http___www.uhpa.hr_o-nama_zastita-privatnosti-5b0d5aff4bb49_politika-zastite-osobnih-podataka-5b0e8495a935c_1.xml
1.1 2.1 2.2 3.1 3.2 3.3 3.4 4.1 5.1 6.1 7.1 8.1 9.1 10.1 11.1 12.1 13.1 13.2 13.3 13.4 14.1 15.1 16.1 17.1 18.1 19.1 20.1 21.1 22.1 23.1 24.1 25.1 25.2 26.1 26.2 26.3 27.1 28.1 29.1 30.1 30.2 30.3 31.1 31.2 31.3 31.4 32.1 33.1 34.1 35.1 36.1 37.1 38.1 39.1 40.1 41.1 42.1 42.2 43.1 43.2 43.3 44.1 44.2 45.1 46.1 47.1 47.2 47.3 47.4 47.5 47.6 48.1 49.1 50.1 50.2 50.3 51.1 52.1 52.2 52.3 52.4 53.1 53.2 53.3 53.4 54.1 54.2 55.1 56.1 57.1 57.2 58.1 58.2 58.3 59.1 60.1 61.1 62.1 63.1 63.2 64.1 65.1 66.1 67.1 68.1 69.1 70.1 71.1 72.1 72.2 72.3 72.4 73.1 73.2 74.1 75.1
Privacy policy regarding personal data protection From May 25, 2018, the Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “Regulation”) will apply in all the countries of the European Union. The purpose of the Regulation is to provide a uniform and coherent legal framework across the European Union, which should not require further implementation measures at national level. BLUGENTO SA, headquartered in Romania, Str. Câmpul Pâinii, no. 3-5, County Cluj-Napoca, Cluj, Trade Register No. J12/1919/2016, Tax Identification No. RO36072180, legally represented by Băbășan Sergiu Lucian, as Data Controller, is responsible for the operation of the website www.zentoshop.com This web page is dedicated exclusively to users above the age of 16 In order to comply with our obligations arising from the Regulation and considering that personal data protection is a major and ongoing concern to us, we have created this document, which describes the categories of personal data that we collect when you access our web page, the purpose and grounds for data processing, the duration of the processing, where we store and with whom we share such data, as well as your rights as a Data Subject, these aspects being implemented to ensure the protection of your fundamental rights and freedoms and particularly your right with respect to personal data security. Definitions - “personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; - “processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; - “controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law; - “processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller; We assure you that your personal data are processed in a lawful, fair and transparent manner, solely for the explicit purposes brought to your attention. THE COMPANY, as Controller, processes personal data in a manner that ensures the proper security of such data, including the protection against unauthorised or unlawful processing, loss, accidental destruction or damage, by implementing appropriate technical and organisational measures. Personal data that we process. Purpose. Grounds. Duration of processing. We only collect from you the personal data that are necessary in order to allow you to access our web page, to process your orders, to give you access to our products and to keep you updated on our products, services and offers (direct marketing), to the extent permitted by the applicable laws or based on your consent. As a rule, we process the following data about you: - Full name - Contact address and delivery address - Phone number - E-mail address - IP address Each category of data is collected for specific, explicit and legitimate purposes, will not be subsequently processed in a manner that is inconsistent with these purposes and will only be processed for as long as necessary to fulfil the processing purposes. In order to be in line with the transparency principle as concerns the processing of your personal data, we present below the manner, the purposes and the legal grounds (legal basis) of our data processing activities. CREATING AN ACCOUNT When you create a user account on our website www.zentoshop.com we request and collect your name, surname, address, phone number, e-mail address and IP address. We need such personal data for pre-contractual purposes, in order to allow you to access our products and to place an order, the grounds for such processing being represented by the contractual obligation. Unless you agree to the processing of your personal data THE COMPANY will not be able to process and deliver your orders. Your personal data will be