http___www.kbz.hr_kreditna-banka-zagreb_gdpr-kbz_1.xml
1.1 1.2 2.1 2.2 2.3 2.4 3.1 3.2 3.3 4.1 5.1 6.1 7.1 7.2 9.1 10.1 11.1 12.1 12.2 13.1 14.1 15.1 15.2 16.1 16.2 16.3 17.1 17.2 18.1 18.2 18.3 18.4 19.1 19.2 19.3 19.4 19.5 19.6 19.7 20.1 21.1 22.1 22.2 23.1 23.2 24.1 25.1 25.2 26.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 34.1 35.1 36.1 37.1 38.1 38.2 39.1 40.1 41.1 42.1 43.1 44.1 45.1 46.1 47.1 48.1 49.1 50.1 51.1 52.1 53.1 54.1 55.1 56.1 57.1 57.2 58.1 59.1 60.1 61.1 62.1 63.1 64.1 65.1 66.1 67.1 68.1 69.1 70.1 71.1 72.1 73.1 74.1 75.1 76.1 77.1 78.1 79.1 80.1 81.1 82.1 83.1 84.1 85.1 86.1 87.1 88.1 89.1 90.1 91.1 92.1 93.1 94.1 95.1 96.1 97.1 98.1 99.1 100.1 101.1 102.1 103.1 104.1 105.1 106.1 107.1 107.2 108.1 109.1 110.1 111.1 112.1 113.1 114.1 115.1 116.1 117.1 118.1 119.1 120.1 121.1 122.1 123.1 124.1 125.1 126.1 127.1 128.1 129.1 130.1 131.1 132.1 133.1 134.1 135.1 136.1 136.2 137.1 138.1 139.1 140.1 141.1 142.1 142.2 143.1 144.1 145.1 146.1 146.2 147.1 148.1 148.2 149.1 149.2 150.1 150.2 151.1 152.1 153.1 153.2 154.1 154.2 154.3 155.1 156.1 156.2
Thank you for visiting our website. The protection and confidentiality of your personal data is of particular importance for Chaos Software Ltd. In this document we will inform you about the processing of personal data in connection with the products and services we offer at www.chaosgroup.com and other websites or apps (collectively referred to as “Platforms”) that incorporate this Data Protection Policy. Personal data comprises all information that relates to an identified or identifiable natural person (Article 4 (1) GDPR). This includes information such as your name, e-mail address, postal address, or telephone number. Information that is not directly associated with your identity, e.g. the number of users of an Internet site, does not fall within this scope. Chaos Software respects the privacy of all users of our products and services. The present privacy policy describes the ways and the terms under which Chaos and its subsidiaries process and use your personal data. We recommend you to read this privacy policy so that you understand our approach towards the processing and use of your personal data. Governing law applicable to this Privacy Policy is the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (‘General Data Protection Regulation’ or ‘GDPR’) and the Bulgarian law, and any and all disputes as regards our relationships under this Privacy Policy will be settled as provided for by the governing law. The data controller (hereinafter referred to as “Chaos Software” or “We”) in the sense of the GDPR and other national data protection laws of the member states as well as other data protection regulations is: Chaos Software Ltd, UIC 131375768, a limited liability company incorporated under the laws of Republic of Bulgaria. Address: Bulgaria, Sofia 1729, Mladost district, Bld. B, fl. 2 Mail: dpo@chaosgroup.com Your personal data may be collected in relation to the access and use of our website, the licenses acquisition by you for the use of our products, and in relation to the provision of services to you. We will handle any information collected thereby, with the due care and according to our obligations of a personal data controller. Our products are not aimed at children under 14 years old and we will not deliberately collect, use, provide or process in any other form any personal information of children under the age of 14. We therefore also ask you, if you are under 14 years old, please do not send us your personal information (for example, your name, address and email address). If you are under 14 years old and you nevertheless wish to ask a question or use our products in any way which requires you to submit your personal information, please get your parent or guardian to do so on your behalf. Chaos Software has developed a privacy notice aimed to all users of our products and services providing the following information: Our privacy notice is available on the following link: www.chaosgroup.com/privacy . If you have not read and acknowledged the information in our privacy notice, please do so at your earliest convenience. Chaos Software has developed and implemented a policy for data subjects’ rights. If you wish to exercise one of the rights provided by the GDPR and explained in the privacy notice, you should check our policy for data subjects’ rights at: www.chaosgroup.com/privacy. In the policy you shall find useful information about the rules and procedures applied by Chaos Software when a request for exercising of a data subject’s right is received. Where the processing of your personal data is based on consent and there is no other legal ground for processing, every user has the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. You may withdraw the consent provided by you by contacting us or our data protection officer at the addresses provided in the last section