http___www.uhpa.hr_o-nama_zastita-privatnosti-5b0d5aff4bb49_politika-zastite-osobnih-podataka-5b0e8495a935c_1.xml
1.1 2.1 3.1 3.2 4.1 5.1 6.1 7.1 8.1 9.1 10.1 11.1 11.2 12.1 13.1 14.1 15.1 15.2 15.3 15.4 16.1 16.2 16.3 16.4 16.5 17.1 17.2 18.1 19.1 20.1 21.1 21.2 21.3 22.1 23.1 23.2 24.1 25.1 26.1 27.1 27.2 28.1 29.1 30.1 31.1 31.2 32.1 33.1 33.2 33.3 34.1 35.1 36.1 37.1 38.1 39.1 40.1 40.2 40.3 41.1 42.1 43.1 44.1 45.1 46.1 47.1 48.1 48.2 48.3 49.1 49.2 50.1 51.1 51.2 52.1 53.1 54.1 54.2 55.1 56.1 56.2 57.1 58.1 59.1 60.1 61.1 62.1 63.1 64.1 65.1 66.1 67.1 68.1 69.1 69.2 70.1 70.2 71.1 72.1 73.1 74.1 75.1 76.1 77.1 78.1 79.1 80.1 81.1 82.1 83.1 84.1 85.1 86.1 86.2 87.1 87.2
In April 2016, the General Data Protection Regulation (GDPR) — a joint proposal by the European Commission, European Parliament, and the Council of the EU which provides individuals with even greater control over the collection and use of their personal data- was adopted by the European Union. As a provider of a world-class email marketing platform, which by its nature has a global reach and deals with the processing of email contact and engagement information, Emma is committed to ensuring our customers are able to comply with their requirements under the GDPR by the May 25, 2018 enforcement timeline. With that goal in mind, we’ve kicked off our compliance efforts in a big way — from training our managers and executives on the GDPR and how it impacts all decisions related to treatment of personal data, to evaluating all of our systems, security practices, and related documentation. Among other things, the key steps that we are taking to comply with the GDPR regulations are: - Documenting all data processing activities that involve the collection, treatment, and safeguarding of personal data - Building and improving processes and features to ensure we can quickly and effectively address any requests from our customers when their subscribers wish to exercise their rights (including the Right of Access, Right to Rectification, Right to Object, Right to be Forgotten, and the Right of Portability) - Reevaluating all of our sub-processors to ensure they have adequate security measures in place for the safeguarding of personal data processed by them and ensuring our contracts with them require them to also abide by their requirements as sub-processors under the GDPR We are very focused on GDPR compliance and will be ready to address the needs of customers like yourself by May 25, 2018. Consent and Purpose Before discussing how and why you should be collecting personal data, it’s important to define what personal data is, according to the GDPR. ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;1 While the definition of ‘personal data’ under the GDPR is largely unchanged from its predecessor, the EU Directive, the inclusion of reference to “online identifiers” is potentially a major shift for marketers’ perception of the data they hold and how it should be handled. So, if you’re storing data about a person in a usable way, it probably relates to some identifier of a natural person (including online identifiers like device IDs, cookie IDs, etc) and is, as a result, personal data. The tips below focus on GDPR requirements that should be considered at the point of collection. Personal Data must be “Processed lawfully, fairly and in a transparent manner”2 Consent and Transparency For all data covered by the above definition of personal data, you’ll need to be able to justify that you’re processing3 it lawfully. Consent is just one way of establishing that your processing activities are lawful under the GDPR, but it is likely going to be the one most applicable to the email marketer. Just as it has been with email marketing in the past, explicit, purpose-based collection, that is freely given is the highest standard for data collection and use policies. This means that there is no ambiguity as to the activities consented to or the organisation carrying out those activities. Consent should be clear and unique to a specific organisation and each reason for processing. Methods like separate forms or separate, default unchecked boxes are