http___www.tzmetkovic.hr_hr_smjestaj1_itemlist_category_4-informacije.html_1.xml
1.1 2.1 3.1 4.1 5.1 6.1 7.1 8.1 9.1 10.1 10.2 11.1 12.1 13.1 14.1 15.1 16.1 16.2 16.3 16.4 17.1 18.1 19.1 20.1 21.1 22.1 23.1 24.1 25.1 26.1 27.1 28.1 29.1 30.1 31.1 32.1 32.2 33.1 34.1 35.1 36.1 37.1 38.1 38.2 39.1 40.1 41.1 41.2 42.1 43.1 44.1 45.1 46.1 47.1 48.1 49.1 50.1 51.1 52.1 53.1 54.1 55.1 56.1 57.1 58.1 59.1 60.1 61.1 62.1 63.1 64.1 65.1 66.1 67.1 68.1 69.1 70.1 71.1 72.1 73.1 74.1 74.2 75.1 76.1 77.1 78.1 79.1 80.1 81.1 82.1 83.1 84.1 85.1 86.1 87.1 88.1 89.1 90.1 91.1 92.1 93.1 94.1 95.1 96.1 97.1 98.1 99.1 100.1 101.1 102.1 103.1 104.1 105.1 106.1 107.1 108.1 108.2 109.1 110.1 111.1 112.1 113.1 114.1 115.1 116.1 117.1 118.1 119.1 120.1 121.1 122.1 123.1 124.1 125.1 126.1 127.1 128.1 129.1 130.1 131.1 131.2 132.1 133.1 134.1 135.1 136.1 137.1 138.1 139.1 140.1 141.1 142.1 143.1 144.1 145.1 146.1 146.2 147.1 148.1 149.1 150.1 151.1 152.1 153.1 154.1 155.1 156.1 157.1 158.1 159.1 160.1 161.1 162.1 163.1 164.1 164.2 165.1 166.1 167.1 168.1 169.1 170.1 171.1 172.1 173.1 174.1 175.1 176.1 177.1 178.1 179.1 180.1 181.1 182.1 183.1 184.1 185.1 186.1 187.1 188.1 189.1 190.1 191.1 192.1 193.1 194.1 195.1 196.1 197.1 198.1 199.1 200.1 201.1 202.1 203.1 204.1
Personal Data Protection Rulebook FIC Rulebook on the Protection of Personal Data FIC Pravilnik o zaštiti podataka o ličnosti In accordance with the Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti ’’Official Gazette of Republic of Serbia’’, no. 87/2018) (hereinafter ’’the Law’’) and in accordance with Article 28 of the Statute of the Foreign Investors Council association adopted on 12 December 2019, the Board of directors of the Foreign Investors Council association, with its business seat in Belgrade, Gospodar Jevremova no. 47/IV, registration number 17411888 (hereinafter ’’the Association’’), at the extraordinary session held on June 9th, 2020 adopts the following: RULEBOOK ON THE PROTECTION OF PERSONAL DATA (hereinafter ’’the Rulebook’’) I Introductory provisions Article 1 The Rulebook regulates the protection of personal data that is processed by the Association, the purpose and objective of the personal data processing, meaning of used terms, principles of processing, retention policy, legal basis for processing, consent for processing, rights of the data subject, obligations of the controller and processor, data protection impact assessment, records of personal data processing activities, transfer of personal data to third countries and international organizations, data protection officer, remedies in case of personal data breach, as well as the amendments to the Rulebook. This Rulebook is the basic internal act that in general regulates personal data protection of the employees, external consultants and other persons who engage in contractual and other legal relationships with the Association, as well as other persons whose data is processed by the Association (users/clients, business partners etc.), in accordance with the Law and other legislative provisions regarding personal data protection. The purpose of this Rulebook is to ensure legal security and transparency during personal data processing. Article 2 The Association processes the personal data of its employees, associates, candidates who apply for job, representatives of members and representatives of potentially interested parties, representatives of public administration, international organizations and diplomacy representatives, representatives of suppliers and visitors of the events organized by the Association. II Objective and purpose of the Rulebook Article 3 The purpose of this Rulebook is to ensure the protection of fundamental rights and freedoms of natural persons, in particular their right to the protection of personal data. The Association collects personal data and processes it as the controller with the purpose of establishing employment and with the objective of exercising rights on work and regarding work, with the purpose of engaging persons on other legal basis, exercising rights and fulfilling obligations regarding employment, organizing job applications, fulfilment of its legal obligations and other purposes which are directly related to work, engagement or any other kind of collaboration with persons whose data is processed. Collection and processing of personal data of representatives of members of the Association and potentially interested parties, the Association does to contact, inform and invite them to the events the Association organizes. Collection and processing of the personal data of the visitors to the events of the Association is done in order to keep record of the attendance to the events and to send letters of appreciation for attendance. Photographs and audio recordings from events are used for informing about the event and are uploaded to the Association’s webpage: www.fic.org.rs. The Association processes the personal data as the controller in order to fulfill its obligations from the legal relationship with associates and partners. III Definition of the terms Article 4 Terms in this Rulebook have the following meaning: - ’’personal data’’ means any information relating to the natural person who is identified or identifiable, directly or indirectly, in particular based on identifier, such as name and identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity; - ’’data subject’’ means the natural person whose data is processed; - ’’processing’’ means any operation or set of operations which is performed automated or not automated on personal data or sets of personal data, such as collection, recording, organization, grouping i.e. structuring, storage, adaptation or alteration, disclosure, insight, usage, disclosure by transmission i.e. delivery, multiplying, spreading