http___www.uhpa.hr_o-nama_zastita-privatnosti-5b0d5aff4bb49_politika-zastite-osobnih-podataka-5b0e8495a935c_1.xml
1.1 1.2 2.1 3.1 4.1 5.1 6.1 7.1 8.1 9.1 10.1 11.1 12.1 13.1 14.1 15.1 16.1 17.1 18.1 19.1 20.1 20.2 21.1 21.2 21.3 21.4 21.5 22.1 22.2 22.3 22.4 23.1 23.2 24.1 24.2 24.3 25.1 25.2 26.1 26.2 27.1 28.1 28.2 28.3 29.1 30.1 31.1 32.1 33.1 33.2 34.1 35.1 36.1 37.1 38.1 39.1 40.1 40.2 41.1 41.2 42.1 43.1 44.1 44.2 45.1 46.1 47.1 47.2 48.1 48.2 49.1 49.2 50.1 50.2 50.3 51.1 51.2 52.1 52.2 52.3 53.1 53.2 53.3 54.1 54.2 55.1 56.1 57.1 57.2 58.1 59.1 60.1 60.2 60.3 60.4 61.1 62.1 62.2 63.1 64.1 64.2 65.1 66.1 66.2 67.1 67.2 68.1 69.1 70.1 71.1 72.1
The aim of the current Regulation is to declare the data handling and control guidelines of the data controller of SeeSharp Group and the data protection and handling policy, all of which the Company recognizes as compulsory. In establishing these guidelines, the Company recognized especially the Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information, Act CXIX of 1995 on the Use of Name and Address Information Serving the Purposes of Research and Direct Marketing, Strasbourg Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data and Act XLVIII of 2008 on the Basic Requirements and Certain Restrictions of Commercial Advertising Activities guidelines, together with "Online Privacy Alliance" guidelines. The aim of the current Regulation is to assure that the services offered by the Company, for every individual, irrespective of nationality or domicile, that during the handling of her data, her rights and fundamental freedoms are respected, especially her right for private life (data protection). Controller reserves the right to alter the current Policy at any time. In case users have doubts about guidelines that are unclear from the current Regulation, please get in touch and our colleagues will answer your query. Controller is committed to the protection of personal data of its partners and users, respects informational self-determination of its users, handles private data confidentially, and does all measures in terms of security, technology and organization that guarantees security of data. Name of data controller: SeeSharp Group Pty Ltd Data control identification number: NAIH-78535 ‘personal data’ shall mean any information relating to the data subject, in particular by reference to his name, an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity, and any reference drawn from such information pertaining to the data subject; ‘the data subject’s consent’ means any freely and expressly given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed without limitation or with regard to specific operations; ‘the data subject’s objection’ shall mean an indication of his wishes by which the data subject objects to the processing of his personal data and requests that the processing of data relating to him be terminated and/or the processed data be deleted; ‘controller’ shall mean the natural or legal person, or unincorporated body which alone or jointly with others determines the purposes of the processing of data, makes decisions regarding data processing (including the means) and implements such decisions itself or engages a data processor to execute them; ‘processing of data’ shall mean any operation or set of operations that is performed upon data, whether or not by automatic means, such as in particular collection, recording, organization, storage, adaptation or alteration, use, retrieval, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction, and blocking them from further use, photographing, sound and video recording, and the recording of physical attributes for identification purposes (such as fingerprints and palm prints, DNA samples and retinal images); ‘disclosure by transmission’ shall mean making data available to a specific third party; ‘public disclosure’ shall mean making data available to the general public; ‘erasure of data’ shall mean the destruction or elimination of data sufficient to make them irretrievable; ‘blocking of data’ shall mean the marking of stored data with the aim of limiting their processing in future permanently or for a predetermined period; ‘destruction of data’ shall mean the complete physical destruction of the medium containing data; ‘third party’ shall mean any natural or legal person or unincorporated organization other than the data subject, the controller or the processor; The user, at her own will, connects her Facebook account with the Application. In this case, Company is entitled