http___www.kbz.hr_kreditna-banka-zagreb_gdpr-kbz_1.xml
1.1 1.2 1.3 2.1 2.2 2.3 3.1 3.2 4.1 4.2 5.1 5.2 6.1 6.2 6.3 7.1 7.2 7.3 7.4 7.5 8.1 9.1 11.1 13.1 15.1 17.1 19.1 21.1 23.1 25.1 27.1 28.1 28.2 28.3 29.1 29.2 29.3 30.1 30.2 31.1 31.2 31.3 32.1 32.2 32.3 32.4 33.1 33.2 34.1 34.2 34.3 34.4 35.1 35.2 35.3 35.4 36.1 36.2 36.3 36.4 36.5 36.6 37.1 38.1 39.1 40.1 41.1 42.1 42.2 43.1 43.2 44.1 44.2 44.3 44.4 45.1 45.2 46.1 47.1 47.2 48.1 48.2 48.3 49.1 49.2 49.3 50.1 50.2 50.3 51.1 51.2 51.3 52.1 52.2 52.3 53.1 53.2 54.1 54.2 54.3 55.1 55.2 55.3 55.4 55.5 56.1 56.2 57.1 57.2 57.3 57.4 58.1 58.2 58.3 58.4 59.1 60.1 60.2 60.3 60.4 61.1 61.2 62.1 63.1 63.2 63.3 63.4 63.5 64.1 65.1 65.2 66.1 67.1 67.2 68.1 69.1 70.1 71.1 71.2 71.3 72.1 72.2 72.3 73.1 75.1 75.2 76.1 77.1 78.1 79.1 79.2 79.3 79.4 80.1 80.2 80.3 80.4 80.5 80.6 81.1 82.1 82.2 83.1 84.1 84.2 85.1 85.2 86.1 87.1 88.1 89.1 90.1 91.1 92.1 93.1 94.1 95.1 95.2 96.1 96.2 96.3 96.4 97.1 97.2 97.3 98.1 99.1 100.1 101.1 102.1 103.1 104.1 104.2 105.1 106.1 107.1 108.1 108.2 108.3 109.1 109.2 109.3 110.1 111.1 112.1 112.2 113.1 114.1 114.2 115.1 116.1 117.1 118.1 119.1 119.2 120.1 120.2 121.1 121.2 122.1 123.1 123.2 124.1 124.2 125.1 125.2 125.3 126.1 127.1 127.2 128.1 128.2 129.1 129.2 130.1 131.1 132.1 132.2 133.1 133.2 133.3 134.1 134.2 135.1 136.1 137.1 138.1 138.2 138.3 139.1 139.2 140.1 141.1 141.2
III. General information about data processing1. Scope of the processing of personal data In principle, we only process personal data of our users insofar as this is necessary in order to provide a functional website, as well as our content and services. Personal data are above all those data that allow for you to be personally identified.2. General legal basis for the processing of personal data Art.6 (1) (b) of the GDPR serves as legal basis for the processing of personal data, which is necessary for the performance of a contract to which the data subject is party. The same applies to the processing operations that are necessary in order to take steps prior to entering into a contract. Art. 6 (1) (c) of the GDPR serves as legal basis insofar as a processing of personal data is necessary for compliance with a legal obligation to which our company is subject. Art. 6 (1) (f) of the GDPR serves as legal basis for the processing if the processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject. Art. 6 (1) (a) of the GDPR serves as legal basis insofar as we seek the consent of the data subject for processing operations of personal data.3. General data erasure and general storage period As soon as the purpose of the storage ceases to exist, the personal data of the data subject are erased or blocked. Beyond that, storage is permissible and possible if this is provided for by the European or national legislator in Union law regulations, laws or other provisions to which the controller is subject. Data is also blocked or erased when a storage period stipulated by the above-mentioned norms expires, unless further storage of the data is necessary for the conclusion or performance of a contract.IV. Provision of the website and log files1. Description and scope of the data processing With every visit to our website, even if you do not otherwise submit information, data and information is automatically collected by the computer system of the calling computer. The following data, which are necessary for the technical operation of our website, are collected in the process: The operating system used by the calling computer/device Information about the browser version, supported browser technology, screen resolution, colour depth and language of the calling computer/device The internet service provider of the user Date and time at the time of access Websites via which the user arrives at our website (URL) Websites that are accessed by the system of the user via our website The sub-websites that are called up via an accessing system on our website The type and manufacturer of the device and browser used, e.g. "Apple iPhone 8 & Safari" The IP address of the calling computer/device The data are stored in log files in our system. These data are not stored together with other personal data of the user.2. Legal basis for the data processing Art. 6 (1) (f) of the GDPR is the legal basis for the temporary storage of the data and the log files.3. Purpose of data processing It is necessary for the system to temporarily store the IP address in order to enable a delivery of the website to the user's computer. To this end, the user's IP address has to be stored for the duration of the session. The storage in log files takes place in order to ensure the functionality of the website. In addition, the data are used to optimise the website and to ensure the security of our information technology systems. The data are not analysed for marketing purposes in this context. These purposes also constitute our legitimate interest in the data processing pursuant to Art. 6 (1) (f) of