http___www.uhpa.hr_o-nama_zastita-privatnosti-5b0d5aff4bb49_politika-zastite-osobnih-podataka-5b0e8495a935c_1.xml
1.1 2.1 3.1 4.1 5.1 6.1 7.1 8.1 9.1 10.1 11.1 12.1 13.1 14.1 15.1 16.1 16.2 16.3 16.4 17.1 18.1 18.2 19.1 20.1 21.1 22.1 23.1 24.1 25.1 26.1 26.2 26.3 27.1 28.1 28.2 29.1 30.1 31.1 32.1 33.1 34.1 34.2 35.1 36.1 37.1 38.1 39.1 40.1 41.1 42.1 43.1 44.1 45.1 45.2 46.1 47.1 48.1 49.1 49.2 50.1 51.1 52.1 53.1 54.1 55.1 56.1 57.1 57.2 58.1 59.1 60.1 61.1 62.1 63.1 64.1 65.1 66.1 67.1 68.1 69.1 70.1 71.1 72.1 73.1 74.1 75.1 75.2 76.1 77.1 78.1 79.1 80.1 80.2 81.1 82.1 83.1 84.1 84.2 85.1 86.1 87.1 88.1 89.1 90.1 91.1 92.1 93.1 94.1 95.1 95.2 96.1 97.1 97.2 98.1 99.1 100.1 101.1 102.1 102.2 102.3 102.4 102.5 103.1 103.2 104.1 105.1 106.1 107.1 108.1 108.2 109.1 110.1 110.2 110.3 111.1 112.1 113.1 113.2 113.3 114.1 115.1 116.1 117.1 118.1 119.1 120.1 121.1 122.1 123.1 124.1 125.1 126.1 127.1 128.1 129.1 130.1 131.1 131.2 132.1 133.1 134.1 135.1 136.1 137.1 138.1 139.1 140.1 140.2 141.1 142.1 142.2 143.1 144.1 145.1 146.1 147.1 148.1 149.1 150.1 151.1 151.2 152.1 153.1 154.1 154.2 155.1 156.1 157.1 158.1 159.1 160.1 161.1 162.1 163.1 164.1 165.1 166.1 166.2 167.1 168.1 169.1 170.1 171.1 171.2 171.3 172.1 173.1 174.1 175.1 176.1 176.2 177.1 178.1 178.2 178.3 179.1 180.1 180.2 181.1 182.1 182.2 183.1 184.1 185.1 186.1 187.1 188.1 189.1 189.2 189.3 190.1 190.2 190.3 190.4 191.1 192.1 193.1 194.1 195.1 196.1 196.2 196.3 197.1 198.1 199.1 200.1 201.1 202.1 203.1 204.1 205.1 206.1 207.1 208.1 209.1 210.1 211.1 212.1 213.1 214.1 215.1 216.1 217.1 218.1 219.1 220.1 221.1 222.1 223.1 224.1 225.1 226.1 227.1 228.1 229.1 229.2 230.1 231.1 232.1 233.1 234.1 235.1 236.1 237.1 237.2 238.1 239.1 240.1 241.1 242.1 243.1 244.1 244.2 245.1 246.1 247.1 248.1 249.1 250.1 251.1 252.1 253.1 254.1 255.1 256.1 257.1 258.1 259.1 260.1 261.1 262.1 263.1 264.1 265.1
- Introduction The purpose of this policy is to set out the principles that must be observed by anyone who works for Frameless Glass Curtains Ltd (FGC) and has access to person or firm identifiable information. - Responsibility for confidentiality, data protection and security Joanna Judge shall be responsible for: - Oversight of compliance with this policy - Advising staff on the application of this policy - Approving unusual or controversial requests for disclosure of data - Handling subject access requests - Briefing the Board on data protection responsibilities - Arranging for data security risk assessment - Reviewing this policy - Duty of confidentiality All employees working within FGC owe a duty of confidentiality to protect all personal and firm information they come into contact with during the course of their work. - Data Protection - Introduction The Data Protection Act 1998 regulates data use. Unlike with the duty of confidentiality referred to above, the Data Protection Act is only concerned with how firms use personal data of individuals. This includes customers, non-customers and employees. It governs not only information held on computer but also information held in manual form (e.g. on file). - The Data Protection Information Commissioner The Data Protection Information Commissioner enforces and oversees the Data Protection Act 1998. The Commissioner has a range of duties including the promotion of good information handling and the encouragement of Codes of Practice for the data controllers, that is, anyone who decides how and why personal data are processed. The Commissioner is a UK independent supervisory authority reporting directly to the UK Parliament. The information provided within this procedural manual is drawn from the requirements laid down by the Office of the Information Commissioner. Further information is available from visiting the Information Commissioner’s website at https://ico.org.uk - Why Data is Important It is therefore essential that those that collect and use personal data to maintain the confidence of those who are asked to provide it by complying with the requirements of the Data Protection Act. All Data Controllers must comply with the eight principles that are at the heart of the Act, including the requirement to obtain and process data fairly. - Individual Rights Under the Act any individual concerned has a right to see almost all personal information held about them, whether it is stored on computer or in manual form. Information held by [DESIGNATED OFFICER OF THE FIRM] must not be amended/deleted following a request to use it. In the event of receiving a so-called ‘subject access request’ please refer to ‘Subject Access Procedures’. - Accuracy The Act places an obligation to ensure the accuracy of an individual’s personal data. Such information should not be misleading as to any matter of fact. - Personal obligations of all staff - All staff who deal with personal information are required to handle that information confidentially and sensitively - Staff undertake to process personal data supplied by the firm only in accordance with the firm’s instructions - Staff obligations in respect of the Data Protection Act form part of their contract of employment - The Data Protection Principles The 1998 Act sets out 8 principles, which define the obligations of the firm as a registered data user of personal data. These principles are as follows: – - Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless – (a) at least one of the conditions