http___lull.hr_politika-o-privatnosti__1.xml
1.1 2.1 4.1 5.1 6.1 8.1 9.1 11.1 12.1 14.1 17.1 18.1 19.1 21.1 22.1 23.1 25.1 26.1 27.1 28.1 30.1 32.1 34.1 35.1 36.1 37.1 38.1 39.1 40.1 41.1 42.1 43.1 44.1 45.1 47.1 48.1 49.1 51.1 52.1 53.1 54.1 55.1 56.1 57.1 58.1 60.1 61.1 62.1 63.1 64.1 65.1 67.1 68.1 69.1 70.1 71.1 72.1 74.1 75.1 77.1 78.1 80.1 81.1 83.1 84.1 85.1 87.1 88.1 90.1 91.1 93.1 94.1 96.1 97.1 98.1 99.1 101.1 102.1 104.1 105.1 106.1 107.1 108.1 109.1 111.1 112.1 113.1 115.1 116.1 117.1 118.1 119.1 120.1 122.1 123.1 124.1 126.1 127.1 129.1 130.1 131.1 133.1 134.1 135.1 136.1 137.1 138.1 139.1 140.1 142.1 143.1 144.1 145.1 146.1 147.1 149.1 150.1 151.1 153.1 154.1 156.1 157.1 159.1 160.1 161.1 163.1 164.1 165.1 166.1 167.1 168.1 170.1 171.1 172.1 173.1 175.1 176.1 177.1 178.1 180.1 181.1 182.1 183.1 185.1 186.1 187.1 188.1 190.1 191.1 192.1 194.1 195.1 196.1 197.1 198.1 200.1 201.1 202.1 203.1 204.1 205.1 206.1 207.1 209.1 210.1 211.1 213.1 214.1 215.1 216.1 217.1 218.1 220.1 221.1 222.1 223.1 224.1 225.1 227.1 228.1 229.1 230.1 231.1 233.1 234.1 235.1 236.1 237.1 238.1 240.1 241.1 242.1 243.1 245.1 246.1 247.1 249.1 250.1 251.1 252.1 253.1 255.1 256.1 257.1 259.1 260.1 261.1 262.1 264.1 265.1 266.1 267.1 269.1 270.1 271.1 272.1 273.1 275.1 276.1 277.1 278.1 280.1 281.1 282.1 283.1 285.1 286.1 288.1 289.1 290.1 291.1 293.1 294.1 296.1 297.1 299.1 300.1 302.1 303.1 304.1 305.1 306.1 307.1 308.1 309.1 311.1 312.1 313.1 315.1 316.1 317.1 319.1 320.1 321.1 322.1 323.1 324.1 325.1 327.1 328.1 329.1 330.1 331.1 332.1 333.1 335.1 336.1 338.1 339.1 341.1 342.1 343.1 345.1 346.1 347.1 349.1 350.1 351.1 352.1 354.1 355.1 357.1 358.1 359.1 361.1 362.1 363.1 365.1 366.1 367.1 369.1 370.1 371.1 373.1 374.1 375.1 376.1 378.1 380.1 381.1 382.1 383.1 385.1 386.1 387.1 388.1 389.1 390.1 391.1 393.1 396.1 397.1 399.1 400.1 401.1 402.1 403.1 404.1 405.1 406.1 407.1 408.1 410.1 411.1 412.1 413.1 415.1 416.1 417.1 418.1 419.1 421.1 422.1 423.1 425.1 426.1 427.1 428.1 430.1 431.1 432.1 433.1 435.1 436.1 437.1 439.1 440.1 442.1 443.1 445.1 446.1 447.1 448.1 449.1 450.1 451.1 452.1 453.1 454.1 456.1 457.1 459.1 460.1 462.1 463.1 465.1 466.1 468.1 469.1 471.1 472.1 473.1 474.1 476.1 477.1 478.1 480.1 481.1 482.1 484.1 485.1 486.1 487.1 488.1 490.1 491.1 492.1 494.1 495.1 496.1 498.1 499.1 500.1 502.1 503.1 504.1 506.1 507.1 508.1 510.1 511.1 512.1 513.1 514.1 515.1 516.1 517.1 519.1 520.1 521.1 523.1 524.1 525.1 526.1 527.1 529.1 530.1 531.1 532.1
Data Protection Bill (HL Bill 66) PART 4 continued CHAPTER 2 continued Data Protection BillPage 50 85 The second data protection principle (1) The second data protection principle is that— the purpose for which personal data is collected on any occasion must be specified, explicit and legitimate, and 5personal data so collected must not be processed in a manner that is incompatible with the purpose for which it is collected. Paragraph (b) of the second data protection principle is subject to subsections Personal data collected by a controller for one purpose may be processed for 10any other purpose of the controller that collected the data or any purpose of another controller provided that— the controller is authorised by law to process the data for that purpose, and (b) the processing is necessary and proportionate to that other purpose. 15Processing of personal data is to be regarded as compatible with the purpose for which it is collected if the processing— (a) consists of— (i) processing for archiving purposes in the public interest, processing for the purposes of scientific or historical research, (iii) processing for statistical purposes, and is subject to appropriate safeguards for the rights and freedoms of the data subject. 86 The third data protection principle 25The third data protection principle is that personal data must be adequate, relevant and not excessive in relation to the purpose for which it is processed. 87 The fourth data protection principle The fourth data protection principle is that personal data undergoing processing must be accurate and, where necessary, kept up to date. 88 30The fifth data protection principle The fifth data protection principle is that personal data must be kept for no longer than is necessary for the purpose for which it is processed. 89 The sixth data protection principle The sixth data protection principle is that personal data must be processed in a 35manner that includes taking appropriate security measures as regards risks that arise from processing personal data. The risks referred to in subsection (1) include (but are not limited to) accidental or unauthorised access to, or destruction, loss, use, modification or disclosure of, personal data. Data Protection BillPage 51 CHAPTER 3 Rights of the data subject Overview 90 Overview (1) 5This Chapter sets out the rights of the data subject as follows— section 91 deals with the information to be made available to the data subject; (b) sections 92 and 93 deal with the right of access by the data subject; (c) sections 94 to 96 deal with rights in relation to automated processing; (d) 10section 97 deals with the right to object to processing; (e) section 98 deals with rights to rectification and erasure of personal data. In this Chapter, “the controller”, in relation to a data subject, means