or otherwise making available, alignment, restriction, erasure or destruction (hereinafter: processing); - ’’pseudonymization’’ means processing in such manner that the personal data can no longer be attributed to a specific person without the use of additional information, provided that such additional information is kept separately and is subject to technical, organizational and personnel measures to ensure that the personal data cannot be attributed to an identified or identifiable natural person; - ’’data collection’’ means any structured set of personal data which is accessible according to specific criteria, regardless the filing system is centralized, decentralized or dispersed on a functional or geographical basis; - ’’controller’’ means the natural or legal person, who alone or jointly with others determines the purpose and means of processing; - ’’processor’’ means the natural or legal person who processes personal data on behalf of the controller; - ’’recipient’’ means the natural or legal person, public authority to which the personal data are disclosed, regardless if it is a third party or not, unless it is public authority which, in accordance with law, receive personal data in the framework of investigating a particular case and are processing those data in compliance with the personal data protection rules according to the purposes of the processing; - ’’third party’’ means a natural or legal person, i.e. public authority, who is not the data subject, controller or processor, nor the person authorized to process personal data under the direct supervision of the controller or processor; - ’’consent’’ of the data subject means any freely given, specific, informed and unambiguous indication expression of the data subject’s will, by which he or she, by a statement or by a clear affirmative action, gives consent to the processing of personal data relating to him or her; - ’’personal data breach’’ means a breach of security of personal data leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed; - ’’Commissioner for Information of Public Importance and Personal Data Protection’’ (hereinafter: ’’the Commissioner’’) is independent public authority established in accordance with the law, who is in charge of supervising the implementation of the Law and carrying out other tasks prescribed in the Law. Contact information of the Commissioner: address of the seat: Bulevar kralja Aleksandra 15, 11120 Belgrade; e-mail: office@poverenik.rs; telephone: +381 11 3408 900; - ’’public authority’’ means government body, autonomous province body and local government unit body, state owned enterprise, institution and other public service, organization and other legal or natural person with delegated public authority; - ’’making available’’ means any activity enables access of the content to third parties, general public or government bodies. IV Principles of processing Article 5 The Association, when processing personal data in the capacity of the controller or processor, complies with the following principles of processing, in accordance with the Law: - Lawfulness, fairness and transparency – personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject. Lawful processing is the processing done in accordance with the Law and other laws relation to processing; - Purpose limitation – personal data shall be collected for specified, explicit, justified and legitimate purposes and shall not be further processed in a manner that is incompatible with those purposes; - Data minimization – personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed; - Accuracy – personal data shall be accurate and, where necessary, kept up to date. Having in mind the purposes for which they are processed, every reasonable step must be taken to ensure that personal data that are inaccurate, are erased or rectified without delay; - Storage limitation – personal data shall be kept in a form which allows identification of data subject for no longer than is necessary for fulfilment of the purpose of processing; - Integrity and confidentiality – personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing, as well as against accidental loss, destruction or damage, using appropriate technical, organizational and personnel measures. The Association, when processing personal data as the controller, during each personal data processing, shall be responsible for and be able to demonstrate compliance with Article 5 paragraph 1 of the Rulebook (accountability). V Categories of personal data that are processed Article 6 The Association processes personal data that is necessary for the activities of achieving its objectives listed in its Statute, in accordance with the purpose of processing and legal basis of processing. The Association will not process data outside of the determined purpose. Personal data of the employees and potential employees that is processed by the Association as the controller is: – name and surname, – date of birth, – name of a parent, – personal identification number, – ID card number, – place of issuance of ID card, – address of residence, – place of birth, – country of birth, – number of children, – name and surname of a child, – personal identification number of a child, – date of Patron Saint Day, – telephone number, – bank account number, – education degree and type of education, – occupation, – years of service, – foreign language knowledge. The Association may process the following personal data of other persons (representatives of the members of the Association and representatives of potentially interested parties): – name and surname, – function of the representative, – business telephone number, – business e-mail address. The Association, in accordance with the minimization principle, does not