stored during the entire existence period of the account, until its deletion, but no longer than 3 years from the last login date or the last order. We will notify you accordingly before closing your client account and deleting all the data linked to it. If you place an order after creating your account, your data will be stored for a period of 3 years since the last order date; this represents the limitation period. The personal data processed upon the creation of your account are not subject to a decision based solely on automated processing, including profiling, will not be disclosed to any third party and will not be transferred to any third country or international organisation. PLACING AN ORDER When you fill in and complete the order form, we request and collect your name, surname, contact address, delivery address, phone number, e-mail address and IP. We need such personal data for contractual purposes, in order to process your orders, to deliver your products at the mentioned address, to fulfil our warranty obligations in respect of the products, or to allow you to return the products. The grounds for such processing are represented by the contractual obligation of the parties, as established in the Terms and Conditions. Unless you agree to the processing of your personal data THE COMPANY will not be able to process and deliver your orders. Moreover, we need your personal data in order to fill in and remit the invoices in connection with the products delivered to you. Your online payment details will not be available to or stored by THE COMPANY, but only by the provider of electronic payment services or by another entity authorised to store the card identification details, of whose identity you will be notified prior to inserting your card details for online payment. The only payment-related details that we will store are those regarding the date when the transaction is initiated or completed and the payment status. Subject to the legal requirements, your personal data required for the issuance of payment documents will be transmitted to our IT service providers and used for the purpose of filing the requested tax and accounting statements with the tax authorities. Your data will be stored during the entire period of the contractual relationship and for a period of 3 years since the last order date; this represents the limitation period. In order for us to fulfil our obligations in a timely and appropriate manner, your personal data will be disclosed to our reliable and carefully selected business partners: - the provider of external server data storage services, located in Romania; - the provider of accounting services; - the provider of communication and e-mail correspondence services; - the provider of mobile communication services located in Romania, through which we stay in contact with you; - the agreed shipping companies; - the online payment processors. The personal data processed upon the creation of your account are not subject to a decision based solely on automated processing, including profiling and will not be transferred to any third country or international organisation. NEWSLETTER – DIRECT MARKETING Subscribing to and unsubscribing from the BRAND newsletter is free, optional and solely based on your consent. The newsletter is a form of periodical notification via electronic channels only (e-mail, SMS), with regard to the Goods, Services and Promotions of the Seller available during a specific period, but with no commitment on behalf of the Seller as concerns the information content of such newsletter. For the purpose of marketing services, the data we collect from you are your e-mail address, phone number and full name. Such data will be used solely for keeping you up to date regarding our products, services and offers. The legal grounds for personal data processing are represented by your consent and the duration of such processing equals the entire existence of the consent. You may withdraw your consent at any time, by sending an e-mail to marketing@blugento.ro or by accessing the unsubscribe link in the e-mail received from us, which results in the cessation of processing. The withdrawal of your consent will not affect the lawfulness of the processing carried out prior to such withdrawal. Your data will