the GDPR. Further interests are the stable and functional operation of this website, as well as achieving the objectives of protecting the confidentiality, integrity and availability of the data.4. Duration of storage The data are erased as soon as they are no longer necessary in order to fulfil the purpose of their collection. If the data is collected for the provision of the website, this is the case when the relevant session has ended. If the data is stored in log files, this is the case after seven days at the latest. Further storage is possible. In such a case, the IP addresses of the users are deleted or altered so that an association with the calling client is no longer possible.5. Possibility of objection and erasure The collection of the data for the provision of the website and the storage of the data in log files is absolutely necessary for the operation of the website. Consequently, there is no possibility of objection on the part of the user. Use of cookies1. Description and scope of the data processing Our website uses cookies. Cookies are small text files, that are also saved on the computer system of the user (terminal device) via your browser. When a user accesses a website, a cookie can be saved in the operating system of the user. This cookie contains a characteristic string of text (cookie ID) through which web pages and servers can be associated with the specific internet browser that the cookie was saved in. This enables the visited web pages and servers to distinguish the individual browser of the data subject from other internet browsers that contain other cookies. In this way, the cookie enables a clear identification of the browser when the website is visited (again). We use cookies in order to design our website in a more user-friendly way and to enable certain functions. On the one hand, we use so-called session cookies that are automatically deleted by your browser immediately after the end of the visit. In the context of web analysis, on the other hand, we also use persistent cookies, which allow us to recognise your browser on your next visit, for instance in order to remember information that you provided during your last visit for your subsequent visit to our website. The following data, inter alia, are saved and transmitted in the cookies: Visitor ID Insofar as we use cookies that enable an analysis of the users' surfing habits, the following data can also be transmitted: Use of website functions. In addition, we work with (advertising) partners, who help us optimise our internet offer for you and make it more interesting. For this purpose, cookies from partner companies are also saved on your hard disk when you visit our website (third-party cookies). Insofar as we cooperate with such advertising partners, you will be informed hereinafter about the use of such cookies and the scope of the information collected in each case.2. Legal basis for the data processing Should personal data be processed through cookies that we implemented, the processing takes place either for the performance of the contract pursuant to Art. 6 (1) (b) of the GDPR, or pursuant to Art. 6 (1) (f) of the GDPR for the purpose of our legitimate interests in the best possible functionality of the website, as well as a client-friendly and effective design of the site visit.3. Purpose of data processing The purpose of the use of technically necessary cookies is to simplify the usage of websites for the users. Some functions of our website cannot be offered without the use of cookies, as they require the browser to be recognised even after a page is changed. The user data collected by technically necessary cookies are not used for the creation of user profiles. Analysis cookies are used for the purpose of improving the quality of our website and its content. Analysis cookies allow us to find out how the website it used and hence to optimise our offer continuously. These purposes constitute our legitimate interest in the processing of personal data pursuant to Art. 6 (1) (f) of the GDPR.4. Duration of storage, possibility of objection and erasure Cookies are stored on the computer of the user, from which they are transmitted to our site. As a user, you hence have full control over the use of cookies. You can deactivate or limit the transmission of cookies by changing the settings in your internet browser. The possibilities of managing cookie settings vary depending on the type of browser used. A description can usually be found in the help menu of every browser, which provides instructions on how to change your cookie settings. Below you can find a compilation of links to the individual browsers:Internet ExplorerFirefoxChromeSafariOpera Even cookies that have already been stored can be deleted at any time. This can also be automated. If cookies are deactivated for our website, it is possible that not all functions of the website can be used to their full extent. The transmission of possible