obvious options. While there may be other, more creative options that are equally viable, it is important to ensure that clarity is not lost in the process. The transparency of your reasons for processing data is a requirement for building explicit consent. As always, data subjects should be able to withdraw their consent for each, or all, processing activity, and withdrawing consent should be as easy as giving it was. As with all GDPR-related things, records keeping is vital to demonstrating compliance. Make sure that, however you decide to do this, these records support your consent-based legal grounds. TIP: If you are relying on consent as the lawful basis for processing your subscriber’s data, we recommend evaluating your subscribe forms to ensure they comply with the consent principles encapsulated in the GDPR (specifically those in Articles 6 & 7 and Recitals 32, 33, 42, 43, and 171). Personal Data must be “Collected for specified, explicit and legitimate purposes”4 and be “Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed”5 Purpose Limitation Obtaining explicit consent goes hand-in-hand with purpose limitation; at the point of data collection (for example, your online form), you should be completely transparent about the purpose for which personal data is being collected such that there should be no confusion regarding the purpose of collection. In addition, once you have collected data for a specified purpose, that data should not be used for another, incompatible purpose. Further, the purpose must be legitimate-- in other words, it must not be in violation of applicable laws. Data Minimization Related to purpose limitation, personal data collected for an explicit purpose should be limited so that only data which is necessary to fulfill the consented-to purpose is processed. This means that you should carefully review the data being collected against the purpose it is meant to fulfill. TIP: When evaluating whether or not you’re complying with the purpose limitation and data minimization principles ask yourself some of these questions: Have I made it clear to the Subscriber what information I am collecting? Have I made it clear to the Subscriber why I am collecting that information? Am I collecting more information than I need? (EX: If your subscriber is signing up for a newsletter-- do you need information about that subscriber’s gender to fulfill your stated purpose?) Relevant Definitions: ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction 1Chapter I; Article 4(1) 2Chapter II; Article 5(1a) 3Processing is defined as “any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means” and includes collection, recording, storage, and other common activities. 4Chapter II; Article 5(1b) 5Chapter II; Article 5(1c) Lawful Data Processing As a marketing professional, especially in the context of using an email marketing application like Emma, you will likely rely on consent (see: Consent and Purpose article) as the lawful basis for processing your subscriber’s personal data. While consent is not the only way to lawfully process personal data, at least one of the following grounds for lawfully processing personal data must apply (Art. 6 GDPR): - the data subject has given consent to the processing of his or her personal data for one or more specific purposes; - processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; - processing is necessary for compliance with a legal obligation to which the controller is subject; - processing is necessary in order to protect the vital interests of the data subject or of another natural person; - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; - processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. While it’s true that for most marketing activities, the industry tends to rely heavily on consent as the lawful ground for processing, it is up to you to analyze your data processing activities and choose the right justification(s). If you are unsure which of the lawful grounds listed in the GDPR apply to you, please consult with legal counsel to ensure processing activities are properly justified. As always, diligent record keeping is vital to