the controller in relation to personal data relating to the data subject. Rights 91 15Right to information (1) The controller must give a data subject the following information— (a) the identity and the contact details of the controller; the legal basis on which, and the purposes for which, the controller processes personal data; 20the categories of personal data relating to the data subject that are being processed; the recipients or the categories of recipients of the personal data (if applicable); the right to lodge a complaint with the Commissioner and the contact 25details of the Commissioner; (f) how to exercise rights under this Chapter; any other information needed to secure that the personal data is processed fairly and transparently. The controller may comply with subsection (1) by making information 30generally available, where the controller considers it appropriate to do so. The controller is not required under subsection (1) to give a data subject information that the data subject already has. Where personal data relating to a data subject is collected by or on behalf of the controller from a person other than the data subject, the requirement in 35subsection (1) has effect, in relation to the personal data so collected, with the following exceptions— the requirement does not apply in relation to processing that is authorised by an enactment; the requirement does not apply in relation to the data subject if giving 40the information to the data subject would be impossible or involve disproportionate effort. Data Protection BillPage 52 92 Right of access (1) An individual is entitled to obtain from a controller— confirmation as to whether or not personal data concerning the individual is being processed, and (b) 5where that is the case— communication, in intelligible form, of the personal data of which that individual is the data subject, and (ii) the information set out in subsection (2). (2) That information is— (a) 10the purposes of and legal basis for the processing; (b) the categories of personal data concerned; the recipients or categories of recipients to whom the personal data has been disclosed; (d) the period for which the personal data is to be preserved; 15the existence of a data subject’s rights to rectification and erasure of personal data (see section 98); the right to lodge a complaint with the Commissioner and the contact details of the Commissioner; (g) any information about the origin of the personal data concerned. 20A controller is not obliged to provide information under this section unless the controller has received such reasonable fee as the controller may require, subject to subsection (4). (4) The Secretary of State may by regulations— (a) specify cases in which a controller may not charge a fee; (b) 25specify the maximum amount of a fee. (5) Where a controller— (a) reasonably requires further information— in order that the controller be satisfied as to the identity of the individual making a request under subsection (1), or (ii) 30to locate the information which that individual seeks, and (b) has informed that individual of that requirement, the controller is not obliged to comply with the request unless the controller is supplied with that further information. Where a controller cannot comply with the request without disclosing 35information relating to another individual who can be identified from that information, the controller is not obliged to comply with the request unless— the other individual has consented to the disclosure of the information to the individual making the request, or it is reasonable in all the circumstances to comply with the request 40without the consent of the other individual. In subsection (6), the reference to information relating to another individual includes a reference to information identifying that individual as the source of the information sought by the request. Subsection (6) is not to be construed as excusing a controller from 45communicating so much of the information sought by the request as can be communicated without disclosing the identity of the other individual Data Protection BillPage 53 concerned, whether by the omission of names or other identifying particulars or otherwise. In determining for the purposes of subsection (6)(b) whether it is reasonable in all the circumstances to comply with the request without the consent of the 5other individual concerned, regard must be had, in particular, to— (a) any duty of confidentiality owed to the other individual, any steps taken by the controller with a view to seeking the consent of the other individual, (c) whether the other individual is capable of giving consent, and (d) 10any express refusal of consent by the other individual. Subject to subsection (6), a controller must comply with a request under subsection (1)— (a) promptly, and (b) in any event before the end of the applicable time period. 