flash cookies cannot be prevented through the browser settings, but by changing the settings of the Flash Player.VI. Contact form and e-mail contact1. Description and scope of data processing Contact can be established via the e-mail address provided. In this case, the user's personal data transmitted in the e-mail are stored. There is no data transfer to third parties in this context. The data are used exclusively for the processing of the conversation.2. Legal basis for the data processing Art. 6 (1) (f) of the GDPR is the legal basis for the processing of the data that are transmitted in the course of sending an e-mail. Art. 6 (1) (b) of the GDPR is an additional legal basis for the processing if the e-mail contact aims at concluding a contract.3. Purpose of data processing The processing of the personal data from the e-mail serves the sole purpose of handling the established contact. Duration of storage The data are erased as soon as they are no longer necessary in order to fulfil the purpose of their collection. For the personal data sent via e-mail, this is the case when the respective contact with the user has ended and the erasure is not prevented by any statutory retention obligations. The contact has ended if it can be concluded from the circumstances that the issue in question has been resolved.5. Possibility of objection and erasure If a user contacts us via e-mail, he can object to the storage of his personal data at any time. In such a case, the communication with you cannot be continued. All personal data that were stored in the course of the establishment of contact will be erased in this case.VII. Application and use of etracker The provider of this website uses the services of etracker GmbH, Hamburg, Germany (www.etracker.com ) to analyse usage data. Here, cookies are used which enable the statistical analysis of the use of this website by its visitors as well as the display of usage-relevant content or advertising. Cookies are small text files that are stored by the Internet browser on the user's device. etracker cookies do not contain any information that could identify a user. The data generated with etracker is processed and stored by etracker solely in Germany by commission of the provider of this website and is thus subject to strict German and European data protection laws and standards. In this regard, etracker was checked, certified and awarded with the ePrivacyseal data protection seal of approval. The data is processed on the legal basis of Art. 6 Section 1 lit f (legitimate interest) of the EU General Data Protection Regulation (GDPR). Our legitimate interest is the optimization of our online offer and our website. As the privacy of our visitors is very important to us, etracker anonymizes the IP address as early as possible and converts login or device IDs into a unique key with which, however, no connection to any specific person can be made with. etracker does not use it for any other purpose, combine it with other data or pass it on to third parties. You can object to the outlined data processing at any time provided it is related to your person. Your objection has no detrimental consequences for you. Further information on data protection with etracker can be found here .VIII. Google AdWords Remarketing We use the functions of Google AdWords Remarketing in order to advertise our website in the search results of Google or on third party websites. The provider of Google AdWords Remarketing is Google LLC., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). By automatically setting a cookie in the browser of your terminal device, Google AdWords Remarkting enables interest-based advertising on the basis of the websites you visited with the help of a pseudonymous cookie ID. The processing takes place in accordance with Art. 6 (1) (f) of the GDPR. The "legitimate interest" is our interest in the optimal marketing of our website. Further data processing only takes place, if you have consented vis-à-vis Google that Google connects your browsing history with your Google account and that information from your Google account is used for the personalisation of online ads. If you are logged in to Google during your visit to our website, Google uses your data together with data from Google Analytics to create target group lists for remarketing (also across devices). For this purpose, Google temporarily links your personal data to data from Google Analytics in order to create relevant target groups. You can prevent the setting of cookies for ad preferences permanently, by downloading and installing the browser plug-in available via this link In addition, you can set your browser in such a way that you will be informed about the setting of cookies and decide individually whether to accept them, or exclude the acceptance of cookies in specific cases or in general, as mentioned above. When cookies are deactivated, the functionality of our website may be restricted. Google