http___www.uo-ivanic.hr_politika-privatnosti__1.xml
1.1 2.1 3.1 4.1 4.2 5.1 6.1 7.1 8.1 9.1 10.1 11.1 12.1 12.2 13.1 14.1 15.1 16.1 17.1 18.1 19.1 21.1 22.1 23.1 24.1 25.1 26.1 27.1 28.1 28.2 29.1 29.2 30.1 31.1 32.1 33.1 34.1 35.1 35.2 36.1 37.1 37.2 38.1 39.1 40.1 40.2 40.3 41.1 41.2 42.1 42.2 42.3 43.1 44.1 44.2 45.1 46.1 46.2 46.3 46.4 46.5 47.1 48.1 48.2 48.3 49.1 50.1 51.1 52.1 53.1 54.1 55.1 56.1 56.2 57.1 58.1 58.2 59.1 59.2 60.1 61.1 62.1 62.2 62.3 62.4 62.5 62.6 62.7 62.8 62.9 62.10 62.11 63.1 63.2 64.1 64.2 65.1 66.1 66.2 67.1 67.2 68.1 69.1 70.1 70.2 70.3 70.4 70.5 70.6 70.7 70.8 70.9 70.10 70.11 71.1 72.1 72.2 73.1 73.2 74.1 75.1 75.2 75.3 75.4 75.5 75.6 75.7 75.8 75.9 75.10 76.1 76.2 77.1 78.1 78.2 79.1 79.2 80.1 80.2 81.1 82.1 83.1 83.2 84.1 84.2 84.3 84.4 84.5 84.6 84.7 85.1 85.2 86.1 86.2 86.3 86.4 86.5 86.6 86.7 87.1 87.2 87.3 87.4 87.5 87.6 88.1 88.2 88.3 88.4 88.5 89.1 90.1 91.1 91.2 91.3 91.4 92.1 92.2 92.3 92.4 92.5 93.1 94.1 94.2 94.3 94.4 95.1 95.2 96.1 96.2 97.1 98.1 99.1 100.1 101.1 101.2 101.3 101.4 101.5 101.6 101.7 101.8 101.9 101.10 102.1 103.1 104.1 104.2 105.1 105.2 105.3 106.1 106.2 106.3 106.4 106.5 106.6 107.1 108.1 109.1 109.2 109.3 109.4 109.5 109.6 109.7 110.1 110.2 111.1 112.1 112.2 112.3 112.4 113.1 114.1 114.2 114.3 115.1 116.1 117.1 118.1 119.1 120.1 121.1 122.1 123.1 124.1 124.2 124.3 124.4 125.1 126.1 126.2 126.3 126.4 126.5 126.6 127.1 128.1 129.1 130.1 131.1 132.1 133.1 134.1 135.1 136.1 137.1 138.1 138.2 139.1 140.1 140.2 140.3 141.1 141.2 142.1 142.2 143.1 143.2 143.3 143.4 144.1 145.1 146.1
Privacy Policy of Meyer Burger Technology AG Legal framework, responsible body, definitions Data subject rights III. General information on data processing ( data processing for informational use of the website, technical background, cookies, etc.). Special notes on data processing in the context of the application of additional functions Data processing in the application context other General information, responsible entity and legal framework legal framework and principles of data processing We take the protection of your personal data very seriously and treat your personal data confidentially and in accordance with the statutory data protection regulations (DSGVO and BDSG) and this privacy policy. When you use our website, we collect personal data about you. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this is done. responsible body The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data (e.g. names, e-mail addresses, etc.). The responsible body (hereinafter also "we", "us", "our") within the meaning of the Data Protection Act is: Meyer Burger (Industries) GmbH Carl-Schiffner-Strasse 17 09599 Freiberg Germany E-mail: info-hohenstein@meyerburger.com The contact details of our company data protection officers are: Meyer Burger (Industries) GmbH- THE DATA PROTECTION AGENCY - Carl-Schiffner-Strasse 17 09599 FreibergGermany E-mail: dsb.mbde@meyerburger.com definitions Our data protection declaration is based on the terms used by the European Directive and Ordinance Maker when adopting the General Data Protection Regulation (DSGVO). We would like to explain essential terms in the following: a) Personal data means any information relating to an identified or identifiable natural person (hereinafter "data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. b) Data subject means any identified or identifiable natural person whose personal data are processed by the controller. c) Processing means any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organization, filing, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. d) Restriction of processing is the marking of stored personal data with the aim of limiting their future processing. (e) profiling means any automated processing of personal data which consists in using such personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects relating to that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or change of location. f) Pseudonymization means the processing of personal data in such a way that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person. (g) Controller or controller means the natural or legal person, public authority, agency or other body which alone or jointly with others determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its designation may be provided for under Union or Member State law. h) Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of and in accordance with the instructions of the Controller pursuant to Article 28 GDPR. (i) recipient means a natural or legal person, public authority, agency or other body to whom personal data are disclosed, whether or not a third party. However, public authorities that may receive personal data in the context of a specific investigative task under Union or Member State law shall not be considered as recipients. j) third party means a natural or legal person, public authority, agency or other body other than the data subject, the controller, the processor and the persons who are authorized to process the personal data under the direct responsibility of the controller or the processor. k) Consent shall mean any freely given indication of the data subject's wishes for the specific case in an informed and unambiguous manner, in the form of a statement or any other unambiguous affirmative act by which the data subject indicates that he or she consents to the processing of personal data relating to him or her. data subject rights according to Art. 15 ff and Art. 77 DSGVO right to object to the collection of data in specific cases and to direct marketing (Art. 21 GDPR) If the data processing is based on Art. 6 (1) e) or f) DSGVO, you have the right to object to the processing of personal data concerning you at any time for reasons arising from your particular situation; this also applies to profiling based on these provisions. The respective legal basis on which processing is based can be found in this privacy policy. If you object, we will no longer process your personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defense of legal claims. If your personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling, insofar as it is associated with such direct marketing. If you object, your personal data will subsequently no longer be used for the purpose of direct advertising. revocation of your consent to data processing Many data processing operations are only possible with your express consent. We obtain this from you before the start of the data processing that requires your consent. You can revoke this consent at any time. Insofar as a revocation option does not already arise via the clicking of links or the adjustment of browser settings, an informal communication to us by e-mail is sufficient. The legality of the data processing operations carried out until the revocation remains