in Schedule 2 is met, and (b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met. - Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes - Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed - Personal data shall be accurate and, where necessary, kept up to date - Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes - Personal data shall be processed in accordance with the rights of data subjects under this Act - Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data - Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data Personal data covers both facts and opinions about the individual. It also includes information regarding the intentions of the Data Controller towards the individual. - Requirements of the Principles - First Principle ‘Personal data shall be processed fairly and lawfully’ The firm must ensure that the processing is fair and lawful. Where the data is obtained from the data subject the firm must ensure that the data subject is provided with, or have made readily available to them at the time of obtaining the data: the identity of the firm the purpose for processing other necessary information as circumstances require to ensure that the processing is fair The firm’s application forms should take into account the following requirements: - The data subject has given their consent to the processing - The processing is necessary for the performance of a contract with the individual to which the firm and data subject is a party - The processing is necessary to comply with legal obligations - The processing is necessary in order to protect the vital interests of the data subject - The processing is necessary for the administration of justice - The processing is necessary to pursue the legitimate business interest of the firm Firms will only need to hold or process customer’s personal data for business needs for example the need to carry out a credit search in respect of an application for a loan. The customer would have been requested to sign our standard declaration in order for their consent to be provided. - Second Principle ‘Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes’ - Third Principle ‘Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed’ Personal data held for specific purposes must be more than sufficient for the purpose or purposes. It would therefore not be sufficient to hold information on the basis that one day it may be useful, without a firm idea of how it will be used. - Fourth Principle ‘Personal data shall be accurate and, where necessary, kept up to date’ All reasonable steps must be taken to ensure the accuracy of data at all times. Firms must have controls in place to ensure that in the event of inaccurate personal data being identified procedures will exist to allow for information to be rectified, blocked or destroyed. - Fifth Principle ‘Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that or those purposes’ - The firm has a document retention policy that sets out the minimum time in which documents should be retained. - This has been formulated in line with legal and regulatory requirements. - Sixth Principle ‘Personal data shall be processed in accordance with the rights of data subjects under this Act’ - This principle covers the requirement of Data Controllers to provide individuals with Rights of Access to personal data - The data subject may submit a subject access request in writing or by electronic means to the firm. See Subject Access Request procedures - Data Subject Access Requests should be referred immediately to Compliance - The firm must respond to the request in any event within 40 days as long as the prescribed fee of £10 has been paid - The firm has satisfied itself as to the identity of the person making the request In addition, principle 6 covers how individuals have a right to be made aware of how their personal information is used and by whom it is used. Under Data Protection Legislation, the firm must be able to prevent processing of data where the individual objects in writing. For example, a customer may request not to receive any direct marketing material from the company or wish to have personal details passed through to a third party. The firm must have systems in place to suppress this type of information being sent out to their customers. - Seventh Principle ‘Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against loss or destruction of, or damage to, personal data’ - The firm has taken measures to ensure that only authorised persons have access to personal data and these persons act only as mandated. Passwords giving access to data are frequently changed - All reasonable steps are taken to ensure that appropriate security measures are in place to safeguard against unauthorized or unlawful processing of personal data - All staff that has access to personal data is deemed to be reliable and training and measures have been put in place - Staff only access and use data that is necessary to perform their job function - Eighth Principle ‘Personal data shall not be transferred to a country of territory outside the European Economic Area without adequate protection. - Where processing across more than one national boundary is undertaken, it is necessary to determine which law applies to which processing operation - The UK law will apply to processing by a controller established in the UK - Consent of the data subject is