj: Koliko dugo zadržavamo Vaše osobne podatke? Osobne podatke pohranjujemo i obrađujemo onoliko dugo koliko je potrebno za izvršenje određene legitimne svrhe, osim ako važećim propisima nije za pojedinu svrhu predviđeno duže vrijeme čuvanja. U slučaju davanja privole za marketing, podatke čuvamo pet godina računajući od dostave osobnih podataka LULL Studio d.o.o. Povlačenje privole ne utječe na zakonitost obrade na temelju privole prije njezina povlačenja. Povlačenje dostavlja se u pisanom obliku. Osobni podaci koji više nisu potrebni se ili nepovratno anonimiziraju ili se uništavaju na siguran način. Kontakti