not be transferred to any other controller or processor, or to any third country or international organisation. COOKIES The www.zentoshop.com website uses cookies, which are stored on the user’s hard disk and contain information about the respective user. The use of cookies is an advantage to the website visitors, allowing the storage or certain navigation options, such as the display language, the filters applied, the user’s name and password, thus ensuring easier access to the website content. The refusal of cookies does not imply the user’s interdiction to access the website or to read its content. By using cookies, website owners can monitor and group the users’ interests around certain website zones or applications, thus enhancing user experience and creating relevant content. Some of our business partners use cookies on our website (for advertising purposes). However, we do not have access to and cannot control such cookies. Cookie files allow us to save your e-mail address, so that you are automatically recognized and logged in on your next visit. But you can also access our web page without cookie acceptance. If you do not want your computer to be recognized, you can block the storage of cookies on your hard drive by configuring your web browser to disable cookies. For detailed instructions on cookies, you may check your browser support page. Should you not accept cookies, this may cause functional restrictions related to our offers. LINKS This website contains links to other websites. THE COMPANY is not responsible for their privacy policy. We recommend that you read in advance the legal conditions and other information regarding the collection of personal data. The standards described here apply only to the information collected on this website. When you access web pages that contain plug-ins, your browser creates a direct connection to the servers of the respective providers. The plug-in content is transferred from the respective provider to your browser and embedded on the web page. By integrating plug-ins, the provider is notified that your browser has accessed our web page. This happens irrespective of whether you have a profile on the respective social network or you have just logged in. If you are already logged in, the social network may assign the visit on our website to your profile. For example, if you use plug-ins and you click the “Like” button or make a comment on Facebook, the related information is sent directly to the respective provider and stored. Further details regarding the purpose and volume of the collected data, the subsequent use and processing of such data through the respective provider, your rights and privacy settings are available in the data protection guidelines of the respective provider. Personal data security Personal data security is a top priority for us. We assure you that we process your personal data in line with the Regulation principles, in a manner that ensures the proper security of the data, including the protection against unauthorised or unlawful processing, loss, accidental destruction or damage, by implementing appropriate technical and organisational measures and by applying adequate internal policies in terms of data protection. This website applies all the security measures required for the protection of our users’ personal data. The personal data filled in on our website will be protected both in offline and in online mode. All personal data will be processed via secure pages using SSL encryption and displaying a lock icon at the bottom of the Microsoft Internet Explorer browser window. Your rights as a Data Subject Regulation 679/2016 aims to ensure the protection of natural persons with regard to their fundamental rights and freedoms, in particular their right to the protection of personal data. You are entitled to exercise any of the following rights in order to ensure the protection of your personal data: -the right of access: you may request information regarding the categories of personal data processed, the purposes of the processing, the recipients to whom the personal data have been or will be disclosed, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period, the existence of automated decision-making, including profiling; -the right to rectification: should