of this privacy policy. To optimize our products and services we may wish to use your personal data for direct marketing. As we respect your privacy we will only use your personal data for this purpose when you are aware thereof and if required we will request your consent prior to using your personal data for direct marketing. If at any time you wish us to stop using your information for direct marketing, please contact us as set out below. We will stop the use of your information for such purposes as soon as it is reasonably possible to do so. Please note that some of our sites, products and services include links to sites, products or services of third parties that have privacy practices different from ours. If you submit personal information to any of those sites or services, your information is governed by the privacy statements of those third parties. In addition, the collected personal data may (occasionally) be transferred to selected third parties, which may be located outside of the Economic European Area (“EEA”) in relation to the services provided to you by us or by our agents and distributors. By way of example, this may happen if any of our servers are from time to time located in a country outside of the EEA or one of our service providers is located in a country outside of the EEA. These third parties will not use your personal information for any other purposes than what we have agreed with them. We request those third parties to implement adequate levels of protection in order to safeguard your personal information. We respect your personal information and therefore, we will take steps to ensure that your privacy rights continue to be protected if we transfer your information outside of the EEA in this way. For more information on the appropriate or suitable safeguards to international data transfers outside of the EEA please check our privacy notice at: www.chaosgroup.com/privacy Except as set out in this privacy policy, we will not disclose any personally identifiable information without your permission unless we are legally entitled or required to do so (for example, if required to do so by legal process or for the purposes of prevention of fraud or other crime), or if we believe that such action is necessary to protect and/or defend our rights, property or personal safety and those of our users/customers or other individuals. We may automatically collect non-personal information about you such as your country, OS, screen resolution, type of internet browser you are using and their versions, or the website from which you landed on our website and your interactions with the website such as clicks, scroll, etc. You cannot be identified from this information and it is only used to assist us in providing an effective service on this website. We aim to keep our information about you as accurate as possible. If you would like to review, change or delete the details you have supplied us with, please contact us as set out below. We have implemented technology and policies with the objective of protecting your privacy from unauthorized access and improper use and will update these measures as new technology becomes available, as appropriate. This Policy (“The Policy”) describes the terms and conditions under which natural persons whose personal data are processed by Chaos Software Ltd. ("Chaos Software ", “The Company”) may exercise their rights under the personal data protection legislation. Part 1: General Principles Chaos Software processes and protects personal data collected throughout its activities transparently, lawfully and according to the purposes for which the personal data were collected. The employees who process personal data for the purposes of sale of software products or clients’ support, as well as the employees who processes personal data of other employees or partners (natural persons) of Chaos Software as part of their employment relationship are obliged to adhere to the following principles of data processing: i) The personal data are processed lawfully and in good faith; ii) The personal data are collected for specific precise and lawful purposes and are not processed additionally in a manner not compatible with those purposes. iii) The personal data which are collected and processed for management of human resources are compatible, related to and limited to the purposes for which they are processed. iv) The personal data are accurate and, if necessary, updated. v) The personal data are being deleted or rectified when it is established that they are inaccurate or not limited for the purposes for which they are being processed. vi) Personal data are maintained in a format, which allows identifying of the respective natural person for a period not longer than the one necessary for the purposes for which the data were collected. The employees who process personal data are subject to an initial and periodic data privacy training and are familiarized with the applicable data privacy legislation. Part 2: Definitions The terms listed below shall have the following meaning: “Personal data” means any information relating to an identified or identifiable natural person (‘data subject’). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; “Applicable legislation” means the legislation of the European Union (EU) and in particular the legislation of Republic of Bulgaria, which is applicable towards the personal data protection. “Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements; “Data subject” means an individual (natural person) who can be identified directly or indirectly, in particular by an identifier such as name, identification number, location data, online identifier or one or more physical, physiological, genetic, mental, economic, cultural or social identifiers of that individual “Regulation (EU) 2016/679“ or “GDPR” means Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). Part 3: Data subjects’ rights The data subjects shall have the following rights regarding to their personal data processed by Chaos Software: i) Right of access; ii) Right of rectification; iii) Right to data portability; iv) Right of erasure (‘right to be forgotten’); v) Right to restriction of processing; vi) Right to object against the processing of personal data; vii) Right not to be subject to a decision based solely on automated processing, including profiling. Right of Access When requested Chaos Software shall present to the data subject the following information: i) information whether Chaos Software processes personal data of the data subject who made the request or not; ii) copy of the personal data of the person which are processed by Chaos Software and iii) explanation about the processed personal data The explanation under item 2.1. (iii) above shall include the following information about the personal data processed by Chaos Software: i) purposes of processing; ii) respective categories of personal data; iii) recipients or categories of recipients to which personal data is or may be disclosed, in particular recipients in third countries outside of the EU or the European Economic Area; iv) when it is possible, the envisaged retention period for which the personal data shall be retained and when this is impossible the criteria used for determining such period; v) the existing of the rights to require correction, rectification, erasure or restriction of processing of personal data related to the data subject as well as the right to object against the processing of personal data; vi) the right to file a complaint before the respective authorities; vii) when the personal data are not collected through the individual full information shall be provided about the source of the collected personal data; viii) the existence of automated decision making regardless of which this processing includes profiling and information related to the logic as well as the expected consequences from this processing to the data subject; ix) when personal data is transferred to a third country or to an international organization the data subject shall have the right to be informed about the applicable safeguards to his/hers personal data related to the transfer The explanation about the processed personal data contains information which Chaos Software provides to the data subject by presenting a privacy notice. Based on a request by the data subject Chaos Software may provide a copy of the personal data, which The Company is processing about the respective data subject. When providing a copy of personal data Chaos Software shall not disclose to the subject the following categories of data: i) personal data of third parties, unless the said parties have given their explicit consent for this; ii) data which can be qualified as trade secret, intellectual property or confidential information; iii) other information which is protected under the applicable legislation Granting the right of access to data subjects shall not interfere negatively to the rights of third parties or lead to a breach of Chaos Software’s statutory obligation. When the requests for access are being manifestly unfounded or excessive, especially because of their repeatability, Chaos Software may charge a reasonable fee based on the administrative costs of providing the information or refuse to respond to the request for access. Chaos Software determines on a case-by-case basis whether a request for access is manifestly unfounded or excessive. When refusing access to personal data, Chaos Software issues an official explanation for its refusal and informs the data subject of his right to file a complaint with the Personal Data Protection Commission (CPDP). Right of rectification Data subjects may request that their personal data processed by Chaos Software be corrected if the data are inaccurate or incomplete. Upon a satisfactory