15If a court is satisfied on the application of an individual who has made a request under subsection (1) that the controller in question has failed to comply with the request in contravention of this section, the court may order the controller to comply with the request. The jurisdiction conferred on a court by this section is exercisable by the High 20Court or, in Scotland, by the Court of Session. (13) In this section— “the applicable time period” means the period of—(a) one month, or(b) such longer period, not exceeding three months, as may be 25specified in regulations made by the Secretary of State, beginning with the relevant day; “the relevant day”, in relation to a request under subsection (1), means the latest of the following days—(a) the day on which the controller receives the request,(b) 30the day on which the fee (if any) is paid, and(c) the day on which the controller receives the information (if any) required under subsection (5) in connection with the request. (14) Regulations under this section are subject to the negative resolution procedure. 93 Right of access: supplementary 35The controller must comply with the obligation imposed by section 92(1)(b)(i) by supplying the data subject with a copy of the information in writing unless— the supply of such a copy is not possible or would involve disproportionate effort, or (b) 40the data subject agrees otherwise; and where any of the information referred to in section 92(1)(b)(i) is expressed in terms which are not intelligible without explanation the copy must be accompanied by an explanation of those terms. Where a controller has previously complied with a request made under section 4592 by an individual, the controller is not obliged to comply with a subsequent Data Protection BillPage 54 identical or similar request under that section by that individual unless a reasonable interval has elapsed between compliance with the previous request and the making of the current request. In determining for the purposes of subsection (2) whether requests under 5section 92 are made at reasonable intervals, regard must be had to— (a) the nature of the data, (b) the purpose for which the data is processed, and (c) the frequency with which the data is altered. The information to be supplied pursuant to a request under section 92 must be 10supplied by reference to the data in question at the time when the request is received, except that it may take account of any amendment or deletion made between that time and the time when the information is supplied, being an amendment or deletion that would have been made regardless of the receipt of the request. 15For the purposes of section 92(6) to (8), an individual can be identified from information to be disclosed to a data subject by a controller if the individual can be identified from— (a) that information, or that and any other information that the controller reasonably believes 20the data subject making the request is likely to possess or obtain. 94 Right not to be subject to automated decision-making The controller may not take a decision significantly affecting a data subject that is based solely on automated processing of personal data relating to the data subject. (2) 25Subsection (1) does not prevent such a decision being made on that basis if— (a) the decision is required or authorised by law, the data subject has given consent to the decision being made on that basis, or (c) the decision is a decision taken in the course of steps taken— 30for the purpose of considering whether to enter into a contract with the data subject, (ii) with a view to entering into such a contract, or (iii) in the course of performing such a contract. For the purposes of this section, a decision that has legal effects as regards an 35individual is to be regarded as significantly affecting the individual. 95 Right to intervene in automated decision-making (1) This section applies where— the controller takes a decision significantly affecting a data subject that is based solely on automated processing of personal data relating to the 40data subject, and (b) the decision is required or authorised by law. (2) This section does not apply to such a decision if— the data subject has given consent to the decision being made on that basis, or Data Protection BillPage 55 (b) the decision is a decision taken in the course of steps taken— for the purpose of considering whether to enter into a contract with the data subject, (ii) with a view to entering into such a contract, or (iii) 5in the course of performing such a contract. The controller must as soon as reasonably practicable notify the data subject that such a decision has been made. The data subject may, before the end of the period of 21 days beginning with receipt of the notification, request the controller— (a) 10to reconsider the decision, or (b) to take a new decision that is not based solely on automated processing. If a request is made to the controller under subsection (4), the controller must, before the end of the period of 21 days beginning with receipt of the request— consider the request, including any information provided by the data 15subject that is relevant to it, and by notice in writing inform the data subject of the outcome of that consideration. For the purposes of this section, a decision that has legal effects as regards an individual is to be regarded as significantly affecting the individual. 96 20Right to information about decision-making (1) Where— (a) the controller processes personal data relating to a data subject, and (b) results produced by the processing are applied to the data subject, the data subject is entitled to obtain from the controller, on request, knowledge 25of the reasoning underlying the processing. Where the data subject makes a request under subsection (1), the controller must comply with the request without undue delay. 