process a larger number or other categories of personal data, than those required for the purpose of processing. In case processing of special categories of data is done based on consent of data subject, the consent must be given in written form which includes detailed information concerning the categories of data that are processed, purpose of processing and manner of usage of those data. The Association may also process specific categories of special personal data, in accordance with Article 17 of the Law (for example, processing of special categories of personal data of employees and their family members for purposes of fulfilling its obligations or the exercise of official authority in the area of employment, social security and social protection). Article 7 The Association performs the activities of processing such as: collecting, recording, organizing, storage, adaptation or alteration, disclosure, insight, usage, disclosure by transmission i.e. delivery, multiplication, spreading and otherwise making available, alignment, restriction, erasure and destruction, as well as any other activities by automated or not automated means and are necessary for the performance of activities. The Association is obliged to regularly update and check the need for personal data processing and undertakes every necessary activity in order to erase and destruct the data which is no longer necessary for the purpose of processing. VI Data retention Article 8 Personal data that is processed by the Association as the controller concerning the employment is kept permanently, in accordance with the current legislation regulating the records in the area of employment. Other personal data is processed by the Association as long as it is necessary, at the latest as long as there is legal basis for data processing or justified interest for its storage. Personal data processed by the Association as the processor, based on legal transaction with other subjects, is kept in periods of time prescribed in applicable legislation. VII Legal basis for processing Article 9 The Association processes personal data in accordance with the principle of lawfulness and rules prescribed in the Rulebook. The Association processes data lawfully when the purpose of processing is: – compliance with a legal obligation, – performance of a contract concluded with data subject or performing activities per request of the data subject made before the contract was concluded, – consent of data subject, – achievement of the legitimate interests of the Association. The Association lawfully processes personal data when the processing is done in order to perform contractual obligation to others subjects, when it has the role of the processor while doing business. Before processing,the Association is obliged to deliver notice to the data subjects whose data is processed based on their consent, which includes all necessary information concerning processing and which is prescribed by the Law. Article 10 Consent may be given as written statement or in electronic form. If the consent of the data subject is given as a part of written statement which relates to other matters as well, the request for consent must be presented in such a way that excludes it from the other matters, in understandable and easily accessible form, using clear and simple terms. Data subject has the right to withdraw his/her consent at any time, and the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. VIII Rights of data subjects Article 11 When the Association processes personal data as the controller or processor, data subjects has: - the right to be informed concerning personal data processing and the manner of collecting data in the moment of data collection; - the right to access and other rights relating to the access to the personal data; - the right to rectification, amendment, erasure, limitation and portability of the collected personal data; - the right to be informed about rectification, limitation, erasure and data portability; - the right to object to processing of personal data to the Association; - the right to object to automated individual decision-making, if such decision produces legal effects concerning him or her or affects his or her position. When the Association processes the personal data as the controller or processor, it is required that the data subjects are provided with help with exercising their right to access personal data, right to rectification and amendment, right to erasure of personal data, right to be informed about rectification or erasure of data and limitation of processing, right to data portability, right to object and right to object to automated individual decision-making. When the Association processes the personal data as the controller or processor, it is required that the data subject is informed about the procedure concerning the request to exercise the right to access personal data, right to rectification and amendment, right to erasure of personal data, right to be informed about rectification or erasure of data and limitation of processing, right to data portability, right to object and right to object to automated individual decision-making, without any delay, at the latest within 30 days since the request was received. That period may be extended up to 60 more days if necessary, having in mind the complexity and number of requests. Article 12 The Association should provide information to the data subject on: - the identity and contact details of the controller, as well as its representative, if any; - contact information of the data protection officer, if any; - the purpose of the intended processing and the legal basis for the processing; - the existence of a legitimate interest of the controller or a third party, if the processing is