LLC, which is based in the USA, is certified for the EU-US data protection agreement "Privacy Shield", which ensures compliance with the level of data protection applicable in the EU. Further information as well as the data protection regulations regarding advertising and Google can be found here Applicant data Insofar as you react to job postings on our website or send us an application for other reasons, we process those data that you send us in connection with your application, in order to review your suitability for the job (or for comparable positions that are currently open at our company) and to carry out the application procedure. After receipt of your application, your application data are reviewed by the responsible employees in the human resources department. Suitable applications are passed on internally to the people within the departments responsible for the respective open position. In principle, only those people who need it for the proper functioning of the application procedure have access to your data within the company. The legal basis for the processing of your personal data in this application procedure is first and foremost § 26 of the BDSG (Federal Data Protection Act) in the version applicable as of 25.05.2018. Pursuant to this provision, the processing of the data is permissible, that is necessary in connection with the decision about establishing an employment relationship. After completion of the application procedure, a processing of data can take place if the requirements of Art. 6 of the GDPR are met, in particular for the purposes of legitimate interests pursuant to Art. 6 (1) (f) of the GDPR. In the case of legal proceedings under the AGG (General Act on Equal Treatment), for instance, our interest lies in the assertion of or the defence against claims. In the case of a rejection, data of applicants are erased 3 months after completion of the application procedure. In the event that you expressly consented to a further storage of your personal data, we will add your data to our pool of applicants. There the data will be erased after a period of two years. Should your application be successful and should you have been awarded a job in the framework of the application procedure, we will transfer your data from the applicant data system to our human resources information system. The data are processed exclusively in data centres in the Federal Republic of Germany. Rights of the data subject Data subjects whose personal data are processed have the following rights vis-à-vis the above-mentioned controller with regard to the personal data that concern them.1. Right of access Upon your request, the controller will confirm whether personal data that concern you are processed by us. If we do process data, you can request access to the following information from the controller: (1) the categories of personal data that are processed; (2) the purposes for which the personal data are processed; (3) the receivers/categories of receivers whom the personal data have been disclosed to or will still be disclosed to; (4) the planned duration of storage of the personal data concerning you, or at least, if specific information about this cannot be provided, the criteria for the definition of the storage duration; (5) the existence of the right to correction or erasure of the personal data, the right to restriction of the processing by the controller, or the right to object against this processing; (6) all available information about the origin of the data, if the personal data were not given by the data subject himself; (7) the right to lodge a complaint with a supervisory authority; (8) the existence of automated decision-making, including profiling (Art. 22 (1) and (4) of the GDPR) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. In addition, you have the right to obtain information about the extent to which the personal data concerning you are transmitted to a third country (or to an international organisation). In this context you can demand to be informed about the suitable safeguards pursuant to Art. 46 of the GDPR in connection with the transmission.2. Right to rectification You have a right to rectification and/or completion vis-à-vis the controller, if the processed personal data concerning you are inaccurate or incomplete. The rectification is to be carried out without undue delay.3. Right to restriction of processing You can demand a restriction of processing of the personal data concerning you, (1) if you contest the accuracy of the personal data concerning you, for a period that enables the controller to verify the accuracy of the personal data; (2) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead; (3) the controller no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims; (4) you have objected to processing pursuant to Article 21(1) of the GDPR and the verification whether the legitimate grounds of the controller override yours is still pending. Where