97 Right to object to processing A data subject is entitled at any time, by notice given to the controller, to 30require the controller— (a) not to process personal data relating to the data subject, or not to process such data for a specified purpose or in a specified manner, on the ground that, for specified reasons relating to the situation of the data 35subject, the processing in question is an unwarranted interference with the interests or rights of the data subject. (2) Where the controller— (a) reasonably requires further information— in order that the controller be satisfied as to the identity of the 40individual giving notice under subsection (1), or (ii) to locate the data to which the notice relates, and (b) has informed that individual of that requirement, the controller is not obliged to comply with the notice unless the controller is supplied with that further information. Data Protection BillPage 56 The controller must, before the end of 21 days beginning with the relevant day, give a notice to the data subject— stating that the controller has complied or intends to comply with the notice under subsection (1), or 5stating the controller’s reasons for not complying with the notice to any extent and the extent (if any) to which the controller has complied or intends to comply with the notice under subsection (1). If the controller does not comply with a notice under subsection (1) to any extent, the data subject may apply to a court for an order that the controller take 10steps for complying with the notice. If the court is satisfied that the controller should comply with the notice (or should comply to any extent), the court may order the controller to take such steps for complying with the notice (or for complying with it to that extent) as the court thinks fit. 15The jurisdiction conferred on a court by this section is exercisable by the High Court or, in Scotland, by the Court of Session. In this section, “the relevant day”, in relation to a notice under subsection (1), means— (a) the day on which the controller receives the notice, or 20if later, the day on which the controller receives the information (if any) required under subsection (2) in connection with the notice. 98 Rights to rectification and erasure If a court is satisfied on the application of a data subject that personal data relating to the data subject is inaccurate, the court may order the controller to 25rectify that data without undue delay. If a court is satisfied on the application of a data subject that the processing of personal data relating to the data subject would infringe any of sections 84 to 89, the court may order the controller to erase that data without undue delay. If personal data relating to the data subject must be maintained for the 30purposes of evidence, the court may (instead of ordering the controller to rectify or erase the personal data) order the controller to restrict its processing without undue delay. (a) the data subject contests the accuracy of personal data, and 35the court is satisfied that the controller is not able to ascertain whether the data is accurate or not, the court may (instead of ordering the controller to rectify or erase the personal data) order the controller to restrict its processing without undue delay. The jurisdiction conferred on a court by this section is exercisable by the High 40Court or, in Scotland, by the Court of Session. Data Protection BillPage 57 CHAPTER 4 Controller and processor Overview 99 Overview 5This Chapter sets out— the general obligations of controllers and processors (see sections 100 to specific obligations of controllers and processors with respect to security (see section 105); 10specific obligations of controllers and processors with respect to personal data breaches (see section 106). General obligations 100 General obligations of the controller Each controller must implement appropriate measures— (a) 15to ensure, and (b) to be able to demonstrate, in particular to the Commissioner, that the processing of personal data complies with the requirements of this Part. 101 Data protection by design 20Where a controller proposes that a particular type of processing of personal data be carried out by or on behalf of the controller, the controller must, prior to the processing, consider the impact of the proposed processing on the rights and freedoms of data subjects. A controller must implement appropriate technical and organisational 25measures which are designed to ensure that— (a) the data protection principles are implemented, and (b) risks to the rights and freedoms of data subjects are minimised. 