request for correcting personal data, Chaos Software shall notify the other recipients to whom personal data have been disclosed (such as government bodies, service providers) so that they can reflect the changes. Right of erasure (‘right to be forgotten’) Upon request, Chaos Software shall erase all personal information of the data subject who made the request in case any of the following grounds apply: i) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; ii) he data subject withdraws consent on which the processing is based and where there is no other legal ground for the processing; iii) the data subject objects to the processing and there are no overriding legitimate grounds for the processing; iv) the data subject objects to the processing of personal data for the puproses of direct marketing; v) the personal data have been unlawfully processed; vi) the personal data must be erased for compliance with a legal obligation in Union or Member State law to which Chaos Software is subject; vii) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1) of the GDPR. Chaos Software is not obliged to erase and may continue processing the personal data as long as the processing is necessary for one of the following grounds: i) for exercising of the right of freedom of expression and information; ii) for compliance with a legal obligation of Chaos Software; iii) for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3) of the GDPR; iv) or archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing ; or v) for the establishment, exercise or defense of legal claims. Right to restriction of processing The data subject has the right to request a restriction of processing when one of the following applies: i) the accuracy of the personal data is contested by the data subject, for a period enabling Chaos Software to verify the accuracy of the personal data; ii) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; iii) Chaos Software no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defense of legal claims; iv) the data subject has objected to processing based on the legitimate interest of Chaos Software pending the verification whether the legitimate grounds of the controller override those of the data subject; Chaos Software may process personal data whose processing is restricted only for the following purposes: i) storage purposes ii) if explicit consent is provided by the data subject; iii) or the establishment, exercise or defense of legal claims; iv) for the protection of the rights of another natural or legal person ; or v) or reasons of important public interest of the Union or of a Member State When a data subject has requested a restriction of the processing and there is one of the grounds under Art. above, Chaos Software informs the data subject before the restriction of the processing is lifted. Right to data portability The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to Chaos Software, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where. Upon request, the personal data may be transferred to another administrator designated by the data subject where this is technically feasible. The data subject may exercise the right of portability in the following cases: i) the processing is based on the consent of the data subject; ii) the processing is based on a contractual obligation; iii) the processing is carried out by automated means. The right of data portability cannot adversely affect the rights and freedoms of others. Right to object The data subject shall have the right to object against the processing of his/hers personal data by Chaos Software if the data are processed based on one of the following grounds: i) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; ii) processing is necessary for the purposes of the legitimate interests pursued by Chaos Software; iii) the processing includes profiling Chaos Software shall no longer process the personal data when the right to object is exercised by a data subject unless the Company demonstrates compelling legitimate grounds for the processing, which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims. Right to object against processing for the purposes of direct marketing Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes. Right of human intervention in the process of automated decision making Where Chaos Software uses automated decision making, regardless of whether it includes profiling and this decision making process have legal consequences for, or significantly affect natural persons, in a similar way, such persons may request a review of the decision with human intervention and express their point of view. Chaos Software provides information to natural persons subject to automated decision making about the logic as well as the meaning and envisaged consequences of such processing when a request for such information is made. Part 4: Procedure for exercising the