required when data is transferred to countries outside the EEA, where protection is inadequate and where the transfer does not fall under any of the exempt cases When assessing ‘adequacy of protection’, all circumstances surrounding the data transfer should be considered (e.g. the nature of the data, the purposes and timescales of the processing etc.). Privacy notices The Data Protection Act does not define fair processing. But it does say that, unless a relevant exemption applies, personal data will be processed fairly only if certain information is given to the individual or individuals concerned. It is clear that the law gives organisations some discretion in how they provide fair processing information – ranging from actively communicating it to making it readily available. The oral or written statement that individuals are given when information about them is collected is often called a “fair processing notice”, although ICO recent guidance uses “privacy notice” instead. However, it is probably helpful to avoid technical language altogether. In general terms, a privacy notice should state: - Your identity and, if you are not based in the UK, the identity of your nominated UK representative; - The purpose or purposes for which you intend to process the information; and - Any extra information you need to give individuals in the circumstances to enable you to process the information fairly The last of these requirements is vague. However, because the Data Protection Act covers all sorts of processing, it is hard to be prescriptive. When deciding whether you should give any other information in the interests of fairness, you have to take into account the nature of the personal data and what the individuals concerned are likely to expect. For example, if you intend to disclose information to another organisation, fairness requires that you tell the individuals concerned unless they are likely to expect such disclosures. It is also good practice to tell people how they can access the information you hold about them, as this may help them spot inaccuracies or omissions in their records. When deciding how to draft and communicate a privacy notice, try to put yourself in the position of the people you are collecting information about. Ask yourself: - Do they already know who is collecting the information and what it will be used for? - Is there anything they would find deceptive, misleading, unexpected or objectionable? - Are the consequences of providing the information, or not providing it, clear to them? The ICO have issued a Privacy notices code of practice to help organisations draft clear privacy notices and to ensure they collect information about people fairly and transparently. The code explains that the duty to give a privacy notice is strongest when the information is likely to be used in an unexpected, objectionable or controversial way, or when the information is confidential or particularly sensitive. It also says there is no point telling people the obvious when it is already clear what their information will be used for. Example When an individual enters into a mobile phone contract, they know the mobile phone company will keep their name and address details for billing purposes. This does not need to be spelt out. However, if the company wants to use the information for another purpose, perhaps to enable a sister company to make holiday offers, then this would not be obvious to the individual customer and should be explained to them. https://ico.org.uk/media/for-organisations/documents/1610/privacy_notices_cop.pdf - Processing Personal Data Processing of personal data can be broadly defined when any operation is carried out on personal data. The Act requires that personal data be processed ‘fairly and lawfully’. Personal data will not be considered to be processed fairly unless certain conditions have been met. Processing may only be carried out where one of the following conditions has been met: - The individual has given his or her consent to the processing - The processing is necessary for the performance of a contract with the individual - The processing is necessary to protect the vital interests of the individual - The process is necessary to carry out public functions - Collecting Personal Data When collecting personal data, it is essential that people know: - Who you / we are - What the data will be used for - To whom it will be disclosed This information can often be provided on an application form or similar document. Data Protection wording is included within the firm’s application package, which when signed by the customer provides necessary comments for processing the customer’s data. When handling, collecting, processing or storing personal data staff must ensure that: - All personal data is both accurate and up to date - Errors are corrected effectively and promptly - The data is deleted/destroyed when it is no longer needed - The personal data is kept secure at all times (protecting from unauthorized disclosure or access) The Data Protection Act is considered when setting up new systems or when considering use of the data for a new purpose. Any changes could affect the company’s existing registration with the Data Protection Registrar and an amendment to the registration sought. It is equally important not to: - Access personal data that you do not need for your work - Use the data for any