carried out on the basis of processing necessary to achieve the legitimate interests of the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a minor; - the recipient, i.e. the group of recipients of personal data, if any; - the retention period of personal data or, if this is not possible, the criteria for determining it; - the right to request from the controller to access, correct or delete his or her personal data, or the right to restrict processing, the right to object, as well as the right to data portability; - the existence of the right to withdraw consent at any time, and that the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal, if it is processed on a base of the consent of a data subject for one or more specifically determined purposes or special types of personal data of the data subject are processed and who have given their explicit consent for processing for one or more purposes; - the right to lodge a complaint to the Commissioner; - whether providing information is a legal or contractual obligation or whether providing information is a necessary condition for concluding an agreement, as well as whether the data subjects have an obligation to provide information about their personal data and possible consequences if the information is not provided; - the existence of automatic decision making. Article 13 The data subject has the right to request and obtain information from the Association on whether it processes his/her personal data, has the right of access to such data, as well as the following information: - purpose of processing; - the types of personal data being processed; - the recipient or types of recipients to whom personal data have been or will be disclosed, and in particular to recipients in other countries or international organizations; - the envisaged retention period for personal data, or if this is not possible, the criteria for determining that period; - the existence of the right to request correction or deletion of his/her personal data, the right to restrict processing and the right to object; - the right to lodge a complaint to the Commissioner. Article 14 The data subject has the right to have his or her inaccurate personal data corrected without undue delay. Depending on the purpose of the processing, the data subject has the right to amend his/her incomplete personal data, which includes giving an additional statement. The data subject has the right to have his/her personal data deleted by the Association. The Association is obliged to delete the data referred to in paragraph 2 of this Article without undue delay in the following cases: - personal data is no longer necessary to achieve the purpose for which it was collected or otherwise processed; - the data subject withdrew his or her consent to the processing of his or her personal data for one or more specific purposes; - the data subject has filed an objection to the processing in accordance with this Rulebook and the Law. The data subject has the right to restrict the processing of his/her personal data by the Association if one of the following cases is met: - the data subject challenges the accuracy of the personal data, within a time limit that allows the controller to verify the accuracy of the personal data; - the processing is unlawful and the data subject opposes the deletion of the personal data and instead of deleting restricts the use of the data; - the Association no longer needs personal data for the purpose of processing, but the data subject has requested it in order to submit, realize or defend a legal claim; - the data subject has filed an objection to the automated decision-making decisions, and an assessment is underway as to whether the legal basis for processing by the controller overrides the interests of the data subject. The controller is obliged to inform all recipients to whom personal data have been disclosed of any correction or deletion of personal data or restriction of their processing, unless this is impossible or requires an excessive expenditure of time and resources. IX Obligations of the controller Article 15 In the event that the Association is the controller it will take appropriate technical, organizational and personnel measures aimed to ensure the effective application of the principles of personal data protection, and to ensure that processing is carried out in accordance with the Law and this Rulebook, making this Rulebook available to the data subject, taking into account the nature, scope, circumstances and purpose of the processing, as well as the probability of occurrence of the risk and the level of risk for the rights and freedoms of natural persons. The Association as the controller applies protection measures in accordance with the level of technological achievements and costs of its application, nature, scope, circumstances and purpose of processing, as well as the probability of risk and the level of risk for personal data protection. Protection measures are applied in order to achieve an appropriate level of safety in relation to risk. The Association, as the controller, undertakes protection measures so that every natural person who is authorized to access personal data by the Association, processes that data only by order of the Association or if required by the law. Article 16 When the Association acts as the controller, it will ensure that without the participation of a natural person, personal data cannot be made available to an unlimited number of natural persons. For the purpose of exercising the rights of the data subject, the Association, when acting as the controller, will make available a special mean of communication for the protection of rights. Any data subject who submits a request for the exercise of rights in accordance with this