to handle the following data: Facebook name, email address, profile picture, gender, friend list, location, birth date and place. Moreover, it can handle all data, which user publishes, with acceptance of Facebook’s Privacy Policy, to others. Especially those that the user shares on Facebook, or specifies during activity on Facebook, such as adding a friend, liking a page, importing contacts or changing her relationship status. User can decide not to connect its account with the Application. In this case, upon decision of the user, Company can handle the following data: email address, name, nick name, address, location. User has the option to share additional data. Data control will occur upon the user’s declaration, which is voluntary, and based on adequate information. This declaration contains the user’s explicit consent that during the usage of the page, data that she granted access to, as well as data generated about her, will be used. The plea of the data control is explicit consent according to Art. 5, Section 1 a) of Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information. The aim of the handling of the recorded data is publishing personalized content and advertisements, statistics, development of the IT system, protection of user rights. Data shared by users during the usage of the service can be used by the Company with the aim to construct user groups, and to show them targeted content and/or advertisements on websites that use the Application. Controller is not allowed to use data for aims other than described above. It is also set forth in this Regulation that data transfer between Controller and its partners can be done without separate consent. Sharing of personal data to third party or authority – unless explicit law requires it – is permissible only upon resolution by an authority or with explicit and prior consent by the user. Controller does not check personal data controlled. The person who shared the data is responsible for its validity. Controller places a “cookie” (small piece of data) on the computer of the user, in order that personalization is possible. With the usage of the Application, the user accepts the placement of cookies on her computer. Controller, acting as technological provider, can ensure that, during the usage of the Application or visit of a partner website, partners of Controller, especially Google Inc. store, with the help of cookies, any prior visit and that they show advertisements. The cookie can be deleted from the user’s computer, and also set her web browser to block the usage of them. Furthermore, Google Inc. ensures that the user can disable cookies on the website designed for that purpose (http://www.google.hu/privacy_ads.html). Blocking of cookies can potentially cause websites to become less comfortable for the user. Visitors of websites using the Application can decide voluntarily to subscribe to the newsletter of the Controller or its partners that contain additional information and will be sent periodically. When registering for the newsletter, the user should specify her valid email address. Controller is allowed to use this piece of data for the sole purpose of sending the newsletter, it does not connect this piece of data with any other piece of data, nor use it for any other purpose, or forward it to third parties. In case the user unsubscribes from the newsletter, Controller deletes its email address immediately and irrevocably. We let the user know that the court, the prosecutor or the investigating authority can contact the Controller, for the purpose of information, data transmission, or making available documents. In this case Controller, for the authorities, when the respective authority specified the exact aim and scope of the data, shares personal data to the extent that is absolutely essential for the purposes of the investigation. We give further notice about data control not listed in this policy at the point of data record. Data should be acquired and recorded only lawfully and fairly. Data can be stored only for the specified aim and it cannot be used for other purposes. Data stored should be in proportion with the aim of their storage and should comply with their purpose, they cannot overreach this aim. Certain measures shall be done in order that data stored in automatized databases are protected against involuntary or unlawful destruction, accidental loss, unauthorized access, change or distribution. The Company uses private data that are essential for the usage of the Company’s services upon approval