http___lily-tours.com_politika-zastite-osobnih-podataka-klijenata__1.xml
1.1 2.1 3.1 4.1 5.1 6.1 7.1 8.1 9.1 10.1 11.1 12.1 13.1 14.1 15.1 16.1 17.1 18.1 19.1 21.1 22.1 23.1 24.1 25.1 25.2 26.1 27.1 27.2 27.3 28.1 29.1 29.2 29.3 29.4 30.1 30.2 30.3 30.4 31.1 31.2 32.1 33.1 34.1 35.1 35.2 36.1 37.1 38.1 39.1 40.1 41.1 42.1 43.1 44.1 45.1 46.1 47.1 48.1 48.2 49.1 49.2 49.3 50.1 50.2 50.3 51.1 51.2 52.1 52.2 53.1 54.1 54.2 54.3 54.4 55.1 55.2 55.3 55.4 55.5 55.6 56.1 57.1 58.1 59.1 60.1 60.2 60.3 60.4 60.5 60.6 61.1 62.1 62.2 62.3 63.1 64.1 65.1 66.1 67.1 68.1 69.1 70.1 71.1 71.2 71.3 72.1 72.2 72.3 73.1 74.1 74.2 74.3 75.1 76.1 77.1 78.1 79.1 80.1 81.1 82.1 83.1 84.1 84.2 84.3 85.1 86.1 86.2 86.3 87.1 88.1 88.2 89.1 90.1 91.1 92.1 93.1 94.1 94.2 94.3 95.1 95.2 96.1 96.2 97.1 98.1 98.2 98.3 99.1 99.2 99.3 99.4 99.5 99.6 99.7 99.8 99.9 99.10 100.1 100.2 100.3 100.4 101.1 102.1 102.2 102.3 103.1 103.2 104.1 105.1 106.1 106.2 106.3 107.1 107.2 108.1 108.2 108.3 109.1 110.1 110.2 110.3 110.4 111.1 112.1 113.1 114.1 114.2 115.1 116.1 116.2 117.1 118.1 119.1 120.1 121.1 122.1 123.1 123.2 124.1 125.1 126.1 126.2 127.1 127.2 128.1 129.1 129.2 130.1 130.2 131.1 132.1 133.1 134.1 135.1 136.1 137.1 138.1
Data Privacy Policy, as of June 20, 2018 of info-key GmbH & Co. KG Heinz-Fangman Str. 42287 Wuppertal Phone: Fax: Contact e-mail: (at)(dot) (hereinafter referred to as “info-key” or “we”) represented by info-key Beteiligungs-GmbH Heinz-Fangman Str. 42287 Wuppertal represented by the managing directors Eliseo Milonia, Ahmet Gülcan (contact details same as above) to the users of the websites - https://info-key.de, - https://www.youtube.com/user/asomv7 and Principles Controller The “controller” of data processing, as defined by the General Data Protection Regulation (GDPR) and other national data protection laws of the EU member states as well as other data protection regulations, is info-key. User User is any natural or legal person who uses tele-media, in particular to obtain information or make information available. The user is the “data subject”, as defined by the GDPR. Scope of processing of personal data We only collect and use personal data of our users insofar as this is necessary to provide a functional website as well as our contents and services. In addition, the collection and use of personal data of our users regularly only takes place with the user’s consent. An exception applies in those cases where prior consent cannot be obtained for factual reasons and the processing of the data is permitted by law. Use of cookies Our website uses cookies. Cookies are text files that are stored in the internet browser or by the internet browser on the user’s computer system. If a user visits a website, a cookie may be stored on the user’s operating system. This cookie contains a characteristic string of characters that enables a unique identification of the browser when the website is called up again. Cookies always have a validity period, which may be limited to the end of the user session (so-called session cookies) or may allow them to exist for a longer period of time (so-called permanent cookies). These permanent cookies remain on your computer and enable the operator of a website or, if applicable, its partner companies (so-called third party cookies) to recognize your computer during your next visit. You can set your browser so that you are informed about the creation of cookies and can decide individually whether to accept them or refuse the creation of cookies in certain cases or in general. If cookies are not accepted, the functionality of a website may be limited. When accessing our website, you, the user, are informed about the use of certain cookies and your consent to the processing of personal data which is used in that context is obtained. At that time, reference is also made to this data privacy policy. Description and scope of the processing of your data In this section we inform you about the purposes for which your personal data may be processed by us and the legal basis for the processing. Contact by e-mail, telephone and telefax If you contact us, using the contact data we provide, the personal data that you provide when contacting us will be stored in the system used (e.g. e-mail). Further data may be stored in other systems, i.e. outside the system originally used (e.g. internal address directory). Collected data (base data) - First and last name - Company - Street address - ZIP code - City - Country - Phone number - Telefax number - E-mail address - Web address Of course, only the parts of the base data listed above that you actually communicate to us are actually processed or stored. The legal basis for the processing of this data is point (a) of Article 6(1) GDPR, if you have given your consent to us, or also point (f) of Article 6(1) GDPR, if the processing is necessary to protect the legitimate interests of us or