http___www.unizg.hr_o-sveucilistu_dokumenti-i-javnost-informacija_sluzbenici-za-zastitu-osobnih-podataka__1.xml
1.1 2.1 3.1 4.1 5.1 5.2 6.1 7.1 8.1 8.2 9.1 10.1 11.1 12.1 12.2 12.3 12.4 12.5 13.1 14.1 15.1 16.1 17.1 17.2 18.1 19.1 20.1 21.1 22.1 23.1 24.1 24.2 25.1 25.2 25.3 26.1 27.1 27.2 27.3 27.4 28.1 29.1 29.2 29.3 30.1 31.1 32.1 33.1 34.1 34.2 35.1 35.2 35.3 35.4 36.1 37.1 37.2 38.1 39.1 39.2 40.1 41.1 42.1 43.1 44.1 45.1 45.2 46.1 47.1 48.1 48.2
PRIVACY POLICY In accordance with the General Data Protection Regulation, the Privacy Policy of the University of Zagreb was created for the purposes of transparency and providing data subjects with information regarding the principles, purposes and legal basis of the processing of personal data, the type of personal data collected in relation to our activities and how the data are processed, used and protected, as well as the rights of the data subjects regarding the protection of personal data. Data controller University of Zagreb, Trg Republike Hrvatske 14, Zagreb, Personal identification number (OIB): 36612267447, protects your personal data and takes all necessary technical and organisational measures in accordance with the best practices and obligations provided in Croatian legislation and the General Data Protection Regulation. This document applies to all persons, students, employees, associates, users and website visitors whose personal data the University of Zagreb collects, uses or otherwise processes. This document defines the types of personal data collected and processed by the University of Zagreb, the purpose and manner in which the collected personal data are used, as well as protection measures for personal data and the rights of data subjects. Principles relating to the processing of personal data The data are always used for specified, explicit and legitimate purposes for which they were provided and about which you have been informed. We are obliged to protect your data and keep them safe. Therefore, we only work with reliable partners. We are obliged to use your data openly and transparently. We respect your rights and we always try to fulfil your requests to the greatest extent possible and in accordance with our legal and operational obligations. Processor The processing of personal data may be entrusted to a processor. In that case, we will conclude a contract with the processor, in which the handling of personal data is prescribed in detail. Therefore, processors will not be able to process your personal data without our order or communicate them to third parties. The University has established contractual relations with the University Computing Centre and Stablo znanja d.o.o., which process data on behalf of the University. In cases in which the University carries out the processing on behalf of another data controller, the University is considered as processor and is obliged to conclude a contract on the processing of personal data in accordance with the regulations. Types of personal data collected Personal data are collected in different ways: via forms, web pages, personal contacts, by telephone and others. The collected personal data may include: name and surname, address and telephone number, JMBAG and OIB numbers, health/pension insurance number, date and place of birth, sex, nationality, bank account number, data on completed education, data on family status, name of father or mother, dependants, trade-union membership, residence/address, data on rights related to employment, e.g. maternity leave, occupational injuries, social rights and support, sick leave, etc., data on the establishment and termination of employment, type of employment relationship, position, data on salaries, working hours, time sheets, marital status, war veteran status, type of study grant, study programme ID, year of enrolment, number of obtained ECTS credits, dormant student statuses and academic years spent on exchange. Legal basis and purpose of processing personal data An appropriate legal basis is a prerequisite for any collection of users’ personal data. Personal data are gathered in order to comply with the University's legal obligations (including tax and accounting obligations), respond to requests for information by the state authorities and comply with legal and regulatory obligations, including those related to transparency and disclosure, public interest, and exercise of public power (statistical surveys, use of human resources, monitoring the quality of professional work or the work of professional services, exercise of rights and obligations related to employment and other official purposes). The collected data are used for the following activities: - regulating the employment status, - regulating the relationship with users of the University's services, - regulating the status of students attending lifelong-learning programmes, - contracting and carrying out business cooperation with the University of Zagreb, - implementing legal obligations and requests to which the University of Zagreb is obliged to respond. The University of Zagreb gains access to regular students’ data (name, surname, OIB, student status) on the basis of the University's legitimate interest to set up the Spajalica application, which serves as a platform for connecting students and employers and the functioning of the digital labour market. Please note that the data for an individual student is processed only after the student signs a declaration with a qualified electronic signature and gives consent for