support these justifications. Relevant Definitions: ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction Security Risk and Appropriate Technical and Organisational Measures While personal data is defined very broadly under the GDPR, the sensitivity of the data and the severity of harm that may result in the event of unauthorized access to the data, is not equal. This means that the measures by which you secure personal data (type of encryption, backup procedures, password requirements, etc.) may vary by data type and the processing activities undertaken using that data. The GDPR requires protection of personal data using “appropriate technical and organisational measures to ensure a level of security appropriate to the risk” throughout the life cycle of the data. “In order to be able to demonstrate compliance with this Regulation, the controller should adopt internal policies and implement measures which meet in particular the principles of data protection by design and data protection by default.” (GDPR- Recital 78) The regulation does not prescribe any specific security mechanisms, but rather requires that data controllers and processors take into “account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons”6 should data be subject to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure or access. Some measures that the GDPR highlights are pseudonymisation and encryption, but the extent to which they represent a standard for data security is unclear. Until more clear guidance is released from the EU, we recommend keeping an eye out for guidance from industry thought leaders, trade organisations, and data security experts and organisations (like the National Institute of Standards and Technology, or NIST), but there may also be clarity in Member State laws and future documents issued from the EU governing body. Regardless of your current security measures, the GDPR highlights the need for ongoing evaluation of risk to personal data and security measures based on product evolution. Privacy By Design The GDPR’s “Data Protection by Design and by Default” model, or more commonly, ‘privacy-by-design’ model, requires that principles of data protection should be taken into account at the product development phase rather than after data is being processed. By implementing appropriate technical and organisational measures, taking into account the nature and sensitivity of data types that will be processed, and ensuring that appropriate data minimization measures are implemented at the product (and feature) development phase, personal data is protected at all stages of its life cycle. Data Breaches If you’re getting a hint of that new-regulation smell, that’s because data breach handling and notification is a previously-untouched scope of data privacy law in the EU. In the GDPR, rules for how and when you should notify data subjects and/or relevant authorities are made more clear. Notice from Controllers to Supervisory Authority: For controllers, notice to the appropriate supervisory authority must be made “without undue delay and, where feasible, not later than 72 hours” after becoming aware of the breach with the following information7: - Describe the nature of the personal data breach including where possible, - The categories and approximate number of data subjects concerned; and - The categories and approximate number of personal data records concerned - Include the name and contact details of the data protection officer or other contact from whom more information may be obtained - Describe the likely consequences of the breach - Describe what the controller is doing to address the breach and/or mitigate possible adverse effects. Throughout the process of identifying, measuring the scope of, and remediating the effects of the breach, records should be maintained to “enable the supervisory authority to verify compliance with this Article.”8 Notice from Processors to Controllers: Processors must inform “the controller without undue delay after becoming aware of a personal data breach”. Notice from Controller directly to Data Subject: If the personal data in question represents “high risk to