http___www.interijer-mva.hr_politika-privatnosti__1.xml
1.1 1.2 2.1 3.1 3.2 3.3 4.1 5.1 6.1 7.1 8.1 10.1 10.2 11.1 12.1 13.1 14.1 16.1 16.2 17.1 18.1 18.2 18.3 18.4 18.5 19.1 19.2 19.3 20.1 20.2 20.3 20.4 20.5 20.6 20.7 21.1 21.2 21.3 21.4 21.5 22.1 22.2 22.3 23.1 23.2 23.3 23.4 23.5 23.6 23.7 23.8 23.9 24.1 24.2 24.3 24.4 24.5 25.1 25.2 25.3 25.4 25.5 25.6 26.1 26.2 26.3 27.1 27.2 27.3 27.4 27.5 28.1 28.2 28.3 28.4 28.5 28.6 28.7 28.8 29.1 29.2 29.3 29.4 30.1 30.2 31.1 32.1 33.1 34.1 35.1 35.2 36.1 36.2 36.3 36.4 37.1 38.1 38.2 39.1 39.2 39.3 39.4 40.1 40.2 41.1 41.2 41.3 41.4 41.5 41.6 41.7 41.8 41.9 41.10 41.11 41.12 41.13 41.14 41.15 42.1 43.1 43.2 43.3 44.1 45.1 45.2 45.3 45.4 45.5 45.6 45.7 45.8 45.9 45.10 46.1 46.2 46.3 46.4 47.1 47.2 48.1 48.2 48.3 48.4 48.5 49.1 50.1 50.2 50.3 51.1 52.1 53.1 54.1 55.1 55.2 56.1 57.1 57.2 58.1 59.1 60.1 61.1 62.1 63.1 64.1 65.1 66.1 67.1 68.1 69.1 70.1 71.1 71.2 72.1 72.2 73.1 74.1 75.1 76.1 77.1 78.1 79.1 80.1 81.1 81.2 82.1 83.1 84.1 84.2 84.3 84.4
Thank you very much for visiting our website. For aik Immobilien-Investmentgesellschaft mbH and its subsidiaries aik Management GmbH and Paik GmbH, the protection and confidentiality of your data is of great importance. We wish to inform you in this statement about the processing of personal data in connection with the services we offer at www.aik-invest.de or other websites which incorporate the statement and in the context of our operations as an investment management company and through the services of our subsidiaries. Personal data here means all the information relating to an identified or identifiable natural person (article 4 no. 1 of the EU General Data Protection Regulation, "GDPR"). This includes information such as your name, your email address, your postal address or your telephone number. It does not include information which cannot be directly connected with you individually, such as the number of users of an internet presence or website. The responsible entity within the meaning of the General Data Protection Regulation, other national data protection laws of the EU member states and other provisions of data protection law (referred to below as "aik" or "we") is: aik Immobilien-Investmentgesellschaft mbH Richard-Oskar-Mattern Str. 40545 Düsseldorf Germany Email: This email address is being protected from spambots. You need JavaScript enabled to view it. You can use the following data to contact our data protection officer: aik Immobilien-Investmentgesellschaft mbH Richard-Oskar-Mattern Str. 40545 Düsseldorf Email: This email address is being protected from spambots. You need JavaScript enabled to view it. In this section we provide information about the various purposes for which we process personal data, the legal basis for such processing and the length of time we store the data. In cases where we obtain consent for processing activities from the person affected (the data subject), article 6 (1) a) GDPR serves as the legal basis for the processing of personal data. In the case of processing personal data necessary for the performance of a contract to which the data subject is the natural person, the legal basis is provided by article 6 (1) b) GDPR. This also applies to processing activities that are necessary in order to take steps prior to entering into a contract. If the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, the legal basis is provided by article 6 (1) c) GDPR. If the processing is necessary in order to uphold a legitimate interest of our company or a third party and such interests not outweigh the fundamental rights and basic freedoms of the data subject, article 6 (1) f) GDPR serves as the legal basis for the processing. We comply with the principles of data avoidance and data minimisation. We therefore store your personal data only as long as is necessary to achieve the purposes stated above or as long as is specified by the various data retention periods laid down in statute law. When the particular purpose has ceased to exist or the data retention period has ended, the corresponding data question are routinely blocked or deleted in accordance with the relevant statutory provisions. Every time one of our websites is accessed we automatically collect data and information from the accessing device and store the said data and information in the server's log files. The data that can be collected are (1) browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which an accessing system has reached our website (the so-called referrer), (4) the sub-websites which are directed to our website via an accessing system, (5) the data and time of an access to the website, (6) an internet protocol address (IP address), (7) the internet service provider of the accessing system and (8) other similar data and information which serve the purpose of security against risks in the event of attacks on our information technology systems. For security purposes, that is, in order to identify such an attack in case of attacks on our platforms, we store these data, including the IP addresses, for a period of 14 days, and then we anonymise the IP addresses or delete the data. During the connection, the IP address is needed in order to transfer the contents of our platform to your browser. The legal basis for the processing and subsequent storage of the IP address is a legitimate interest under article 6 (1) f) GDPR. The legitimate interest with regard to the transmission of the IP address is that the address is necessary for a display of the contents of the platform; without a transfer of the IP address it is not possible to display the website. The legitimate interest in the temporary storage is our security interests. If you register for a newsletter, we use your email address or your postal address to dispatch the newsletter, which provides you with regular information on subjects of interest and our latest acquisitions. In order to ensure that your registration for the newsletter is proper and correct, that is, to prevent unauthorised registrations in the name of third parties, we will send you, after your first-time registration for the newsletter, a confirmation email as part of our double opt-in procedure, with a request for your confirmation of the registration. The legal basis is your consent under