processing of the personal data concerning you has been restricted, these data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. If the restriction of processing has been obtained according to the above-mentioned requirements, you shall be informed by the controller before the restriction of processing is lifted.4. Right to erasure a) Obligation of erasure You can demand that the controller erases the personal data concerning you without undue delay and the controller shall have the obligation to erase these data without undue delay where one of the following grounds applies: (1) the personal data concerning you are no longer necessary in relation to the purposes for which they were collected or otherwise processed. (2) you withdraw your consent on which the processing was based according to Art. 6 (1) (a) or Art. 9 (2) (a) of the GDPR and there is no other legal ground for the processing. (3) you object to the processing pursuant to Art. 21 (1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 (2) of the GDPR. (4) the personal data concerning you have been unlawfully processed. (5) the personal data concerning you have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject. (6) the personal data concerning you have been collected in relation to the offer of information society services referred to in Art. 8 (1) of the GDPR. b) Information to third parties Where the controller has made the personal data concerning you public and is obliged pursuant to Art. 17 (1) of the GDPR to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data, that you as a data subject have requested the erasure by such controllers of any links to, or copies or replications of, those personal data. c) Exceptions The right to erasure does not apply to the extent that processing is necessary (1) for exercising the right of freedom of expression and information; (2) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (3) for reasons of public interest in the area of public health in accordance with Art. 9 (2) (h) and (i) as well as Article 9 (3) of the GDPR; (4) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89 (1) of the GDPR, in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or (5) for the establishment, exercise or defence of legal claims.5. Right to information If you have asserted your right to rectification, erasure or restriction of processing vis-à-vis the controller, the controller is obliged to communicate this rectification or erasure of the data or restriction of processing to each recipient to whom the personal data concerning you have been disclosed, unless this proves impossible or involves disproportionate effort. You have the right vis-à-vis the controller to be informed about these recipients.6. Right to data portability You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used and machine-readable format. You also have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where: (1) the processing is based on consent pursuant to Art. 6 (1) (a) of the GDPR or Art. 9 (2) (a) of the GDPR or on a contract pursuant to Article 6 (1) (b) of the GDPR; and (2) the processing is carried out by automated means. In exercising this right, you also have the right to have the personal data concerning you transmitted directly from one controller to another, where technically feasible. The rights and freedoms of others shall not be adversely affected by this. The right to data portability shall not apply to a processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.7. Right to object You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art. 6 (1) (f) of the GDPR, including profiling based on those provisions. The controller shall no longer process the personal data concerning you unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims. Where the personal data concerning you are processed for direct marketing purposes, you shall have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing. Where you object to processing for direct marketing purposes, the personal data concerning you shall no longer be processed for such purposes.8. Right to withdrawal of the data protection consent declaration You have the right to withdraw your declaration of consent under data protection law at any time, with effect for the future. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the withdrawal.9. Automated individual decision-making, including profiling You have the right not to be subject to a decision based solely on automated processing, which produces legal effects concerning you or similarly significantly affects you. This shall not apply if the decision (1) is necessary for entering into, or performance of, a contract between you and a data controller, (2) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests; or (3) is based on your explicit consent. However, such decisions shall not be based on special categories of personal data referred to in Art. 9 (1) of the GDPR, unless point (a) or (g) of Art. 9 (2) of the GDPR applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place. In the cases referred to in (1) and (3), the data controller shall implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision.10. Right to lodge a complaint with a supervisory authority You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Art. 78 of the GDPR.