102 Joint controllers Where two or more intelligence services jointly determine the purposes and 30means of processing personal data, they are joint controllers for the purposes of this Part. Joint controllers must, in a transparent manner, determine their respective responsibilities for compliance with this Part by means of an arrangement between them, except to the extent that those responsibilities are determined 35under or by virtue of an enactment. The arrangement must designate the controller which is to be the contact point for data subjects. Data Protection BillPage 58 103 Processors This section applies to the use by a controller of a processor to carry out processing of personal data on behalf of the controller. (2) The controller may use only a processor who undertakes— 5to implement appropriate measures that are sufficient to secure that the processing complies with this Part; to provide to the controller such information as is necessary for demonstrating that the processing complies with this Part. If a processor determines, in breach of this Part, the purposes and means of 10processing, the processor is to be treated for the purposes of this Part as a controller in respect of that processing. 104 Processing under the authority of the controller or processor A processor, and any person acting under the authority of a controller or processor, who has access to personal data may not process the data except— (a) 15on instructions from the controller, or (b) to comply with a legal obligation. Obligations relating to security 105 Security of processing Each controller and each processor must implement security measures 20appropriate to the risks arising from the processing of personal data. In the case of automated processing, each controller and each processor must, following an evaluation of the risks, implement measures designed to— prevent unauthorised processing or unauthorised interference with the systems used in connection with it, 25ensure that it is possible to establish the precise details of any processing that takes place, ensure that any systems used in connection with the processing function properly and may, in the case of interruption, be restored, and ensure that stored personal data cannot be corrupted if a system used 30in connection with the processing malfunctions. Obligations relating to personal data breaches 106 Communication of a personal data breach If a controller becomes aware of a serious personal data breach in relation to personal data for which the controller is responsible, the controller must notify 35the Commissioner of the breach without undue delay. Where the notification to the Commissioner is not made within 72 hours, the notification must be accompanied by reasons for the delay. (3) Subject to subsection (4), the notification must include— a description of the nature of the personal data breach including, where 40possible, the categories and approximate number of data subjects Data Protection BillPage 59 concerned and the categories and approximate number of personal data records concerned; the name and contact details of the contact point from whom more information can be obtained; (c) 5a description of the likely consequences of the personal data breach; a description of the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects. Where and to the extent that it is not possible to provide all the information 10mentioned in subsection (3) at the same time, the information may be provided in phases without undue further delay. If a processor becomes aware of a personal data breach (in relation to data processed by the processor), the processor must notify the controller without undue delay. 15Subsection (1) does not apply in relation to a personal data breach if the breach also constitutes a relevant error within the meaning given by section 231(9) of the Investigatory Powers Act 2016. For the purposes of this section, a personal data breach is serious if the breach seriously interferes with the rights and freedoms of a data subject. 20CHAPTER 5 Transfers of personal data outside the United Kingdom 107 Transfers of personal data outside the United Kingdom (1) A controller may not transfer personal data to— (a) a country or territory outside the United Kingdom, or (b) 25an international organisation, unless the transfer falls within subsection (2). A transfer of personal data falls within this subsection if the transfer is a necessary and proportionate measure carried out— (a) for the purposes of the controller’s statutory functions, or 30for other purposes provided for, in relation to the controller, in section 2(2)(a) of the Security Service Act 1989 or section 2(2)(a) or 4(2)(a) of the Intelligence Services Act 1994. CHAPTER 6 Exemptions 108 35National security A provision mentioned in subsection (2) does not apply to personal data to which this Part applies if exemption from the provision is required for the purpose of safeguarding national security. (2) The provisions are—
1.1 2.1 3.1 4.1 5.1 6.1 7.1 8.1 9.1 10.1 11.1 12.1 13.1 14.1 15.1 16.1 17.1 18.1 19.1 20.1 21.1 22.1 23.1 24.1 25.1 26.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 33.2 34.1 35.1 36.1 37.1 38.1 39.1 39.2 39.3 39.4 40.1 41.1 42.1 42.2 43.1 43.2 43.3 43.4 44.1 45.1 46.1 47.1 47.2 48.1 48.2 49.1 49.2 50.1 51.1 52.1 53.1 54.1 54.2 55.1 56.1 57.1 57.2 58.1 59.1 60.1 61.1 61.2 61.3 61.4 61.5 61.6 61.7 62.1 62.2 63.1 64.1 64.2 65.1 65.2 65.3 66.1 67.1 67.2 68.1 68.2 69.1 70.1 70.2 71.1 71.2 71.3 71.4 71.5 72.1 73.1 74.1 75.1 75.2 76.1 77.1 78.1 79.1 80.1 81.1 82.1 83.1 84.1 85.1 86.1 87.1 87.2 87.3 87.4 88.1