the terms of article 6 (1) a) GDPR. The legal basis for the storage of the data is a legitimate interest within the meaning of article 6 (1) f) GDPR, the legitimate interest being the possibility of providing evidence of registration. We store your email address or your postal address so as to send you the newsletter until such time as you deregister or we decide to stop sending it. If we receive an objection from you to the use of advertising, we can add your personal contact data (name, address, telephone number, fax number, email address) to a blocking list with the help of which we ensure that we no longer transmit to you any unwanted advertising. The legal basis is a legitimate interest within the meaning of article 6 (1) f) GDPR, the legitimate interest consisting in the fact that we can fulfil our obligations arising from your objection to advertising. The data will be stored for this purpose until such time as you expressly withdraw the objection in writing. Our websites make contact forms available which can be used for the purpose of electronic establishment of contact. By clicking on the "send" button you agree to the transmission to us of the data entered in the input mask. We also store the date and time you made contact. An alternative possibility for making contact is to use the email address provided. In this case what is stored is the user's personal data transmitted with the email and our reply. The personal data voluntarily transmitted to us in this connection enables us to process your enquiry and make contact with you. The legal basis for the transmission of the data is article 6 (1) a) GDPR. We use the data for this purpose until this particular email correspondence with you has ended. It is considered to be ended when the circumstances of the case make it evident that the matter in question has been finally clarified. In the context of our operations as an investment management company we conduct a large number of different transactions across the fields of real estate and capital investment. In doing so we process the personal data of companies (the data referring to business operators are only personal data in the legal sense if the business operator is a natural person) and the staff of companies. The particular companies or business operators may be in a contractual or pre-contractual relationship with us, but in individual cases we can also process the data of companies and their staff if there is no such pre-contractual relationship. In the following sections we inform you about the purposes, the particular legal basis and the storage duration of the processing of business operators or company staff, and also about the data categories in cases where we do not obtain the personal data from the data subject. The data are deleted as soon as they are no longer necessary to achieve the purpose concerned; that is to say, when there is no longer a contract with the business partners or customers and we also no longer intend to enter into a contract with the business partners or customers in question, a legitimate interest no longer exists, and we are also no longer legally obliged in other respects to retain documents which could contain personal data We process personal data for the purpose of contract management, that is, to enable us to render the contractually specified services for our business partners or customers and for the purpose of making the necessary contract preparations. If the business partner or customer is a natural person, the legal basis is that the processing is necessary for the performance of a contract or for taking steps prior to entering into a contract, as stated in article 6 (1) b) GDPR. If we process the personal data of staff of the business partner or customer, the legal basis is a legitimate interest within the meaning of article 6 (1) f) GDPR. The legitimate interest consists in conducting our business activities and those of our business partner or customer. A conflicting interest of the data subject concerned does not exist because, from the perspective of our business partner or customer, processing by us is necessary in the context of the existing employment relationship with the data subject (section 26 BDSG, German data protection act, new version). For this purpose we store personal data for the term of the contract. Furthermore, we store accounting records for a period of ten years, and business letters – that is, every communication which is concerned with the preparation, execution or cancellation of a business transaction – for a period of six years, in order to fulfil our statutory data retention obligations under section 257 (1) no. 2 HGB (German Commercial Code) and section 147 AO (German Fiscal Code). The said periods commencing at the end of the calendar year in which the business letter was received or dispatched or alternatively the accounting record was made. The legal basis is article 6 (1) c) GDPR. Acting as a point of contact, we process the personal data of our business partners or customers, prospective customers or their staff which we receive in connection with our operations as an investment management company in the context of the preparation, conclusion and execution of a contract, and also after the contract has ended. Alternatively, if no contract has been concluded, the processing is for the purpose of business and customer account management and, in the event of a new enquiry by the business partner or customer or prospective customer, in order to be able, on the basis of previously concluded contracts and the offers or enquiries received, ourselves to utilise or render appropriate services. The legal basis is a legitimate interest within the meaning of article 6 (1) f) GDPR. The legitimate interest consists in conducting our business activities. For this purpose we store personal data for as long as we can assume that the particular customer may at a future date conclude another or a first-time contract with us, which will be the case until such time as the business partner or customer concerned informs us that it will in no circumstances ever enter into a contract with us. We process personal data of our business partners or customers and customers and other business operators and companies with which we do not have