the rights and freedoms of natural persons,” the controller will need to notify the data subject without undue delay. This notification should include a description of the breach in clear, plain language that includes contact details for the appropriate person (DPO or otherwise), the likely consequences of the breach, and the current and future measures the controller will take to address the breach. There are a few exceptions to the data subject notice requirement: where the controller employed safeguards or has taken subsequent action to render the risk of the breach inert, and where individual data subject outreach would require disproportionate effort. But as with any exception under the regulation, legal counsel should be sought before proceeding. Relevant Definitions: ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person ‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed; ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller ‘supervisory authority’ means an independent public authority which is established by a Member State pursuant to Article 51; 6Article 32 (1) 7Article 33(3a-d) 8Article 33(4) How to submit my GDPR rights How can I submit a request to exercise my (or my subscriber’s) GDPR rights? While we’ve built in a Delete* function in your Emma account to remove a subscriber’s personal data, here’s how to respond and act on your subscribers’ requests. - Head over to https://support.myemma.com/Resource_Center/Account_how-to/contact-us - Ensure that you select “GDPR Request” as your main issue, and detail the appropriate subcategory of Deletion, Retrieval, or Rectification to indicate the specific GDPR rights you’d like to exercise in the text field. - Please provide the following information in the notes with your request (this part is important for us to be able to help as quickly and accurately as possible!): - Full name of data subject, email address of data subject, and your account’s username - Our Support team will be in touch with confirmation that we’ve received your request, and we’ll start processing for you as quickly as possible. You’ll receive confirmation when we’re all done and we’ll make sure to deliver any collateral in a secure format (if applicable). Note: The Delete function in your Emma account will remove all of a subscriber’s personal data within Emma and any systems connected to app, but it’s possible that subscriber’s data could exist elsewhere. If your subscriber’s personal data was provided to us in connection with any prior request for support or services, please indicate this when submitting the request to our Support team.
1.1 2.1 3.1 4.1 4.2 5.1 6.1 7.1 8.1 9.1 10.1 11.1 12.1 13.1 14.1 14.2 15.1 16.1 17.1 18.1 19.1 20.1 21.1 22.1 23.1 24.1 25.1 26.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 34.1 35.1 36.1 37.1 38.1 39.1 40.1 40.2 41.1 42.1 42.2 43.1 43.2 43.3 44.1 45.1 46.1 46.2 47.1 48.1 49.1 50.1 51.1 52.1 53.1 54.1 55.1 56.1 56.2 56.3 57.1 58.1 59.1 60.1 61.1 62.1 63.1 64.1 64.2 65.1 66.1 67.1 68.1 69.1 70.1 71.1 72.1 73.1 74.1 74.2 75.1 76.1 77.1 78.1 78.2 79.1 80.1 81.1 82.1 83.1 84.1 85.1 86.1 87.1 88.1 88.2 89.1 90.1 91.1 92.1 93.1 94.1 95.1 96.1 97.1 98.1 99.1 100.1 101.1 102.1 103.1 103.2 104.1 105.1 106.1 107.1 108.1 110.1
Politika zaštite osobnih podataka UVOD Udruga hrvatskih putničkih agencija (u daljnjem tekstu UHPA) u svom poslovanju provodi mjere zaštite osobnih podataka sukladno Općoj Uredbi o zaštiti podataka (GDPR), zakonskim i regulatornim obvezama. Uprava je u potpunosti predana osiguranju kontinuirane i efektivne uspostave ove politike, te isto očekuje od svojih zaposlenika i poslovnih partnera. Svako kršenje ove politike može rezultirati disciplinskim mjerama ili poslovnim sankcijama. Ova politika određuje očekivano ponašanje UHPA-e, njenih stalnih, privremenih i povremenih zaposlenika kao i poslovnih partnera te trećih strana u odnosu na prikupljanje, korištenje, čuvanje, prijenos, otkrivanje ili uništavanje osobnih podataka koji se obrađuju u poslovnim procesima UHPA-e DEFINICIJE - osobni podaci su svi podaci koji se odnose na pojedinca čiji je identitet utvrđen ili se može utvrditi („Ispitanik”); pojedinac