purpose it was not explicitly obtained for - Keep data that would embarrass or damage the firm if disclosed (e.g. via a subject access request) - Transfer personal data outside of the European Economic Area unless you are certain you are entitled to or consent from the individual concerned has been obtained - Store / process / handle sensitive data unless you are certain you are entitled to or consent from the individual concerned has been obtained. - Rights of Individuals ‘Subject Access’ and ‘Subject Rights’ The Data Protection Act enables individuals who are the subject of personal data a general right of access to the personal data, which relates to them. Personal data may take the form of computerised or, in some cases, paper records. These rights are known as ‘subject access rights’. - Individuals, who the data relates to, have various rights: - To receive a request (a ‘subject access request’) details of the processing relating to them. This includes any information about themselves including information regarding the source of the data - To have any inaccurate data corrected or removed - In certain circumstances to stop processing likely to cause ‘substantial damage or substantial distress’ - To prevent their data being used for advertising or marketing - Not to be subject to certain ‘fully automated decisions’ if they significantly affect him / her When a subject access request is received, it is important to: - Treat the requester with courtesy and try to understand what exactly is being sought - Act promptly and effectively as certain timescales are imposed regarding response What is a Subject Access Request? Often a customer will not have heard of the term ‘Subject Access Request’. Staff should be able to distinguish between a casual enquiry and a ‘Subject Access Request’. A Subject Access Request is not, for example, where:- - A customer wishes to know something specific about their bank account, such as their balance or transaction details - A customer wishes to raise a complaint. In these circumstances the normal complaints procedure should be followed A Subject Access Request is where: - A customer wishes to be provided with personal data that the firm holds about them Subject Access Requests It is important that subject access requests are recognised and dealt with quickly. A subject access request may be as simple as a letter from one the firm’s customers asking what information we hold about them. If a request is received the enquirer must be sent: - A copy of the information held on them, this includes both computer and relevant written paper records - A description provided as to why that information is processed - Anyone it may be seen by or passed to - The logic involved in any automated decisions Before any request is auctioned the Data Controller should verify the identity of the person making the request. Subject access requests must be dealt with within 40 days from the date of receipt. If further details are needed from the person making the request to assist with finding the data the 40 days will begin when the extra information is received. A maximum fee of £10 can be imposed and the 40 days will not commence until the fee has been received. All information sent in response to a subject access request should be easy to understand and therefore the sending of computer printouts may not be acceptable without a covering explanation on codes used. - Identifying the Customer Subject Access Requests Firms are not obliged to comply with a subject access request until sufficient information to clearly identify the individual requesting the file has been given. Before releasing data staff should satisfy themselves as to the identity of the customer. This is important to firms, as releasing information to the wrong person is likely to amount to a breach of security. Any of the documents listed below may be used to identify the customer(s): - A bank, building society or credit card statement - A store card or catalogue statement - A utility bill All documents must be original, not photocopies, and dated within the last three months. It must show the customer’s full name or first initial, surname and current address. It is important that all documentation is returned to the customer once identity has been verified. In the rare circumstances where the customer is unable to provide any of the above items, they must provide a letter confirming their identity. This must be an original, typed or headed paper, dated within the last three months and authenticated with an official stamp if applicable. This should be from an employer, solicitor or other professional body or person. Telephone requests for information It is important not to release any personal information to customers before you have established their identity. Requests should be treated with great care, particularly as the issues of proof of identity are difficult to manage. The steps that need to be taken to verify the identity of the customer will depend upon the type of information, and possibly the customer. Although wherever possible access to a data subject’s personal information should be provided ‘without excessive constraints or delay’. This needs to be balanced against the responsibilities of the data controller to safeguard personal information and to avoid giving personal data to another individual. Therefore, depending on the