there be any errors regarding your personal data, you have the right to obtain their rectification or to have incomplete personal data completed. We will notify such rectification to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. -right to restriction of processing: you have the right to request the restriction of processing in the following situations: you contested the accuracy of the personal data, for a period enabling us to verify the accuracy of the personal data; the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead; the undersigned company no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims; you have objected to processing, pending the verification whether the legitimate grounds of the controller override yours. -right to erasure: you may request the erasure of your personal data if: they are no longer necessary in relation to the purposes for which they were collected or otherwise processed; you withdraw the consent on which the processing is based and where there is no other legal ground for the processing; you object to the processing and there are no overriding legitimate grounds for the processing; the personal data have been unlawfully processed; the personal data have to be erased for compliance with a legal obligation; the personal data have been collected in relation to the offer of information society services. -right to data portability: you may request the transfer of your personal data to another controller, where the processing is based on your consent and the processing is carried out by automated means. -right to object: you may object at any time to the processing of your personal data for direct marketing purposes, including profiling, in which case your personal data will be erased. -right not to be subject to a decision based solely on automated processing, including profiling. You may exercise these rights by sending a request to THE COMPANY, as controller, at our headquarters, or at the e-mail address marketing@blugento.ro, or by using the options available on our website (link to export and delete). If you consider that your rights have been violated, you may file a complaint with the National Supervisory Authority for Personal Data Processing. Contact details This Policy is supplemented by the other specific policies of THE COMPANY and by the Terms and Conditions available on our website. Any change in the provisions of this policy will be notified to the users by e-mail, in order to ensure that they are permanently updated regarding the information that we collect, how we use it and in what circumstances, if any, we disclose it. The users may agree or disagree with the use of the information for other purposes. We will use the information in accordance with the policy based on which it was collected. This notification is limited to our web page and is not valid for the websites of third-party controllers, which may be accessed via this website. We have no control of the processing of data by such third-party controllers and we decline any responsibility or liability in relation to the respective web pages. BLUGENTO SA Email: marketing@blugento.ro
1.1 2.1 3.1 4.1 4.2 5.1 6.1 7.1 8.1 9.1 10.1 11.1 12.1 13.1 14.1 14.2 15.1 16.1 17.1 18.1 19.1 20.1 21.1 22.1 23.1 24.1 25.1 26.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 34.1 35.1 36.1 37.1 38.1 39.1 40.1 40.2 41.1 42.1 42.2 43.1 43.2 43.3 44.1 45.1 46.1 46.2 47.1 48.1 49.1 50.1 51.1 52.1 53.1 54.1 55.1 56.1 56.2 56.3 57.1 58.1 59.1 60.1 61.1 62.1 63.1 64.1 64.2 65.1 66.1 67.1 68.1 69.1 70.1 71.1 72.1 73.1 74.1 74.2 75.1 76.1 77.1 78.1 78.2 79.1 80.1 81.1 82.1 83.1 84.1 85.1 86.1 87.1 88.1 88.2 89.1 90.1 91.1 92.1 93.1 94.1 95.1 96.1 97.1 98.1 99.1 100.1 101.1 102.1 103.1 103.2 104.1 105.1 106.1 107.1 108.1 110.1