a business relationship and in this connection, where appropriate, also data from the contact persons there for the purpose of providing direct advertising, insofar as legally permissible. In cases where we have not obtained these data direct from the particular data subject, we can also obtain contact data for the data subject from sources accessible to the public, such as, in particular, the website of the company concerned and classified directories. In connection with these direct advertising purposes we can also make use of the contracts concluded in the past with our business partners or customers and specific company-related information such as the size of the particular company or business operator and the sector it belongs to, in order to target the advertising as accurately as possible. The legal basis is a legitimate interest within the meaning of article 6 (1) f) GDPR. The legitimate interest consists in the processing of personal data for the purpose of direct advertising itself (see recital 47 GDPR). The data subjects have the right to object at any time to the processing of personal data affecting them for the purpose of such advertising. This objection can be lodged at any time, using the contact data specified in section 1. We store the data for this purpose for as long as we are interested in concluding a contract with the company concerned or until an objection has been entered. We use various tools including "Zoom", "Webex" and "Microsoft Teams" to conduct telephone conferences, online meetings, video conferences and/or chats (hereinafter: "online meetings"). "Zoom" is a service of Zoom Video Communications, Inc. which has its registered office in the USA. Insofar as you call up the Internet page of the respective programme, the provider in question is responsible for data processing. However, calling up the website is only necessary to download the software for using "Zoom". When using online meeting, various types of data are processed. The scope of the data also depends on the data you provide before or during participation in an "online meeting". The following personal data are subject of the processing: User information: first name, last name, telephone (optional), e-mail address, password (if "Single-Sign-On" is not used), profile picture (optional), department (optional) Meeting metadata: Subject, Description (optional), Attendee IP addresses, Device/Hardware information. For recordings (optional): MP4 file of all video, audio and presentation recordings, M4A file of all audio recordings, text file of online meeting chat. When dialling in by phone: information on incoming and outgoing phone number, country name, start and end time. If necessary, further connection data such as the IP address of the device can be saved. Text, audio and video data: You may be able to use the chat, question or survey functions in an "online meeting". To this extent, your text entries are processed in order to display and, if necessary, log them in the "online meeting". In order to enable the display of video and the playback of audio, the data from the microphone of your terminal device and from any video camera of the terminal device will be processed for the duration of the meeting. You can switch off or mute the camera or microphone yourself at any time using the "Zoom" applications. In order to participate in an "online meeting" or to enter the "meeting room", you must at least provide information about your name. If we want to record "online meetings", we will inform you of this transparently in advance and - if necessary - ask for your consent. The fact of the recording will also be displayed in the respective app. If it is necessary for the purpose of recording the results of an online meeting, we will log the chat content. However, this will usually not be the case. If you are registered as a user on "Zoom", "Webex" or "Microsoft Teams" then reports on "online meetings" (meeting metadata, phone dial-up data, questions and answers in webinars, survey function in webinars) can be stored for up to one month with the respective provider. The possibility of software-based "attention tracking" in "online meeting" tools such as "Zoom" is deactivated. Automated decision making as defined by Art. 22 DSGVO is not used. If personal data of employees of aik Immobilien-Investmentgesellschaft mbH are processed, § 26 BDSG is the legal basis for data processing. If, in connection with the use of "Zoom", personal data are not required for the establishment, execution or termination of the employment relationship, but are nevertheless an elementary component in the use of "Zoom", Art. 6 para. 1 lit. f)DSGVO is the legal basis for data processing. In these cases, we are interested in the effective conduct of "online meetings" for the purpose of conducting, for example job interviews. In other respects, the legal basis for data processing when conducting "online meetings" is Art. 6 para. 1 lit. b) DSGVO, insofar as the meetings are conducted within the framework of contractual relationships. If no contractual relationship exists, the legal basis is Art. 6 para. 1 lit. f) DSGVO. Here too, we are interested in the effective implementation of "online meetings". Recipient / passing on of data Personal data processed in connection with participation in "online meetings" will generally not provided to third parties, unless it is specifically intended to be passed on. Please note that contents from "online meetings" as well as personal meetings are often used to communicate information with customers, interested parties or third parties and are therefore intended to be passed on. Othter recipients: The respective provider of the online meeting tool necessarily receives knowledge of the above-mentioned data, insofar as this is provided for the context of our order processing contract with the provider. Data processing outside the European Union "Zoom", "Webex" and "Microsoft Teams" are services provided by providers from the USA. Processing of personal data therefore also takes place in a third country. We have concluded an order-processing contract with the respective provider which meets the requirements of Art. 28 DSGVO. The use of Zoom takes place on the basis of a commissioned data processing contract. Insofar as