circumstances, staff should be asking customers to confirm selective information to verify identity from the following: - Confirmation of their date of birth and postal address - Confirmation of their employment record - Confirmation of their National Insurance number If the customer requests a Subject Access report then the customer needs to be reminded that the request needs to be put in writing, and will be dealt with in accordance with the procedures as detailed in section 4. - Credit Reference Agencies There are two major credit reference agencies in the UK at present. They are Experian and Equifax. Their main purpose is to supply factual information to providers of financial services in order to establish peoples credit histories. Customers have a legal right to have access to the data held by credit reference agencies. Customers also have a right to request that the agency remove/amend incorrect data. Customers can write to the agency to obtain a copy of their credit file. Generally a small fee is payable. Equifax Europe UK Limited Experian Plc. PO Box 3001 PO Box 8000 Glasgow Nottingham GS1 2DT NG1 5GX - Consent to Obtain Credit Search Credit searches on an individual must not be conducted without the consent of that individual. The firm’s policy is to obtain this consent in writing, normally as part of the application process, however, verbal consent of the customer will be considered in certain circumstances. Staff should contact Compliance Department if they are unsure if adequate consents have been obtained. - Processing for Direct Marketing Purposes To comply with the requirements of the Data Protection Act all customers both new and existing have to be given the right to opt out from receiving advertising and marketing material from the firm. Likewise, customers have to be informed if the firm intends to pass information to a third party for marketing purposes. Customer’s personal data is collected on application forms and the election for customers not be receive marketing material is covered through the inclusion of an ‘opt-out’ box. - Preference Services There are a number of marketing preference services available to customers: - The Mail Preference Service (MPS) - The Telephone Preference Service (TPS) - The Fax Preference Service (FPS) - The E-mail Preference Service (EPS) The MPS is funded by the direct mail industry to enable customers to have their names and home addresses in the UK removed from or added to lists used by the direct mail industry. Firms must ensure that customers that have registered with the MPS do not receive any marketing material. - Third Parties and Data Processors - General Guidelines - Always read the contract carefully before signing - Check that you understand what each clause means and the effect of that clause - Remember – a contact is an agreement enforceable in law - Ensure that you receive a signed original of the document - Once the contract is in force, then it is the firm’s responsibility to ensure that it complies with the term of the contract In the event of a query reference should be made to senior management - Data Protection Act Definitions - Data Automated and manual data that is recorded as part of a relevant filing system - Data Controller The data controller is Compliance Officer/Nominated Officer - Data Protection Commissioner This is the name for the Data Protection Registrar - Data Subject The individual who is the subject of the personal data - Manual Data Manual records are those which are structured by reference to individuals or criteria relating to individuals, and which allow easy access to the personal data they contain - Notification Notification by the firm of certain basic information about the data held; the purposes for which it is held; the persons to whom it may be disclosed; a general description of the technical and organisational steps a Data Controller takes to protect data held from unauthorised access, disclosure or loss; and the identity of the Data Controller i.e. Compliance is responsible for ensuring that notification / registration is completed as necessary. - Personal Data This is data relating to an individual who can be identified from that data and/or other information which is the possession of or likely to come into possession of the firm - Processing of Personal Data Obtaining or recording the information to be contained in the data or carrying out an operation, including disclosure by transmission / documentation, organisation, adaptation, alteration of the information or data, retrieval, blocking, erasure or destruction of the data. - Relevant filing systems / manual data Any set of information relating to individuals which is structured either by reference to individuals i.e. by name/employee code etc., or by reference to criteria i.e. age job type, credit history etc. relating to individuals so that specific information relating to an individual is readily accessible. - Sensitive Data Means data pertaining to: racial or ethnic origin; religions or similar beliefs; trade union membership; physical or mental health or sexual life; political options; criminal offices. This data may only be held in strictly defined situations or where explicit consent has been obtained. - Subject Access The right of individuals to have access to the data about them and any other related information - Third Party Any person other than the