unaffected by the revocation. right of appeal to the competent supervisory authority In the event of violations of data protection law, data subjects have a right of appeal to the competent supervisory authority. The competent supervisory authority for data protection issues is the state data protection commissioner of the federal state in which our company has its headquarters. A list of the data protection officers and their contact details can be found in the following link: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html The data protection authority responsible for us is: Saxon Data Protection Commissioner PO Box 11 01 32 01330 Dresden https://www.saechsdsb.de/n-kontakt right to data portability You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to another person responsible, in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done insofar as it is technically feasible. information, correction, blocking, deletion Within the framework of the applicable legal provisions, you have the right at any time to free information about your stored personal data, its origin and recipient and the purpose of data processing and, if applicable, a right to correction, blocking or deletion of this data. For this purpose, as well as for further questions on the subject of personal data, you can contact us at any time at the address given above in Section I.2. III. data processing during informational use of the website, technical background, cookies etc. We collect and process the personal data listed below in sections 3 to 7 for the purposes stated therein, on the basis of the legal grounds stated therein and for the duration stated therein. legal basis and storage period If you have consented to the processing of your personal data within the meaning of Art. 4 No. 1 DSGVO by us, Art. 6 (1) a) DSGVO serves as the legal basis for the processing. The processing of personal data, which we need to fulfill contractual or pre-contractual obligations, is based on Art. 6 para. 1 lit. b) DSGVO. If the processing is necessary to safeguard our legitimate interests or those of a third party and the interests, fundamental freedoms and fundamental rights of the data subject do not override these, then Art. 6 (1) (f) DSGVO serves us as the legal basis for the processing of personal data. For the processing operations carried out by us, we indicate below the applicable legal basis in each case. Processing may also be based on several legal bases. For the processing operations carried out by us, we indicate below in each case how long the data will be stored by us and when it will be deleted or blocked. If no explicit storage period is specified below, your personal data will be deleted or blocked as soon as the purpose or legal basis for the storage no longer applies. However, storage may take place beyond the specified time in the event of a (threatened) legal dispute with you or other legal proceedings or if storage is provided for by statutory provisions to which we are subject as the responsible party (e.g. § 257 HGB, § 147 AO). If the storage period prescribed by the legal regulations expires, the personal data will be blocked or deleted unless further storage by us is necessary and there is a legal basis for this. data security We use appropriate technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or against unauthorized access by third parties, taking into account the state of the art, implementation costs and the nature, scope, context and purpose of the processing, as well as the existing risks of a data breach (including its probability and impact) for the data subject. Our security measures are continuously improved in line with technological developments. We will be happy to provide you with more detailed information on request. Please contact our data protection officer (see above). data processed during the (informational) use of the website Inevitably, we can only provide you with the benefits of our Internet offering if, when you use it, we collect certain personal data from you that is necessary for the operation of the website. We collect this data if this is necessary for the fulfillment of the contract between you and us (including in the form of terms of use for this website) (Art. 6 para. 1 lit. b) DSGVO) or your consent is given (Art. 6 para. 1 lit. a) DSGVO). Furthermore, we collect this data if this is necessary for the functionality of the website and your interest in the protection of your personal data does not outweigh this (Art. 6 para. 1 lit. f) DSGVO). We collect and process the following data from you: - Device information: Access data includes the IP address, device ID, device type, device-specific settings, the date and time of the retrieval, time zone, the amount of data transferred and the message whether the data exchange was complete, crash of the terminal device, browser type and operating system. This access data is processed in order to technically enable the operation of the website. - Information with your consent: Other information (e.g. geo-location data, personal data such as name and e-mail address, etc.) is processed by us if you allow us to do so. ) we process if you allow us to do so. contact us When you (proactively) contact us, via a contact form or chat provided by us, the data you provide will be stored by us in order to answer your inquiry. The provision of certain truthful data is required to process your request, other information is voluntary. Mandatory data required to answer your inquiry are marked as such, the remaining data are provided voluntarily. The processing of the above data is based on your consent, which you have expressed by contacting us, in accordance with Art. 6 (1) a) DSGVO and, insofar as special categories of personal data (e.g. health data or other "sensitive" data) are concerned, in accordance with Art. 9 (2) a) DSGVO. The collected personal data will be deleted immediately after the complete completion of your request, unless they are required for the initiation or execution of a contract with you pursuant to Art. 6 para. 1 lit. b) DSGVO. If you are an entrepreneur in the sense of § 14 BGB (German Civil Code) and contact us via a contact form provided by us or via e-mail, your data may be stored in a customer care system, which may also be used to contact you for advertising purposes if you have given us the appropriate additional consent (see also the following section). Please note that in the case of contact forms with fixed subject selection options, you must select the correct subject for you or your capacity as a consumer in accordance with Section 13 of the German Civil Code (BGB) or entrepreneur in accordance with Section 14 of the German Civil Code (BGB), in order to avoid you appearing as a business customer/entrepreneur by mistake and our response being correspondingly