of the concerned users and only for purposes specified. The Company, as Controller, undertakes that it will treat data acquired in accordance with provisions set forth in Infotv. and data protection principles set forth in the current Regulation and it does not transfer data to third parties. An exception from the measures set forth in this part is usage of data in a statistically summarized form which does not contain the name of the user, or any other information from which the user can be identified. Thus, this process is not considered Data Control or Data Transfer. The Company, in certain cases – official contact by the court or police, legal proceedings due to copyright, property right or other infringement, or their reasonable suspicion, with the aim of prejudicing the interests of the Company, or imperiling the services of the Company, etc. – makes data concerning the user available for third parties. The system of the Company can gather data about the activity of the user, data that cannot be connected with data given by the user at the time of registration, nor with data generated by visiting other websites or using other services. The user should be informed about the aim of Data Control and about who treats or processes their data. Information about Data Control is considered adequate when a law rules about existing Data Control – data record by means of forwarding or connecting. Each case when the Company intends to use data for purposes other than that was specified at the initial data record, it informs the User and receives her explicit consent, or provides her with the opportunity to deny usage. The Company, as Controller, respects the regarding limitations set forth by the law at data input, record, and management. The Company obliges itself that it applies care with the security of the data, does all the necessary measures in terms of technology and organization, and establishes the rules of procedure that ensure security of data recorded and prevent them from loss, unauthorized use and unauthorized modification. It also obliges itself that it will inform all third parties to whom data may be transferred to respect its duties. Controller locks personal data when the concerned user requests it, or when information available indicates that deletion would harm the lawful interests of the user. Personal data locked this way may only be treated insofar as the data control aim, which excluded deletion of personal data, persists. The concerned User, together with all to whom data was transferred, must be notified about correction, or deletion of her data. Notification may be omitted in case this does not harm lawful interest of the concerned user with respect to the aim of Data Control. Control of Personal data specified by the User will pertain as long as the User unsubscribes – with its username – and at the same time requests deletion of her data. The deadline for deletion is 10 working days from the receipt of the User’s request. In this case, data will be deleted from all Controllers defined in the current Regulation. In case of unlawful, misleading use of Personal data, crime committed by the User, or attack against the system, Controller is authorized to delete the registration of the User and at the same time delete all her data. Nevertheless, in case of suspected criminal responsibility or civil responsibility, Controller is authorized to keep the data for the duration of the proceedings. Personal data provided by the User – also in case the User does not unsubscribe from the service or with deletion of her registration does not terminate rights for her data, her stored comments and uploaded content stays – can be controlled by the Company, as Controller, as long as User does not request explicitly, in written form, termination of control. The User’s request to terminate Control without unsubscribing from the service does not affect her right to use the service, but she might not be able to use certain services without Personal data. Data is deleted within 10 working days from the receipt of request. Data stored automatically during functioning of the system are stored from their generation to a certain period that ensures safe functioning of the system. The Company ensures that these automatically recorded pieces of data cannot be connected with other personal data – except in cases where the law provides otherwise. In case the User terminates her consent to the Control of her Personal data, or unsubscribes from the service, then she may not be identified from