Politika zaštite osobnih podataka UVOD Udruga hrvatskih putničkih agencija (u daljnjem tekstu UHPA) u svom poslovanju provodi mjere zaštite osobnih podataka sukladno Općoj Uredbi o zaštiti podataka (GDPR), zakonskim i regulatornim obvezama. Uprava je u potpunosti predana osiguranju kontinuirane i efektivne uspostave ove politike, te isto očekuje od svojih zaposlenika i poslovnih partnera. Svako kršenje ove politike može rezultirati disciplinskim mjerama ili poslovnim sankcijama. Ova politika određuje očekivano ponašanje UHPA-e, njenih stalnih, privremenih i povremenih zaposlenika kao i poslovnih partnera te trećih strana u odnosu na prikupljanje, korištenje, čuvanje, prijenos, otkrivanje ili uništavanje osobnih podataka koji se obrađuju u poslovnim procesima UHPA-e DEFINICIJE - osobni podaci su svi podaci koji se odnose na pojedinca čiji je identitet utvrđen ili se može utvrditi („Ispitanik”); pojedinac čiji se identitet može utvrditi jest osoba koja se može identificirati izravno ili neizravno, osobito uz pomoć identifikatora kao što su ime, identifikacijski broj, podaci o lokaciji, mrežni identifikator ili uz pomoć jednog ili više čimbenika svojstvenih za fizički, fiziološki, genetski, mentalni, ekonomski, kulturni ili socijalni identitet tog pojedinca; - obrada je svaki postupak ili skup postupaka koji se obavljaju na osobnim podacima ili na skupovima osobnih podataka, bilo automatiziranim bilo neautomatiziranim sredstvima kao što su prikupljanje, bilježenje, organizacija, strukturiranje, pohrana, prilagodba ili izmjena, pronalaženje, obavljanje uvida, uporaba, otkrivanje prijenosom, širenjem ili stavljanjem na raspolaganje na drugi način, usklađivanje ili kombiniranje, ograničavanje, brisanje ili uništavanje; - ograničavanje obrade je označivanje pohranjenih osobnih podataka s ciljem ograničavanja njihove obrade u budućnosti; - izrada profila je svaki oblik automatizirane obrade osobnih podataka koji se sastoji od uporabe osobnih podataka za ocjenu određenih osobnih aspekata povezanih s pojedincem, posebno za analizu ili predviđanje aspekata u vezi s radnim učinkom, ekonomskim stanjem, zdravljem, osobnim sklonostima, interesima, pouzdanošću, ponašanjem, lokacijom ili kretanjem tog pojedinca; - sustav pohrane je svaki strukturirani skup osobnih podataka dostupnih prema posebnim kriterijima, bilo da su centralizirani, decentralizirani ili raspršeni na funkcionalnoj ili zemljopisnoj osnovi; - voditelj obrade je fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje samo ili zajedno s drugima određuje svrhe i sredstva obrade osobnih podataka; kada su svrhe i sredstva takve obrade utvrđeni pravom Unije ili pravom države članice, voditelj obrade ili posebni kriteriji za njegovo imenovanje mogu se predvidjeti pravom Unije ili pravom države članice; - izvršitelj obrade je fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje obrađuje osobne podatke u ime voditelja obrade; - primatelj je fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo kojem se otkrivaju osobni podaci, neovisno o tome je li on treća strana. Međutim, tijela javne vlasti koja mogu primiti osobne podatke u okviru određene istrage u skladu s pravom Unije ili države članice ne smatraju se primateljima; obrada tih podataka koju obavljaju ta tijela javne vlasti mora biti u skladu s primjenjivim pravilima o zaštiti podataka prema svrhama obrade; - treća strana je fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje nije Ispitanik, voditelj obrade, izvršitelj obrade ni osobe koje su ovlaštene za obradu osobnih podataka pod izravnom nadležnošću voditelja obrade ili izvršitelja obrade; - privola Ispitanika znači svako dobrovoljno, posebno, informirano i nedvosmisleno izražavanje želja Ispitanika kojim on izjavom ili jasnom potvrdnom radnjom daje pristanak za obradu osobnih podataka koji se na njega odnose; - povreda osobnih podataka je kršenje sigurnosti koje dovodi do slučajnog ili nezakonitog uništenja, gubitka, izmjene, neovlaštenog otkrivanja ili pristupa osobnim podacima koji su preneseni, pohranjeni ili na drugi način obrađivani; - poduzeće ili društvo je fizička ili pravna osoba koja se bavi gospodarskom djelatnošću, bez obzira na pravni oblik te djelatnosti, uključujući partnerstva ili udruženja koja se redovno bave gospodarskom djelatnošću; - nadzorno tijelo znači neovisno tijelo javne vlasti koje je osnovala država članica; - međunarodna organizacija je organizacija i njezina podređena tijela uređena međunarodnim javnim pravom ili bilo koje drugo tijelo koje su sporazumom ili na osnovi sporazuma osnovale dvije ili više zemalja. PODACI KOJE PRIKUPLJAMO Tijekom različitih oblika interakcije sa UHPA-om (korištenje Internet stranice, slanje upita/zahtjeva e-mailom, poštom) prikupljaju se osobni podaci koji podrazumijevaju, ali nisu ograničeni na sljedeće: - Ime, prezime - Funkcija - e-mail adresa - broj telefona UHPA tijekom različitih oblika interakcije može prikupljati i podatke koji ne spadaju u grupu osobnih podataka, koji podrazumijevaju, ali nisu ograničeni na sljedeće: - Podatke o uređaju putem kojeg se spajate na Internet - Vrstu i verziju Internet preglednika koji koristite - Načine korištenja Internet stranice UHPA-e Korištenje podataka UHPA koristi osobne podatke za slijedeće svrhe: - Pružanje usluga članovima i partnerima sukladno ugovornim obvezama – UHPA osobne podatke može upotrijebiti tijekom pružanja ugovorenih usluga, te za pružanje različitih oblika komunikacije tijekom procesa realizacije suradnje - Marketinške i prodajne aktivnosti – UHPA osobne podatke može upotrijebiti s ciljem obavještavanja o novim pogodnostima, popustima ili sličnim aktivnostima - Zaštita zaposlenika UHPA-e – UHPA osobne podatke pojedinaca može otkriti ako vjeruje da je neophodno ili prikladno kako bi se zaštitili zdravlje i sigurnost zaposlenika, posjetitelja, imovine i/ili korisnika - Zakonske obveze izvještavanja i obrade podataka Prikupljanje podataka Osobni podaci se prikupljaju na jedan od sljedećih načina: - Izravno od pojedinca – kada osoba stupa u kontakt s UHPA-om slanjem upita za određenu uslugu putem e-maila, telefonskog poziva, popunjavanjem kontakt forme na www.uhpa.hr i dolaskom u prostore UHPA-e - Neizravno – podaci koji su javno dostupni na internetskim stranicama koje ne pripadaju UHPA-i (npr. Sudski i obrtni registar, objave na društvenim mrežama, otvorenim forumima), podaci dobiveni korištenjem kolačića, poveznica i sličnih tehnologija KOLAČIĆI Kolačići (engl. cookies) omogućavaju UHPA-i prikupljanje statističkih podataka o ponašanju korisnika na www.uhpa.hr (npr. na kojim dijelovima Internet stranice se korisnici zadržavaju najduže, a gdje najkraće), koji se Internet preglednik (npr. Internet Explorer, Opera, Safari, Google Chrome, Firefox) koristi i slično. Kolačići su mali skup podataka poslan sa poslužitelja www.uhpa.hr na računalo korisnika, a služi kao anonimni identifikator. Kolačići se također koriste za lakšu navigaciju kroz Internet stranice (npr. ne morate svaki put iznova unositi podatke za registraciju). Kolačići se ne koriste s ciljem pristupa korisničkim podacima ili kako bi se pratile aktivnosti korisnika nakon www.uhpa.hr . UHPA zadržava pravo korištenja kolačića na www.uhpa.hr no svaki korisnik može zabraniti primanje kolačića uređivanjem/promjenama postavki u svom Internet pregledniku. DIGITALNI MARKETING UHPA šalje promotivne materijale putem digitalnih komunikacijskih kanala korisnicima koji su dali privolu za takav oblik komunikacije. Korisnici imaju u svakom trenutku pravo onemogućiti uslugu primanja promotivnih materijala, a UHPA će omogućiti alate kako bi se pravo za brisanje iz baze podataka za slanje obavijesti provelo. Korisnik će biti obaviješten u trenutku prvog kontakta ili u bilo kojoj fazi vršenja usluge o korištenju njegovih podataka u svrhe digitalnog marketinga. ZAHTJEVI ISPITANIKA UHPA osigurava ostvarivanje prava korisnika u odnosu na: - Pristup informacijama; - Prigovor na obradu; - Ograničenje obrade; - Prijenos podataka; - Ispravljanje podataka; - Brisanje podataka. Korisnik zahtjeve za ostvarenje prava podnosi pisanim ili usmenim putem. Ako pojedinac podnese zahtjev koji se odnosi na bilo koje gore navedeno pravo, UHPA će razmotriti svaki takav zahtjev u skladu sa svim primjenjivim zakonima i propisima o zaštiti podataka. UHPA zadržava pravo naplate troškova za obradu zahtjeva korisnika u iznimnim slučajevima kada su zahtjevi nerazumni. Korisnici imaju pravo na informiranje temeljem podnesenog zahtjeva, a nakon uspješne provjere njihovog identiteta, o sljedećem: - Svrsi obrade osobnih podataka; - Izvoru osobnih podataka, ako nije dobiven od korisnika; - Kategoriji osobnih podataka; - Primateljima ili kategorijama primatelja kojima su ili mogu biti preneseni osobni podaci, zajedno s lokacijom tih primatelja; - Predviđenom razdoblje pohrane osobnih podataka ili obrazloženje za određivanje razdoblja pohrane; - Upotrebi bilo kakvog automatiziranog odlučivanja, uključujući profiliranje; Svi zahtjevi za pristup ili ispravak osobnih podataka moraju biti upućeni UHPA-i kao Voditelju obrade koja će evidentirati svaki zahtjev po primitku. Odgovor