http___www.unizg.hr_o-sveucilistu_dokumenti-i-javnost-informacija_sluzbenici-za-zastitu-osobnih-podataka__1.xml
1.1 2.1 3.1 4.1 5.1 6.1 7.1 8.1 9.1 10.1 11.1 12.1 13.1 14.1 15.1 17.1 18.1 19.1 19.2 20.1 21.1 22.1 23.1 24.1 25.1 26.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 34.1 35.1 36.1 37.1 38.1 39.1 40.1 41.1 42.1 43.1 44.1 45.1 45.2 46.1 46.2 47.1 48.1 49.1 50.1 51.1 52.1 52.2 53.1 54.1 55.1 56.1 57.1 58.1 59.1 59.2 60.1 61.1 62.1 62.2 62.3 62.4 63.1 63.2 63.3 64.1 65.1 66.1 67.1 68.1 69.1 70.1 71.1 72.1 73.1 73.2 74.1 75.1 75.2 76.1 77.1 78.1 79.1 80.1 81.1 82.1 83.1 84.1 85.1 86.1 87.1 88.1 89.1 90.1 90.2 91.1 92.1 92.2 93.1 94.1 95.1 96.1 97.1 97.2 98.1 99.1 100.1 100.2 101.1 102.1 103.1 104.1 104.2 105.1 106.1 107.1 108.1 109.1
PRIVACY POLICY The access and usage of the website chilltea-tokyo.com and all of its subdomains are likely to lead the user to communicate us some personal data as defined in the GDPR article 4(1) Personal data is processed in accordance with the principles relating to the processing of personal data listed in article 5 of the GDPR. ○Lawfulness, fairness, and transparency: processed lawfully, fairly, and in a transparent manner in relation to the data subject ○Purpose limitation: collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes ○Data minimization: adequate, relevant, and limited to what is necessary for relation to the purposes for which they are processed ○Accuracy: accurate and where necessary, kept up to date ○Storage limitation: kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed ○Integrity and confidentiality: processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organizational measures We undertake not to process any sensitive personal data, in accordance with article 9 of the GDPR. This privacy policy page is created in accordance with article 13 of the GDPR which regulates the Information to be provided where personal data are collected from the data subject. Identity and the contact details of the controller and where applicable, of the controller’s representative; Chilty Co., Ltd. KC Building 6F,2-35-1 Higashiazabu , Minato-ku , Tokyo 106-0044 info@chilty.com Where do we store your data? The data we collect is stored with our service provider. SiteGround Spain S.L. Calle de Prim 19,28004 Madrid, Spain The data is stored in its data center in Singapore. You can find the « privacy policy » of SiteGround here; https://www.siteground.com/privacy.htm How is your data protected? We use appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate: ○Pseudonymisation and encryption of personal data; ○Ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services ○Ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident ○Regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing. Purposes of the processing for which the personal data are intended as well as the legal basis for the processing; We may collect, use, store and transfer the following kinds of information about you: ○Identity Data includes first name, last name, username, or similar identifier. ○Contact Data includes billing address, delivery address, email address, and telephone numbers. ○Financial Data includes the bank account and payment card details. ○Transaction Data includes details about payments to and from you and other details of products you have purchased from us. ○Technical Data includes internet protocol (IP) address, your login data, browser type, and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website. ○Profile Data includes your username and password, purchases or orders made by you, your interests, preferences, feedback, and survey responses. ○Usage Data includes information about how you use our website, products, and services. ○Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences. This is the purpose of collecting the personal data we need to provide you with the service offered. ○To provide, maintain, protect, and improve the service, including the acceptance of registration, identification, user authentication, recording of user settings, and calculation of usage fees. ○To measure user traffic and behavior ○To analyze the hobbies and preferences of users and to distribute, display, and measure the effectiveness of advertisements related to the products and other services of the company or third parties affiliated with the company, by linking information about users obtained from the company’s