different from that of consumers. sending specific information materials about products and services. If consent is given, we may inform users of our website about specific Meyer Burger products and services (in particular the Meyer Burger affiliate program) at a later date. The personal data that may be used when sending the information is specified in the input mask used for this purpose. For legal reasons, a confirmation email is sent to the email address entered by a data subject using the double opt-in method. This confirmation e-mail serves to verify whether the owner of the e-mail address, as the data subject, has authorized the receipt of advertising content. When registering or sending the contact form content, we also store the IP address of the computer system used by the data subject at the time of registration, as assigned by the Internet service provider (ISP), as well as the date and time of registration. The collection of this data is necessary in order to be able to trace the (possible) misuse of the e-mail address of a data subject at a later point in time and therefore serves as a legal safeguard for the controller. The consent to the processing of personal data that the data subject has given us for the purpose of sending information may be revoked at any time with effect for the future. subscription to our newsletter On our website, users are given the opportunity to subscribe to our enterprise's newsletter. The personal data transmitted to the controller when the newsletter is ordered is specified in the input mask used for this purpose. In case of consent pursuant to Art. 6 Para. 1 lit. a) DSGVO, we inform our customers and business partners at regular intervals by means of a newsletter about offers of our company. The newsletter of our company can only be received by the data subject if 1.) the data subject has a valid e-mail address and 2.) the data subject registers for the newsletter mailing. For legal reasons, a confirmation e-mail will be sent to the e-mail address entered by a data subject for the first time for newsletter dispatch using the double opt-in procedure. This confirmation e-mail serves to verify whether the owner of the e-mail address as the data subject has authorized the receipt of the newsletter. When registering for the newsletter, we also store the IP address of the computer system used by the data subject at the time of registration, as assigned by the Internet service provider (ISP), as well as the date and time of registration. The collection of this data is necessary in order to be able to trace the (possible) misuse of the e-mail address of a data subject at a later point in time and therefore serves the legal safeguarding of the controller. The personal data collected in the context of a registration for the newsletter will be used exclusively for sending our newsletter. Furthermore, subscribers to the newsletter could be informed by e-mail if this is necessary for the operation of the newsletter service or a related registration, as could be the case in the event of changes to the newsletter offer or changes in the technical circumstances. No personal data collected as part of the newsletter service will be passed on to third parties. The subscription to our newsletter can be cancelled by the data subject at any time. The consent to the storage of personal data that the data subject has given us for the newsletter mailing can be revoked at any time. For the purpose of revoking consent, a corresponding link can be found in each newsletter. Furthermore, it is also possible to unsubscribe from the newsletter mailing directly on the website of the controller at any time or to notify the controller of this in another way. The controller has integrated the component Tensid marCo of the provider EQS Group AG, Schochenmühlestrasse 4, 6340 Baar, Switzerland, on this website by way of commissioned processing pursuant to Art. 28 DSGVO. The purpose of the component is the newsletter registration. Further information and the applicable data protection provisions of EQS Group AG can be found at switzerland.eqs.com. For Switzerland, the EU Commission has issued a so-called adequacy decision pursuant to Art. In this decision, the Commission determined that personal data in Switzerland enjoys adequate protection comparable to European data protection law. Newsletter2Go from Sendinblue can be used as additional newsletter software. Your data will be transmitted to Sendinblue GmbH by way of order processing pursuant to Art. 28 DSGVO. Sendinblue is also prohibited from selling your data and using it for purposes other than sending newsletters. Sendinblue is a German, certified provider, which was selected according to the requirements of the General Data Protection Regulation and the Federal Data Protection Act. For more information, click here: https://de.sendinblue.com/informationen-newsletter-empfaenger/?rtype=n2go Newsletter tracking Our newsletters may contain so-called tracking pixels. A tracking pixel is a miniature graphic that is embedded in such emails that are sent in HTML format to enable log file recording and log file analysis. This allows a statistical evaluation of the success or failure of online marketing campaigns. Based on the embedded tracking pixel, we can see if and when an e-mail was opened by a data subject, and which links in the e-mail were called up by the data subject. Such personal data collected via the tracking pixels contained in the newsletters are stored and evaluated by the controller in order to optimize the newsletter dispatch and to better adapt the content of future newsletters to the interests of the data subject. This personal data will not be disclosed to third parties. Data subjects are entitled at any time to revoke the separate declaration of consent given in this regard via the double opt-in procedure. After a revocation, this personal data will be deleted by the controller. We automatically interpret a withdrawal from the receipt of the newsletter as a revocation. automated processing operations and use of cookies Cookies may be used in the operation of our website. Cookies are small text files that are stored on the device memory of your end device and, if applicable, assigned to the mobile device you are using, and through which certain information flows to the location that sets the cookie. Cookies cannot execute programs or transfer viruses to your end device and therefore cannot cause any damage. They serve to make our Internet offer more user-friendly and effective overall, i.e. more pleasant for you. Cookies cannot directly identify a user, but can contain data that makes it possible to recognize the device used. In some cases, however, cookies only contain information about certain settings that are not personally identifiable. A distinction is made between session cookies, which