firm or its staff, data subject, or data processor - Data security - Data security obligations Firms have a responsibility under FCA Regulations to put in place systems and controls that keep the data of customers secure whilst also minimising the risks of data loss. The nature of the steps that firms will be expected to take will depend on the size, complexity and nature of the services that the firm provides. FGC policy requirements: - Sensitive Customer data cannot be taken off site by staff - Where customer data is transferred electronically we use secure internet links - Access to sensitive areas (call centres, server rooms, filing rooms) is restricted - Staff will not be able to access data that they do not need for their roles - Staff data access rights are reviewed to ensure that they remain appropriate - When staff members leave their user accounts are permanently deleted - Paper files are kept in a secure office - Staff dispose of hard data securely through physically destroying data e.g. by using shredders or using confidential waste bins - There are robust password standards and that passwords are not shared - That there are individual user accounts requiring passwords for all systems containing sensitive customer data - Systems operate in such a way as to prohibit the setting of passwords which do not comply with password policy - Data is wiped before computers are disposed or transferred to new users - There is some mechanism to check that hard and electronic data is being destroyed competently - There are clear & consistent procedures for backing up data - Backed up data is limited to appropriate staff - Firms have security measures in place to protect data e.g. alarm systems & keypad entry doors - There is a robust policy for logging visitors in and out - Dealing with data security incidents Where data loss has been encountered the compliance officer Joanna Judge shall write to customers within 24 hours after the incident to advise them that data has been lost, and the manner in which it was lost. FGC shall also ensure that following data loss it conducts a review of the systems that led to the loss.
1.1 2.1 3.1 4.1 4.2 5.1 6.1 7.1 8.1 9.1 10.1 11.1 12.1 13.1 14.1 14.2 15.1 16.1 17.1 18.1 19.1 20.1 21.1 22.1 23.1 24.1 25.1 26.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 34.1 35.1 36.1 37.1 38.1 39.1 40.1 40.2 41.1 42.1 42.2 43.1 43.2 43.3 44.1 45.1 46.1 46.2 47.1 48.1 49.1 50.1 51.1 52.1 53.1 54.1 55.1 56.1 56.2 56.3 57.1 58.1 59.1 60.1 61.1 62.1 63.1 64.1 64.2 65.1 66.1 67.1 68.1 69.1 70.1 71.1 72.1 73.1 74.1 74.2 75.1 76.1 77.1 78.1 78.2 79.1 80.1 81.1 82.1 83.1 84.1 85.1 86.1 87.1 88.1 88.2 89.1 90.1 91.1 92.1 93.1 94.1 95.1 96.1 97.1 98.1 99.1 100.1 101.1 102.1 103.1 103.2 104.1 105.1 106.1 107.1 108.1 110.1
Politika zaštite osobnih podataka UVOD Udruga hrvatskih putničkih agencija (u daljnjem tekstu UHPA) u svom poslovanju provodi mjere zaštite osobnih podataka sukladno Općoj Uredbi o zaštiti podataka (GDPR), zakonskim i regulatornim obvezama. Uprava je u potpunosti predana osiguranju kontinuirane i efektivne uspostave ove politike, te isto očekuje od svojih zaposlenika i poslovnih partnera. Svako kršenje ove politike može rezultirati disciplinskim mjerama ili poslovnim sankcijama. Ova politika određuje očekivano ponašanje UHPA-e, njenih stalnih, privremenih i povremenih zaposlenika kao i poslovnih partnera te trećih strana u odnosu na prikupljanje, korištenje, čuvanje, prijenos, otkrivanje ili uništavanje osobnih podataka koji se obrađuju u poslovnim procesima UHPA-e DEFINICIJE - osobni podaci su svi podaci koji se odnose na pojedinca čiji je identitet utvrđen ili se može utvrditi („Ispitanik”); pojedinac čiji se identitet može utvrditi jest osoba koja se može identificirati izravno ili neizravno, osobito uz pomoć identifikatora kao što su ime, identifikacijski broj, podaci o lokaciji, mrežni identifikator ili uz pomoć jednog ili više čimbenika svojstvenih za fizički, fiziološki, genetski, mentalni, ekonomski, kulturni ili socijalni identitet tog pojedinca; - obrada je svaki postupak ili skup postupaka koji se obavljaju na osobnim podacima ili na skupovima osobnih podataka, bilo automatiziranim bilo neautomatiziranim sredstvima kao što su prikupljanje, bilježenje, organizacija, strukturiranje, pohrana, prilagodba ili izmjena, pronalaženje, obavljanje uvida, uporaba, otkrivanje prijenosom, širenjem ili stavljanjem na raspolaganje na drugi način, usklađivanje ili kombiniranje, ograničavanje, brisanje ili uništavanje; - ograničavanje obrade je označivanje pohranjenih osobnih podataka s ciljem ograničavanja njihove obrade u budućnosti; - izrada profila je svaki oblik automatizirane obrade osobnih podataka koji se sastoji od uporabe osobnih podataka za ocjenu određenih osobnih aspekata povezanih s pojedincem, posebno za analizu ili predviđanje aspekata u vezi s radnim učinkom, ekonomskim stanjem, zdravljem, osobnim sklonostima, interesima, pouzdanošću, ponašanjem, lokacijom ili kretanjem tog pojedinca; - sustav pohrane je svaki strukturirani skup osobnih podataka dostupnih prema posebnim kriterijima, bilo da su centralizirani, decentralizirani ili raspršeni na funkcionalnoj ili zemljopisnoj osnovi; - voditelj obrade je fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje samo ili zajedno s drugima određuje svrhe i sredstva obrade osobnih podataka; kada su svrhe i sredstva takve obrade