Zoom transfers personal data to third countries outside the EU / EEA, this shall be done in compliance with the provisions of Art. 44 et seq. DSGVO. In order to ensure a sufficient level of data protection in third countries, standard data protection clauses approved by the EU Commission have been agreed with Zoom and the respective additional recipients / sub-processors. A complete list of sub-processors used by Zoom who may access and process customer data can be found at: https://zoom.us/de-de/subprocessors.html. Cross-references (links or linkages) to contents provided by external providers must be kept distinct from our own content. By installing a link to third-party websites (hyperlinks) we do not adopt the website or its content as our own, as we cannot keep a continuous check on the content of such websites. Furthermore, the company is not responsible for the availability of these websites or their content. Use of the hyperlinks to these contents is at the user's own risk. aik is not liable for direct or indirect damage or loss suffered by the user through the use and the existence of the information on these websites. aik also has no liability for the information accessed by the user being free of viruses. We integrate YouTube videos in some of our websites. The operator of the plugins needed for the purpose is YouTube, LLC., 901 Cherry Ave., San Bruno, CA 94066, USA. If you visit a page of our website that is fitted with a YouTube plugin, you are connected to YouTube servers, so that YouTube is informed which pages you visit. Should you be logged in on your YouTube account, YouTube can attribute your surfing activity to you personally. You can prevent such attribution if you log out of your YouTube account before you visit our website. If and when a YouTube video is started, the provider installs cookies which collect information on user behaviour. If you have deactivated the storage of cookies for the Google-Ad program, you will not need to expect such cookies when you watch a YouTube video. However, YouTube also enters in other cookies information on use that does not refer to individual users. If you wish to prevent this, you need to block the storage of cookies in your browser. Further information on data protection at YouTube can be found in the provider's data protection statement at: https://www.google.de/intl/de/policies/privacy. If personal data of yours is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the responsible entity (called "controller" in the GDPR): You can require confirmation from us as to whether personal data concerning you are processed by us. If such processing is being or has been done, you can require information from us on the following: You have the right to require information as to whether the personal data concerning you are transferred to a third country or an international organisation. In this connection you can require to be informed about the appropriate safeguards laid down in article 46 GDPR in connection with the said transfer. This right to information may be restricted to the extent that it is likely to render impossible or seriously impair the achievement of the statistical purposes and the restriction is necessary for the achievement of the statistical purposes. You have the right to obtain from the controller (aik) the correction and/or completion of the processed personal data concerning you in cases where these data are incorrect and/or incomplete. The controller must carry out the correction without undue delay. Your right to correction may be restricted to the extent that it is likely to render impossible or seriously impair the achievement of the statistical purposes and the restriction is necessary for the achievement of the statistical purposes. You can require the restriction of the processing of the personal data concerning you subject to the following conditions: Where processing of the personal data concerning you has been restricted, these data will – with the exception of storage – only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a Member State. If processing has been restricted subject to the above-stated conditions, you will be informed by us before the restriction of processing is lifted. Your right to restriction of processing may be restricted to the extent that it is likely to render impossible or seriously impair the achievement of the statistical purposes, and our restriction is necessary for the achievement of the statistical purposes. You can require us to delete the personal data concerning you, and we will be obliged to delete these data without undue delay if one of the following grounds applies: Where we have made the personal data concerning you public and are obliged pursuant to article 17 (1) GDPR to delete the said data, we will, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform the entities responsible for the processing of the personal data (the controllers) that you, as the data subject, have requested the deletion by the controllers of any links to, or copy or replication of, the personal data in question. The right to deletion does not exist in cases where the processing is necessary 3.1 for exercising the right of freedom of expression and information; 3.2 for compliance with a legal obligation which requires processing by Union or Member State law to which the controller (aik) is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; 3.3 for reasons of public interest in the area of public health in accordance with article 9 (2), h) and i), GDPR and article 9 (3) GDPR; 3.4 for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with article 89 (1) GDPR in so far as the right referred to in subsection (1), above, is likely to render impossible or seriously impair the achievement of the objectives of the processing; or 3.5 for the establishment, exercise or defence of legal claims. You have the right to receive the personal data concerning you, with which you have provided us, in a structured, commonly used and machine-readable format. You also have the right to transmit the said data to another controller without hindrance from us, where In exercising this right, you also have the right to have the personal data concerning you transmitted directly from one controller to another, where technically