the processing of personal data. As a personal data controller, the University of Zagreb processes the personal data of Erasmus+ candidates solely for the purpose of conducting the call concerned, i.e., the University processes the personal data of the participants in the Erasmus+ Programme solely for the purposes of implementing the Erasmus+ mobility scheme, reporting on the project, drafting and implementing contracts awarding financial support, as well as the disbursement of the financial support. The implementation of the Erasmus+ mobility scheme and reporting on the project imply entering the candidates’ personal data into the database of the University of Zagreb and that of the European Commission (https://webgate.ec.europa.eu/erasmus-esc/index/privacy-statement). The national Agency for Mobility and EU Programmes and the relevant bodies for exercising student rights may be provided with the candidates’ personal data for the purposes of implementing the Erasmus+ mobility scheme and reporting on the project. Employment candidates and recruitment procedures The Office for Human Resources of the University of Zagreb collects and processes candidates’ personal data for the purposes of completing the recruitment procedure and establishing an employment relationship. The data can also be processed electronically. If an employment contract is concluded with the candidate, the submitted data will be stored according to the regulations governing employment relationships. If an employment contract is not concluded with the candidate, the candidate’s personal data are deleted after expiration of the appeal period, except where they are retained in the database, with the candidate’s consent, for the purpose of possible future employment. Cookies The website of the University of Zagreb and all other network services use cookies. Cookies are small text files which are stored on your computer by your web browser and do not cause any damage. These are technical cookies ‒ obligatory cookies (always active), which are necessary for the proper functioning of the website and cannot be turned off in our systems. Making personal data available for use User data are not communicated or exchanged with any other legal or natural persons (hereinafter referred to as „persons”), except in the following cases and to the extent necessary for meeting the specified purpose. Security of personal data We collect and process personal data in a manner that ensures appropriate security and confidentiality and enables efficient application of data protection principles, data minimisation, scope of their processing, the period of their storage and their accessibility. In order to protect the collected personal data, we implement appropriate physical, technical and organisational protection measures to prevent accidental or unlawful destruction, loss, alteration, unauthorised use, disclosure, consultation of or access to the data. All employees of the University are required to protect information about the personal data of the data subjects. All collected data are stored in protected databases. Those databases can be accessed only by authorised persons. We use tools to protect data and prevent data leakages, continuously monitor critical systems and protect data from unauthorised consultation, alteration, loss, theft and any other breach or misuse. In case of a data breach, we will take all available measures to mitigate the consequences of the breach, inform without delay the relevant institutions and all the data subjects whose data have been affected where there is a risk of a serious threat to their rights and freedoms. LOCATION OF PERSONAL DATA PROCESSING As a rule, the subjects’ personal data are processed in Croatia, exceptionally in other countries, and, in that case, as a rule in the Member States of the European Union. Exceptionally, we also process data in other countries, always ensuring that personal data are appropriately protected and that the users are informed. Retention period of personal data Your personal data are processed until the purpose of the processing of personal data has been fulfilled. Once that purpose has been fulfilled, we will no longer use the personal data, they will be retained in our filing system and kept in accordance with the applicable regulations. Automated decision-making The University of Zagreb does not use automated decision-making (profiling) on this website. User rights Under the conditions laid down in the General Data Protection Regulation, the user has the following rights, which can be exercised once the data subject/applicant has been identified: These rights are exercised via a request sent by e-mail to the University of Zagreb's data protection officer or by handing in the request in person in the University's offices. For all issues related to the protection of personal data at the University of Zagreb, contact the data protection officer by email at gdpr@, by post to the University's main seat or by phone at 01 456 4221. unizg.hr The user has the right to lodge a complaint concerning the collection and processing of personal data with the Croatian Personal Data Protection Agency, Martićeva ulica 14, Zagreb, azop@, azop.hrhttp://azop.hr/. Amendments to the Privacy Policy We regularly update the Privacy Policy to ensure that it is accurate and up-to-date, and we reserve the right to alter its content, if deemed necessary. You will be informed about any amendments on our website in accordance with the principle of transparency.