a third party, provided that your interests, fundamental rights and freedoms do not override them. If the purpose of the establishment of contact is the initiation of a contract with us, point (b) of Article 6(1) GDPR is also a legal basis for data processing. Data provided by you will be deleted immediately after your request has been taken care of, or, in the event that it has not been taken care of within that time frame, after 12 months, following the last contact at the latest. A request can be said to be taken care of when all circumstances indicate that the problem in question has been solved completely. However, we will not delete your data if another reason for processing your data (e.g. the fulfilment of a contract with us) arises in the meantime. You have the possibility at any time to revoke your consent to the processing of personal data or to object to the processing of data which is not based on consent. The right to object or revoke your consent can be exercised in particular by just sending an e-mail (no specific form needed) to our contact e-mail address (see above). All personal data that info-key has stored in the course of being contacted by you will be deleted in this case. Your right to revoke your consent does not extend, in principle, to such data that we need for the performance of a contract with you or to take necessary steps prior to entering into such a contract. You may, however, have further rights. In this context, no data will be passed on to third parties. The data will only be used for the reasons that you contacted us for and for the subsequent communication with you. Use of cookies by info-key for the purpose of website use (technically necessary cookies) If you visit our website and you are not logged in to the download area, we use a maximum of one cookie. This cookie controls the information display, informing you that we generally use cookies on our website. If you click the “okay!” button in the information display, a cookie with the content “1” is created, which suppresses this information display for the next seven days. It will then be automatically deleted by your browser. In addition, we also allow certain users to log into the download area of our website using a password. In this case, four additional cookies are created, which our web server needs to recognize that you are currently logged in. Three of these cookies are session cookies with a (always new and different) session ID. These are automatically deleted when you log out. Another is formally necessary for the login, but does not contain any user information, but always the text “en”. This is automatically deleted by your browser after 24 hours. Collected data (usage data) - Information whether the information display about the use of cookies has been marked as read by the user (valid for 7 days) - Session ID from session cookies (while you are logged in, for staying logged in) The legal basis for this processing of data is point (f) of Article 6(1) GDPR. Technically necessary cookies are automatically stored on your computer and transmitted to our website. You have the possibility at any time to object to data processing which is not based on consent. In general, however, you as a user have full control over the use of cookies anyways. You can deactivate or restrict the transmission of cookies by changing the settings in your Internet browser. You can delete cookies that have already been saved at any time. Please note, however, that in this case the function of our website and especially the download area may be restricted. Data processing during login We enable certain users to log in to our website with the help of a password. After a successful login, the user can access information provided by info-key and download documents and software. During login and subsequent downloads, the data described below are processed. Collected data (usage data) When logging in with the help of a download password, the following personal data of the customer is stored: - The full IP of the user’s calling system - Date of the download (if a download takes place) - Content of the download (if a download takes place) - Operating system and version - Browser and browser version The legal basis for this processing of data is point (f) of Article 6(1) GDPR. The usage data will be deleted after 7 days at the latest. Further storage is possible in accordance with the provisions of data protection law. In this case, however, the IP addresses will be deleted or altered so that it is no longer possible to attribute the internet page access to your computer. The collection of data for the purpose of providing the website and the storage of data in temporary log files is absolutely necessary for the operation of the website. Consequently, there is no possibility of objection on the part of the user. However, you can exercise your right of objection