feasible. The latter right must not adversely affect the rights and freedoms of others. The right to data portability does not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us. You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on article 6 (1) e) or f) GDPR; this shall also apply to profiling based on those provisions. We will then no longer process the personal data concerning you unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or unless the processing serves the establishment, exercise or defence of legal claims. Where the personal data concerning you are processed for direct marketing purposes you have the right to object at any time to the processing of personal data concerning you for such marketing; this shall also apply to profiling to the extent that it is related to such direct marketing. Where you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for such purposes In the context of the use of information society services – and notwithstanding Directive 2002/58/EC – you may exercise your right to object by automated means using technical specifications. You also have the right, on grounds relating to your particular situation, to object to the processing of personal data concerning you, where the data are processed for statistical purposes pursuant to article 89 (1) GDPR. Your right to object may be restricted to the extent that it is likely to render impossible or seriously impair the achievement of the statistical purposes and the restriction is necessary for the achievement of the statistical purposes. You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR. The supervisory authority with which the complaint has been lodged will inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to article 78 GDPR. We reserve the right to amend this data protection statement subject to the provisions of data protection law. You can always find the most recently amended version here or in another easily accessible place on our website. Should we intend to process your data for other purposes than those for which they were collected, we will, in compliance with the relevant statutory provisions, inform you in advance. Effective 01 May 2021
1.1 1.2 2.1 3.1 4.1 5.1 6.1 7.1 8.1 9.1 10.1 11.1 12.1 13.1 14.1 14.2 15.1 16.1 17.1 18.1 19.1 22.1 23.1 24.1 25.1 26.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 34.1 35.1 36.1 37.1 38.1 39.1 40.1 41.1 42.1 43.1 44.1 45.1 45.2 45.3 46.1 47.1 48.1 49.1 50.1 51.1 52.1 53.1 54.1 55.1 56.1 57.1 58.1 59.1 60.1 61.1 62.1 62.2 63.1 64.1 65.1 66.1 67.1 68.1 69.1 69.2 70.1 71.1 72.1 73.1 74.1 75.1 76.1 77.1 78.1 79.1 80.1 81.1 82.1 83.1 84.1 85.1 86.1 87.1 88.1 89.1 90.1 91.1 92.1 93.1 94.1 94.2 94.3 95.1 96.1 96.2 97.1 98.1 99.1 100.1 101.1 102.1 103.1 104.1 105.1 106.1 107.1 108.1 109.1 110.1 111.1 112.1 113.1 114.1 115.1 116.1 117.1 118.1 119.1 120.1 121.1 122.1 123.1 124.1 124.2 125.1 126.1 127.1 128.1 129.1 129.2 130.1 130.2 130.3 131.1 132.1 133.1 134.1 135.1 136.1 137.1 138.1 139.1 140.1 141.1 142.1 143.1 144.1 144.2 145.1 146.1 147.1 148.1 149.1 150.1 151.1 152.1 153.1 154.1 155.1 156.1 157.1 158.1 159.1 160.1 161.1 162.1 163.1 164.1 165.1 165.2 166.1 167.1 168.1 169.1 170.1 171.1 172.1 173.1 174.1 175.1 176.1 177.1 178.1 179.1 180.1 180.2 180.3 181.1 182.1 183.1 184.1 185.1 186.1 187.1 188.1 189.1 190.1 190.2 191.1 192.1 192.2 193.1 194.1 195.1 196.1 197.1 198.1 199.1 200.1 201.1 202.1 203.1 204.1 205.1 206.1 207.1 208.1 209.1 210.1 211.1 212.1 213.1 214.1 215.1 216.1 217.1 217.2 218.1 219.1 220.1 220.2 221.1 221.2 222.1 222.2 223.1 223.2 224.1 225.1 226.1 226.2 227.1 228.1 229.1 230.1 231.1 232.1 233.1 234.1 235.1 236.1 237.1 238.1 239.1 240.1 241.1 242.1 243.1 243.2 243.3 244.1 245.1 246.1 247.1 248.1 249.1 250.1 251.1 252.1 252.2 253.1 254.1 255.1 255.2 256.1 257.1 258.1 258.2 259.1 260.1 261.1 262.1 262.2 263.1 264.1 265.1 266.1 269.1 270.1 271.1 272.1 272.2 273.1 274.1 274.2 275.1 276.1 279.1 280.1 281.1 282.1 283.1 284.1 285.1 286.1 287.1 288.1 289.1 289.2 290.1 291.1 292.1 293.1 294.1
INTERIJER MVA d.o.o. / OIB: 19652126492 / 10250 Zagreb-Lučko, Vrbice 15 c POLITIKA PRIVATNOSTI INTERIJER MVA d.o.o. kao voditelj obrade osobnih podataka brine se za zaštitu Vaših osobnih podataka u skladu sa svim važećim zakonima koji reguliraju zaštitu podataka, osobito u skladu s Općom uredbom o zaštiti osobnih podataka (EU) 2016/679 (”GDPR”), te Zakonom o provedbi Opće uredbe o zaštiti podataka, a Vaše osobne podatke obrađuje samo na temelju pravnih osnova ili ako ste dali svoju suglasnost. U ovoj politici privatnosti objašnjavamo koje podatke (uključujući osobne podatke) obrađujemo, s kime ih dijelimo, koliko ih dugo čuvamo, te koja su Vaša prava vezano uz zaštitu osobnih podataka. Ova politika se odnosi na obradu Vaših osobnih podataka bilo da ste u radnom odnosu sa nama, kupac naših usluga, naš poslovni partner, posjećujete našu web stranicu ili nam šaljete upite o našim uslugama. TKO OBRAĐUJE VAŠE PODATKE INTERIJER MVA d.o.o. (u daljnjem tekstu: mi, Voditelj obrade) kao voditelj obrade Vaših podataka sa sjedištem u: Vrbice 15 c 10 250 Zagreb-Lučko Društvo zastupano po Direktorici Antoneli Bilobrk. Možete nas kontaktirati na slijedeće načine: E-mail: interijer-mva@zg.htnet.hr KOJE PODATKE OBRAĐUJEMO Ako ste naš zaposlenik obrađujemo Vaše osobne podatke: Neophodne podatke vezane za radni odnos koje prikupljamo od Vas prilikom zaposlenja, kao što su npr. spol, ime, prezime, adresa, broj telefona, datum rođenja, državljanstvo, osobni identifikacijski broj, broj osiguranika, podatke o Vašem obrazovanju i prijašnjem zaposlenju, te ostalo. Također tijekom radnog odnosa prikupljamo od Vas i podatke za ostvarivanje prava, samoinicijativno od Vas, na naš zahtjev ili zahtjev treće strane (državna tijela), i to podatke kao što su podaci o bolovanjima, promjeni prebivališta, trudnoćama, rođenju djeteta, rodiljskom i roditeljskom dopustu, invaliditetu, braku ili usporedivim promjenama osobnih statusa. Također tijekom radnog odnosa prikupljamo informacije o Vašem korištenju naše informatičke infrastrukture, npr. određene podatke o Vašem poslovnom e-mailu, pristupu internetu, korištenju fiksne i mobilne usluge ili pristup i korištenje drugih aplikacija, programa i uređaja koji Vam dajemo na raspolaganje. Dužni ste nam dati točne, gore navedene neophodne podatke, jer