technical data – except for investigating authorities and their experts. The Company – during the use of some of its services – can cooperate with service providers that make registration and login easier (For example, Facebook Inc., Google Inc., further: Third party providers). With respect to systems of Third party providers, for data provided in their systems, their privacy policies are authoritative. Regarding data made available on certain social media platforms, Data Controller is the Third party provider that makes possible sharing of content, its service is governed by its own terms of use and privacy policy. The Company is allowed to transfer, with the aim of providing its service, certain pieces of data specified by the user to Third party providers, but the transferred data should be used for purposes specified in the current Regulation. The Company, as Controller is entitled and required to transfer all Personal data in its custody to the respective authorities upon law or official obligation. Controller cannot be held responsible for Such Data transfer and its consequences. The Company keeps, for the examination of the lawfulness of such Data transfer and for the information of concerned individuals, a data transfer register. Concerned individuals may request information about the control of their personal data, and they may request correction and – except when the law provides otherwise – deletion of their personal data. Upon request of concerned individuals Controller gives information about data controlled by the Controller or data processor appointed by the Controller, aim of data control, plea of data control, time frame of data control, name, address and headquarters of data controller, about any activity connected to data control, and about who and for what aim received data. Controller gives information in written form that is easy to understand, at the earliest possible time, but within 30 days. This information is free of charge in case the requesting individual has not submitted request concerning the same area in the current year. In all other cases, Controller specifies a fee for this service. Controller deletes the personal data when its control is unlawful, the concerned individual requests it, the aim of data control ceased to exist, the legal deadline of data storage passed, and when a court or data protection authority ruled so. Controller notifies the concerned individual and others who have previously received data for data control about correction and deletion. Notice may be omitted when it does not harm the lawful interest of the concerned individual with respect to the aim of data control. Concerned individual may protest against control of her personal data in case: Controller examines the protest – at the same time suspending data control – at the earliest from submission of the request, but within 15 days, and it notifies the requesting party about the result in written form. In case the protest is justified, controller suspends data control – including data record and data transfer – blocks data, and notifies all parties who have received personal data concerned with the protest about actions taken upon the protest, and who are obliged to take action in order to validate the protest. In case concerned individual does not agree with the decision of the Controller, it can pursue the matter in court, within 30 days from the notification about the decision. In case rights of concerned individual are breached, she can pursue the matter in court. The court rules in the matter out of turn. Controller compensates damage resulting from the unlawful control of data of concerned individual or from breach of technical data protection requirements. Controller is exempt from compensation when damage was caused by unavoidable circumstances out of the reach of data control. Damages may not be compensated in case they resulted from intentional or seriously negligent behavior of the harmed individual. Complaints concerning data control shall be addressed to the court or the Hungarian National Authority for Data Protection and Freedom of Information. Start a project with us Let's work together!
1.1 2.1 3.1 4.1 4.2 5.1 6.1 7.1 8.1 9.1 10.1 11.1 12.1 13.1 14.1 14.2 15.1 16.1 17.1 18.1 19.1 20.1 21.1 22.1 23.1 24.1 25.1 26.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 34.1 35.1 36.1 37.1 38.1 39.1 40.1 40.2 41.1 42.1 42.2 43.1 43.2 43.3 44.1 45.1 46.1 46.2 47.1 48.1 49.1 50.1 51.1 52.1 53.1 54.1 55.1 56.1 56.2 56.3 57.1 58.1 59.1 60.1 61.1 62.1 63.1 64.1 64.2 65.1 66.1 67.1 68.1 69.1 70.1 71.1 72.1 73.1 74.1 74.2 75.1 76.1 77.1 78.1 78.2 79.1 80.1 81.1 82.1 83.1 84.1 85.1 86.1 87.1 88.1 88.2 89.1 90.1 91.1 92.1 93.1 94.1 95.1 96.1 97.1 98.1 99.1 100.1 101.1 102.1 103.1 103.2 104.1 105.1 106.1 107.1 108.1 110.1