by means of automated procedures using technical specifications, e.g. by using VPN providers to anonymize your IP address. Data processing when using a login link We provide certain users with a link that enables the direct download of documents and software. Such a link remains valid for a maximum of three days and cannot be used afterwards. When a download is performed, the data specified in the section “Data processing during login” will be processed. Collected data (usage data) After a successful download, we receive an automatically generated e-mail from our webserver confirming the success of the corresponding download with the following information: - The full IP of the user’s calling system - Which link was used - What e-mail address received this link - Date of download via this link - Content of the download - Operating system and version - Browser and browser version The usage data will be deleted after 7 days at the latest. Further storage is possible in accordance with the provisions of data protection law. In this case, however, the IP addresses are deleted or altered so that it is no longer possible to attribute the internet page access to your computer. The legal basis for the processing of data is point (f) of Article 6(1) GDPR. The collection of data for the purpose of providing the website and the storage of data in temporary log files is absolutely necessary for the operation of the website. Consequently, there is no possibility of objection on the part of the user. However, you can exercise your right of objection by means of automated procedures using technical specifications, e.g. by using VPN providers to anonymize your IP address. Processing related to the reception of the newsletter If you inform us that you would like to receive our newsletter, info-key will use the e-mail address you entered only for exactly those advertising purposes that you have selected, and only until you unsubscribe from the newsletter. You can unsubscribe at any time. Collected data (base data) - E-mail address (required) - Title, first and last name - Company The legal basis for the storage and use of data within the scope of newsletter e-mails, if consent has been obtained, is point (a) or (f) of Article 6(1) GDPR and Article 7(3) UWG. The data will be deleted as soon as it is no longer necessary to fulfil the purpose for which it was collected. The data necessary for sending the e-mail newsletter will thus be stored for as long as the subscription is active. Unless otherwise agreed, your subscription is valid for 5 years and expires automatically after this period. You have the possibility at any time to revoke your consent to the processing of personal data or to object to the processing of data which is not based on consent. You can send us an e-mail to our contact e-mail address (see above) or contact us by other means, for example by mail or by telephone. All personal data that info-key has stored about you in the scope of your newsletter subscription will be deleted in this case. If you cancel the subscription, your data will also be deleted in accordance with the above description. Use of our YouTube content (data transfer to a non-EU country) We provide videos with examples and tutorials for our products which can be accessed at https://www.youtube.com/user/asomv7. These are stored by a service provider at the internet address www.YouTube.com, YouTube LLC, 901 Cherry Ave, San Bruno, CA 94066, USA. YouTube is a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. By visiting the internet address https://www.youtube.com/user/asomv7 or by watching one of our videos stored on YouTube, personal data may be transferred to a third country. YouTube receives the information that you have accessed the corresponding page or video. In addition, the data mentioned in the YouTube data privacy policy, available at https://policies.google.com/privacy/update?hl=en&gl=en, will be transmitted. This is independent of whether you have a user account on YouTube, via which you are logged in, or whether no user account exists. If you are logged in to Google or YouTube, your information will be directly associated with your account. If you do not wish your access to be associated with your profile on YouTube, you must log out of YouTube before visiting any of our pages or content there. YouTube stores your data as usage profiles and uses them for the purposes of advertising, market research and/or the demand-driven design of its website. Such data processing takes place in particular (even for users who are not logged in) to provide user-specific advertising and to inform other users of the social network about your activities in relation to our pages and contents on YouTube. You have the right to object to the creation of these usage profiles. To exercise this right of objection, however, you must contact YouTube directly. For more