čiji se identitet može utvrditi jest osoba koja se može identificirati izravno ili neizravno, osobito uz pomoć identifikatora kao što su ime, identifikacijski broj, podaci o lokaciji, mrežni identifikator ili uz pomoć jednog ili više čimbenika svojstvenih za fizički, fiziološki, genetski, mentalni, ekonomski, kulturni ili socijalni identitet tog pojedinca; - obrada je svaki postupak ili skup postupaka koji se obavljaju na osobnim podacima ili na skupovima osobnih podataka, bilo automatiziranim bilo neautomatiziranim sredstvima kao što su prikupljanje, bilježenje, organizacija, strukturiranje, pohrana, prilagodba ili izmjena, pronalaženje, obavljanje uvida, uporaba, otkrivanje prijenosom, širenjem ili stavljanjem na raspolaganje na drugi način, usklađivanje ili kombiniranje, ograničavanje, brisanje ili uništavanje; - ograničavanje obrade je označivanje pohranjenih osobnih podataka s ciljem ograničavanja njihove obrade u budućnosti; - izrada profila je svaki oblik automatizirane obrade osobnih podataka koji se sastoji od uporabe osobnih podataka za ocjenu određenih osobnih aspekata povezanih s pojedincem, posebno za analizu ili predviđanje aspekata u vezi s radnim učinkom, ekonomskim stanjem, zdravljem, osobnim sklonostima, interesima, pouzdanošću, ponašanjem, lokacijom ili kretanjem tog pojedinca; - sustav pohrane je svaki strukturirani skup osobnih podataka dostupnih prema posebnim kriterijima, bilo da su centralizirani, decentralizirani ili raspršeni na funkcionalnoj ili zemljopisnoj osnovi; - voditelj obrade je fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje samo ili zajedno s drugima određuje svrhe i sredstva obrade osobnih podataka; kada su svrhe i sredstva takve obrade utvrđeni pravom Unije ili pravom države članice, voditelj obrade ili posebni kriteriji za njegovo imenovanje mogu se predvidjeti pravom Unije ili pravom države članice; - izvršitelj obrade je fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje obrađuje osobne podatke u ime voditelja obrade; - primatelj je fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo kojem se otkrivaju osobni podaci, neovisno o tome je li on treća strana. Međutim, tijela javne vlasti koja mogu primiti osobne podatke u okviru određene istrage u skladu s pravom Unije ili države članice ne smatraju se primateljima; obrada tih podataka koju obavljaju ta tijela javne vlasti mora biti u skladu s primjenjivim pravilima o zaštiti podataka prema svrhama obrade; - treća strana je fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje nije Ispitanik, voditelj obrade, izvršitelj obrade ni osobe koje su ovlaštene za obradu osobnih podataka pod izravnom nadležnošću voditelja obrade ili izvršitelja obrade; - privola Ispitanika znači svako dobrovoljno, posebno, informirano i nedvosmisleno izražavanje želja Ispitanika kojim on izjavom ili jasnom potvrdnom radnjom daje pristanak za obradu osobnih podataka koji se na njega odnose; - povreda osobnih podataka je kršenje sigurnosti koje dovodi do slučajnog ili nezakonitog uništenja, gubitka, izmjene, neovlaštenog otkrivanja ili pristupa osobnim podacima koji su preneseni, pohranjeni ili na drugi način obrađivani; - poduzeće ili društvo je fizička ili pravna osoba koja se bavi gospodarskom djelatnošću, bez obzira na pravni oblik te djelatnosti, uključujući partnerstva ili udruženja koja se redovno bave gospodarskom djelatnošću; - nadzorno tijelo znači neovisno tijelo javne vlasti koje je osnovala država članica; - međunarodna organizacija je organizacija i njezina podređena tijela uređena međunarodnim javnim pravom ili bilo koje drugo tijelo koje su sporazumom ili na osnovi sporazuma osnovale dvije ili više zemalja. PODACI KOJE PRIKUPLJAMO Tijekom različitih oblika interakcije sa UHPA-om (korištenje Internet stranice, slanje upita/zahtjeva e-mailom, poštom) prikupljaju se osobni podaci koji podrazumijevaju, ali nisu ograničeni na sljedeće: - Ime, prezime - Funkcija - e-mail adresa - broj telefona UHPA tijekom različitih oblika interakcije može prikupljati i podatke koji ne spadaju u grupu osobnih podataka, koji podrazumijevaju, ali nisu ograničeni na sljedeće: - Podatke o uređaju putem kojeg se spajate na Internet - Vrstu i verziju Internet preglednika koji koristite - Načine korištenja Internet stranice UHPA-e Korištenje podataka UHPA koristi osobne podatke za slijedeće svrhe: - Pružanje usluga članovima i partnerima sukladno ugovornim obvezama – UHPA osobne podatke može upotrijebiti tijekom pružanja ugovorenih usluga, te za pružanje različitih oblika komunikacije tijekom procesa realizacije suradnje - Marketinške i prodajne aktivnosti – UHPA osobne podatke može upotrijebiti s ciljem obavještavanja o novim pogodnostima, popustima ili sličnim aktivnostima - Zaštita zaposlenika UHPA-e – UHPA osobne podatke pojedinaca može otkriti ako vjeruje da je neophodno ili prikladno kako bi se zaštitili zdravlje i sigurnost zaposlenika, posjetitelja, imovine i/ili korisnika - Zakonske obveze izvještavanja i obrade podataka Prikupljanje podataka Osobni podaci se prikupljaju na jedan od sljedećih načina: - Izravno od pojedinca – kada osoba stupa u kontakt s UHPA-om slanjem upita za određenu uslugu putem e-maila, telefonskog poziva, popunjavanjem kontakt forme na www.uhpa.hr i dolaskom u prostore UHPA-e - Neizravno – podaci koji su javno dostupni na internetskim stranicama koje ne pripadaju UHPA-i (npr. Sudski i obrtni registar, objave na društvenim mrežama, otvorenim forumima), podaci dobiveni korištenjem kolačića, poveznica i sličnih tehnologija KOLAČIĆI Kolačići (engl. cookies) omogućavaju UHPA-i prikupljanje statističkih podataka o ponašanju korisnika na www.uhpa.hr (npr. na kojim dijelovima Internet stranice se korisnici zadržavaju najduže, a gdje najkraće), koji se Internet preglednik (npr. Internet Explorer, Opera, Safari, Google Chrome, Firefox) koristi i slično. Kolačići su mali skup podataka poslan sa poslužitelja www.uhpa.hr na računalo korisnika, a služi kao anonimni identifikator. Kolačići se također koriste za lakšu navigaciju kroz Internet stranice (npr. ne morate svaki put iznova unositi podatke za registraciju). Kolačići se ne koriste s ciljem pristupa korisničkim podacima ili kako bi se pratile aktivnosti korisnika nakon www.uhpa.hr . UHPA zadržava pravo korištenja kolačića na www.uhpa.hr no svaki korisnik može zabraniti primanje kolačića uređivanjem/promjenama postavki u svom Internet pregledniku. DIGITALNI MARKETING UHPA šalje promotivne materijale putem digitalnih komunikacijskih kanala korisnicima koji su dali privolu za takav oblik komunikacije. Korisnici imaju u svakom trenutku pravo onemogućiti uslugu primanja promotivnih materijala, a UHPA će omogućiti alate kako bi se pravo za brisanje iz baze podataka za slanje obavijesti provelo. Korisnik će biti obaviješten u trenutku prvog kontakta ili u bilo kojoj fazi vršenja usluge o korištenju njegovih podataka u svrhe digitalnog marketinga. ZAHTJEVI ISPITANIKA UHPA osigurava ostvarivanje prava korisnika u odnosu na: - Pristup informacijama; - Prigovor na obradu; - Ograničenje obrade; - Prijenos podataka; - Ispravljanje podataka; - Brisanje podataka. Korisnik zahtjeve za ostvarenje prava podnosi pisanim ili usmenim putem. Ako pojedinac podnese zahtjev koji se odnosi na bilo koje gore navedeno pravo, UHPA će razmotriti svaki takav zahtjev u skladu sa svim primjenjivim zakonima i propisima o zaštiti podataka. UHPA zadržava pravo naplate troškova za obradu zahtjeva korisnika u iznimnim slučajevima kada su zahtjevi nerazumni. Korisnici imaju pravo na informiranje temeljem podnesenog zahtjeva, a nakon uspješne provjere njihovog identiteta, o sljedećem: - Svrsi obrade osobnih podataka; - Izvoru osobnih podataka, ako nije dobiven od korisnika; - Kategoriji osobnih podataka; - Primateljima ili kategorijama primatelja kojima su ili mogu biti preneseni osobni podaci, zajedno s lokacijom tih primatelja; - Predviđenom razdoblje pohrane osobnih podataka ili obrazloženje za određivanje razdoblja pohrane; - Upotrebi bilo kakvog automatiziranog odlučivanja, uključujući profiliranje; Svi zahtjevi za pristup ili ispravak osobnih podataka moraju biti upućeni UHPA-i kao Voditelju obrade koja će evidentirati svaki zahtjev po primitku. Odgovor na svaki zahtjev dostavlja se u roku od 30 dana od primitka pismenog zahtjeva korisnika. Ako se ne može u potpunosti odgovoriti na