1.1 2.1 3.1 4.1 4.2 4.3 4.4 5.1 6.1 7.1 7.2 7.3 7.4 8.1 9.1 9.2 9.3 10.1 10.2 10.3 10.4 11.1 12.1 13.1 13.2 14.1 15.1 16.1 17.1 18.1 19.1 20.1 21.1 22.1 23.1 24.1 25.1 26.1 27.1 28.1 29.1
Odabirom poveznice s desne strane (Izjava) pristupit ćete Izjavi o zaštiti privatnosti na internetskim stranicama Kreditne banke Zagreb d.d. OPĆA UREDBA O ZAŠTITI PODATAKA Uredba (EU) 2016/679 Europskog parlamenta i Vijeća od 27. travnja 2016. o zaštiti pojedinaca u vezi s obradom osobnih podataka i o slobodnom kretanju takvih podataka (dalje u nastavku: Uredba), primjenjivat će se u Republici Hrvatskoj od 25. svibnja 2018. godine. Uredba predstavlja bitan napredak u području zaštite osobnih podataka kojom se osigurava zaštita prava i temeljnih sloboda pojedinaca u vezi s obradom njihovih osobnih podataka. Isto tako, utvrđuju se pravila povezana u pogledu obrade osobnih podataka i pravila povezana sa slobodnim kretanjem osobnih podataka. Nadalje, općom Uredbom se osigurava ujednačeno i jednoobrazno postupanje nadzornih tijela za zaštitu osobnih podataka, što će imati za posljedicu jednostavniju i jednaku zaštitu prava svih pojedinaca u Europskoj uniji. Uredba propisuje prava pojedinca, obveze Banke koja obrađuju osobne podatke kao voditelja obrade, odnosno izvršitelja. Uredba se primjenjuje na sve državne institucije koje su dužne obrađivati osobne podatke u okviru njenih odredaba, osim u slučajevima obrade osobnih podataka koju obavljaju nadležna tijela u svrhu sprečavanja, istrage, otkrivanja ili progona kaznenih djela ili izvršavanja kaznenih sankcija, uključujući zaštitu od prijetnji javnoj sigurnosti i njihova sprečavanja. OSOBNI PODACI U SMISLU OPĆE UREDBE Osobni podaci su svi podaci koji se odnose na pojedinca čiji je identitet utvrđen ili se može utvrditi. Pojedinac čiji se identitet može utvrditi jest osoba koja se može identificirati izravno ili neizravno, osobito uz pomoć identifikatora kao što su ime, identifikacijski broj, podaci o lokaciji, mrežni identifikator ili uz pomoć jednog ili više čimbenika svojstvenih za fizički, fiziološki, genetski, mentalni, ekonomski, kulturni ili socijalni identitet tog pojedinca. Jako je širok spektar što su osobni podaci, jednostavnije rečeno to su: ime i prezime, email adresa, slika, bankovni podaci, identifikacijski broj, glas, adresa, broj telefona, IP adresa, objava na društvenim mrežama, povijest bolesti, popis najdraže literature ili pjesme, ako takvi podaci mogu fizičku osobu čiji se identitet može utvrditi, dovesti do izravnog ili neizravnog identificiranja uz pomoć pojedinog identifikatora. Neposredno prije prikupljanja osobnih podataka subjekt koji ih prikuplja ima obvezu pružanja informacija u koju svrhu se podaci prikupljaju, na temelju koje pravne osnove, komu se podaci otkrivaju te o pravu pojedinca da svojim podacima pristupi, da zahtijeva njihov ispravak ili eventualno brisanje. OBRADA OSOBNIH PODATAKA Obrada osobnih podataka trebala bi biti osmišljena tako da bude u službi čovječanstva. Pravo na zaštitu osobnih podataka nije apsolutno pravo, mora ga se razmatrati u vezi s njegovom funkcijom u društvu te ga treba ujednačiti s drugim temeljnim pravima u skladu s načelom proporcionalnosti. Ovom se Uredbom poštuju sva temeljna prava i uvažavaju slobode i načela priznata Poveljom koja su sadržana u ugovorima, osobito poštovanje privatnog i obiteljskog života, doma i komuniciranja, zaštita osobnih podataka, sloboda mišljenja, savjesti i vjeroispovijedi, sloboda izražavanja i informiranja, sloboda poduzetništva, pravo na učinkoviti pravni lijek i pošteno suđenje te pravo na kulturnu, vjersku i jezičnu raznolikost. Obrada obuhvaća radnje poput prikupljanja, bilježenja, čuvanja, uvida, otkrivanja, prenošenja ili uništavanja. Svaka obrada osobnih podataka trebala bi biti zakonita i poštena. Za pojedince bi trebalo biti transparentno kako se osobni podaci koji se odnose na njih prikupljaju, upotrebljavaju, daju na uvid ili na drugi način obrađuju, kao i do koje se mjere ti osobni podaci obrađuju ili će se obrađivati. Načelom transparentnosti traži se da svaka informacija i komunikacija u vezi s obradom tih osobnih podataka bude lako dostupna i razumljiva te da se upotrebljava jasan i jednostavan jezik. PRAVNI TEMELJ OBRADE Za zakonitu obradu osobnih podataka potrebno je ispuniti barem jedan od narednih pravnih temelja: - (a) ispitanik je dao privolu za obradu svojih osobnih podataka u jednu ili više posebnih svrha - privola je dobrovoljan, poseban, informiran i nedvosmislen pristanak ispitanika na obradu osobnih podataka koji se odnose na njega, poput pisane izjave, uključujući elektroničku, ili usmenu