are deleted again as soon as you close your Internet session, and permanent cookies, which are stored beyond the individual session. With regard to their function, cookies are again differentiated between: - Technically necessary cookies: these are mandatory in order to navigate within our website, use basic functions and ensure the security of the website; they do not collect information about you for marketing purposes, nor do they store which web pages you have visited; - Performance cookies: these collect information about how you use our website, which pages you visit and, for example, whether errors occur during website use; they do not collect information that could identify you - all information collected is anonymous and is only used to improve our website and find out what interests our users; - Advertising cookies, targeting cookies: These are used to offer the user tailored advertising within our Internet offering or third-party offerings and to measure the effectiveness of these offerings; advertising and targeting cookies are stored for a maximum of 36 months; - Sharing cookies: These are used to improve the interactivity of our website with other services (e.g. social networks); sharing cookies are stored for a maximum of 36 months. Any use of cookies that is not absolutely technically necessary constitutes data processing that is only permitted with your explicit and active consent pursuant to Art. a) DSGVO, § 25 (1) TTDSG. This applies in particular to the use of advertising, targeting or sharing cookies. In addition, we will only disclose your personal data processed through cookies to third parties if you have given your express consent to do so in accordance with Art. 6 para. 1 p. 1 lit. a) DSGVO, § 25 para. 1 TTDSG. Please note that when using cookies, your data may be transferred to recipients outside the EEA where there is no adequate level of data protection in accordance with the DSGVO (e.g. USA). Details on this can be found in the following description of the individual marketing tools. The following cookies may be used on our website: google maps This site uses the map service Google Maps via an API interface. The provider is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. To use the functions of Google Maps, it is necessary to store your IP address. This information is usually transmitted to a Google LLC server in the USA and stored there. The provider of this site has no influence on this data transmission. The use of Google Maps is in the interest of an appealing presentation of our online offers and an easy location of the places indicated by us on the website. This represents an overriding legitimate interest on our part within the meaning of Art. 6 para. 1 lit. f) DSGVO, § 25 para. 2 TTDSG. You can find more information on the handling of user data in Google's privacy policy: https://www.google.de/intl/de/policies/privacy/. circle of recipients; third country transfer Within our company, the departments responsible for processing the requests have access to your data. In addition, we use external service providers, in particular order processors in accordance with Art. 28 DSGVO, insofar as we cannot or cannot reasonably perform services ourselves. These external service providers are thereby primarily providers of IT services and telecommunications services. If certain service providers are explicitly mentioned, you will also find further information in the privacy statements of the service providers. In addition, we may transfer your data to external service providers who can provide you with further offers. You can find more information on this below under the item " Use of the Solar Calculator". A transfer to third countries outside the European Economic Area (EEA) only takes place under certain conditions within the framework of Art. 44ff DSGVO. Some third countries are certified by the European Commission as having a level of data protection comparable to the EEA standard through so-called adequacy decisions (a list of these countries and a copy of the adequacy decisions can be obtained here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en However, in other third countries to which personal data may be transferred, there may not be a consistently high level of data protection due to a lack of legal provisions. If this is the case, we ensure that data protection is adequately guaranteed. This is possible through binding company regulations, standard data protection clauses of the European Commission for the protection of personal data (available at ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en), certificates or recognized codes of conduct. You can contact our data protection officer if you would like more information on this. minors Our website is not intended for children. Persons under the age of 16 may not transmit personal data to us or submit declarations of consent without the consent of their legal guardians. We would like to urge parents and guardians and minors to comply with the requirements of the GDPR and not to circumvent any age restrictions. no automated decision making (including profiling) We do not intend to use any personal data collected from you for any automated decision making process (including profiling). Special notes on data processing in the context of the application of additional functions Installer finder In order to be able to show you installers in your area, we process the following personal data on the basis of a contract. - Name and first name - Address - E-mail address - Geo-location data The legal basis for the processing of the data is Art. 6 para. 1 lit. b) DSGVO. use of the solar calculator In cases where you use the solar calculator, we use the data you enter there to send you a corresponding non-binding offer and to provide you with further information such as savings, etc., as well as to contact you in the future under the contact data you have provided for information and marketing purposes if you have given your consent. In addition, we will forward your data to up to three installers selected by us in your region - provided you also give your consent for this - in order to provide you with further advice and a non-binding offer. The provision of certain truthful data (in particular name, address, geolocation data, roof area based on satellite images from third-party services, type of heating, e-mail address) is necessary to process your request and provide you with a PDF summary. The processing of the above data is based on your consent, which you have expressed by entering the data in the form interface, in accordance with Art. 6 (1) a) DSGVO. The collected personal data will be deleted at the latest insofar as it is no longer required for the initiation or execution of a contract with you after a transitional period of 24 months. Data processing