FOR A RELAXING HOME Pravila privatnosti: – Zaštita osobnih podataka i politika privatnosti Definicije Prema Uredbi (EU) 2016/679 Europskog parlamenta i vijeća od 27. travnja 2016. o zaštiti pojedinaca u vezi s obradom osobnih podataka i o slobodnom kretanju takvih podataka te o stavljanju izvan snage Direktive 95/46/EZ (dalje u tekstu: Opća uredba o zaštiti podataka), osobni podaci su svi podaci koji se odnose na pojedinca čiji je identitet utvrđen ili se može utvrditi („ispitanik”); pojedinac čiji se identitet može utvrditi jest osoba koja se može identificirati izravno ili neizravno, osobito uz pomoć identifikatora kao što su ime, identifikacijski broj, podaci o lokaciji, mrežni identifikator ili uz pomoć jednog ili više čimbenika svojstvenih za fizički, fiziološki, genetski, mentalni, ekonomski, kulturni ili socijalni identitet tog pojedinca. Obrada podataka znači svaki postupak ili skup postupaka koji se obavljaju na osobnim podacima ili na skupovima osobnih podataka, bilo automatiziranim bilo neautomatiziranim sredstvima kao što su prikupljanje, bilježenje, organizacija, strukturiranje, pohrana, prilagodba ili izmjena, pronalaženje, obavljanje uvida, uporaba, otkrivanje prijenosom, širenjem ili stavljanjem na raspolaganje na drugi način, usklađivanje ili kombiniranje, ograničavanje, brisanje ili uništavanje. Pravna osnova obrade podataka Pravne osnove za zakonitu obradu osobnih podataka sukladno Općoj uredbi o zaštiti podataka i Zakonu o provedbi Opće uredbe o zaštiti podataka su sljedeće: Načela Prilikom obrade osobnih podataka LULL Studio d.o.o. kao voditelj obrade poštuje sljedeća načela: (a) zakonitosti, poštenosti i transparentnosti; (b) ograničavanja svrhe; (c) smanjenja količine podataka; (d) točnost; (e) ograničenje pohrane; (f) cjelovitosti i povjerljivosti; (g) pouzdanosti. Podaci koji se pružaju ispitaniku Kupcu kao ispitaniku se pružaju sljedeće informacije u smislu odredbe čl. 13. Opće uredbe o zaštiti podataka: (a) identitet i kontaktni podaci voditelja obrade: LULL Studio d.o.o., Ulica Augusta Piazze 10, 10000 Zagreb, Hrvatska, [email protected], Tel: 00 385 99 497 5592, (b) kontaktni podaci službenika za zaštitu podataka: [email protected] (c) svrha obrade radi kojih se upotrebljavaju osobni podaci kao i pravna osnova za obradu: izvršavanje ugovora, izvršavanja dostave kupljenog proizvoda, zaštita ključnih interesa ispitanika, dostava newslettera, u svrhu osiguravanja podrške kupcima i marketing (d) primatelji ili kategorije primatelja osobnih podataka: posrednici i/ili suradnici koji su u ugovornom odnosu sa LULL Studio d.o.o. (e) LULL Studio d.o.o. neće dostavljati osobne podatke na teritorij treće zemlje ili međunarodne organizacije, osim uz Vašu izričitu privolu. (f) razdoblje u kojem će osobni podaci biti pohranjeni/kriteriji kojima se utvrdilo to razdoblje: pet godina računajući od dostave osobnih podataka LULL Studio d.o.o. (g) ispitanik ima pravo od LULL Studio d.o.o. zatražiti pristup osobnim podacima i ispravak ili brisanje osobnih podataka ili ograničavanje obrade koji se odnose na ispitanika ili prava na ulaganje prigovora na obradu takvih te prava na prenosivost podataka; (h) ako se obrada temelji na danoj privoli ispitanika, ispitanik je ovlašten u bilo kojem trenutku povući privolu, a da to ne utječe na zakonitost obrade koja se temeljila na privoli prije nego što je ona povučena; (i) pravo je ispitanika podnijeti prigovor nadzornom tijelu; (j) pružanje osobnih podataka nije uvjet nužan za sklapanje ugovora te ispitanik nema obvezu pružanja osobnih podataka i nema posljedica ako se takvi podaci ne pruže, ali nedostavljanje potrebnih podataka može utjecati na mogućnost i/ili kvalitetu ispunjenja ugovora; (k) ne postoji automatizirano donošenje odluka. Podaci koji se odnose na djecu Sukladno Općoj uredbi o zaštiti podataka djeca zaslužuju posebnu zaštitu u svakom pogledu, pa tako i u pogledu zaštite osobnih podataka. Sukladno članku 19., stavku 1. Zakona o provedbi Opće uredbe o zaštiti podataka, djecom se smatraju sve osobe mlađe od 16 godina, te LULL Studio d.o.o. ne traži niti prikuplja osobne podatke djece ili o njima bez suglasnosti nositelja roditeljske odgovornosti. Stoga će LULL Studio d.o.o. poduzeti sve razumne napore, kako bi podatke koje dobije od djece obrađivalo samo uz suglasnost nositelja roditeljske odgovornosti. Ako LULL Studio d.o.o. sazna da su mu poslani osobni podaci djece, ali bez valjane suglasnosti nositelja roditeljske odgovornosti, LULL Studio d.o.o. će u razumnoj mjeri nastojati učiniti sljedeće: Kada i kako Lull.hr prikuplja podatke korisnika? Osobni podaci se prikupljaju izravno od pojedinca – podaci dostavljeni za potrebe sklapanja ili izvršenja ugovora, kreiranjem korisničkog računa na Internet stranici LULL Studio d.o.o., neposredno, telefonskim razgovorom sa pojedincem. LULL Studio d.o.o. prikuplja osobne podatke Kupaca samo u mjeri koji su nužni za ispunjenje svoje obveze sukladno zahtjevima Kupca, odnosno za koje postoji legitimni interes te za koje ima privolu Kupca u svrhu informiranja, podrške kupcima i marketing u mjeri u kojoj je to važno za poslovanje LULL Studio d.o.o.. LULL Studio d.o.o. se obvezuje štititi osobne podatke Kupaca u skladu sa Općom uredbom o zaštiti osobnih podataka te se obvezuje da osobne podatke neće ni na koji način ustupiti trećim osobama bez pristanka Kupca (osim nužnih podataka za koje postoji legitimni interes u svrhu izvršavanja