Politika zaštite osobnih podataka UVOD Udruga hrvatskih putničkih agencija (u daljnjem tekstu UHPA) u svom poslovanju provodi mjere zaštite osobnih podataka sukladno Općoj Uredbi o zaštiti podataka (GDPR), zakonskim i regulatornim obvezama. Uprava je u potpunosti predana osiguranju kontinuirane i efektivne uspostave ove politike, te isto očekuje od svojih zaposlenika i poslovnih partnera. Svako kršenje ove politike može rezultirati disciplinskim mjerama ili poslovnim sankcijama. Ova politika određuje očekivano ponašanje UHPA-e, njenih stalnih, privremenih i povremenih zaposlenika kao i poslovnih partnera te trećih strana u odnosu na prikupljanje, korištenje, čuvanje, prijenos, otkrivanje ili uništavanje osobnih podataka koji se obrađuju u poslovnim procesima UHPA-e DEFINICIJE - osobni podaci su svi podaci koji se odnose na pojedinca čiji je identitet utvrđen ili se može utvrditi („Ispitanik”); pojedinac čiji se identitet može utvrditi jest osoba koja se može identificirati izravno ili neizravno, osobito uz pomoć identifikatora kao što su ime, identifikacijski broj, podaci o lokaciji, mrežni identifikator ili uz pomoć jednog ili više čimbenika svojstvenih za fizički, fiziološki, genetski, mentalni, ekonomski, kulturni ili socijalni identitet tog pojedinca; - obrada je svaki postupak ili skup postupaka koji se obavljaju na osobnim podacima ili na skupovima osobnih podataka, bilo automatiziranim bilo neautomatiziranim sredstvima kao što su prikupljanje, bilježenje, organizacija, strukturiranje, pohrana, prilagodba ili izmjena, pronalaženje, obavljanje uvida, uporaba, otkrivanje prijenosom, širenjem ili stavljanjem na raspolaganje na drugi način, usklađivanje ili kombiniranje, ograničavanje, brisanje ili uništavanje; - ograničavanje obrade je označivanje pohranjenih osobnih podataka s ciljem ograničavanja njihove obrade u budućnosti; - izrada profila je svaki oblik automatizirane obrade osobnih podataka koji se sastoji od uporabe osobnih podataka za ocjenu određenih osobnih aspekata povezanih s pojedincem, posebno za analizu ili predviđanje aspekata u vezi s radnim učinkom, ekonomskim stanjem, zdravljem, osobnim sklonostima, interesima, pouzdanošću, ponašanjem, lokacijom ili kretanjem tog pojedinca; - sustav pohrane je svaki strukturirani skup osobnih podataka dostupnih prema posebnim kriterijima, bilo da su centralizirani, decentralizirani ili raspršeni na funkcionalnoj ili zemljopisnoj osnovi; - voditelj obrade je fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje samo ili zajedno s drugima određuje svrhe i sredstva obrade osobnih podataka; kada su svrhe i sredstva takve obrade utvrđeni pravom Unije ili pravom države članice, voditelj obrade ili posebni kriteriji za njegovo imenovanje mogu se predvidjeti pravom Unije ili pravom države članice; - izvršitelj obrade je fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje obrađuje osobne podatke u ime voditelja obrade; - primatelj je fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo kojem se otkrivaju osobni podaci, neovisno o tome je li on treća strana. Međutim, tijela javne vlasti koja mogu primiti osobne podatke u okviru određene istrage u skladu s pravom Unije ili države članice ne smatraju se primateljima; obrada tih podataka koju obavljaju ta tijela javne vlasti mora biti u skladu s primjenjivim pravilima o zaštiti podataka prema svrhama obrade; - treća strana je fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje nije Ispitanik, voditelj obrade, izvršitelj obrade ni osobe koje su ovlaštene za obradu osobnih podataka pod izravnom nadležnošću voditelja obrade ili izvršitelja obrade; - privola Ispitanika znači svako dobrovoljno, posebno, informirano i nedvosmisleno izražavanje želja Ispitanika kojim on izjavom ili jasnom potvrdnom radnjom daje pristanak za obradu osobnih podataka koji se na njega odnose; - povreda osobnih podataka je kršenje sigurnosti koje dovodi do slučajnog ili nezakonitog uništenja, gubitka, izmjene, neovlaštenog otkrivanja ili pristupa osobnim podacima koji su preneseni, pohranjeni ili na drugi način obrađivani; - poduzeće ili društvo je fizička ili pravna osoba koja se bavi gospodarskom djelatnošću, bez obzira na pravni oblik te djelatnosti, uključujući partnerstva ili udruženja koja se redovno bave gospodarskom djelatnošću; - nadzorno