1.1 2.1 2.2 3.1 3.2 3.3 4.1 5.1 6.1 6.2 7.1 8.1 8.2 8.3 8.4 9.1 10.1 10.2 10.3 11.1 12.1 13.1 14.1 15.1 16.1 17.1 18.1 19.1 20.1 20.2 21.1 22.1 23.1 24.1 25.1 26.1 27.1 27.2 28.1 29.1 29.2 30.1 31.1
Obavijest o obradi osobnih podataka Zaštita osobnih podatka pojedinca utvrđena je člankom 37. Ustava Republike Hrvatske (NN 85/10 – pročišćeni tekst), Općom uredbom o zaštiti podataka (EU, 2016/679) i Zakonom o provedbi Opće uredbe o zaštiti podataka (NN, 42/2018). Sveučilište u Zagrebu brine za sigurnost Vaših osobnih podataka i zaštitu osobnih podataka svih ispitanika shvaća vrlo ozbiljno. Osobni podaci su svi podaci koji se odnose na pojedinca čiji je identitet utvrđen ili se može utvrditi („ispitanik“). Ovom obaviješću želimo Vas upoznati s našim sigurnosnim mjerama kako biste znali koje podatke pohranjujemo i kako ih koristimo. Temeljna načela i prakse zaštite podataka Zakonitost, poštenost i transparentnost Osobne podatke naših studenata, zaposlenika, vanjskih suradnika i drugih osoba s kojima smo povezani u obavljanju svoje djelatnosti obrađivat ćemo samo na temelju zakonske obveze, Vaše privole ili druge legitimne osnove. Podaci koji se odnose na Vas na transparentan će se način prikupljati, upotrebljavati, dati na uvid ili na neki drugi način obrađivati, te su javno objavljeni rokovi i svrhe obrade podataka, podaci o identitetu voditelja obrade, informacija o načinu na koji možete pristupiti svojim podacima, procesu za podnošenje pritužbi i zahtjeva za ažuriranje podataka. Ograničavanje svrhe Vaši osobni podaci prikupljat će se u posebne, izričite i zakonite svrhe i neće se dalje obrađivati na način koji nije u skladu s tim svrhama. Vaše osobne podatke prikupljati ćemo i pohranjivati u svrhu izvršenja zakonskih obveza, ispunjenja obveza od javnog interesa, izvršavanja javnih ovlasti i ugovora. Podaci koji su prikupljeni za jednu svrhu neće se koristiti ni za jednu drugu svrhu ili na način koji nije u skladu s odobrenom svrhom. Za svrhu obrade koja se ne provodi temeljem zakonske osnove ili ugovora tražit ćemo od Vas posebnu privolu. Smanjenje količine podataka Osobni podaci koje prikupljamo su primjereni, bitni i ograničeni na svrhu obrade. Sveučilište prikuplja i obrađuje osobne podatke u mjeri u kojoj je to potrebno za ispunjenje Zakonom i drugim propisima utvrđenih obveza redovite djelatnosti Sveučilišta, te sukladno Zakonu o znanstvenoj djelatnosti i visokom obrazovanju i drugim propisima koje primjenjujemo u svom radu. Voditelj obrade i izvršitelj obrade neće prikupljati osobne podatke koji mu nisu potrebni za svrhu obrade. Točnost i integritet podataka Nužno je da osobni podaci koje prikupljamo i spremamo budu točni i ažurni i zato ćemo poduzeti svaku razumnu mjeru kako bismo osigurali da se osobni podaci koji nisu točni, uzimajući u obzir svrhe u koje se obrađuju, bez odlaganja izbrišu ili isprave. Ograničenje pohrane Rokovi čuvanja Vaših osobnih podataka određeni su pozitivnim zakonskim propisima i internim aktima Sveučilišta u Zagrebu ili Vašom suglasnošću za