dostave kupljenog proizvoda) niti će ih koristiti u neodređene svrhe. Obrada osobnih podataka koja se temelji na legitimnom interesu ili predstavlja ugovornu obvezu obavlja se održavanjem najviši standarda sigurnosti i poslovanja. Kupac u svakom trenutku može izjaviti prigovor na obradu svojih osobnih podataka na temelju svoje specifične situacije. Kupac ima pravo zatražiti nadopunu, ispravak ili izmjenu netočnih osobnih podataka. Od ovog se izuzimaju slučajevi u kojima je LULL Studio d.o.o. po valjanom nalogu ovlaštenih državnih tijela, u skladu sa zakonom, dužan dostaviti ili dopustiti uvid u osobne podatke Kupaca. Podaci koje prikuplja LULL Studio d.o.o. su ime, prezime, adresa dostave, broj telefona i adresa e-pošte. Prilikom kupovine u Lull.hr fizičkoj i internetskoj trgovini tražimo od Vas određene osobne podatke koje su nužne za ispunjenje usluge i kupovinu. Pružanje osobnih podataka u svrhu prodaje nužno je za izvršavanje ugovora te ako ih ne pružite, to će utjecati na ispravno izvršenje ugovora ili ga čak onemogućiti. Tako prikupljene podatke koristimo samo za obradu traženih informacija i upita korisnika te u svrhu osiguravanja kvalitetnog korisničkog iskustva. Podaci su dostupni samo djelatnicima kojima su nužni za ispunjenje ugovora. Kupci i korisnici internetske stranice www.lull.hr suglasni su da u skladu sa Općom uredbom o zaštiti osobnih podataka te u skladu s traženim upitom obrađujemo osobne podatke te prihvaćaju sve rizike koji nastaju korištenjem internetske stranice. Informatički sustav koji koristi LULL Studio d.o.o. zaštićen je tehničkim mjerama od neovlaštenog pristupa, izmjene, širenja, gubljenja i brisanja podataka Kupaca. LULL Studio d.o.o. prikuplja e-mail adrese korisnika koje koristi za slanje newslettera odnosno elektroničkih poruka koje sadrže promotivne poruke, ponude i vijesti iz svijeta mobilne tehnologije. LULL Studio d.o.o. uz privolu Kupca može koristiti osobne podatke za informiranje o novim i akcijskim proizvodima te dostavu promotivnih materijala, newslettera te unapređenja odnosa s Kupcima. Ukoliko pristup podacima u svrhe marketinške obrade imaju treći pružatelji usluga, oni su detaljno opisani u ovim Uvjetima. LULL Studio d.o.o. je voditelj obrade osobnih podataka u skladu sa zakonom i propisima o zaštiti osobnih podataka. LULL Studio d.o.o. kao voditelj obrade osobnih podataka određuje svrhu i sredstva obrade osobnih podataka i odgovorna je za čuvanje i korištenje osobnih podataka u papirnatom i/ili elektronskom obliku. Temeljem članka 37. Opće uredbe o zaštiti podataka LULL Studio d.o.o. kao voditelj obrade osobnih podataka, imenovao je službenika za zaštitu osobnih podataka kojeg možete kontaktirati putem e-adrese [email protected] U slučaju povrede osobnih podataka LULL studio d.o.o. bez nepotrebnog odgađanja i, ako je izvedivo, najkasnije 72 sata nakon saznanja o toj povredi, izvješćuje nadzorno tijelo nadležno o povredi osobnih podataka, osim ako nije vjerojatno da će povreda osobnih podataka prouzročiti rizik za prava i slobode pojedinaca. Ako izvješćivanje nije učinjeno unutar 72 sata, mora biti popraćeno razlozima za kašnjenje. Tko su subjekti s kojima Lull.hr može dijeliti osobne podatke? Prilikom kreiranja Lull.hr računa na Lull.hr trgovini potrebno je unijeti svoje podatke (e-mail, ime i prezime). Prilikom prijave putem društvenih mreža, odnosno Google i Facebook računa, LULL Studio d.o.o. ne zadržava podatke prikupljene takvom prijavom. Lull.hr surađuje s pružateljima usluga trećim stranama kako bi se mogle provesti aktivnosti slanja e-pošte, oglašavanja i analiziranja upotrebe naših web mjesta i aplikacija te praćenja učinkovitosti kampanja. Osobne podatke dijelimo samo u onoj mjeri potrebnoj za izvršavanje usluge u naše ime. U nastavku možete provjeriti tko su davatelji usluga trećih strana potrebnih za suradnju: https://www.google.com/analytics/terms/gb.html, Opći pregled o načelima sigurnosti i privatnosti Google Analytics: https://support.google.com/analytics/answer/6004245?hl=en, kao i Googleova Pravila privatnosti: https://policies.google.com/privacy?hl=en. Ove internetske stranice upotrebljavaju Google Analytics za analizu protoka posjetitelja neovisno o vrsti uređaja, a koji se temelji na korisničkom identifikacijskom broju (ID). Možete onemogućiti praćenje Vašeg korištenja više uređaja u svom Google računu pod „Moje informacije“ („My information“), „Osobne informacije“ („Personal information“). Pristup bazi Kupaca s osobnim podacima Kupaca uz LULL Studio d.o.o. u svrhu sklapanja ili izvršavanja ugovora, odnosno kupovine u Lull.hr trgovini i dostavu proizvoda imaju: • Plavi pixel d.o.o., specijalizirana tvrtka za izradu web trgovina s kojom LULL Studio d.o.o. ima sklopljen ugovor o zaštiti podataka. Politika kolačića „Kolačić“ je dio informacija spremljenih na računalo, mobitel ili tablet korisnika (dalje u tekstu: „uređaj“), koje mogu biti dostavljene neposredno od strane internetske stranice koju posjetite (kolačići od prve strane) ili u suradnji i za potrebe internetske stranice od treće strane (kolačići treće strane). Kolačići u pravilu spremaju postavke korisnika, postavke za internetsku stranicu i sl. Nakon što ponovno korisnik otvori internetsku stranicu, internetski preglednik korisnika šalje natrag kolačiće koji pripadaju ovoj web