information on the purpose and scope of data collection and data processing by YouTube please refer to YouTube’s data privacy policy. There you will also find further information about your rights and settings options to protect your privacy. Google and YouTube also process your personal data in the USA. Google has submitted to the EU-US Privacy Shield, https://www.privacyshield.gov/EU-US-Framework. The legal basis for the processing of data is point (f) of Article 6(1) GDPR. You have the possibility at any time to revoke your consent to the processing of personal data or to object to the processing of data which is not based on consent. However, the revocation or objection must be addressed directly to YouTube. Please refer to YouTube’s data privacy policy for further details. Alternatively, you can watch the same videos on our website. These are hosted by us and not by YouTube. Use of our Google+ company profile (data transfer to a non-EU country) We maintain a company profile at https://plus.google.com/105772690450707991408 on the social media portal plus.google.com, a web service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (Google). When you access our company profile, certain data is transferred to Google. You can find out which data is involved from the current version of the data privacy policy of Google, which can be accessed at https://policies.google.com/privacy/update?hl=en. The company info-key has no influence on these data. The legal basis for the storage of data and log files is point (f) of Article 6(1) GDPR. Under this agreement, we must provide appropriate safeguards for the protection of the data subject, on the basis of which enforceable rights and effective remedies are available to the data subject. The transfer of this usage data to Google is technically necessary for the operation of our company profile there. Consequently, there is no possibility of objection on the part of the user. However, you can exercise your right of objection by means of automated procedures in which technical specifications are used, e.g. in the case of anonymizing your IP address by using a VPN service. Your rights as the data subject You have a right of access to the personal data concerning you and to rectification or erasure or to restriction of the processing or a right to object to the processing. In addition, you have a right to data portability and a right to lodge a complaint with a supervisory authority in accordance with the description below. In cases corresponding to Article 32ff BDSG 2018, however, these claims only exist to the extent provided for under BDSG 2018. Below, these rights, as defined by the GDPR, are explained in more detail. Your right of access You have the right to obtain from us confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and the following information: the purposes of the processing; the categories of personal data concerned; the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; the existence of the right to request from us rectification or erasure of personal data or restriction of processing of personal data concerning you or to object to such processing; the right to lodge a complaint with a supervisory authority; where the personal data are not collected from you, any available information as to their source; the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you. Right to rectification You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. You have the right to request that incomplete personal data be completed by us – including by means of providing a supplementary statement – if this is compatible with the above-mentioned purposes of processing or if there is a factual reason for this. Right to erasure You have the right to obtain from us the erasure of personal data concerning you without undue delay. We are obliged to erase personal data without undue delay if one of the following grounds applies: The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1) GDPR, or point (a) of Article 9(2) GDPR, and where there is no other legal ground for the processing; you object to the processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) GDPR; the personal data have been unlawfully processed; the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which info-key is subject; the personal data have been collected in relation to the offer of information society services referred to in Article 8(1) GDPR (consent of a child in relation to information society services). If we have made the personal data public and we are obliged to erase them, we will, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you have requested the erasure by such controllers of any links to, or copy or replication of, those personal data. In accordance with Article 17(3) GDPR, however, you will not have a right to erasure where the processing is necessary: for exercising the right of freedom