business partners with users’ personal information. ○To provide information and respond to inquiries regarding the Service. ○To respond to violations of the company’s terms, policies, etc. (hereinafter referred to as the “Terms, etc.”) related to the Service. ○To respond to violations of the Company’s terms, policies, etc. (hereinafter referred to as the “Terms, etc.”) regarding the Service ○To conduct surveys, statistics, and analysis for marketing purposes ○To improve the services of the company or third parties affiliated with the company, or to develop new services or new functions. ○To maintain the system and respond to problems ○To notify you of changes to the terms of service, etc. ○For other purposes incidental to the preceding items. We only use as a legal basis those proposed by article 6 of the GDPR. Including; ○The data subject has given consent to the processing of his or her personal data for one or more specific purposes ○Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract ○Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. ○processing is necessary for compliance with a legal obligation to which the controller is subject; The period for which the personal data will be stored ○The customer file: the personal data of customers are kept for the time necessary for the commercial relationship. They can be kept for commercial prospecting purposes for a maximum of 3 years from the end of this commercial relationship ○The prospect file: the personal data of prospects are kept for 3 years from their collection by the data controller or from the last contact from the prospect. Recipients of personal data Only chilltea-tokyo is the recipient of your Personal Information. These are never passed on to a third party. Only subcontractors to which chilltea-tokyo uses can access it. Neither chilltea-tokyo nor our subcontractors market your Personal Data. Our website uses the Shopify platform to enable you to make purchases. Some personal data, therefore, needs to be transferred to this platform. You can find the “privacy policy” of Shopify here: https://www.shopify.com/legal/privacy Your rights under the GDPR regulation. ○The Right to Information. ○The Right of Access. ○The Right to Rectification. ○The Right to Erasure. ○The Right to Restriction of Processing. ○The Right to Data Portability. ○The Right to Object. ○The Right to Avoid Automated Decision making. (1)The Right to Information; you have the right to request information about the personal data we hold. You have the right to be informed of how your personal data is processed. (2)The Right of Access; (Article 15, Recitals 63 & 64 GDPR) The General Data Protection Regulation (GDPR), under Article 15, gives individuals the right to request a copy of any of their personal data which are being ‘processed’ (i.e. used in any way) by ‘controllers’ (i.e. those who decide how and why data are processed), as well as other relevant information (as detailed below). These requests are often referred to as ‘data subject access requests, or ‘access requests.’ (3)The Right to Rectification; (Articles 16 & 19 of the GDPR) If your personal data is inaccurate, you have the right to have the data rectified, by the controller, without undue delay. If your personal data is incomplete, you have the right to have data completed, including by means of providing supplementary information. The right of rectification is restricted in certain circumstances under Section 60 of the Data Protection Act 2018, which provides for restrictions that are necessary for important objectives of public interest, and by Section 43 of the Act which seeks to balance the right of rectification with the right of freedom of expression and information. (4)The Right to Erasure; (Articles 17 & 19 of the GDPR) This is also known as the ‘right to be forgotten. You have the right to have your data erased, without undue delay, by the data controller, if one of the following grounds applies: ○Where your personal data are no longer necessary in relation to the purpose for which it was collected or processed. ○Where you withdraw your consent to the processing and there is no other lawful basis for processing the data. ○Where you object to the processing and there are no overriding legitimate grounds for continuing the processing (see point 6 below). ○Where you object to the processing and your personal data are being processed for direct marketing