rights of data subjects All data subjects may exercise the rights under this Polict by submitting a request for the exercise of the relevant right. Requests to exercise the data subjects’ rights shall be made in one of the following manners: i) By email to the following email address dpo@chaosgroup.com ii) At the office of Chaos Software iii) By mail to the following address: 147 Tsarigradsko Shose Blvd., fl. 4, Sofia Bulgaria, 1784. The request for the exercise of rights relating to the personal data of the data subject should contain the following information: Chaos Software provides information on the actions taken in relation to a request for the exercise of the rights of the data subjects within one month of the receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. Chaos Software shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Chaos Software is not obliged to respond to a request if it is unable to identify the data subject. Chaos Software may request the provision of additional information necessary to verify the identity of the data subject when there are reasonable concerns about the identity of the requesting individual. Where the data subject makes the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject. With the following privacy notice Chaos Software (“Chaos Software”, “We”, “The Company”) provides information about the personal data, which may be processed in the course of registration of Chaos ID account, usage of free trials and demo versions of software products, as well as purchasing of software products and services provided by Chaos Software. This privacy notice is an addition to the Privacy Policy, which stipulates the rules and procedures of data processing regarding the personal data of our clients and users collected through our websites. This privacy notice aims to help you understand how and why we may use your personal information. The tables and examples listed below are illustrative, non-exhaustive, and not fully representative for any client or user who provides personal data to the Company. “Personal data” means any information relating to an identified or identifiable natural person (‘data subject’) including such data, which may be subject to a specific protection under the applicable local and European data protection legislation. The personal data, which is processed for clients and users of Chaos Software are as follows: The personal data provided by you shall be used for the following purposes, including but not limited to: Chaos Software respects your privacy and keeps your data secured. Subject to statutory requirements, Chaos Software may disclose your personal data to the following persons: Is your personal data shared in countries outside the European Union and the European Economic Area? Chaos Software uses Microsoft, Google, ClickDimensions, Mailchimp, Hotjar and GoToWebinar services to build and run its technical infrastructure. As part of this process, your personal data may be stored on servers owned by Microsoft, Google, ClickDimensions, Mailchimp, Hotjar or GoToWebinar physically located in the United States. It is important to know that your personal data may only be stored on those servers for storage purposes as part of the contracts between Chaos Software and Microsoft, Google, ClickDimensions, Mailchimp, Hotjar or GoToWebinar, which contain clauses guaranteeing an adequate level of protection. Also at the time of introduction to this notification policy as Microsoft, Google, ClickDimensions, Mailchimp, Hotjar and GoToWebinarare certified under "Privacy Shield Framework" ( "Shield of personal data") which is a mechanism for the protection of personal data, approved by the European Commission Case 12 July 2016 (more information can be found here: http://eur-lex.europa.eu/legal-content/BG/TXT/?uri=CELEX:32016D1250). Also, some of the companies, part of the corporate group of Chaos Software are established and operate in the US. Your personal data could be disclosed to these companies on the basis of the legitimate interest of Chaos Software only after the companies in question have taken full assurance that they can offer adequate protection of the personal data they have provided. Chaos Software stores your data for the purposes of maintaining Chaos ID and administering contractual relationships with you as follows: Subject to Bulgarian law, you have the following rights to your personal data processed by Chaos Software: Detailed information on the terms and conditions under which you can exercise your rights can be found in the Privacy Policy of Chaos Software on our website at www.chaosgroup.com/privacy. You also have the right to file a complaint with the Personal Data Protection Commission when the relevant prerequisites are in place. You can contact us at the following address: Bulgaria, Sofia 1784, Bulgaria, Sofia 1784, Mladost, bl. 548, ent. B, floor 2, apt. 201, 202, 203, e-mail: dpo@chaosgroup.com Our Data Privacy Officer is Mr. Lenko Ressilovski. This notice may be updated periodically to reflect changes in the privacy practices of Chaos Software customers. The Company undertakes to notify you of all material changes to this notification.