bez tih podataka nismo u mogućnosti ostvariti, odnosno održavati radni odnos, niti ispuniti ugovorne obveze prema Vama, pa ste tako sami odgovorni za pretrpljenu štetu nastalu zbog neispunjavanja ugovornih obveza sa naše strane, koje se dogodilo jer ste nam uskratili ili dali netočne neophodne osobne podatke. Ako od Vas dobijemo dodatne podatke, naznačiti ćemo je li pružanje takvih podataka utemeljeno na pravnoj osnovi ili pravnoj obvezi ili je neophodno za izvršavanje ugovora (osobito Vašeg ugovora o radnom odnosu). Ako ste naš kupac/poslovni partner obrađujemo Vaše osobne podatke: Naši poslovni odnosi zahtijevaju obradu podataka koji se odnose na naše kupace, a ako se ti podaci odnose na fizičku osobu, oni se smatraju osobnim podacima (ako ste npr. privatna osoba ili obrtnik i INTERIJER MVA d.o.o. / OIB: 19652126492 / 10250 Zagreb-Lučko, Vrbice 15 c i stupite u poslovni odnos s nama). Bez obzira na pravni oblik naših ugovornih partnera, obrađujemo podatke o kontakt osobama koje rade za našeg kupca. Obrađujemo opće podatke o našim kupcima i kontakt osobama, te podatke o poslovnom odnosu koji imaju s nama, a to su svi podaci koji su nam dani na raspolaganje pri uspostavljanju poslovnog odnosa ili koje smo zatražili od naših kupaca, odnosno kontakt osoba, npr. ime, adresa i kontakt podaci i sve podatke koje prikupljamo i obrađujemo u vezi s uspostavljanjem poslovnog odnosa kao što su pojedinosti u sklopljenim ugovorima. Obrađujemo osobne podatke prikupljenje tijekom poslovnog odnosa i to ne samo ažuriranjem osnovnih podataka, a to su podaci o izvršavanju ugovornih obveza naših kupaca na temelju sklopljenih ugovora, podatke koje nam priopći kupac ili kontakt osoba tijekom tijekom našeg poslovnog odnosa, samoinicijativno ili na naš zahtjev i osobne podatke koje nam je dao kupac, kontakt osoba ili treća strana tijekom našeg poslovnog odnosa. U mjeri dopuštenoj zakonom, osobne podatke kupca dobivene od treće strane, kao što su podaci o poslovnom položaju/rejtingu naših kupaca, obrađujemo ako je to potrebno za procjenu financijskih rizika (npr. kašnjenja plaćanja). Ako ste posjetitelj naše Internet (web) stranice obrađujemo Vaše osobne podatke: Našoj Internetskoj stranici možete pristupiti bez unošenja osobnih podataka (kao što su Vaše ime i prezime, poštanska adresa ili e-mail adresa). U tom slučaju također moramo obrađivati određene podatke kako bismo Vam omogućili pristup našoj Internetskoj stranici, te funkcioniranje stranice i to putem kolačića (cookies). Naša web stranica koristi samo kolačiće nužne za funkcioniranje. Na našoj web stranici možemo prikupljati podatke koji nam ne omogućuju donošenje izravnih zaključaka o Vašem identitetu, ali u određenim slučajevima, osobito u kombinaciji s drugim podacima, ti se podaci u skladu s primjenjivim zakonima o zaštiti osobnih podataka, ipak mogu smatrati osobnim podacima. Na našoj web stranici možemo prikupljati i podatke koji nam ne omogućuju da Vas, izravno ili neizravno identificiramo; to je slučaj primjerice s prikupljanjem podataka o svim korisnicima ove Internetske stranice, te se takvi statistički/skupni podaci ne smatraju osobnim podacima. Ako ste kandidat za posao obrađujemo Vaše osobne podatke: Ako ste se javili na naš oglas za posao, te nam poslali životopis, tražimo od Vas za obradu sljedeće osobne podatke: spol, ime, prezime, prebivalište, broj telefona, e-mail, datum rođenja, državljanstvo, podatke o Vašem obrazovanju i prijašnjem zaposlenju. Molimo da nam ne šaljete Vaše podatke koje nismo tražili i koji nisu potrebni za natječaj za posao, jer takve podatke odmah trajno brišemo, kao i podatke neuspješnih kandidata za posao. Ako želite da Vaš životopis zadržimo za buduće natječaje za posao, molimo navedite to u životopisu, kao i na koji rok želite da čuvamo Vaš životopis, što će se smatrati Vašom privolom za obradom Vaših podataka. Privola za obradu daje se dobrovoljno, te može biti povučena u bilo kojem trenutku što ne utječe na obradu do trenutka povlačenja. ZA KOJE SVRHE I NA KOJOJ PRAVNOJ OSNOVI OBRAĐUJEMO VAŠE OSOBNE PODATKE Obrađujemo nužne osobne podatke u svrhu radnog odnosa ili primanja u dani odnos. Pravna osnova takve obrade nalazi se u Zakonu o radu, Zakonu o isplati plaće, Zakonu o porezu na dohodak, Pravilniku o radu i ostalim važećim zakonskim propisima, kao i legitimnom interesu za ispunjavanje ugovornih obveza. Obrađujemo osobne podatke u svrhu poštivanja zakonskih obveza kojima smo podvrgnuti, a zakonske obveze mogu uključivati obvezno otkrivanje osobnih podataka tijelima socijalnog, mirovinskog i zdravstvenog osiguranja, te poreznim službama. Podatke proslijeđujemo na njihov zahtjev ili postupamo prema zakonskim odredbama. U najmanjoj mogućoj mjeri koja je potrebna, obrađujemo osobne podatke u svrhu radnog odnosa, radnog procesa, te u svrhu naših ostalih legitimnih interesa ili legitimnih interesa treće strane. INTERIJER MVA d.o.o. / OIB: 19652126492 / 10250 Zagreb-Lučko, Vrbice 15 c Legitimni interes je pravna osnova za obradu sve dok nisu jače od slobode i prava pojedinca kod pojedine obrade. Legitimni interes može uključivati: – administracija podataka o kupcima; – ostvarivanje pravnih zahtjeva ili obranu od pravnih zahtjeva; – sprečavanje, istraga, otkrivanje ili progon kaznenih djela; – održavanje sigurnosti naših sustava informacijskih tehnologija; – održavanje sigurnosti naših prostora i infrastrukture; – troškove i kontrolu broja zaposlenih u okviru odjela financija i računovodstva; – popunjavanje slobodnih radnih mjesta, promicanje zaposlenika; – dobivanje subvencija i subvencioniranog financiranja iz raspoloživih javnih izvora; – procese za zapošljavanje i razvoj karijera; – promoviranje/provedba zaštite na radu. Posebne kategorije osobnih podataka (npr. zdravstvene podatke, podatke o članstvu u sindikatu, podatke maloljetnika), obrađujemo za izvršavanje obveza i ostvarivanja Vaših prava u području radnog prava i prava o socijalnoj sigurnosti, te socijalnoj zaštiti, osim ako se obrada odnosi na osobne podatke za koje je očito da ste ih Vi javno izjavili ili je obrada nužna za uspostavu, ostvarivanje ili obranu pravnih zahtjeva ili kad god sudovi djeluju u sudbenom svojstvu. Ako nam prilikom procesa zapošljavanja ili tijekom radnog odnosa date privolu za obradu osobnih podataka, obrađujemo one osobne podatke koji su