utvrđeni pravom Unije ili pravom države članice, voditelj obrade ili posebni kriteriji za njegovo imenovanje mogu se predvidjeti pravom Unije ili pravom države članice; - izvršitelj obrade je fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje obrađuje osobne podatke u ime voditelja obrade; - primatelj je fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo kojem se otkrivaju osobni podaci, neovisno o tome je li on treća strana. Međutim, tijela javne vlasti koja mogu primiti osobne podatke u okviru određene istrage u skladu s pravom Unije ili države članice ne smatraju se primateljima; obrada tih podataka koju obavljaju ta tijela javne vlasti mora biti u skladu s primjenjivim pravilima o zaštiti podataka prema svrhama obrade; - treća strana je fizička ili pravna osoba, tijelo javne vlasti, agencija ili drugo tijelo koje nije Ispitanik, voditelj obrade, izvršitelj obrade ni osobe koje su ovlaštene za obradu osobnih podataka pod izravnom nadležnošću voditelja obrade ili izvršitelja obrade; - privola Ispitanika znači svako dobrovoljno, posebno, informirano i nedvosmisleno izražavanje želja Ispitanika kojim on izjavom ili jasnom potvrdnom radnjom daje pristanak za obradu osobnih podataka koji se na njega odnose; - povreda osobnih podataka je kršenje sigurnosti koje dovodi do slučajnog ili nezakonitog uništenja, gubitka, izmjene, neovlaštenog otkrivanja ili pristupa osobnim podacima koji su preneseni, pohranjeni ili na drugi način obrađivani; - poduzeće ili društvo je fizička ili pravna osoba koja se bavi gospodarskom djelatnošću, bez obzira na pravni oblik te djelatnosti, uključujući partnerstva ili udruženja koja se redovno bave gospodarskom djelatnošću; - nadzorno tijelo znači neovisno tijelo javne vlasti koje je osnovala država članica; - međunarodna organizacija je organizacija i njezina podređena tijela uređena međunarodnim javnim pravom ili bilo koje drugo tijelo koje su sporazumom ili na osnovi sporazuma osnovale dvije ili više zemalja. PODACI KOJE PRIKUPLJAMO Tijekom različitih oblika interakcije sa UHPA-om (korištenje Internet stranice, slanje upita/zahtjeva e-mailom, poštom) prikupljaju se osobni podaci koji podrazumijevaju, ali nisu ograničeni na sljedeće: - Ime, prezime - Funkcija - e-mail adresa - broj telefona UHPA tijekom različitih oblika interakcije može prikupljati i podatke koji ne spadaju u grupu osobnih podataka, koji podrazumijevaju, ali nisu ograničeni na sljedeće: - Podatke o uređaju putem kojeg se spajate na Internet - Vrstu i verziju Internet preglednika koji koristite - Načine korištenja Internet stranice UHPA-e Korištenje podataka UHPA koristi osobne podatke za slijedeće svrhe: - Pružanje usluga članovima i partnerima sukladno ugovornim obvezama – UHPA osobne podatke može upotrijebiti tijekom pružanja ugovorenih usluga, te za pružanje različitih oblika komunikacije tijekom procesa realizacije suradnje - Marketinške i prodajne aktivnosti – UHPA osobne podatke može upotrijebiti s ciljem obavještavanja o novim pogodnostima, popustima ili sličnim aktivnostima - Zaštita zaposlenika UHPA-e – UHPA osobne podatke pojedinaca može otkriti ako vjeruje da je neophodno ili prikladno kako bi se zaštitili zdravlje i sigurnost zaposlenika, posjetitelja, imovine i/ili korisnika - Zakonske obveze izvještavanja i obrade podataka Prikupljanje podataka Osobni podaci se prikupljaju na jedan od sljedećih načina: - Izravno od pojedinca – kada osoba stupa u kontakt s UHPA-om slanjem upita za određenu uslugu putem e-maila, telefonskog poziva, popunjavanjem kontakt forme na www.uhpa.hr i dolaskom u prostore UHPA-e - Neizravno – podaci koji su javno dostupni na internetskim stranicama koje ne pripadaju UHPA-i (npr. Sudski i obrtni registar, objave na društvenim mrežama, otvorenim forumima), podaci dobiveni korištenjem kolačića, poveznica i sličnih tehnologija KOLAČIĆI Kolačići (engl. cookies) omogućavaju UHPA-i prikupljanje statističkih podataka o ponašanju korisnika na www.uhpa.hr (npr. na kojim dijelovima Internet stranice se korisnici zadržavaju najduže, a gdje najkraće), koji se Internet preglednik (npr. Internet Explorer, Opera, Safari, Google Chrome, Firefox) koristi i slično. Kolačići su mali skup podataka poslan sa poslužitelja www.uhpa.hr na računalo korisnika, a služi kao anonimni identifikator. Kolačići se također koriste za lakšu navigaciju kroz Internet stranice (npr. ne morate svaki put iznova unositi podatke za registraciju). Kolačići se ne koriste s ciljem pristupa korisničkim podacima ili kako bi se pratile aktivnosti korisnika nakon www.uhpa.hr . UHPA zadržava pravo korištenja kolačića na www.uhpa.hr no svaki korisnik može zabraniti primanje kolačića uređivanjem/promjenama postavki u svom Internet pregledniku. DIGITALNI MARKETING UHPA šalje promotivne materijale putem digitalnih komunikacijskih kanala korisnicima koji su dali privolu za takav oblik komunikacije. Korisnici imaju u svakom trenutku pravo onemogućiti uslugu primanja promotivnih materijala, a UHPA će omogućiti alate kako bi se pravo za brisanje iz baze podataka za slanje obavijesti provelo. Korisnik će biti obaviješten u trenutku prvog kontakta ili u bilo kojoj fazi vršenja usluge o korištenju njegovih podataka u svrhe digitalnog marketinga. ZAHTJEVI ISPITANIKA UHPA osigurava ostvarivanje prava korisnika u odnosu na: - Pristup informacijama; - Prigovor na obradu; - Ograničenje obrade; - Prijenos podataka; - Ispravljanje podataka; - Brisanje