of expression and information; for compliance with a legal obligation which requires processing by Union or Member State law to which info-key is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3) GDPR; for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) GDPR in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing, or for the establishment, exercise or defence of legal claims. Right to restriction of processing You have the right to obtain from us restriction of processing where one of the following applies: The accuracy of the personal data is contested by you, for a period enabling us to verify the accuracy of the personal data; the processing is unlawful and you opposes the erasure of the personal data and request the restriction of their use instead; we no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims; you have objected to processing pursuant to Article 21(1) GDPR pending the verification whether our legitimate grounds override yours. Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. If you have obtained a restriction on processing, you will be informed by us before the restriction is lifted. Right to data portability You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and you have the right to transmit those data to another controller without hindrance from us, the controller to which the personal data have been provided, where the processing is based on consent pursuant to point (a) of Article 6(1) GDPR or point (a) of Article 9(2) GDPR or on a contract pursuant to point (b) of Article 6(1) GDPR; and the processing is carried out by automated means. In exercising your right to data portability pursuant to paragraph 1, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible. This right shall not adversely affect the rights and freedoms of others. The exercise of the right to data portability shall be without prejudice to Article 17 GDPR (Right to erasure / “right to be forgotten”). That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Right to object to the processing You have the right to object, on grounds relating to your particular situation, at any time, to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR (protection of the legitimate interests of the controller or a third party), including profiling based on those provisions. We will then no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or unless the processing is necessary for the establishment, exercise or defence of legal claims. Where personal data are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing. Where you object to processing for direct marketing purposes, the personal data will no longer be processed for such purposes. At the latest at the time of the first communication with you, we must explicitly bring to your attention your right to object to data processing described above; this information must be presented clearly and separately from any other information. In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications (e.g. by using caller ID blocking on the telephone, or by using browser settings like “Do Not Track”). Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1) GDPR, you, on grounds relating to your particular situation, have the right to object to processing of personal data concerning you, unless the processing is necessary for the performance of a task carried out for reasons of public interest. Right to lodge a complaint with a supervisory authority Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes the GDPR. The supervisory authority with which the complaint has been lodged shall inform you on the progress and the outcome of the complaint, including the possibility of a judicial remedy pursuant to Article 78 GDPR. — End of data privacy policy — Created by Direktkanzlei Fischer
1.1 2.1 3.1 4.1 5.1 6.1 7.1 7.2 8.1 8.2 9.1 10.1 11.1 12.1 13.1 14.1 15.1 16.1 17.1 17.2 18.1 19.1 20.1 21.1 22.1 23.1 24.1 25.1 26.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 34.1 35.1 36.1 37.1 38.1 39.1 40.1 41.1 42.1 43.1 44.1 45.1 46.1 46.2 47.1 48.1 49.1 50.1 51.1 51.2 52.1 53.1 54.1 55.1 56.1 57.1 58.1 59.1 59.2 59.3 59.4 60.1 61.1 62.1 63.1 64.1 65.1 66.1 66.2 67.1 68.1 69.1 70.1 70.2 71.1 72.1 72.2 72.3 73.1 74.1 75.1 76.1 77.1 78.1 78.2 78.3