zahtjev korisnika u roku od 30 dana, dostavlja se obavijest o: - Potvrdi primitku zahtjeva - Svim informacijama koje su prikupljene - Pojedinosti o bilo kojoj traženoj informaciji ili izmjenama koje neće biti dostavljene korisniku, razlogu za odbijanje te o svim mogućim postupcima za žalbu na odluku. - Procijenjeni datum do kojeg će biti dostavljeni preostali odgovori. - Procjena troškova koje mora platiti korisnik (ako je zahtjev prekomjeran). - Ime i kontaktne informacije društva koje bi Ispitanik trebao kontaktirati za daljnje informacije. ZADRŽAVANJE PODATAKA UHPA neće zadržati osobne podatke duže nego što je to neophodno u odnosu na svrhe za koje su izvorno prikupljeni ili za koje je definiran zakonski ili ugovorni rok. Točni vremenski periodi čuvanja podataka navedena su u dokumentu "Politika pohrane podataka". Pri čemu se uzimaju u obzir zakonske i ugovorne obveze, kako minimalne tako i maksimalne. Kad razdoblje zadržavanja istekne, organizacija će osobne podatke izbrisati na način koji osigurava da se oni ne mogu rekonstruirati niti pročitati. ZAŠTITA PODATAKA UHPA provodi fizičke, tehničke i organizacijske mjere koje jamče sigurnost osobnih podataka (npr. prevenciju gubitka ili oštećenja, neovlaštene izmjene, pristupa ili obrade i drugih prijetnji kojima mogu biti izloženi osobni podaci uzrokovani ljudskim djelovanjem ili fizičkim/prirodnim okruženjem). Minimalni skup sigurnosnih mjera koje UHPA provodi u svrhu zaštite osobnih podataka navedeni su u dokumentu „Politika informacijske sigurnosti“ i drugim vezanim politikama i procedurama. Sigurnosne mjere koje se provode imaju za cilj: - Spriječiti neovlaštene osobe da dobiju pristup sustavu obrade podataka u kojima se obrađuju osobni podaci. - Spriječiti osobe koje imaju pravo koristiti sustav obrade podataka od pristupa osobnim podacima koji su izvan njihovih potreba i ovlaštenja. - Osigurati da se osobni podaci tijekom elektronskog prijenosa ili tijekom prijenosa ne mogu čitati, kopirati, mijenjati ili ukloniti bez odobrenja. - Osigurati dostupnost zapisa sustava u svrhu utvrđivanja od koga su uneseni, mijenjani ili uklonjeni osobni podaci iz sustava obrade podataka. - Osigurati da u slučaju kada obradu obavlja izvršitelj obrade, podaci se mogu obrađivati samo u skladu s uputama voditelja obrade. - Osigurati da su osobni podaci zaštićeni od neželjenog uništavanja ili gubitka. - Osigurati da osobni podaci prikupljeni za različite svrhe mogu biti obrađeni odvojeno. - Osigurati da se osobni podaci ne drže duže nego što je potrebno. ZAHTJEVI OD STRANE PRAVOSUDNIH TIJELA U određenim okolnostima, dopušteno je da se osobni podaci dijele bez znanja ili suglasnosti korisnika. I to kada je otkrivanje osobnih podataka potrebno u bilo kojoj od sljedećih svrha: - Sprječavanje ili otkrivanje zločina. - Uhićenje ili progon prekršitelja. - Procjena ili naplata poreza ili pristojbi. - Po nalogu suda ili bilo kojeg zakona. PRIJENOS PODATAKA UHPA zadržava pravo prijenosa osobnih podataka unutar svoje poslovne grupe kao i na treće strane poštivajući načelo odgovarajuće razine pravne zaštite za prava i slobode korisnika. Prijenos osobnih podataka se provodi isključivo ako je zadovoljen barem jedan od sljedećih uvjeta: - Prijenos je neophodan za izvedbu ugovornih obveza/usluga; - Prijenos je neophodan za provedbu predugovornih mjera koje se poduzimaju kao odgovor na zahtjev korisnika; - Prijenos je neophodan za zaključivanje ili izvršenje ugovora sklopljenog s trećom stranom u interesu korisnika; - Prijenos je zakonski obvezan na temelju važnih javnih interesa; - Prijenos je neophodan za osnivanje, vršenje ili obranu pravnih zahtjeva; - Prijenos je neophodan kako bi se zaštitili vitalni interesi korisnika. RUKOVANJE PRITUŽBAMA U slučaju pritužbi vezanih uz pridržavanje ovih i drugih pravila vezanih za zaštitu osobnih podataka, molimo da nam se javite na uhpa1@uhpa.hr . U slučaju pritužbe, istražit ćemo cijelu situaciju koja se odnosi na upotrebu i otkrivanje osobnih podataka sukladno ovim pravilima te ćemo ih pokušati riješiti u najkraćem mogućem roku. KONTAKT Udruga hrvatskih putničkih agencija Kršnjavoga 1/II Zagreb E: uhpa1@uhpa.hr U Zagrebu, 15. svibnja 2018.