purposes (see point 6 below). ○Where your personal data have been unlawfully processed. ○Where your personal data have to be erased in order to comply with a legal obligation. ○Where your personal data have been collected in relation to the offer of information society services (e.g. social media) to a child. (5)The Right to Restriction of Processing; (Article 18 of the GDPR) You have a limited right of restriction of processing of your personal data by a data controller. Where the processing of your data is restricted, it can be stored by the data controller, but most other processing actions, such as deletion, will require your permission. (6)The Right to Data Portability; (Article 20 of the GDPR) In some circumstances, you may be entitled to obtain your personal data from a data controller in a format that makes it easier to reuse your information in another context and to transmit this data to another data controller of your choosing without hindrance. This is referred to as the right to data portability. (7)The Right to Object; (Article 21 of the GDPR) When do you have a right to object? ○You have the right to object to certain types of processing of your personal data where this processing is carried out in connection with tasks: In the public interest, Under official authority, or in the legitimate interests of others. ○You have a stronger right to object to the processing of your personal data where the processing relates to direct marketing. Where a data controller is using your personal data for the purpose of marketing something directly to you or profiling you for direct marketing purposes, you can object at any time, and the data controller must stop processing as soon as they receive your objection. ○You may also object to the processing of your personal data for research purposes unless the processing is necessary for the performance of a task carried out in the public interest. (8)The Right to Avoid Automated Decisionmaking; (Article 22 of the GDPR) You have the right to not be subject to a decision based solely on automated processing. Processing is “automated” where it is carried out without human intervention and where it produces legal effects or significantly affects you. Automated processing includes profiling. How to exercise your rights. You can exercise your rights by contacting us directly by any means of contact that we have provided to you at the beginning of the “privacy policy” page. You also have the right to lodge a complaint. (Article 77 of the GDPR) For English-speaking peoples, you can contact the ICO, which is the English authority for the protection of personal data. The Information Commissioner’s Office Water Lane, Wycliffe House Wilmslow – Cheshire SK9 5AF Tel. e-mail: international.team@ico.org.uk Website: https://ico.org.uk
1.1 2.1 2.2 3.1 3.2 3.3 4.1 5.1 6.1 6.2 7.1 8.1 8.2 8.3 8.4 9.1 10.1 10.2 10.3 11.1 12.1 13.1 14.1 15.1 16.1 17.1 18.1 19.1 20.1 20.2 21.1 22.1 23.1 24.1 25.1 26.1 27.1 27.2 28.1 29.1 29.2 30.1 31.1
Obavijest o obradi osobnih podataka Zaštita osobnih podatka pojedinca utvrđena je člankom 37. Ustava Republike Hrvatske (NN 85/10 – pročišćeni tekst), Općom uredbom o zaštiti podataka (EU, 2016/679) i Zakonom o provedbi Opće uredbe o zaštiti podataka (NN, 42/2018). Sveučilište u Zagrebu brine za sigurnost Vaših osobnih podataka i zaštitu osobnih podataka svih ispitanika shvaća vrlo ozbiljno. Osobni podaci su svi podaci koji se odnose na pojedinca čiji je identitet utvrđen ili se može utvrditi („ispitanik“). Ovom obaviješću želimo Vas upoznati s našim sigurnosnim mjerama kako biste znali koje podatke pohranjujemo i kako ih koristimo. Temeljna načela i prakse zaštite podataka Zakonitost, poštenost i transparentnost Osobne podatke naših studenata, zaposlenika, vanjskih suradnika i drugih osoba s kojima smo povezani u obavljanju svoje djelatnosti obrađivat ćemo samo na temelju zakonske obveze, Vaše privole ili druge legitimne osnove. Podaci koji se odnose na Vas na transparentan će se način prikupljati, upotrebljavati, dati na uvid ili na neki drugi način obrađivati, te su javno objavljeni rokovi i svrhe obrade podataka, podaci o identitetu voditelja obrade, informacija o načinu na koji možete pristupiti svojim podacima, procesu za podnošenje pritužbi i zahtjeva za ažuriranje podataka. Ograničavanje svrhe Vaši osobni podaci prikupljat će se u posebne, izričite i zakonite svrhe i neće se dalje obrađivati