1.1 2.1 3.1 4.1 4.2 4.3 4.4 5.1 6.1 7.1 7.2 7.3 7.4 8.1 9.1 9.2 9.3 10.1 10.2 10.3 10.4 11.1 12.1 13.1 13.2 14.1 15.1 16.1 17.1 18.1 19.1 20.1 21.1 22.1 23.1 24.1 25.1 26.1 27.1 28.1 29.1
Odabirom poveznice s desne strane (Izjava) pristupit ćete Izjavi o zaštiti privatnosti na internetskim stranicama Kreditne banke Zagreb d.d. OPĆA UREDBA O ZAŠTITI PODATAKA Uredba (EU) 2016/679 Europskog parlamenta i Vijeća od 27. travnja 2016. o zaštiti pojedinaca u vezi s obradom osobnih podataka i o slobodnom kretanju takvih podataka (dalje u nastavku: Uredba), primjenjivat će se u Republici Hrvatskoj od 25. svibnja 2018. godine. Uredba predstavlja bitan napredak u području zaštite osobnih podataka kojom se osigurava zaštita prava i temeljnih sloboda pojedinaca u vezi s obradom njihovih osobnih podataka. Isto tako, utvrđuju se pravila povezana u pogledu obrade osobnih podataka i pravila povezana sa slobodnim kretanjem osobnih podataka. Nadalje, općom Uredbom se osigurava ujednačeno i jednoobrazno postupanje nadzornih tijela za zaštitu osobnih podataka, što će imati za posljedicu jednostavniju i jednaku zaštitu prava svih pojedinaca u Europskoj uniji. Uredba propisuje prava pojedinca, obveze Banke koja obrađuju osobne podatke kao voditelja obrade, odnosno izvršitelja. Uredba se primjenjuje na sve državne institucije koje su dužne obrađivati osobne podatke u okviru njenih odredaba, osim u slučajevima obrade osobnih podataka koju obavljaju nadležna tijela u svrhu sprečavanja, istrage, otkrivanja ili progona kaznenih djela ili izvršavanja kaznenih sankcija, uključujući zaštitu od prijetnji javnoj sigurnosti i njihova sprečavanja. OSOBNI PODACI U SMISLU OPĆE UREDBE Osobni podaci su svi podaci koji se odnose na pojedinca čiji je identitet utvrđen ili se može utvrditi. Pojedinac čiji se identitet može utvrditi jest osoba koja se može identificirati izravno ili neizravno, osobito uz pomoć identifikatora kao što su ime, identifikacijski broj, podaci o lokaciji, mrežni identifikator ili uz pomoć jednog ili više čimbenika svojstvenih za fizički, fiziološki, genetski, mentalni, ekonomski, kulturni ili socijalni identitet tog pojedinca. Jako je širok spektar što su osobni podaci, jednostavnije rečeno to su: ime i prezime, email adresa, slika, bankovni podaci, identifikacijski broj, glas, adresa, broj telefona, IP adresa, objava na društvenim mrežama, povijest bolesti, popis najdraže literature ili pjesme, ako takvi podaci mogu fizičku osobu čiji se identitet može utvrditi, dovesti do izravnog ili neizravnog identificiranja uz pomoć pojedinog identifikatora. Neposredno prije prikupljanja osobnih podataka subjekt koji ih prikuplja ima obvezu pružanja informacija u koju svrhu se podaci prikupljaju, na temelju koje pravne osnove, komu se podaci otkrivaju te o pravu pojedinca da svojim podacima pristupi, da zahtijeva njihov ispravak ili eventualno brisanje. OBRADA OSOBNIH PODATAKA Obrada osobnih podataka trebala bi biti osmišljena tako da bude u službi čovječanstva. Pravo na zaštitu osobnih podataka nije apsolutno pravo, mora ga se razmatrati u vezi s njegovom funkcijom u društvu te ga treba ujednačiti s drugim temeljnim pravima u skladu s načelom proporcionalnosti. Ovom se Uredbom poštuju sva temeljna prava i uvažavaju slobode i načela priznata Poveljom koja su sadržana u ugovorima, osobito poštovanje privatnog i obiteljskog života, doma i komuniciranja, zaštita osobnih podataka, sloboda mišljenja, savjesti i vjeroispovijedi, sloboda izražavanja i informiranja, sloboda poduzetništva, pravo na učinkoviti pravni lijek i pošteno suđenje te pravo na kulturnu, vjersku i jezičnu raznolikost. Obrada obuhvaća radnje poput prikupljanja, bilježenja, čuvanja, uvida, otkrivanja, prenošenja ili uništavanja. Svaka obrada osobnih podataka trebala bi biti zakonita i poštena. Za pojedince bi trebalo biti transparentno kako se osobni podaci koji se odnose na njih prikupljaju, upotrebljavaju, daju na uvid ili na drugi način obrađuju, kao i do koje se mjere ti osobni podaci obrađuju ili će se obrađivati. Načelom transparentnosti traži se da svaka informacija i komunikacija u vezi s obradom tih osobnih podataka bude lako dostupna i razumljiva te da se upotrebljava jasan i jednostavan jezik. PRAVNI TEMELJ OBRADE Za zakonitu obradu osobnih podataka potrebno je ispuniti barem jedan od narednih pravnih temelja: - (a) ispitanik je dao privolu za obradu svojih osobnih podataka u jednu ili više posebnih svrha - privola je dobrovoljan, poseban, informiran i nedvosmislen pristanak ispitanika na obradu osobnih podataka koji se odnose na njega, poput pisane izjave, uključujući elektroničku, ili usmenu izjavu. Uredbom se među ostalim utvrđuje da