podataka. Korisnik zahtjeve za ostvarenje prava podnosi pisanim ili usmenim putem. Ako pojedinac podnese zahtjev koji se odnosi na bilo koje gore navedeno pravo, UHPA će razmotriti svaki takav zahtjev u skladu sa svim primjenjivim zakonima i propisima o zaštiti podataka. UHPA zadržava pravo naplate troškova za obradu zahtjeva korisnika u iznimnim slučajevima kada su zahtjevi nerazumni. Korisnici imaju pravo na informiranje temeljem podnesenog zahtjeva, a nakon uspješne provjere njihovog identiteta, o sljedećem: - Svrsi obrade osobnih podataka; - Izvoru osobnih podataka, ako nije dobiven od korisnika; - Kategoriji osobnih podataka; - Primateljima ili kategorijama primatelja kojima su ili mogu biti preneseni osobni podaci, zajedno s lokacijom tih primatelja; - Predviđenom razdoblje pohrane osobnih podataka ili obrazloženje za određivanje razdoblja pohrane; - Upotrebi bilo kakvog automatiziranog odlučivanja, uključujući profiliranje; Svi zahtjevi za pristup ili ispravak osobnih podataka moraju biti upućeni UHPA-i kao Voditelju obrade koja će evidentirati svaki zahtjev po primitku. Odgovor na svaki zahtjev dostavlja se u roku od 30 dana od primitka pismenog zahtjeva korisnika. Ako se ne može u potpunosti odgovoriti na zahtjev korisnika u roku od 30 dana, dostavlja se obavijest o: - Potvrdi primitku zahtjeva - Svim informacijama koje su prikupljene - Pojedinosti o bilo kojoj traženoj informaciji ili izmjenama koje neće biti dostavljene korisniku, razlogu za odbijanje te o svim mogućim postupcima za žalbu na odluku. - Procijenjeni datum do kojeg će biti dostavljeni preostali odgovori. - Procjena troškova koje mora platiti korisnik (ako je zahtjev prekomjeran). - Ime i kontaktne informacije društva koje bi Ispitanik trebao kontaktirati za daljnje informacije. ZADRŽAVANJE PODATAKA UHPA neće zadržati osobne podatke duže nego što je to neophodno u odnosu na svrhe za koje su izvorno prikupljeni ili za koje je definiran zakonski ili ugovorni rok. Točni vremenski periodi čuvanja podataka navedena su u dokumentu "Politika pohrane podataka". Pri čemu se uzimaju u obzir zakonske i ugovorne obveze, kako minimalne tako i maksimalne. Kad razdoblje zadržavanja istekne, organizacija će osobne podatke izbrisati na način koji osigurava da se oni ne mogu rekonstruirati niti pročitati. ZAŠTITA PODATAKA UHPA provodi fizičke, tehničke i organizacijske mjere koje jamče sigurnost osobnih podataka (npr. prevenciju gubitka ili oštećenja, neovlaštene izmjene, pristupa ili obrade i drugih prijetnji kojima mogu biti izloženi osobni podaci uzrokovani ljudskim djelovanjem ili fizičkim/prirodnim okruženjem). Minimalni skup sigurnosnih mjera koje UHPA provodi u svrhu zaštite osobnih podataka navedeni su u dokumentu „Politika informacijske sigurnosti“ i drugim vezanim politikama i procedurama. Sigurnosne mjere koje se provode imaju za cilj: - Spriječiti neovlaštene osobe da dobiju pristup sustavu obrade podataka u kojima se obrađuju osobni podaci. - Spriječiti osobe koje imaju pravo koristiti sustav obrade podataka od pristupa osobnim podacima koji su izvan njihovih potreba i ovlaštenja. - Osigurati da se osobni podaci tijekom elektronskog prijenosa ili tijekom prijenosa ne mogu čitati, kopirati, mijenjati ili ukloniti bez odobrenja. - Osigurati dostupnost zapisa sustava u svrhu utvrđivanja od koga su uneseni, mijenjani ili uklonjeni osobni podaci iz sustava obrade podataka. - Osigurati da u slučaju kada obradu obavlja izvršitelj obrade, podaci se mogu obrađivati samo u skladu s uputama voditelja obrade. - Osigurati da su osobni podaci zaštićeni od neželjenog uništavanja ili gubitka. - Osigurati da osobni podaci prikupljeni za različite svrhe mogu biti obrađeni odvojeno. - Osigurati da se osobni podaci ne drže duže nego što je potrebno. ZAHTJEVI OD STRANE PRAVOSUDNIH TIJELA U određenim okolnostima, dopušteno je da se osobni podaci dijele bez znanja ili suglasnosti korisnika. I to kada je otkrivanje osobnih podataka potrebno u bilo kojoj od sljedećih svrha: - Sprječavanje ili otkrivanje zločina. - Uhićenje ili progon prekršitelja. - Procjena ili naplata poreza ili pristojbi. - Po nalogu suda ili bilo kojeg zakona. PRIJENOS PODATAKA UHPA zadržava pravo prijenosa osobnih podataka unutar svoje poslovne grupe kao i na treće strane poštivajući načelo odgovarajuće razine pravne zaštite za prava i slobode korisnika. Prijenos osobnih podataka se provodi isključivo ako je zadovoljen barem jedan od sljedećih uvjeta: - Prijenos je neophodan za izvedbu ugovornih obveza/usluga; - Prijenos je neophodan za provedbu predugovornih mjera koje se poduzimaju kao odgovor na zahtjev korisnika; - Prijenos je neophodan za zaključivanje ili izvršenje ugovora sklopljenog s trećom stranom u interesu korisnika; - Prijenos je zakonski obvezan na temelju važnih javnih interesa; - Prijenos je neophodan za osnivanje, vršenje ili obranu pravnih zahtjeva; - Prijenos je neophodan kako bi se zaštitili vitalni interesi korisnika. RUKOVANJE PRITUŽBAMA U slučaju pritužbi vezanih uz pridržavanje ovih i drugih pravila vezanih za zaštitu osobnih podataka, molimo da nam se javite na uhpa1@uhpa.hr . U slučaju pritužbe, istražit ćemo cijelu situaciju koja se odnosi na upotrebu i otkrivanje osobnih podataka sukladno ovim pravilima te ćemo ih pokušati riješiti u najkraćem mogućem roku. KONTAKT Udruga hrvatskih putničkih agencija Kršnjavoga 1/II Zagreb E: uhpa1@uhpa.hr U Zagrebu, 15. svibnja 2018.