na način koji nije u skladu s tim svrhama. Vaše osobne podatke prikupljati ćemo i pohranjivati u svrhu izvršenja zakonskih obveza, ispunjenja obveza od javnog interesa, izvršavanja javnih ovlasti i ugovora. Podaci koji su prikupljeni za jednu svrhu neće se koristiti ni za jednu drugu svrhu ili na način koji nije u skladu s odobrenom svrhom. Za svrhu obrade koja se ne provodi temeljem zakonske osnove ili ugovora tražit ćemo od Vas posebnu privolu. Smanjenje količine podataka Osobni podaci koje prikupljamo su primjereni, bitni i ograničeni na svrhu obrade. Sveučilište prikuplja i obrađuje osobne podatke u mjeri u kojoj je to potrebno za ispunjenje Zakonom i drugim propisima utvrđenih obveza redovite djelatnosti Sveučilišta, te sukladno Zakonu o znanstvenoj djelatnosti i visokom obrazovanju i drugim propisima koje primjenjujemo u svom radu. Voditelj obrade i izvršitelj obrade neće prikupljati osobne podatke koji mu nisu potrebni za svrhu obrade. Točnost i integritet podataka Nužno je da osobni podaci koje prikupljamo i spremamo budu točni i ažurni i zato ćemo poduzeti svaku razumnu mjeru kako bismo osigurali da se osobni podaci koji nisu točni, uzimajući u obzir svrhe u koje se obrađuju, bez odlaganja izbrišu ili isprave. Ograničenje pohrane Rokovi čuvanja Vaših osobnih podataka određeni su pozitivnim zakonskim propisima i internim aktima Sveučilišta u Zagrebu ili Vašom suglasnošću za prikupljanje i obradu osobnih podataka. Cjelovitost i povjerljivost Kako bi zaštitila osobne podatke ispitanika, Sveučilište u Zagrebu poduzima sve odgovarajuće mjere zaštite koje su u skladu s primjenjivim propisima o zaštiti privatnosti i osobnih podataka te su osigurane sve razumne tehničke, fizičke i organizacijske mjere za zaštitu osobnih podataka ispitanika od neovlaštene ili nezakonite obrade, uništenja, slučajnog gubitka, štete, izmjene, neovlaštenog odavanja ili pristupa te od svih ostalih oblika nezakonite i/ili pretjerane obrade Vodit ćemo nadzor nad pristupom, korištenjem i održavanjem osobnih podataka, te ćemo kontinuirano unapređivati naše sigurnosne mjere sukladno tehnološkim mogućnostima. Postupanje u slučaju povrede osobnih podataka U slučaju povrede osobnih podataka, Sveučilište u Zagrebu će kao voditelj obrade osobnih podataka, bez nepotrebnog odgađanja i ukoliko je izvedivo, u roku od 72 sata nakon saznanja o povredi osobnih podataka ispitanika izvijestiti Agenciju za zaštitu osobnih podataka. Ostvarivanje prava ispitanika Svaki ispitanik ima pravo u svakom trenutku od voditelja obrade zatražiti pristup svojim osobnim podacima, njihov ispravak, brisanje ili ograničavanje njihove obrade kao i pravo na prigovor Agenciji za zaštitu osobnih podataka te pravo na prenosivost podataka. Navedena prava ostvaruju se podnošenjem zahtjeva na e-mail adresu Službenika za zaštitu osobnih podataka Sveučilišta u Zagrebu. e-mail: gdpr@ unizg.hr Dokumenti i obrasci: Obrazac za pristup, promjenu, dopunu, prigovor, ograničenje prikupljanja osobnih podatka Obrazac za brisanje osobnih podataka Službenici za zaštitu osobnih podataka Uredba (EU) 2016/679 Europskog parlamenta i Vijeća od 27. travnja 2016. o zaštiti pojedinaca u vezi s obradom osobnih podataka i o slobodnom kretanju takvih podataka – Opća uredba o zaštiti podataka – GDPR (General Data Protection Regulation) izravno se primjenjuje u Republici Hrvatskoj od 25. svibnja 2018. godine. Uredba određuje koja su prava pojedinaca, a u skladu s tim i koje su obveze subjekata koji obrađuju osobne podatke poput voditelja obrade odnosno izvršitelja obrade. Neke od obveza subjekata su obrada osobnih podataka ako je građanin dao privolu ili radi izvršavanja zadaći temeljem drugih zakonskih propisa, obrada podataka prema načelima obrade navedenih u Uredbi, zatim informacije koje subjekt daje građaninu prije same obrade njegovih osobnih podataka te uspostava evidencija o vođenju obrade osobnih podataka. Općom uredbom o zaštiti osobnih podataka definiraju se i obveze službenika za zaštitu osobnih podataka, koje imenuje voditelj obrade, koji o imenovanju službenika pisano obavještava Agenciju za zaštitu osobnih podataka. Temeljem članka 38. Opće uredbe o zaštiti podataka, rektor Sveučilišta u Zagrebu, kao voditelj obrade osobnih podataka, imenovao je sljedeće službenike za zaštitu osobnih podataka: Imenovane službenice možete kontaktirati putem e-adrese: gdpr@ unizg.hr Navedeni tekst u obliku zasebnog dokumenta možete preuzeti ovdje.