tijelo znači neovisno tijelo javne vlasti koje je osnovala država članica; - međunarodna organizacija je organizacija i njezina podređena tijela uređena međunarodnim javnim pravom ili bilo koje drugo tijelo koje su sporazumom ili na osnovi sporazuma osnovale dvije ili više zemalja. PODACI KOJE PRIKUPLJAMO Tijekom različitih oblika interakcije sa UHPA-om (korištenje Internet stranice, slanje upita/zahtjeva e-mailom, poštom) prikupljaju se osobni podaci koji podrazumijevaju, ali nisu ograničeni na sljedeće: - Ime, prezime - Funkcija - e-mail adresa - broj telefona UHPA tijekom različitih oblika interakcije može prikupljati i podatke koji ne spadaju u grupu osobnih podataka, koji podrazumijevaju, ali nisu ograničeni na sljedeće: - Podatke o uređaju putem kojeg se spajate na Internet - Vrstu i verziju Internet preglednika koji koristite - Načine korištenja Internet stranice UHPA-e Korištenje podataka UHPA koristi osobne podatke za slijedeće svrhe: - Pružanje usluga članovima i partnerima sukladno ugovornim obvezama – UHPA osobne podatke može upotrijebiti tijekom pružanja ugovorenih usluga, te za pružanje različitih oblika komunikacije tijekom procesa realizacije suradnje - Marketinške i prodajne aktivnosti – UHPA osobne podatke može upotrijebiti s ciljem obavještavanja o novim pogodnostima, popustima ili sličnim aktivnostima - Zaštita zaposlenika UHPA-e – UHPA osobne podatke pojedinaca može otkriti ako vjeruje da je neophodno ili prikladno kako bi se zaštitili zdravlje i sigurnost zaposlenika, posjetitelja, imovine i/ili korisnika - Zakonske obveze izvještavanja i obrade podataka Prikupljanje podataka Osobni podaci se prikupljaju na jedan od sljedećih načina: - Izravno od pojedinca – kada osoba stupa u kontakt s UHPA-om slanjem upita za određenu uslugu putem e-maila, telefonskog poziva, popunjavanjem kontakt forme na www.uhpa.hr i dolaskom u prostore UHPA-e - Neizravno – podaci koji su javno dostupni na internetskim stranicama koje ne pripadaju UHPA-i (npr. Sudski i obrtni registar, objave na društvenim mrežama, otvorenim forumima), podaci dobiveni korištenjem kolačića, poveznica i sličnih tehnologija KOLAČIĆI Kolačići (engl. cookies) omogućavaju UHPA-i prikupljanje statističkih podataka o ponašanju korisnika na www.uhpa.hr (npr. na kojim dijelovima Internet stranice se korisnici zadržavaju najduže, a gdje najkraće), koji se Internet preglednik (npr. Internet Explorer, Opera, Safari, Google Chrome, Firefox) koristi i slično. Kolačići su mali skup podataka poslan sa poslužitelja www.uhpa.hr na računalo korisnika, a služi kao anonimni identifikator. Kolačići se također koriste za lakšu navigaciju kroz Internet stranice (npr. ne morate svaki put iznova unositi podatke za registraciju). Kolačići se ne koriste s ciljem pristupa korisničkim podacima ili kako bi se pratile aktivnosti korisnika nakon www.uhpa.hr . UHPA zadržava pravo korištenja kolačića na www.uhpa.hr no svaki korisnik može zabraniti primanje kolačića uređivanjem/promjenama postavki u svom Internet pregledniku. DIGITALNI MARKETING UHPA šalje promotivne materijale putem digitalnih komunikacijskih kanala korisnicima koji su dali privolu za takav oblik komunikacije. Korisnici imaju u svakom trenutku pravo onemogućiti uslugu primanja promotivnih materijala, a UHPA će omogućiti alate kako bi se pravo za brisanje iz baze podataka za slanje obavijesti provelo. Korisnik će biti obaviješten u trenutku prvog kontakta ili u bilo kojoj fazi vršenja usluge o korištenju njegovih podataka u svrhe digitalnog marketinga. ZAHTJEVI ISPITANIKA UHPA osigurava ostvarivanje prava korisnika u odnosu na: - Pristup informacijama; - Prigovor na obradu; - Ograničenje obrade; - Prijenos podataka; - Ispravljanje podataka; - Brisanje podataka. Korisnik zahtjeve za ostvarenje prava podnosi pisanim ili usmenim putem. Ako pojedinac podnese zahtjev koji se odnosi na bilo koje gore navedeno pravo, UHPA će razmotriti svaki takav zahtjev u skladu sa svim primjenjivim zakonima i propisima o zaštiti podataka. UHPA zadržava pravo naplate troškova za obradu zahtjeva korisnika u iznimnim slučajevima kada su zahtjevi nerazumni. Korisnici imaju pravo na informiranje temeljem podnesenog zahtjeva, a nakon uspješne provjere njihovog identiteta, o sljedećem: - Svrsi obrade osobnih podataka; - Izvoru osobnih podataka, ako nije dobiven od korisnika; - Kategoriji osobnih podataka; - Primateljima ili kategorijama primatelja kojima su ili mogu biti preneseni osobni podaci, zajedno s lokacijom tih primatelja; - Predviđenom razdoblje pohrane osobnih podataka ili obrazloženje za određivanje