in the application context processing purposes, categories of personal data We process the application data outlined in this section for the purpose of initiating or implementing an employment relationship or a relationship similar to employment to the extent outlined below. In particular, the following categories of data may be processed: - General personal data (name, address and other contact data, application photo, dates of birth, nationality, marital status, other (possibly also sensitive) data disclosed by you to us) - Job-related data (professional contact information, current position, responsibilities/responsibilities, current employer, current compensation, notice period, holds). - Experience-related data (previous positions and employers, school and university education, vocational training, experience, knowledge) - Future-related data (wishes and ideas, assessments, conceivable areas of application, mediation ideas) - Other data (information focusing on your professional life that is publicly available through social media services (e.g., XING, Google, LinkedIn, Experteer, etc.) or otherwise available on the Internet that may be relevant to your qualifications for a particular vacancy) further data processing by the controller; legal basis for data processing If you approach us proactively, we will process the data you provide as part of the initial contact, as well as any other data we may request. As application data, we treat and process all information (CV, certificates, proof of qualifications) as well as all other information (e.g. in telephone interviews, in personal interviews). This is done for the contractual or pre-contractual purposes outlined above. The provision of certain truthful data is required in order to process your request, further information (in particular the submission of a photo) is voluntary. Insofar as your data is required to carry out the application procedure, Art. 88 DSGVO in conjunction with. § Section 26 of the German Federal Data Protection Act (BDSG) is the legal basis for processing your data. As far as special categories of personal data are concerned (e.g. health data, trade union or religious affiliation or other "sensitive" data), the processing is based on your consent pursuant to Art. 9 (2) a) DSGVO, which you have expressed by communicating this data. If your application is successful and an employment relationship is established with us, your data will initially be stored for the duration of the employment relationship. After you leave us, we will process your data for a maximum of three years for purposes of preserving evidence. The processed personal data will be deleted insofar as the processing is no longer necessary for the fulfillment of the contract or you request us to delete the data in the context of asserting your rights as a data subject. This is regularly done at the latest after six (6) months following the conclusion of the application process, if no longer retention obligations apply after a position has not been filled. If no recruitment takes place, a longer storage period of 24 months from the last individual contact with you - for example to defend against potential AGG claims - may be necessary in individual cases on the basis of our legitimate interests pursuant to Art. 6 (1) f) DSGVO. other Amendment of this privacy policy We reserve the right to change this privacy policy at any time in compliance with legal requirements.
1.1 2.1 3.1 4.1 5.1 6.1 6.2 7.1 8.1 9.1 10.1 10.2 11.1 12.1 13.1 14.1 15.1 16.1 16.2 17.1 18.1 19.1 20.1 21.1 21.2 22.1 23.1 24.1 25.1 26.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 34.1 35.1 36.1 36.2 36.3 37.1 38.1 38.2 39.1 39.2 40.1 41.1 42.1 43.1 44.1 45.1 46.1 47.1 48.1 49.1 50.1 51.1 52.1 53.1 54.1 55.1 56.1 57.1 58.1 59.1 60.1 61.1 62.1 63.1 63.2 64.1 65.1 66.1 67.1 68.1 69.1 70.1 71.1 72.1 73.1 74.1 75.1 76.1 76.2 77.1 78.1 79.1 80.1 81.1 82.1 83.1 84.1 85.1 86.1 87.1 88.1 89.1 90.1 91.1 92.1 93.1 94.1 95.1 95.2 96.1 97.1 98.1 99.1 100.1 101.1 102.1 103.1 104.1 105.1 106.1 107.1 108.1 109.1 109.2 110.1 111.1 112.1 113.1 114.1 115.1 116.1 117.1 118.1 119.1 120.1 121.1 122.1 123.1 124.1 125.1 126.1 127.1 128.1 129.1 130.1 131.1 132.1 133.1 134.1 135.1 136.1 137.1 138.1 139.1 140.1 141.1 142.1 143.1 144.1 145.1 146.1 147.1 148.1 149.1 150.1 151.1 152.1 153.1 154.1 155.1 155.2 156.1 157.1 158.1 159.1 160.1 160.2 161.1 162.1 163.1 164.1 165.1 166.1 167.1 168.1 169.1 170.1 171.1 172.1 173.1 174.1 175.1 176.1 177.1 178.1 179.1 180.1 181.1 182.1 183.1 184.1 185.1
Na temelju Opće uredbe o zaštiti podataka 2016/679 (General Dana Protection Regulation, GDPR), Zakona o provedbi Opće uredbe o zaštiti podataka (Narodne novine broj: 42/18) i Zakona o obrtu (Narodne novine broj: 143/13), Upravni odbor Udruženja obrtnika Ivanić-Grad na sjednici održanoj 26.srpnja 2018. godine PRAVILNIK O ZAŠTITI I OBRADI OSOBNIH PODATAKA - OPĆE ODREDBE Članak 1. U postupku zaštite i obrade osobnih podataka primjenjuje se Opća uredba o zaštiti podataka 2016/679 (General Dana Protection Regulation, GDPR), Zakon o provedbi Opće Uredbe o zaštiti podataka (Narodne novine broj: 42/18) i Zakon o obrtu (Narodne novine broj: 143/13). Temeljem Opće uredbe o zaštiti podataka (GDPR), Udruženje obrtnika Ivanić-Grad obveznik je primjene ove Uredbe te je dužna nadzirati prikupljanje, obradu, korištenje i zaštitu osobnih podataka svih fizičkih osoba čije podatke uzima i koristi. Članak 2. Ovaj Pravilnik se primjenjuje na obradu osobnih podataka koja se obavlja automatizirano te na neautomatiziranu obradu osobnih podataka koja čini dio sustava pohrane. Članak 3. Sukladno čl. 7. Opće uredbe o zaštiti podataka (GDPR) Udruženje obrtnika Ivanić-Grad je voditelj zbirke osobnih podataka te utvrđuje svrhu i način obrade osobnih podataka. Članak 4. U skladu s Općom uredbom o zaštiti podataka (GDPR) pojedini izrazi imaju sljedeće značenje: Osobni podatak označava sve podatke koji se odnose na pojedinca čiji je identitet utvrđen ili se može utvrditi (ispitanik); pojedinac čiji se identitet može utvrditi jest osoba koja se može identificirati izravno ili neizravno, osobito uz pomoć identifikatora kao što su ime i prezime, identifikacijski broj, podaci o lokaciji, mrežni identifikator ili uz pomoć jednog ili više čimbenika svojstvenih za fizički, fiziološki, genetski, mentalni, ekonomski, kulturni ili socijalni identitet tog pojedinca. Obrada osobnih podataka znači svaki postupak ili skup postupaka koji se obavljaju na osobnim podacima ili skupovima osobnih podataka bilo automatiziranim sredstvima ili neautomatiziranim sredstvima kao što su prikupljanje, bilježenje, organizacija, strukturiranje, pohrana, prilagodba ili izmjena, pronalaženje, obavljanje uvida, uporaba, otkrivanje prijenosom, širenjem ili stavljanjem na raspolaganje na drugi način, usklađivanje ili kombiniranje, ograničavanje, brisanje ili