stranici. To omogućuje stranici da prikaže informacije prilagođene potrebama korisnika. Kolačići mogu imati širok raspon informacija, uključujući i dio osobnih informacija. Takve informacije mogu biti spremljene jedino ako to korisnik omogući. Sama internetska stranica ne može dobiti pristup informacijama koje im korisnik ne dopusti te ne mogu pristupiti niti jednoj drugoj datoteci na računalu korisnika. Kako bi stranice Lull.hr ispravno radile, one moraju na računalo korisnika spremiti malenu količinu kolačića (Cookies). Prema Općoj uredbi o zaštiti podataka, Zakonu o provedbi Opće uredbe o zaštiti podataka i Zakonu o elektroničkim komunikacijama, LULL Studio d.o.o. prije spremanja Cookiea mora zatražiti pristanak (privolu) korisnika. Ukoliko korisnik ne pristane na pohranu kolačića postoji mogućnost da stranica neće moći koristiti neke od funkcionalnosti koje daje LULL Studio d.o.o. web trgovina. Zadaća kolačića kojem ste dopustili da se pohrani na Vaše računalo je spremanje Vaših postavki, postavki web stranice, Vašeg preferiranog jezika ili adrese. Kada nakon nekog vremena opet posjetite istu stranicu internet preglednik kojim se koristite šalje informacije prilagođene Vašim potrebama. Ovisno o definiranoj zadaći kolačići spremaju širok spektar informacija koji između ostalih uključuju i osobne podatke. Međutim, isključivo vi odlučujete koje informacije će kolačići spremati. U postavkama Vašeg internet preglednika možete sami birati hoćete li zahtjeve za spremanje kolačića odobriti ili odbiti. Onemogućavanjem kolačića možda nećete moći koristiti neke od funkcionalnosti na stranicama koje posjećujete. Stalni kolačići ostaju na računalu nakon zatvaranja programa internet preglednika. Stalni kolačići ostat će na računalu ili mobilnom uređaju danima, mjesecima, čak i godinama te imaju svrhu pohraniti stalne podatke kao što su npr. korisničko ime i lozinka da se ne morate svaki puta iznova prijavljivati. Privremeni kolačići nestaju s računala nakon što zatvorite internet preglednik. Uz njihovu pomoć se pohranjuju privremeni podaci kao što su podaci koje dajete kad ste u online kupnji. Kolačići od prve strane mogu biti stalni ili privremeni, a pohranjuju podatke koje ćete ponovo koristiti prilikom sljedećeg posjeta stranicama sa kojih su pohranjeni na Vaše računalo. Kolačići treće strane ili tzv. reklamni kolačići pohranjuju se na Vaše računalo ako koristite reklame i oglase na stranici koju posjećujete a ona vas preusmjeri na treću stranu. Ovaj način služi za praćenje korištenja Interneta u marketinške svrhe. Lull.hr koristi kolačiće u svrhu poboljšanja korisničkog iskustva, u svrhu funkcioniranja stranice u kontekstu sigurnosti i u svrhu radnji koje posjetitelj stranice odabere samostalno (web forma za slanje poruka ili traženje usluga). Privremeni kolačići se brišu kada napustite internetski preglednik. Njihova jedina svrha je unaprijediti korisničko iskustvo za vrijeme posjete stranici. Stalni kolačići nemaju ograničenja i ostaju u Vašem pregledniku dok ih ručno ne obrišete. Prikupljeni podaci se koriste isključivo u statističke svrhe. Ovo su primjeri trećih strana koje pružaju usluge analize i marketinške obrade podataka Za više informacije o svrsi i opsegu prikupljanja podataka i obradi istih od strane pružatelja dodatka, molimo da pogledate izjave o zaštiti privatnosti ovih pružatelja koji su niže navedeni. Kako korisnici mogu ažurirati, urediti ili obrisati svoje osobne podatke? LULL Studio d.o.o. – internet trgovina. prikuplja podatke korisnika u skladu Općom uredbom o zaštiti osobnih podataka i Zakonom o provedbi Opće uredbe o zaštiti podataka. Svaki korisnik može u svakom trenutku može: LULL Studio d.o.o. može odbiti provođenja zahtjeva ukoliko se time ugrožava privatnost korisnika ili drugih korisnika, ako primjena zahtjeva je suprotna zakonu, u izuzecima radi zaštite javnog interesa (npr. sprječavanje ili otkrivanje zločina), pravnih obveza ili prava i sloboda drugih. Zahtjeve za pristup, ispravljanje ili brisanje podataka možete uputiti na: [email protected]lull.hr ili na adresu sjedišta Ulica Augusta Piazze 10, Zagreb, 10000 Zagreb, Hrvatska. Obrada takvog zahtjeva može biti tehnički i vremenski složen proces te je u složenim slučajevima ili u slučaju većeg broja zahtjeva potrebno duže vrijeme potrebno za obradu podataka o čemu ćemo vas obavijestiti na zakonit i siguran način. Kako čuvamo sigurnost Vaših podataka? U svrhu očuvanja sigurnosti, integriteta i dostupnosti osobnih podataka kupaca, podatke osiguravamo nizom sigurnosnih mjera koje uključuju enkripciju, autentifikaciju i strogo ograničeni pristup podacima. Neke od mjera koje koristimo uključuju: Sigurnosne mjere koje se provode imaju za cilj: Koliko dugo zadržavamo Vaše osobne podatke? Osobne podatke pohranjujemo i obrađujemo onoliko dugo koliko je potrebno za izvršenje određene legitimne svrhe, osim ako važećim propisima nije za pojedinu svrhu predviđeno duže vrijeme čuvanja. U slučaju davanja privole za marketing, podatke čuvamo pet godina računajući od dostave osobnih podataka LULL Studio d.o.o. Povlačenje privole ne utječe na zakonitost obrade na temelju privole prije njezina povlačenja. Povlačenje dostavlja se u pisanom obliku. Osobni podaci koji više nisu potrebni se ili nepovratno anonimiziraju ili se uništavaju na siguran način. Kontakti