obuhvaćeni privolom i to samo i izričito u svrhe navedene u toj suglasnosti. Ne zaboravite da danu privolu možete povući u svakom trenutku kontaktiranjem voditelja obrade (nas), na bilo koji kontakt naveden u ovoj Politici, a preporučamo da nas kontaktirate na e-mail: interijer-mva@zg.htnet.hr KOLIKO DUGO ČUVAMO VAŠE PODATKE Vaše osobne podatke uglavnom čuvamo (pohranjujemo) sve dok postoji legitiman interes za zadržavanje takvih podataka (istek svrhe obrade) i dok ne prevladava Vaš interes za suzdržavanje od daljnje obrade. Ako više i ne postoji legitiman interes, podatke možemo i dalje pohranjivati ako za to postoji zakonska obveza (npr. pridržavanje zakonskih obveza o čuvanju). Osobne ćemo podatke obrisati, čak i ako ispitanik ne poduzme nikakvu akciju, čim daljnje zadržavanje više nije potrebno za potrebe za koje su podaci prikupljeni ili na drugi način obrađeni ili ako daljnje zadržavanje na neki drugi način nije dopušteno zakonom. Općenito podatke prikupljenje u tijeku radnog ili poslovnog odnosa zadržati ćemo barem do kraja radnog, odnosno poslovnog odnosa. Podaci se u svakom slučaju brišu ako su postignute svrhe prikupljanja ili obrade. To može biti tek nakon završetka poslovnog odnosa s nama. Ako se osobni podaci trebaju pohraniti zbog zakonske obveze čuvanja, oni se čuvaju do kraja odgovarajućeg razdoblja čuvanja. Ako se osobni podaci obrađuju samo u skladu sa zakonskom obvezom čuvanja, pristup takvim podacima uglavnom je ograničen, stoga su podaci dostupni samo ako je to potrebno u svrhu obveze čuvanja. ZAŠTITA PODATAKA Uzimajući u obzir troškove provedbe, te prirodu, opseg, kontekst i svrhe obrade, kao i rizik različitih razina vjerojatnosti i ozbiljnosti za prava i slobode pojedinaca, poduzimamo sve moguće, razumne, tehničke i organizacijske mjere kako bi zaštitili Vaše osobne podatke od gubitka, uništavanja, neovlaštenog pristupa i dijeljenja i to na način: – pristup Vašim osobnim podacima imaju samo naši zaposlenici kojima su te informacije potrebne da bi izvršili naše poslovne aktivnosti ili Vaše zahtjeve; – svi naši zaposlenici koji imaju pristup osobnim podacima potpisali su Izjavu o povjerljivosti; INTERIJER MVA d.o.o. / OIB: 19652126492 / 10250 Zagreb-Lučko, Vrbice 15 c – podatke spremamo u posebno odvojene foldere (posebne foldere na osobnim računalima, zasebna mjesta u zaključane ormare), sa jasno definiranim pravima pristupa; – implementirali smo odgovarajuće tehničke i organizacijske mjere kako bismo spriječili gubitak Vaših podataka, izmjenu, krađu ili pristup neovlaštene treće strane, te također koristimo backup sustav na vanjske memorije; – osigurali smo odgovarajuće fizičke, elektroničke i upravljačke sustave kojima štitimo i čuvamo podatke koje prikupljamo, koristimo kontrolu pristupa ureda i svakog zasebnog odjela, kao i kontrolu pristupa pojedinom računalu. – sa svim našim izvršiteljima obrade podataka potpisali smo Ugovor o povjerljivosti; – naša elektronička pošta automatski se briše nakon 30 dana; – pri obradi podataka koristi se podjela uloga, a osobni podaci se obrađuju samo na ograničenom broju računala unutar odjela knjigovodstva; – redovito se preispituju svrhe obrade osobnih podataka, te se provjeravaju rokovi čuvanja osobnih podataka. TKO PRIMA VAŠE PODATKE / TKO IMA PRISTUP Vaši se osobni podaci uglavnom obrađuju unutar našeg društva, u odjelu knjigovodstva, a proslijeđuju se po potrebi odjelu financija i marketinga. Na temelju koncepta upravljanja ulogama/pravima, pristup osobnim podacima ograničen je na funkcije i opseg potreban za odgovarajuću svrhu obrade. Ako je potrebno i u mjeri dopuštenoj zakonom, Vaše osobne podatke možemo proslijediti i primateljima izvan našeg društva. Takvi vanjski primatelji mogu biti: – pružatelji usluga koji nam na temelju posebnih ugovora pružaju određene usluge, uključujući i obradu osobnih podataka, kao i odobreni kooperanti naših pružatelja usluga (podizvršitelji), primjerice za usluge kao što su prikupljanje podataka, računovodstvenih usluga, pravnih usluga, usluga zaštite zdravlja i sigurnosti na radu, upravljanja ljudskim potencijalima; – privatna ili javna tijela, u mjeri u kojoj smo dužni prenositi Vaše osobne podatke na temelju zakonske obveze kojoj podliježemo; – poslovni partneri i kupci, u mjeri u kojoj je prijenos osobnih podataka (primjerice pojedinosti o Vašem poslovnom kontaktu ili osposobljenosti za određen posao) nužan za izvršavanje poslovnog odnosa i Vašeg radnog odnosa. PRIJENOS PODATAKA U ZEMLJE IZVAN EU / EGP Vaši osobni podaci obrađuju se samo unutar Europske unije ili Europskog gospodarskog prostora, a osobne podatke nemamo namjeru proslijeđivati u druge zemlje (”treće zemlje”). AUTOMATIZIRANO DONOŠENJE ODLUKA U tijeku procesa zapošljavanja i tijekom radnog odnosa ne koristimo automatsko donošenje odluka (uključujući profiliranje) u smislu članka 22. GDPR-a. Ako takve postupke primjenimo u budućnosti, obavijestiti ćemo Vas zasebno u skladu s primjenjivim zakonskim propisima. PRAVA ISPITANIKA Na temelju Opće Uredbe o zaštiti podataka (GDPR), na raspolaganju imate slijedeća prava: Pravo na prigovor Ovo pravo omogućuje Vam da prigovorite obradi Vaših osobnih podataka, u onim slučajevima kada obradu Vaših osobnih podataka vršimo na jednoj od slijedećih pravnih osnova: – zato što je obrada osobnih podataka u našem legitimnom interesu; – kako bismo izvršili ugovornu obvezu; – u znanstvene, istraživačke, marketinške ili statističke svrhe. INTERIJER MVA d.o.o. / OIB: 19652126492 / 10250 Zagreb-Lučko, Vrbice 15 c U ovim okolnostima najčešće će biti primjenjiv slučaj obrade Vaših osobnih podataka na temelju legitimnog interesa. Ako nismo u mogućnosti pokazati da imamo uvjerljivu i legitimnu osnovu za obradu Vaših osobnih podataka, a koja nadilazi Vaša prava i interese, prestat ćemo s obradom Vaših osobnih podataka. Pravo na povlačenje privole U slučajevima u kojima smo pribavili Vašu privolu za određene radnje, ovlašteni ste povući danu privolu u bilo kojem trenutku i mi ćemo prestati s korištenjem Vaših osobnih podataka u tu svrhu, osim ako smatramo da postoji alternativna pravna osnova kojom bismo opravdali daljnju obradu Vaših osobnih podataka u tu svrhu, u kojem slučaju ćemo Vas o tome obavijestiti. Pravo na pristup Ispitanik ima pravo dobiti od voditelja obrade potvrdu obrađuju li se osobni podaci koji se odnose na