uništavanje. Osobni se podaci mogu obrađivati ručno, primjenom tehničkih pomagala ili u računalnoj bazi osobnih podataka. Obrada osobnih podataka mora biti usklađena sa svrhama u koje su osobni podaci prikupljeni, odnosno svrhe obrade moraju biti izrijekom navedene i opravdane u vrijeme prikupljanja osobnih podataka. Osobni podaci trebaju biti relevantni i ograničeni na ono što je nužno za svrhe u koje se podaci obrađuju. Sustav pohrane znači svaki strukturirani skup osobnih podataka dostupnih prema posebnim kriterijima, bilo da su centralizirani, decentralizirani ili raspršeni na funkcionalnoj ili zemljopisnoj osnovi. Povreda osobnih podataka značisvako kršenje sigurnosti koje dovodi do slučajnog ili nezakonitog uništenja, gubitka, izmjene, neovlaštenog otkrivanja ili pristupa osobnim podacima koji su preneseni, pohranjeni ili na drugi način obrađivani. Voditelj obrade osobnih podataka je fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje samo ili zajedno s drugima čini i utvrđuje svrhu i sredstva obrade osobnih podataka. Treća strana je fizička ili pravna osoba, tijelo javne vlasti , agencija ili drugo tijelo koje nije ispitanik, voditelj obrade, izvršitelj obrade ni osobe koje su ovlaštene za obradu osobnih podataka pod izravnom nadležnošću voditelja obrade ili izvršitelja obrade. Primatelj osobnih podataka je fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo kojim se otkrivaju osobni podaci, neovisno o tome je li on treća strana. Međutim, državna tijela koja mogu primiti osobne podatke u skladu s pravom Unije ili pravom države članice u okviru provođenja istrage ne smatraju se primateljima. Izvršitelj obrade je fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje obrađuje osobne podatke u ime voditelja zbirke osobnih podataka na temelju ugovora ili drugog pisanog akta kojim se utvrđuju obveze i odgovornosti izvršitelja obrade u odnosu na voditelja obrade. Privola ispitanika je svako dobrovoljno, posebno, informirano i nedvosmisleno izražavanje želja ispitanika kojim on izjavom ili jasnom potvrdnom radnjom daje pristanak za obradu osobnih podataka koji se na njega odnose. Pseudonimizacija znači obrada osobnih podataka na način da se osobni podaci više ne mogu pripisati određenom ispitaniku bez uporabe dodatnih informacija, pod uvjetom da se takve dodatne informacije drže odvojeno te da podliježu tehničkim i organizacijskim mjerama kako bi se osiguralo da se osobni podaci ne mogu pripisati pojedincu čiji je identitet utvrđen ili se može utvrditi. Službenik za zaštitu osobnih podataka je osoba imenovana od strane voditelja osobnih podataka koja vodi brigu o zakonitosti obrade osobnih podataka i ostvarivanju prava za zaštitu osobnih podataka. Članak 5. Udruženje obrtnika Ivanić-Grad podatke obrađuje zakonito, etički, objektivno i transparentno. Udruženje obrtnika Ivanić-Grad obrađuje samo primjerene i relevantne osobne podatke i to isključivo u posebne, izričite i zakonite svrhe te ih dalje ne obrađuje na način koji nije u skladu s tim svrhama. Osobni podaci koje Udruženje obrtnika Ivanić-Grad obrađuje su točni te se po potrebi ažuriraju. Podaci koji nisu točni Udruženje obrtnika Ivanić-Grad bez odlaganja briše ili ispravlja. Udruženje obrtnika Ivanić-Grad osobne podatke čuva u obliku koji omogućuje identifikaciju ispitanika i to samo onoliko dugo koliko je potrebno u svrhe radi kojih se osobni podaci obrađuju. Iznimno od stavka 5. ovog članka, osobni podaci mogu se pohraniti i na dulja razdoblja ali samo ako će se isti obrađivati isključivo u svrhe arhiviranja u javnom interesu, u svrhe znanstvenog ili povijesnog istraživanja ili u statističke svrhe pazeći pri tome da su ispunjene tehničke i organizacijske mjere kojima bi se zajamčilo načelo smanjenja količine podataka. Udruženje obrtnika Ivanić-Grad osobne podatke obrađuje isključivo na način kojim se osigurava odgovarajuća sigurnost osobnih podataka, uključujući zaštitu osobnih podataka, zaštitu od neovlaštene ili nezakonite obrade te zaštitu od slučajnog gubitka, uništenja ili oštećenja primjenom odgovarajućih tehničkih ili organizacijskih mjera. - IMENOVANJE SLUŽBENIKA ZA ZAŠTITU OSOBNIH PODATAKA Članak 6. Sukladno članku 37. Opće uredbe o zaštiti podataka (GDPR), Udruženje obrtnika Ivanić-Grad imenuje službenika za zaštitu osobnih podataka i odluku o imenovanju službenika dostavlja Agenciji za zaštitu osobnih podataka kao nadzornom tijelu. Kontakt podatke službenika Udruženje obrtnika Ivanić-Grad objavljuje na web stranici. Članak 7. Službenik za zaštitu osobnih podataka (dalje u tekstu Službenik) imenuje se na temelju stručnih kvalifikacija, a osobito stručnog znanja o pravu i praksama u području zaštite osobnih podataka te sposobnosti izvršavanja zadaća iz članka 39. Opće uredbe o zaštiti podataka (GDPR). Obveze službenika regulirane su čl. 38. i 39. Opće uredbe o zaštiti podataka. Službenik za zaštitu osobnih podataka izvršava sljedeće zadatke: – informira i savjetuje voditelja i izvršitelja obrade te osobe koje obavljaju obradu podataka; – prati kako se poštuje Uredba te drugi propisi o zaštiti podataka, podiže svijest i osposobljava osoblje koje sudjeluju u postupcima obrade; – pruža savjete, kada je to zatraženo, u pogledu procjene učinka na zaštitu podataka i prati procjenu učinka; – surađuje s Agencijom za zaštitu podataka – djeluje kao kontaktna točka za nadzorno tijelo. Službenik ne smije biti razriješen niti kažnjen zbog izvršavanja svojih zadaća, te izravno odgovara najvišoj rukovodećoj razini voditelja obrade podataka ili izvršitelja obrade. Službenik je obvezan tajnošću i povjerljivošću, a može ispunjavati i druge zadaće i dužnosti. Službenik djeluje neovisno te ne smije biti u sukobu interesa. Članak 8. Udruženje obrtnika Ivanić-Grad osigurava službeniku mogućnost pravodobnog i primjerenog informiranja o svim pitanjima vezanim za sva pitanja koja se tiču obrade osobnih podataka, te osiguravaju njegovu neovisnost u pogledu izvršavanja njegovih zadaća. - OBRADA OSOBNIH PODATAKA Članak 9. Udruženje obrtnika Ivanić-Grad osobne podatke obrađuje samo i u onoj mjeri ako je ispunjen jedan od sljedećih uvjeta: - a) da je ispitanik dao privolu za obradu svojih osobnih podataka u jednu ili više posebnih svrha; - b) da je obrada nužna za izvršavanje ugovora u kojem je ispitanik stranka ili kako bi se poduzele radnje na zahtjev ispitanika prije sklapanja ugovora; - c) da je obrada nužna radi poštovanja pravnih obveza Udruženja obrtnika Ivanić-Grad; - d) da je obrada nužna kako bi se zaštitili ključni interesi ispitanika ili druge fizičke osobe; - e) da je obrada nužna za izvršenje zadaće od javnog interesa ili pri izvršavanju službene ovlasti Udruženja obrtnika Ivanić-Grad; - f) da je obrada nužna za potrebe legitimnih interesa Udruženja obrtnika Ivanić-Grad ili treće strane, osim u slučaju kada su od tih interesa jači interesi ili temeljna prava i slobode ispitanika koji zahtijevaju