razdoblja pohrane; - Upotrebi bilo kakvog automatiziranog odlučivanja, uključujući profiliranje; Svi zahtjevi za pristup ili ispravak osobnih podataka moraju biti upućeni UHPA-i kao Voditelju obrade koja će evidentirati svaki zahtjev po primitku. Odgovor na svaki zahtjev dostavlja se u roku od 30 dana od primitka pismenog zahtjeva korisnika. Ako se ne može u potpunosti odgovoriti na zahtjev korisnika u roku od 30 dana, dostavlja se obavijest o: - Potvrdi primitku zahtjeva - Svim informacijama koje su prikupljene - Pojedinosti o bilo kojoj traženoj informaciji ili izmjenama koje neće biti dostavljene korisniku, razlogu za odbijanje te o svim mogućim postupcima za žalbu na odluku. - Procijenjeni datum do kojeg će biti dostavljeni preostali odgovori. - Procjena troškova koje mora platiti korisnik (ako je zahtjev prekomjeran). - Ime i kontaktne informacije društva koje bi Ispitanik trebao kontaktirati za daljnje informacije. ZADRŽAVANJE PODATAKA UHPA neće zadržati osobne podatke duže nego što je to neophodno u odnosu na svrhe za koje su izvorno prikupljeni ili za koje je definiran zakonski ili ugovorni rok. Točni vremenski periodi čuvanja podataka navedena su u dokumentu "Politika pohrane podataka". Pri čemu se uzimaju u obzir zakonske i ugovorne obveze, kako minimalne tako i maksimalne. Kad razdoblje zadržavanja istekne, organizacija će osobne podatke izbrisati na način koji osigurava da se oni ne mogu rekonstruirati niti pročitati. ZAŠTITA PODATAKA UHPA provodi fizičke, tehničke i organizacijske mjere koje jamče sigurnost osobnih podataka (npr. prevenciju gubitka ili oštećenja, neovlaštene izmjene, pristupa ili obrade i drugih prijetnji kojima mogu biti izloženi osobni podaci uzrokovani ljudskim djelovanjem ili fizičkim/prirodnim okruženjem). Minimalni skup sigurnosnih mjera koje UHPA provodi u svrhu zaštite osobnih podataka navedeni su u dokumentu „Politika informacijske sigurnosti“ i drugim vezanim politikama i procedurama. Sigurnosne mjere koje se provode imaju za cilj: - Spriječiti neovlaštene osobe da dobiju pristup sustavu obrade podataka u kojima se obrađuju osobni podaci. - Spriječiti osobe koje imaju pravo koristiti sustav obrade podataka od pristupa osobnim podacima koji su izvan njihovih potreba i ovlaštenja. - Osigurati da se osobni podaci tijekom elektronskog prijenosa ili tijekom prijenosa ne mogu čitati, kopirati, mijenjati ili ukloniti bez odobrenja. - Osigurati dostupnost zapisa sustava u svrhu utvrđivanja od koga su uneseni, mijenjani ili uklonjeni osobni podaci iz sustava obrade podataka. - Osigurati da u slučaju kada obradu obavlja izvršitelj obrade, podaci se mogu obrađivati samo u skladu s uputama voditelja obrade. - Osigurati da su osobni podaci zaštićeni od neželjenog uništavanja ili gubitka. - Osigurati da osobni podaci prikupljeni za različite svrhe mogu biti obrađeni odvojeno. - Osigurati da se osobni podaci ne drže duže nego što je potrebno. ZAHTJEVI OD STRANE PRAVOSUDNIH TIJELA U određenim okolnostima, dopušteno je da se osobni podaci dijele bez znanja ili suglasnosti korisnika. I to kada je otkrivanje osobnih podataka potrebno u bilo kojoj od sljedećih svrha: - Sprječavanje ili otkrivanje zločina. - Uhićenje ili progon prekršitelja. - Procjena ili naplata poreza ili pristojbi. - Po nalogu suda ili bilo kojeg zakona. PRIJENOS PODATAKA UHPA zadržava pravo prijenosa osobnih podataka unutar svoje poslovne grupe kao i na treće strane poštivajući načelo odgovarajuće razine pravne zaštite za prava i slobode korisnika. Prijenos osobnih podataka se provodi isključivo ako je zadovoljen barem jedan od sljedećih uvjeta: - Prijenos je neophodan za izvedbu ugovornih obveza/usluga; - Prijenos je neophodan za provedbu predugovornih mjera koje se poduzimaju kao odgovor na zahtjev korisnika; - Prijenos je neophodan za zaključivanje ili izvršenje ugovora sklopljenog s trećom stranom u interesu korisnika; - Prijenos je zakonski obvezan na temelju važnih javnih interesa; - Prijenos je neophodan za osnivanje, vršenje ili obranu pravnih zahtjeva; - Prijenos je neophodan kako bi se zaštitili vitalni interesi korisnika. RUKOVANJE PRITUŽBAMA U slučaju pritužbi vezanih uz pridržavanje ovih i drugih pravila vezanih za zaštitu osobnih podataka, molimo da nam se javite na uhpa1@uhpa.hr . U slučaju pritužbe, istražit ćemo cijelu situaciju koja se odnosi na upotrebu i otkrivanje osobnih podataka sukladno ovim pravilima te ćemo ih pokušati riješiti u najkraćem mogućem roku. KONTAKT Udruga hrvatskih putničkih agencija Kršnjavoga 1/II Zagreb E: uhpa1@uhpa.hr U Zagrebu, 15. svibnja 2018.