na svaki zahtjev dostavlja se u roku od 30 dana od primitka pismenog zahtjeva korisnika. Ako se ne može u potpunosti odgovoriti na zahtjev korisnika u roku od 30 dana, dostavlja se obavijest o: - Potvrdi primitku zahtjeva - Svim informacijama koje su prikupljene - Pojedinosti o bilo kojoj traženoj informaciji ili izmjenama koje neće biti dostavljene korisniku, razlogu za odbijanje te o svim mogućim postupcima za žalbu na odluku. - Procijenjeni datum do kojeg će biti dostavljeni preostali odgovori. - Procjena troškova koje mora platiti korisnik (ako je zahtjev prekomjeran). - Ime i kontaktne informacije društva koje bi Ispitanik trebao kontaktirati za daljnje informacije. ZADRŽAVANJE PODATAKA UHPA neće zadržati osobne podatke duže nego što je to neophodno u odnosu na svrhe za koje su izvorno prikupljeni ili za koje je definiran zakonski ili ugovorni rok. Točni vremenski periodi čuvanja podataka navedena su u dokumentu "Politika pohrane podataka". Pri čemu se uzimaju u obzir zakonske i ugovorne obveze, kako minimalne tako i maksimalne. Kad razdoblje zadržavanja istekne, organizacija će osobne podatke izbrisati na način koji osigurava da se oni ne mogu rekonstruirati niti pročitati. ZAŠTITA PODATAKA UHPA provodi fizičke, tehničke i organizacijske mjere koje jamče sigurnost osobnih podataka (npr. prevenciju gubitka ili oštećenja, neovlaštene izmjene, pristupa ili obrade i drugih prijetnji kojima mogu biti izloženi osobni podaci uzrokovani ljudskim djelovanjem ili fizičkim/prirodnim okruženjem). Minimalni skup sigurnosnih mjera koje UHPA provodi u svrhu zaštite osobnih podataka navedeni su u dokumentu „Politika informacijske sigurnosti“ i drugim vezanim politikama i procedurama. Sigurnosne mjere koje se provode imaju za cilj: - Spriječiti neovlaštene osobe da dobiju pristup sustavu obrade podataka u kojima se obrađuju osobni podaci. - Spriječiti osobe koje imaju pravo koristiti sustav obrade podataka od pristupa osobnim podacima koji su izvan njihovih potreba i ovlaštenja. - Osigurati da se osobni podaci tijekom elektronskog prijenosa ili tijekom prijenosa ne mogu čitati, kopirati, mijenjati ili ukloniti bez odobrenja. - Osigurati dostupnost zapisa sustava u svrhu utvrđivanja od koga su uneseni, mijenjani ili uklonjeni osobni podaci iz sustava obrade podataka. - Osigurati da u slučaju kada obradu obavlja izvršitelj obrade, podaci se mogu obrađivati samo u skladu s uputama voditelja obrade. - Osigurati da su osobni podaci zaštićeni od neželjenog uništavanja ili gubitka. - Osigurati da osobni podaci prikupljeni za različite svrhe mogu biti obrađeni odvojeno. - Osigurati da se osobni podaci ne drže duže nego što je potrebno. ZAHTJEVI OD STRANE PRAVOSUDNIH TIJELA U određenim okolnostima, dopušteno je da se osobni podaci dijele bez znanja ili suglasnosti korisnika. I to kada je otkrivanje osobnih podataka potrebno u bilo kojoj od sljedećih svrha: - Sprječavanje ili otkrivanje zločina. - Uhićenje ili progon prekršitelja. - Procjena ili naplata poreza ili pristojbi. - Po nalogu suda ili bilo kojeg zakona. PRIJENOS PODATAKA UHPA zadržava pravo prijenosa osobnih podataka unutar svoje poslovne grupe kao i na treće strane poštivajući načelo odgovarajuće razine pravne zaštite za prava i slobode korisnika. Prijenos osobnih podataka se provodi isključivo ako je zadovoljen barem jedan od sljedećih uvjeta: - Prijenos je neophodan za izvedbu ugovornih obveza/usluga; - Prijenos je neophodan za provedbu predugovornih mjera koje se poduzimaju kao odgovor na zahtjev korisnika; - Prijenos je neophodan za zaključivanje ili izvršenje ugovora sklopljenog s trećom stranom u interesu korisnika; - Prijenos je zakonski obvezan na temelju važnih javnih interesa; - Prijenos je neophodan za osnivanje, vršenje ili obranu pravnih zahtjeva; - Prijenos je neophodan kako bi se zaštitili vitalni interesi korisnika. RUKOVANJE PRITUŽBAMA U slučaju pritužbi vezanih uz pridržavanje ovih i drugih pravila vezanih za zaštitu osobnih podataka, molimo da nam se javite na uhpa1@uhpa.hr . U slučaju pritužbe, istražit ćemo cijelu situaciju koja se odnosi na upotrebu i otkrivanje osobnih podataka sukladno ovim pravilima te ćemo ih pokušati riješiti u najkraćem mogućem roku. KONTAKT Udruga hrvatskih putničkih agencija Kršnjavoga 1/II Zagreb E: uhpa1@uhpa.hr U Zagrebu, 15. svibnja 2018.