zaštitu osobnih podataka, osobito ako je ispitanik dijete. Točka f) prvog stavka ne odnosi se na obradu koju provodi Udruženje obrtnika Ivanić-Grad pri izvršavanju svojih javnih ovlasti. Udruženje obrtnika Ivanić-Grad prikuplja i obrađuje osobne podatke u svrhu promicanja obrta i obrtništva, zastupanja i predstavljanja obrtnika i ostalih članova HOK-a pred državnim i drugim tijelima u zemlji i inozemstvu, pružanja pomoći prilikom osnivanja i poslovanja obrta, ugovaranja usluga i uspostavljanja poslovnog odnosa, ispunjenja ugovornih obveza, unaprjeđenja poslovnih procesa te izvršavanja zadaća od javnog interesa. Članak 10. Privola kojom ispitanik daje pristanak za obradu osobnih podataka koje se na njega odnose mora biti dobrovoljna, dana u pisanom obliku s lako razumljivim, jasnim i jednostavnim jezikom, s jasno naznačenom svrhom za koju se daje. Ispitanik u bilo kojem trenutku može povući privolu, a da to ne utječe na zakonitost obrade koja se temeljila na privoli prije nego što je ona povučena. Ukoliko se radi o obradi osobnih podataka maloljetnika ispod dobne granice od 16 godina, privolu na način opisan u stavku 1. ovog članka daje nositelj roditeljske odgovornosti nad djetetom (roditelj ili zakonski skrbnik djeteta). U postupku obrade osobnih podataka Udruženje obrtnika Ivanić-Grad na odgovarajući način (pisano ili izravno usmeno) ispitaniku pruža sve informacije vezano uz obradu njegovih osobnih podataka, a osobito o svrsi obrade podataka, pravnoj osnovi za obradu podataka, legitimnim interesima Udruženja obrtnika Ivanić-Grad, namjeri predaje osobnih podataka trećim osobama, razdoblju u kojem će osobni podaci biti pohranjeni, o postojanju prava ispitanika na pristup osobnim podacima te na ispravak ili brisanje osobnih podataka i ograničavanje obrade, prava na ulaganje prigovora i dr. Članak 11. Posebne kategorije osobnih podataka su podaci koji se odnose na rasno ili etničko podrijetlo, politička stajališta, vjerska ili druga uvjerenja, sindikalno članstvo, zdravlje ili spolni život i osobni podaci o kaznenom i prekršajnom postupku. Posebne kategorije osobnih podataka prikupljaju se i dalje obrađuju: – uz privolu ispitanika samo u svrhu za koju je ispitanik dao privolu, – u slučajevima određenim zakonom odnosno u svrhu izvršavanja zakonskih obveza voditelja obrade ili ispitanika u području radnog prava i prava o socijalnoj sigurnosti te socijalnoj zaštiti, – u svrhu zaštite životno važnih interesa ispitanika ili drugog pojedinca ako ispitanik fizički ili pravno nije u mogućnosti dati privolu – ako se obrada provodi u sklopu legitimnih aktivnosti s – ako je ispitanik sam objavio podatke, – ako je obrada nužna za uspostavu, ostvarivanje ili obranu pravnih zahtjeva ili kad god sudovi djeluju u sudbenom svojstvu; – ako je obrada nužna za potrebe značajnog javnog interesa na temelju prava Unije ili prava države članice koje je razmjerno željenom cilju te kojim se poštuje bit prava na zaštitu podataka i osiguravaju prikladne i posebne mjere za zaštitu temeljnih prava i interesa ispitanika; – ako je obrada nužna u svrhe arhiviranja u javnom interesu, u svrhe znanstvenog ili povijesnog istraživanja ili u statističke svrhe u skladu sa člankom 89. stavkom 1. Opće uredbe o zaštiti podataka ili prava države članice koje je razmjerno cilju koji se nastoji postići te kojim se poštuje bit prava na zaštitu podataka i osiguravaju prikladne i posebne mjere za zaštitu temeljnih prava i interesa ispitanika. Članak 12. Osobni podaci fizičkih osoba mogu se iznositi iz Republike Hrvatske u druge države ili međunarodne organizacije ukoliko one osiguravaju odgovarajuću zaštitu osobnih podataka. Popis država koje osiguravaju odgovarajuću zaštitu osobnih podataka može se pronaći na web stranici Agencije: www.azop.hr. Podaci se mogu iznositi u zemlje koje ne osiguravaju odgovarajuću zaštitu osobnih podataka u sljedećim slučajevima: – postoji privola ispitanika ili – iznošenje je nužno u svrhu zaštite vitalnih interesa ispitanika ili – iznošenje se temelji na ugovoru koji pruža dovoljna jamstva za zaštitu podataka (primjerice ugovor koji je sukladan standardnim ugovornim klauzulama Europske komisije) ili – iznošenje je potrebno radi izvršenja ugovora između voditelja zbirke osobnih podataka i ispitanika ili provedbe predugovornih mjera na zahtjev ispitanika ili – iznošenje je potrebno za zaključivanje ili izvršenje ugovora između voditelja zbirke osobnih podataka i treće osobe a koji je u interesu ispitanika ili – iznošenje je potrebno ili određeno zakonom radi zaštite javnog interesa ili radi zakonskih potraživanja ili – iznošenje se obavlja iz evidencije koja je sukladno zakonu ili drugom propisu namijenjena pružanju informacija javnosti. U svakom slučaju sumnje o postojanju zaštite osobnih podataka u konkretnom slučaju Agencija na zahtjev voditelja zbirke daje mišljenje. - OBRADA OSOBNIH PODATAKA PUTEM VIDEONADZORA Članak 13. Obrada osobnih podataka putem videonadzora provodi se u svrhu koja je nužna i opravdana za zaštitu osoba i imovine, ako ne prevladaju interesi ispitanika koji su u suprotnosti s obradom podataka putem videonadzora. Videonadzorom su obuhvaćene prostorije, dijelovi prostorija te vanjska površina Hrvatske obrtničke komore, a čiji je nadzor nužan radi postizanja svrhe iz stavka 1. ovog članka. Članak 14. Hrvatska obrtnička komora označava da je objekt odnosno pojedina prostorija u njemu te vanjska površina objekta pod videonadzorom, a oznaka je vidljiva najkasnije prilikom ulaska u perimetar snimanja. Obavijest iz stavka 1. ovog članka sadržava sve relevantne informacije sukladno odredbi članka 13. Opće uredbe o zaštiti podataka, a posebno jednostavnu i lako razumljivu sliku uz tekst kojim se ispitanicima pružaju sljedeće informacije: – da je prostor pod videonadzorom – podatke o Hrvatskoj obrtničkoj komori – podatke za kontakt putem kojih ispitanik može ostvariti svoja prava. Članak 15. Pravo pristupa osobnim podacima prikupljenim putem videonadzora ima osoba koju Hrvatska obrtnička komora ovlasti. Osobe iz stavka 1. ovog članka ne smiju koristiti snimke iz sustava videonadzora suprotno svrsi utvrđenoj u članku 11. ovog Pravilnika. Sustav videonadzora mora biti zaštićen od pristupa neovlaštenim osobama te imati automatizirani sustav zapisa za evidentiranje pristupa snimkama videonadzora koji će sadržavati vrijeme i mjesto pristupa, kao i oznaku osoba koje su izvršile pristup podacima prikupljenim putem videonadzora. Članak 16. Snimke dobivene putem videonadzora čuvaju se do mjesec dana osim ako su dokaz u sudskom, upravnom, arbitražnom ili drugom istovrijednom postupku. Članak 17. Videonadzor radnih prostorija ne smije obuhvaćati prostorije za odmor, osobnu higijenu i presvlačenje. - DAVANJE OSOBNIH PODATAKA Članak 18. Udruženje obrtnika Ivanić-Grad je ovlaštena osobne podatke dati na korištenje drugim primateljima na temelju pisanog zahtjeva ako je to potrebno