uvjet dobrovoljnosti nije ispunjen ako ispitanik nema istinski ili slobodan izbor ili ako nije u mogućnosti odbiti ili povući privolu bez posljedica - (b) obrada je nužna za izvršavanje ugovora u kojem je ispitanik stranka ili kako bi se poduzele radnje na zahtjev ispitanika prije sklapanja ugovora (npr. obrada podataka klijenta radi izvršenja ugovora o kreditu ili obrada podataka klijenta radi sklapanja neke usluge) - (c) obrada je nužna radi poštovanja pravnih obveza voditelja obrade (npr. slanje podataka o radnicima HZZO-u ili HZMO-u ili slanje podataka stranaka od strane javnog bilježnika Poreznoj upravi sukladno posebnim propisima) - (d) obrada je nužna da bi se zaštitili ključni interesi ispitanika ili druge fizičke osobe (npr. otkrivanje od strane nadležnih tijela podataka jednog roditelja drugomu radi uzdržavanja djeteta) - (e) obrada je nužna za izvršavanje zadaće od javnog interesa ili pri izvršavanju službene ovlasti voditelja obrade (npr. zbog službene ovlasti Državnog zavoda za statistiku pojedini voditelji obrade su dužni tom zavodu dostavljati određene osobne podatke) - (f) obrada je nužna za potrebe legitimnih interesa voditelja obrade ili treće strane, osim kada su od tih interesa jači interesi ili temeljna prava i slobode ispitanika koji zahtijevaju zaštitu osobnih podataka, osobito ako je ispitanik dijete, s time da se ova točka ne odnosi na obradu koju provode tijela javne vlasti pri izvršavanju svojih zadaća (npr. legitimni interes vlasnika nekretnine da postavi sustav video nazora da bi spriječio realan rizik po njegovoj imovini) PRAVA POTROŠAČA/ISPITANIKA U sklopu Opće uredbe definirana su i karakteristična prava: - Transparentnost - pružanje informacija prilikom prikupljanja osobnih podatak kada voditelj obrade mora među ostalim informacijama obavijestiti ispitanika i o svojem identitetu i kontakt podacima, svrhama obrade i pravnoj osnovi za obradu podataka, primateljima, iznošenju u treće zemlje, razdoblju pohrane, mogućnosti povlačenja privole itd. - Pristup podacima - dobiti od voditelja obrade potvrdu obrađuju li se osobni podaci koji se odnose na njega te ako se takvi osobni podaci obrađuju, pristup osobnim podacima i informacije, među ostalim, o obrađenim osobnim podacima, o svrsi obrade, roku pohrane, iznošenju u treće zemlje itd. - Pravo na ispravak - ispitanik ima pravo zahtijevati ispravak netočnih osobnih podataka koji se na njega odnose, a uzimajući u obzir svrhe obrade, ispitanik ima pravo dopuniti nepotpune osobne podatke, među ostalim i davanjem dodatne izjave - Brisanje („pravo na zaborav“) - ispitanik ima pravo od voditelja obrade ishoditi brisanje osobnih podataka koji se na njega odnose bez nepotrebnog odgađanja te voditelj obrade ima obvezu obrisati osobne podatke bez nepotrebnog odgađanja ako, među ostalim, osobni podaci više nisu nužni u odnosu na svrhu obrade, ili je ispitanik povukao privolu za obradu, ili su osobni podaci nezakonito obrađeni - Pravo na ograničenje obrade - u pojedinim situacijama (npr. kada je točnost podataka osporavana ili kada pravom na brisanje ispitanik želi da voditelj obrade zadrži njegove podatke) ispitanik ima pravo zahtijevati da se obrada ograniči uz iznimku pohrane i nekih drugih vrsta obrade - Pravo na prenosivost - ispitanik ima pravo zaprimiti svoje osobne podatke, a koje je pružio voditelju obrade, uobičajeno upotrebljavanom i strojno čitljivom formatu te ima pravo prenijeti te podatke drugom voditelju obrade bez ometanja od strane voditelja obrade kojem su osobni podaci pruženi, ako se obrada temelji na privoli ili ugovoru i provodi automatiziranim putem - Pravo na prigovor - ispitanik ima pravo uložiti prigovor na obradu osobnih podataka ako se ista temelji na zadaće od javnog interesa, na izvršavanje službenih ovlasti voditelja obrade ili na legitimne interesa voditelja obrade (uključujući i profiliranje), tada voditelj obrade ne može više obrađivati osobne podatke ispitanika osim ako dokaže da njegovi legitimni razlozi za obradu nadilaze interese ispitanika te radi zaštite pravnih zahtjeva, također ako se ispitanik protivi obradi za potrebe izravnog marketinga, osobni podaci više se ne smiju obrađivati - Pravo usprotiviti se na automatizirano pojedinačno donošenje odluka, uključujući izradu profila (profiliranje) - pravo usprotiviti se donošenju automatiziranih pojedinačnih odluka (profiliranje) - ispitanik ima pravo da se na njega ne odnosi odluka koja se temelji isključivo na automatiziranoj obradi, uključujući izradu profila, koja proizvodi pravne učinke koji se na njega odnose ili na sličan način značajno na njega utječu, osim ako je takva odluka potrebna za sklapanje ili izvršenje ugovora između ispitanika i voditelja obrade podataka, ako je dopuštena pravom Unije ili pravom države članice koji se propisuju odgovarajuće mjere zaštite prava i sloboda te legitimnih interesa ispitanika ili temeljena na izričitoj privoli ispitanika DOKUMENTACIJA I KORISNE POVEZNICE