izjavu. Uredbom se među ostalim utvrđuje da uvjet dobrovoljnosti nije ispunjen ako ispitanik nema istinski ili slobodan izbor ili ako nije u mogućnosti odbiti ili povući privolu bez posljedica - (b) obrada je nužna za izvršavanje ugovora u kojem je ispitanik stranka ili kako bi se poduzele radnje na zahtjev ispitanika prije sklapanja ugovora (npr. obrada podataka klijenta radi izvršenja ugovora o kreditu ili obrada podataka klijenta radi sklapanja neke usluge) - (c) obrada je nužna radi poštovanja pravnih obveza voditelja obrade (npr. slanje podataka o radnicima HZZO-u ili HZMO-u ili slanje podataka stranaka od strane javnog bilježnika Poreznoj upravi sukladno posebnim propisima) - (d) obrada je nužna da bi se zaštitili ključni interesi ispitanika ili druge fizičke osobe (npr. otkrivanje od strane nadležnih tijela podataka jednog roditelja drugomu radi uzdržavanja djeteta) - (e) obrada je nužna za izvršavanje zadaće od javnog interesa ili pri izvršavanju službene ovlasti voditelja obrade (npr. zbog službene ovlasti Državnog zavoda za statistiku pojedini voditelji obrade su dužni tom zavodu dostavljati određene osobne podatke) - (f) obrada je nužna za potrebe legitimnih interesa voditelja obrade ili treće strane, osim kada su od tih interesa jači interesi ili temeljna prava i slobode ispitanika koji zahtijevaju zaštitu osobnih podataka, osobito ako je ispitanik dijete, s time da se ova točka ne odnosi na obradu koju provode tijela javne vlasti pri izvršavanju svojih zadaća (npr. legitimni interes vlasnika nekretnine da postavi sustav video nazora da bi spriječio realan rizik po njegovoj imovini) PRAVA POTROŠAČA/ISPITANIKA U sklopu Opće uredbe definirana su i karakteristična prava: - Transparentnost - pružanje informacija prilikom prikupljanja osobnih podatak kada voditelj obrade mora među ostalim informacijama obavijestiti ispitanika i o svojem identitetu i kontakt podacima, svrhama obrade i pravnoj osnovi za obradu podataka, primateljima, iznošenju u treće zemlje, razdoblju pohrane, mogućnosti povlačenja privole itd. - Pristup podacima - dobiti od voditelja obrade potvrdu obrađuju li se osobni podaci koji se odnose na njega te ako se takvi osobni podaci obrađuju, pristup osobnim podacima i informacije, među ostalim, o obrađenim osobnim podacima, o svrsi obrade, roku pohrane, iznošenju u treće zemlje itd. - Pravo na ispravak - ispitanik ima pravo zahtijevati ispravak netočnih osobnih podataka koji se na njega odnose, a uzimajući u obzir svrhe obrade, ispitanik ima pravo dopuniti nepotpune osobne podatke, među ostalim i davanjem dodatne izjave - Brisanje („pravo na zaborav“) - ispitanik ima pravo od voditelja obrade ishoditi brisanje osobnih podataka koji se na njega odnose bez nepotrebnog odgađanja te voditelj obrade ima obvezu obrisati osobne podatke bez nepotrebnog odgađanja ako, među ostalim, osobni podaci više nisu nužni u odnosu na svrhu obrade, ili je ispitanik povukao privolu za obradu, ili su osobni podaci nezakonito obrađeni - Pravo na ograničenje obrade - u pojedinim situacijama (npr. kada je točnost podataka osporavana ili kada pravom na brisanje ispitanik želi da voditelj obrade zadrži njegove podatke) ispitanik ima pravo zahtijevati da se obrada ograniči uz iznimku pohrane i nekih drugih vrsta obrade - Pravo na prenosivost - ispitanik ima pravo zaprimiti svoje osobne podatke, a koje je pružio voditelju obrade, uobičajeno upotrebljavanom i strojno čitljivom formatu te ima pravo prenijeti te podatke drugom voditelju obrade bez ometanja od strane voditelja obrade kojem su osobni podaci pruženi, ako se obrada temelji na privoli ili ugovoru i provodi automatiziranim putem - Pravo na prigovor - ispitanik ima pravo uložiti prigovor na obradu osobnih podataka ako se ista temelji na zadaće od javnog interesa, na izvršavanje službenih ovlasti voditelja obrade ili na legitimne interesa voditelja obrade (uključujući i profiliranje), tada voditelj obrade ne može više obrađivati osobne podatke ispitanika osim ako dokaže da njegovi legitimni razlozi za obradu nadilaze interese ispitanika te radi zaštite pravnih zahtjeva, također ako se ispitanik protivi obradi za potrebe izravnog marketinga, osobni podaci više se ne smiju obrađivati - Pravo usprotiviti se na automatizirano pojedinačno donošenje odluka, uključujući izradu profila (profiliranje) - pravo usprotiviti se donošenju automatiziranih pojedinačnih odluka (profiliranje) - ispitanik ima pravo da se na njega ne odnosi odluka koja se temelji isključivo na automatiziranoj obradi, uključujući izradu profila, koja proizvodi pravne učinke koji se na njega odnose ili na sličan način značajno na njega utječu, osim ako je takva odluka potrebna za sklapanje ili izvršenje ugovora između ispitanika i voditelja obrade podataka, ako je dopuštena pravom Unije ili pravom države članice koji se propisuju odgovarajuće mjere zaštite prava i sloboda te legitimnih interesa ispitanika ili temeljena na izričitoj privoli ispitanika DOKUMENTACIJA I KORISNE POVEZNICE