radi obavljanja poslova u okviru zakonom utvrđene djelatnosti primatelja. Pisani zahtjev mora sadržavati svrhu i pravni temelj za korištenje osobnih podataka te vrstu osobnih podataka koji se traže. Članak 19. Prije davanja osobnih podataka na korištenje drugim primateljima voditelj obrade osobnih podataka dužan je informirati ispitanika o davanju osobnih podataka drugim primateljima. Članak 20. Informacije se ne moraju dati ispitaniku ako se osobni podaci daju na korištenje za potrebe obrade u statističke svrhe ili u svrhe povijesnog ili znanstvenog istraživanja ili se prikupljaju iz postojećih zbirki osobnih podataka ili ako je obrada osobnih podataka izričito određena zakonom. - PRAVA I ZAŠTITA ISPITNIKA Članak 21. Ispitanik ima pravo uvida u osobne podatke sadržane u sustavu pohrane Udruženja obrtnika Ivanić-Grad koji se na njega odnose. Ispitanik ima pravo ograničavanja obrade osobnih podataka sadržanih u sustavu pohrane koji se na njega odnose. Udruženje obrtnika Ivanić-Grad će bez odgađanja, na zahtjev ispitanika ispraviti netočne podatke koji se na njega odnose odnosno, temeljem traženja ispitanika ili iste dopuniti. Udruženje obrtnika Ivanić-Grad će bez odgađanja, temeljem zahtjeva ispitanika, provesti brisanje osobnih podataka koji se na njega odnose pod uvjetom da osobni podaci više nisu nužni u odnosu na svrhe za koje su prikupljeni ili ako ispitanik povuče privolu na kojoj se obrada temelji. Ispitanik, ako smatra da mu je povrijeđeno neko pravo zajamčeno zakonom, ima pravo na ulaganje prigovora na obradu osobnih podataka Agenciji za zaštitu osobnih podataka. Članak 22. Ispitanik svoja prava može ostvariti putem zahtjeva za prava ispitanika objavljenih na web stranici www.hok.hr. - SUSTAV POHRANE I EVIDENCIJA AKTIVNOSTI OBRADE Članak 23. Udruženje obrtnika Ivanić-Grad prikuplja i obrađuje sljedeće vrste osobnih podataka: - podatke zaposlenika Udruženja obrtnika Ivanić-Grad ; - podatke o kandidatima koji sudjeluju u natječajnom postupku za zasnivanje radnog odnosa; - podatke članova Udruženja obrtnika Ivanić-Grad; - podatke dužnosnika Udruženja obrtnika Ivanić-Grad; - podatke ispitanika na ispitima koji su u nadležnosti Hrvatske obrtničke komore; - podatke članova ispitnih komisija; - podatke o licenciranim obrtima i mentorima u obrtima i pravnim osobama; - podatke sudaca Suda časti; - podatke izmiritelja Centra za mirenje; - podatke u spisima Suda časti; - podatke u spisima Centra za mirenje; - podatke vanjskih korisnika usluga Udruženja obrtnika Ivanić-Grad; - podatke pružatelja usluga i dobavljača Udruženja obrtnika Ivanić-Grad Članak 24. Za osobne podatke navedene u članku 23. ovog članka Udruženje obrtnika Ivanić-Grad vodi evidenciju aktivnosti obrade. Evidencija aktivnosti obrade sadrži najmanje sljedeće podatke: - naziv i kontaktne podatke Udruženja obrtnika Ivanić-Grad, predstavnika Udruženja i službenika za zaštitu podataka i osobe određene za obradu podataka; - svrha obrade; - opis kategorija ispitanika i kategorija osobnih podataka; - kategorije primatelja kojima su osobni podaci otkriveni ili će im biti otkriveni, uključujući primatelje u trećim zemljama ili međunarodne organizacije; - prijenose osobnih podataka u treću zemlju ili međunarodnu organizaciju, uključujući identificiranje te treće zemlje ili međunarodne organizacije te - predviđene rokove za brisanje različitih kategorija podataka; - opći opis tehničkih i organizacijskih sigurnosnih mjera za zaštitu podataka. Članak 25. Predsjednik Udruženja obrtnika Ivanić-Grad donosi odluku o osobama zaduženim za obradu i zaštitu osobnih podataka iz članka 24. ovog Pravilnika. - ZAŠTITA OSOBNIH PODATAKA Članak 26. Da bi se izbjegao neovlašteni pristup osobnim podacima, podaci u pisanom obliku čuvaju se u registratorima, u zaključanim ormarima, a podaci u računalu zaštićuju se vatrozidom i antivirusnim softwareom te dodjeljivanjem korisničkog imena i lozinke koja je poznata zaposlenicima zaduženim za obradu podataka. U slučaju prijenosa osobnih podataka potrebno je osigurati siguran prijenos. U slučaju dostupa do osobnih podataka izvana potrebno je osigurati siguran dostup. Članak 27. Osobe zadužene za obradu osobnih podataka dužne su poduzeti tehničke, kadrovske i organizacijske mjere zaštite osobnih podataka koje su potrebne da bi se osobni podaci zaštitili od slučajnog gubitka ili uništenja, od nedopuštenog pristupa ili nedopuštene promjene, nedopuštenog objavljivanja i svake druge zlouporabe. - IZVJEŠĆIVANJE O POVREDI Članak 28. Udruženje obrtnika Ivanić-Grad može protiv onoga za koga postoji sumnja da je zlouporabio osobne podatke, ili je neovlašteno ušao u zbirku osobnih podataka, postupiti sukladno zakonu. Pod zlouporabom osobnih podataka podrazumijeva se svaka uporaba osobnih podataka u svrhe koje nisu sukladne svrsi prikupljanja određene u evidenciji zbirke osobnih podataka. Članak 29. U slučaju narušavanja sigurnosti osobnih podataka Udruženje obrtnika Ivanić-Grad će bez odlaganja, a najkasnije u roku od 72 sata po otkrivanju incidenta, o tome izvijestiti nadležno tijelo. U slučaju povrede osobnih podataka koje će vjerojatno prouzročiti visok rizik za prava i slobode pojedinaca, Udruženje obrtnika Ivanić-Grad bez nepotrebnog odgađanja obavješćuje ispitanika o povredi osobnih podataka. Udruženje obrtnika Ivanić-Grad dokumentira sve povrede osobnih podataka, uključujući činjenice vezane za povredu osobnih podataka, njezine posljedice i mjere poduzete za popravljanje štete. - PROCJENA UČINKA NA ZAŠTITU PODATAKA Članak 30. Ako je vjerojatno da će neka vrsta obrade, osobito putem novih tehnologija i uzimajući u obzir prirodu, opseg, kontekst i svrhe obrade, prouzročiti visok rizik za prava i slobode pojedinaca, Udruženje obrtnika Ivanić-Grad će prije obrade provesti procjenu učinka predviđenih postupaka obrade na zaštitu osobnih podataka. Procjena učinka na zaštitu osobnih podataka nužna je za: – sustavne i opsežne procjene osobnosti i izrade profila ispitanika (kod odluka koje mogu imati pravne učinke), – sustavno praćenje javno dostupnog područja u velikoj mjeri. - DIZANJE SVIJESTI Članak 31. Udruženje obrtnika Ivanić-Grad provodi redovitu i adekvatnu edukaciju o informacijskoj sigurnosti i zaštiti osobnih podataka. Odgovarajuća edukacija provodi se na početku zaposlenja, a nakon toga najmanje jednom godišnje. Službenik za zaštitu osobnih podataka osigurava odgovarajuće informacije potrebne za edukaciju radnika o postupanju sa osobnim podacima i ovlašten je za savjetovanje i koordinaciju poslova u navedenom području. - PRIJELAZNE I ZAVRŠNE ODREDBE Članak 32. U dijelu o zaštiti, nadzoru nad prikupljanjem, obradi i korištenju osobnih podataka koji nije uređen ovim Pravilnikom, neposredno se primjenjuje Opća uredbe o zaštiti osobnih podataka (GDPR). Članak 33. Ovaj Pravilnik stupa na snagu danom donošenja. Urudžbeni broj: Zagreb, Predsjednica Udruženja obrtnika Ivanić-Grad Marina Hrastić