UVODNE ODREDBE Turistička agencija „Lily Tours“ pridaje posebnu pažnju zaštiti osobnih podataka svojih klijenata, u skladu s najboljom poslovnom praksom i važećim hrvatskim i europskim propisima, uključujući i Opću uredbu o zaštiti podataka (Uredba (EU) 2016/679 Europskog parlamenta i Vijeća od 27. travnja 2016.) Cilj ove politike je pružiti svim zainteresiranim stranama sve potrebne informacije o načinu obrade i zaštite osobnih podataka i pravima koje klijenti u vezi obrade osobnih podataka imaju. PODRUČJE PRIMJENE Politika se primjenjuje na sve osobne podatke klijenata koje Turistička agencija „Lily Tours“ prikuplja i obrađuje i podataka koje prikupljaju i obrađuju partneri Turističke agencije „Lily Tours“ u ime i za potrebe „Lily Tours-a“. Klijentom se smatra osoba koja je od Turističke agencije „Lily Tours“ zatražila uslugu ili ponudu za uslugu. Osobni podatak je svaki podatak koji se odnosi na pojedinca čiji je identitet utvrđen ili se može utvrditi (Članak 4. Opće uredbe o zaštiti podataka). Obrada podataka znači svaki postupak ili skup postupaka koji se obavljaju na osobnim podacima ili na skupovima osobnih podataka (Članak 4. Opće uredbe o zaštiti podataka). NAČELA OBRADE OSOBNIH PODATAKA Zakonita, poštena i transparentna obrada Podatke obrađujemo u skladu s važećim zakonima koji se odnose na obradu osobnih podataka i u skladu s najboljom poslovnom praksom zaštite podataka. Obrada u skladu sa svrhom prikupljanja podataka Prikupljene podatke obrađujemo samo u skladu sa svrhom za koje su ti podaci prikupljeni. Ograničenje količine podataka Prikupljamo i obrađujemo samo one podatke koji su nužni za postizanje svrhe obrade. Točnost podataka Posebnu pažnju pridajemo točnosti prikupljenih podataka. Korisnik u svakom trenutku ima pravo uvida u podatke i ispravka svojih podataka. Ograničavanje vremena obrade i čuvanja podataka Podatke obrađujemo i čuvamo samo onoliko dugo koliko je potrebno za ispunjenje svrhe za koju su podaci prikupljeni ili koliko nalažu primjenjivi propisi. Sigurnost osobnih podataka Pridajemo najveću moguću pažnju sigurnosti osobnih podataka. PRAVA KLIJENATA U skladu s Općom uredbom o zaštiti podataka, klijent ima sljedeća prava: Pravo na pristup podacima Klijent ima pravo dobiti potvrdu obrađujemo li njegove osobne podatke, te ako obrađujemo, ima pravo dobiti sljedeće informacije: informaciju o svrsi obrade, o kategoriji osobnih podataka koje obrađujemo, o primateljima ili kategorijama primatelja podataka koje obrađujemo, o predviđenom razdoblju u kojem će podaci biti pohranjeni ili kriterijima za utvrđivanje tog razdoblja, o pravu da zatraži ispravak, brisanje i ograničenje obrade podataka, o pravu na podnošenje tužbe nadzornom tijelu, , informacije o sustavu za automatizirano odlučivanje, poput izrade profila, o zaštitnim mjerama ako se podaci prenose u treću zemlju. Pravo na ispravak i brisanje Klijent ima pravo ishoditi ispravak netočnih podataka. Klijent ima pravo ishoditi brisanje podataka, osim ako su podaci nužni za svrhu za koju su prikupljeni ili ih je potrebno čuvati prema važećim zakonskim propisima. Turistička agencija „Lily Tours“ ima obvezu obavijestiti klijenta o promjeni ili brisanju podataka napravljenih na zahtjev klijenta. Pravo na ograničenje obrade Klijent ima pravo ishoditi ograničenje obrade podataka, pod uvjetima definiranima u Općoj uredbi o zaštiti podataka. Turistička agencija „Lily Tours“ ima obvezu obavijestiti klijenta o ograničenju obrade napravljenom na zahtjev klijenta. Pravo na prenosivost podataka Klijent ima pravo zaprimiti podatke koje nam je dostavio u strukturiranom, uobičajenom i strojno čitljivom formatu, te ih prenijeti drugom voditelju obrade bez ograničenja. Pravo na prigovor Klijent ima u svakom trenutku pravo na prigovor na obradu osobnih podataka. Klijent ima u svakom trenutku pravo na prigovor na izravni marketing, u kom slučaju podatke više nećemo koristiti u tu svrhu. Automatizirano donošenje odluka uključujući izradu profila Klijent ima pravo da se na njega ne odnose odluke temeljene na automatiziranoj obradi, uključujući izradu profila. NAČIN PRIKUPLJANJA OSOBNIH PODATAKA Podatke o svojim klijentima prikupljamo na sljedeće načine: Prikupljanje podataka u poslovnicama Prilikom izrade rezervacije ili ponude, tražimo od korisnika osobne podatke potrebne za rezervaciju ili ponudu. Korisnik svoje podatke može ostaviti osobno, ili u ime korisnika to može napraviti druga osoba, ili nam korisnik podatke može javiti telefonom ili mailom. Privola klijenta Privola klijenta znači svako dobrovoljno, posebno, informirano i nedvosmisleno izražavanje želja ispitanika kojim on izjavom ili jasnom potvrdnom radnjom daje pristanak za obradu osobnih podataka koji se na njega odnose (Članak 4. Opće uredbe o zaštiti podataka). Bez privole klijenta nikad nećemo upotrebljavati osobne podatke klijenta ni u kakve svrhe za koje je prema važećim propisima nužna privola. VRSTE OSOBNIH PODATAKA KOJE PRIKUPLJAMO Prikupljamo samo one podatke koji su nužni za izvršenje svrhe prikupljanja podataka i u skladu s važećim zakonskim propisima. Podaci koje prikupljamo su: ime i prezime, datum rođenja djece radi ostvarivanja popusta, broj telefona i e-mail adresu radi kontakta, lokacija, spol, državljanstvo, broj putovnice ili drugog odgovarajućeg osobnog dokumenta tamo gdje je to potrebno radi izvršenja zakonskih obveza (npr. kod prelaska granice), broj kreditne kartice ili podatke o drugom sredstvu plaćanja. Zbog prirode putničkih usluga može se dogoditi potreba za obradom posebno zaštićenih kategorija osobnih podataka koji