njega, te ako se takvi osobni podaci obrađuju, pristup osobnim podacima i sljedećim informacijama: – svrsi obrade; – kategorijama osobnih podataka o kojima je riječ; – primateljima ili kategorijama primatelja kojima su osobni podaci otkriveni ili će im biti otkriveni, osobito primateljima u trećim zemljama ili međunarodnim organizacijama; – ako je moguće, predviđenom razdoblju u kojem će osobni podaci biti pohranjeni ili ako je moguće, kriterijima korištenima za utvrđivanje tog razdoblja; – postojanju prava da se od voditelja obrade zatraži ispravak ili brisanje osobnih podataka ili ograničavanje obrade osobnih podataka koji se odnose na ispitanika ili prava na prigovor na takvu obradu; – pravo na podnošenje pritužbe nadzornom tijelu; – ako se osobni podaci ne prikupljaju od ispitanika, svakoj dostupnoj informaciji o njihovu izvoru; – postojanju automatiziranog donošenja odluka, što uključuje izradu profila; – ako se osobni podaci prenose u treću zemlju ili međunarodnu organizaciju, ispitanik ima pravo biti informiran o odgovarajućim zaštitnim mjerama u skladu s člankom 46. GDPR-a, koje se odnose na prijenos. Zato ste ovlašteni u bilo kojem trenutku zatražiti nas presliku informacija koje imamo o Vama, kao i zatražiti nas da izmijenimo, ažuriramo ili izbrišemo te podatke. Možda ćemo od Vas tražiti dodatne podatke o Vašem zahtjevu. Ako Vam omogućimo uvid u podatke koje o Vama imamo, to ćemo učiniti bez naknade, osim ako obrada zahtjeva nije ”očito neosnovana ili pretjerana”. U slučaju da zatražite dodatne preslike ovih podataka od nas, moguća je naplata razmjernog administrativnog troška. Vaš zahtjev može biti odbijen u slučajevima u kojima je to pravno i zakonski dopušteno. Pravo na brisanje (pravo na zaborav) U određenim okolnostima, ovlašteni ste zatražiti da ”izbrišemo” Vaše osobne podatke. Primjerice, ovo pravo imate u slijedećim slučajevima: – Vaši podaci nam više nisu potrebni u svrhu za koju su prikupljeni; – povukli ste privolu koju ste nam dali za obradu Vaših osobnih podataka, te nema druge pravne osnove da nastavimo s obradom Vaših osobnih podataka (u slučajevima kada je pravni temelj za obradu osobnih podataka privola); – podaci su obrađeni bez valjanje pravne osnove; – potrebno je brisanje podataka kako bismo se uskladili s našim obvezama koje proizlaze na temelju zakona; – prigovorili ste obradi osobnih podataka, a mi nismo u mogućnosti dokazati postojanje legitimne pravne osnove koja nadilazi Vaša prava i interese na temelju koje bismo bili ovlašteni nastaviti obrađivati Vaše osobne podatke. Ovlašteni smo odbiti Vaš zahtjev za brisanje podataka samo u ograničenom broju slučajeva, te ćemo Vam u takvim slučajevima detaljno obrazložiti razloge odbijanja. Pravo na ograničenje obrade U određenim okolnostima imate pravo zatražiti da ograničimo obradu Vaših osobnih podataka, primjerice, u slučaju da osporite točnost osobnih podataka koje imamo o Vama ili ako prigovorite obradi Vaših osobnih podataka na temelju našeg legitimnog interesa. Ako smo podijelili Vaše osobne INTERIJER MVA d.o.o. / OIB: 19652126492 / 10250 Zagreb-Lučko, Vrbice 15 c podatke s trećim osobama, obavijestiti ćemo ih o ograničenju obrade, osim ako to nije moguće ili bi izazvalo nerazmjerne teškoće. Obavijestiti ćemo Vas o bilo kakvom prestanku ograničenja u obradi Vaših osobnih podataka. Pravo na ispravak Imate pravo zatražiti ispravak bilo koje netočne ili nepotpune informacije koje imamo o Vama. slučaju da smo podatke o Vama podijelili s trećim osobama, obavijestiti ćemo ih o ispravku, osim ako to nije moguće ili bi izazvalo nerazmjerne teškoće. Ovlašteni ste i zatražiti podatke o trećim osobama kojima smo ustupili netočne ili nepotpune osobne podatke. U slučaju da smatramo da nije razumno moguće postupiti po Vašem zahtjevu, o tome ćemo Vas obavijestiti, te ćemo obrazložiti razloge takve odluke. Pravo na prijenos Imate pravo zatražiti prijenos Vaših osobnih podataka drugom voditelju obrade. Ovo pravo zapravo znači da je moguće tražiti da Vaši osobni podaci budu ustupljeni, odnosno preneseni trećoj osobi. Kako bismo Vam to omogućili ustupiti ćemo Vam podatke o Vama u uobičajenom, strojno čitljivom obliku, tako da osobne podatke možete prenjeti trećoj osobi. Takav prijenos je moguć ako se obrada temelji na privoli ili na ugovoru, te se obrada provodi automatiziranim putem. Pravo na pritužbu U svakom trenutku možete podnjeti pritužbu nadzornom tijelu za zaštitu osobnih podataka, ako mislite da su povrijeđena Vaša prava ili niste dobili od nas informacije o obradi Vaših podataka. U Hrvatskoj je to Agencija za zaštitu osobnih podataka (AZOP), koju je moguće kontaktirati na slijedeći način: Agencija za zaštitu osobnih podataka Martićeva ulica 14 10 000 Zagreb E-mail: azop@azop.hr Kako nas kontaktirati U slučaju da želite iskoristiti neko od navedenih prava ili povući privolu koju ste dali za obradu Vaših osobnih podataka, možete nas kontaktirati na kontakt podatke navedene u ovoj Politici. Molimo Vas da primite na znanje da ćemo čuvati zapis o našoj komunikaciji u svrhu ostvarivanja Vaših prava ili davanja Vam informacija o obradi Vaših podataka. Odgovor na Vaš upit dali ćemo najkasnije u roku 30 dana. Možete nas u svako doba kontaktirati na slijedeći način: E-mail: interijer-mva@zg.htnet.hr ZAVRŠNE ODREDBE – U slučaju pritužbi vezanih uz pridržavanje odredbi ove Politike i drugih zakonskih propisa iz područja zaštite osobnih podataka, istražiti ćemo u potpunosti sve elemente pritužbe, te ćemo ih pokušati rješiti u najkraćem mogućem roku. – Ova Politika privatnosti podložna je promjenama zbog uvođenja novih tehnologija i novih obrada podataka, te će aktualna verzija biti na našoj Internet stranici, a ako će promjene ove Politike utjecati na Vaša prava i slobode, biti ćete pravovremeno obaviješteni. – Ova Politika je obavezujuća za sve zaposlenike društva INTERIJER MVA d.o.o. kao i izvršitelje obrade koje angažira INTERIJER MVA d.o.o, te izvršitelje izvršitelja (podizvršitelji). INTERIJER MVA d.o.o. / OIB: 19652126492 / 10250 Zagreb-Lučko, Vrbice 15 c – Svako nepridržavanje ove Politike privatnosti od strane zaposlenika, smatrati će se povredom radne obveze. – Svako nepridržavanje ove Politike privatnosti od strane izvršitelja obrade, rezultirati će raskidom poslovne suradnje. Ova Politika privatnosti stupa na snagu 25.05.2018. godine.