prikupljanje i obradu osobnih podataka. Cjelovitost i povjerljivost Kako bi zaštitila osobne podatke ispitanika, Sveučilište u Zagrebu poduzima sve odgovarajuće mjere zaštite koje su u skladu s primjenjivim propisima o zaštiti privatnosti i osobnih podataka te su osigurane sve razumne tehničke, fizičke i organizacijske mjere za zaštitu osobnih podataka ispitanika od neovlaštene ili nezakonite obrade, uništenja, slučajnog gubitka, štete, izmjene, neovlaštenog odavanja ili pristupa te od svih ostalih oblika nezakonite i/ili pretjerane obrade Vodit ćemo nadzor nad pristupom, korištenjem i održavanjem osobnih podataka, te ćemo kontinuirano unapređivati naše sigurnosne mjere sukladno tehnološkim mogućnostima. Postupanje u slučaju povrede osobnih podataka U slučaju povrede osobnih podataka, Sveučilište u Zagrebu će kao voditelj obrade osobnih podataka, bez nepotrebnog odgađanja i ukoliko je izvedivo, u roku od 72 sata nakon saznanja o povredi osobnih podataka ispitanika izvijestiti Agenciju za zaštitu osobnih podataka. Ostvarivanje prava ispitanika Svaki ispitanik ima pravo u svakom trenutku od voditelja obrade zatražiti pristup svojim osobnim podacima, njihov ispravak, brisanje ili ograničavanje njihove obrade kao i pravo na prigovor Agenciji za zaštitu osobnih podataka te pravo na prenosivost podataka. Navedena prava ostvaruju se podnošenjem zahtjeva na e-mail adresu Službenika za zaštitu osobnih podataka Sveučilišta u Zagrebu. e-mail: gdpr@ unizg.hr Dokumenti i obrasci: Obrazac za pristup, promjenu, dopunu, prigovor, ograničenje prikupljanja osobnih podatka Obrazac za brisanje osobnih podataka Službenici za zaštitu osobnih podataka Uredba (EU) 2016/679 Europskog parlamenta i Vijeća od 27. travnja 2016. o zaštiti pojedinaca u vezi s obradom osobnih podataka i o slobodnom kretanju takvih podataka – Opća uredba o zaštiti podataka – GDPR (General Data Protection Regulation) izravno se primjenjuje u Republici Hrvatskoj od 25. svibnja 2018. godine. Uredba određuje koja su prava pojedinaca, a u skladu s tim i koje su obveze subjekata koji obrađuju osobne podatke poput voditelja obrade odnosno izvršitelja obrade. Neke od obveza subjekata su obrada osobnih podataka ako je građanin dao privolu ili radi izvršavanja zadaći temeljem drugih zakonskih propisa, obrada podataka prema načelima obrade navedenih u Uredbi, zatim informacije koje subjekt daje građaninu prije same obrade njegovih osobnih podataka te uspostava evidencija o vođenju obrade osobnih podataka. Općom uredbom o zaštiti osobnih podataka definiraju se i obveze službenika za zaštitu osobnih podataka, koje imenuje voditelj obrade, koji o imenovanju službenika pisano obavještava Agenciju za zaštitu osobnih podataka. Temeljem članka 38. Opće uredbe o zaštiti podataka, rektor Sveučilišta u Zagrebu, kao voditelj obrade osobnih podataka, imenovao je sljedeće službenike za zaštitu osobnih podataka: Imenovane službenice možete kontaktirati putem e-adrese: gdpr@ unizg.hr Navedeni tekst u obliku zasebnog dokumenta možete preuzeti ovdje.