otkrivaju, primjerice, vjerska ili filozofska uvjerenja, članstvo u sindikatu i podataka koji se odnose na zdravlje klijenta i to isključivo u svrhu izvršenja ugovora između Turističke agencije „Lily Tours“ i klijenta, odnosno obavljanja radnji koje prethode sklapanju ugovora. Smatrat će se da je klijent koji je Turističkoj agenciji „Lily Tours“ dao podatak iz posebne kategorije osobnih podataka time izričito iskazao svoju privolu na obradu takvih podataka. SVRHA PRIKUPLJANJA OSOBNIH PODATAKA Osobne podatke prikupljamo u sljedeće svrhe: Radi izvršenja ugovora ili pripreme za izvršenje ugovora Osobne podatke prikupljamo kako bismo mogli izvršiti uslugu prema klijentu ili kako bismo mogli napraviti ponudu za uslugu klijentu. Radi obavještavanja korisnika o uslugama i proizvodima Ako je klijent dao privolu, podatke klijenta možemo upotrebljavati kako bismo klijenta upoznali s našim uslugama i proizvodima koji mogu biti zanimljivi klijentu. Za interne potrebe Podatke klijenta čuvamo kako bismo zaštitili legitimne interese klijenta ili naše legitimne interese, a u skladu s važećim zakonskim propisima. To na primjer može uključivati čuvanje podataka klijenta kako bismo na najbolji način mogli odgovoriti na eventualne prigovore klijenata, upotrebu podataka klijenata radi sprječavanja, otkrivanja i procesuiranja zloupotreba na štetu klijenata ili Turističke agencije „Lily Tours“, osiguravanja sigurnosti zaposlenika, klijenata, proizvoda i usluga Turističke agencije „Lily Tours“, kreiranja usluga i ponuda koje odgovaraju potrebama i željama klijenata, osiguravanja vrhunskog korisničkog iskustva, personalizirane korisničke podrške, istraživanja i analize tržišta, optimizacije prodajnih kanala itd. Pravna osnova za obradu podataka u ove svrhe jest legitiman interes Turističke agencije „Lily Tours“, osim kad su od tog interesa jači interes ili temeljna prava i slobode koje zahtijevaju zaštitu podataka klijenta i/ili pravna osnova zaštite ključnih interesa klijenta ili druge fizičke osobe. Iznimka su slučajevi kada je pravna osnova privola. U svrhu ispunjenja zakonskih obveza Na temelju pisanog zahtjeva utemeljenog na važećim propisima, Turistička agencija „Lily Tours“ je nadležnim državnim tijelima (npr. sudovima, policiji, turističkoj inspekciji itd.) obvezna dostaviti ili omogućiti pristup određenim osobnim podacima klijenata. Pravna osnova za obradu podataka u ove svrhe jest ispunjavanje zakonskih obveza Turističke agencije „Lily Tours“. PROSLJEĐIVANJE PODATAKA TREĆIM STRANAMA Podatke klijenata prosljeđujemo trećim stranama u sljedećim slučajevima: U svrhu izvršenja ugovora ili priprema za izvršenje ugovora s klijentom Podatke prosljeđujemo trećoj strani kad je to potrebno da bismo klijentu pružili ugovorenu uslugu ili tražene informacije. To na primjer uključuje slanje podataka klijenta hotelu ili prijevozniku, kada je to potrebno da bi se izvršila usluga ili napravila ponuda za uslugu. Kada je korisnik dao privolu Podatke prosljeđujemo trećoj strani ako je to potrebno za svrhu za koju je korisnik dao izričitu privolu. Kada za obavljanje pojedinih poslova angažiramo podizvođače Ako za obavljanje pojedinih poslova angažiramo podizvođače kao izvršitelje obrade, u tom slučaju prosljeđujemo osobne podatke podizvođaču. Pritom koristimo podizvođače isključivo s prostora EU i ti podizvođači rade isključivo po nalogu Turističke agencije „Lily Tours“ i po ugovoru sklopljenim s Turističkom agencijom „Lily Tours“, što osigurava mjere zaštite podatka kao da podatke obrađuje Turistička agencija „Lily Tours“. ZAŠTITA OSOBNIH PODATAKA U svrhu zaštite osobnih podataka svojih klijenata koristimo najbolje poslovne prakse u području turizma i informacijsko-komunikacijskih tehnologija. Kontinuirano prilagođavamo naše interne procese kako bismo postigli optimalnu razinu zaštite osobnih podataka. Pritom koristimo različite organizacijske mjere i tehnička sredstva zaštite podataka korisnika od neovlaštenog uvida, promjene, gubitka, krađe ili druge zloupotrebe podataka. KONTAKT Klijent može ostvariti svoja prava iz Opće uredbe o zaštiti podataka podnošenjem zahtjeva na adresu elektroničke pošte info@lily-tours.com Ako klijent sumnja na povredu svojih osobnih podataka, može poslati prijavu na adresu elektroničke pošte info@lily-tours.com Klijent također može prijavu podnijeti Agenciji za zaštitu osobnih podataka. Izmjene, dopune i prijelazne odredbe Politike Politika stupa na snagu i počinje se primjenjivati na dan objave te je dostupna na internetskim stranicama i na prodajnim mjestima Turističke agencije „Lily Tours“. O mogućim izmjenama i dopunama Politike klijenti će biti pravovremeno obaviješteni, uključujući i putem objave na internetskim stranicama. Pravo na prenosivost osobnih podataka, brisanje podataka i ograničenje obrade osobnih podataka klijent ima najkasnije od početka primjene Opće uredbe o zaštiti osobnih podataka, tj. od 25. svibnja 2018. godine.