Rulebook and the Law, should submit it by sending a letter to the e-mail address: koviljka.nikolic@fic.org.rs. Article 17 When processing is performed on behalf of the Association as the controller, the Association will designate as a processor only the person who fully guarantees the application of the provisions of the Law and the rules prescribed by this Rulebook, in a manner that ensures that processing is performed in accordance with the provisions of the Law and provides protection to data subjects as prescribed herein. X Obligations of the processor Article 18 The Association acts as the processor when it processes personal data in the name and on behalf of clients and service users as a controller in accordance with the contract between them. The contract between the controller and the processor determines the subject and duration of processing, the nature and purpose, the types of personal data and the types of persons whose data is processed, as well as the mutual rights and obligations. When the Association acts as the processor, it is obliged to: - process data in accordance with the Law and principles of processing; - implement organizational, technical and personnel measures for the protection of personal data; - act in accordance with the order given by the controller. XI Data Protection Impact Assessment Article 19 Before processing personal data, the Association, as the controller, will assess the impact of the planned processing operations on the protection of personal data if it is likely that some kind of processing, especially using new technologies and taking into account the nature, scope, circumstances and purpose of processing, could cause a high risk for processing. During impact assessment, the Association will request the opinion of the data protection officer, if any. XII Records of processing operations Article 20 The Association may keep records of collected personal data, as well as of the processing operations for which it is responsible, in writing, including electronic form. When the Association acts as the controller, the records refer to actions that contain information: - names and contact details of the controller and data protection officer, if designated; - purpose of processing; - type of data subjects; - the type of recipients to whom the personal data have been or will be disclosed; - the deadline after which certain types of personal data would be deleted; - transfer of personal data to other countries; - description of protection measures. When the Association acts as the processor, the duty of recording refers to all processing operations on behalf of the controller, which contains the following information: - names and contact details of each controller on whose behalf the processing is performed; - the type of processing performed on behalf of each controller; - transfer of personal data to other countries; - description of protection measures. XIII Transfer of personal data to other countries and international organizations Article 21 Any transfer of personal data whose processing is ongoing or intended for further processing after its transfer to another country or international organization, can be done only if in accordance with other provisions of this Law 6he Association as the controller and/or processor acts in accordance with the conditions prescribed by the Law, which includes the further transfer of personal data from another country or international organization to a third country or international organization, in order to ensure an appropriate level of protection of natural persons equal to the level guaranteed by the Law. The Association may, as a part of international cooperation, disclose personal data out of the Republic of Serbia, in accordance with the Law and other regulations. XIV Data Protection Officer Article 22 The Association may appoint a data protection officer by a decision, and in that case it will be obliged to submit the contact information of the appointed person to the Commissioner. In order to perform the obligations related to the protection of personal data, the data protection officer, if designated, is obliged to comply with this Rulebook and the Law. All persons whose data is processed by the Association, in the capacity of the controller or processor, may contact the data protection officer, if designated, in order to obtain all information regarding the processing of their data, as well as regarding the exercise of rights that belong to them. Data protection officer is obliged to keep the confidentiality of all data obtained in the performance of his/her duties related to the processing and protection of personal data. XV Remedies Article 23 The data subject has the right to file an objection to the data protection officer within the Association, if designated, if he/she considers that his/her rights established by this Rulebook and the Law have been violated. The data subject has the right to file a complaint to the Commissioner, if he/she considers that his/her rights established by this Rulebook and the Law have been violated. The data subject has the right to judicial protection, by filing a lawsuit, if he/she considers that his/her rights established by this Rulebook and the Law have been violated. XVI Amendments to the Rulebook Article 24 The Association reserves the right to amend the Rulebook in accordance with applicable regulations. XVII Final Provisions Article 25 For all issues that are not regulated by this Rulebook, the Law applies, as well as other legally relevant regulations that contain provisions on personal data protection. The Rulebook is published on the notice board of the Association, and enters into force and applies on the eighth day from the day of its publication. President of the Board of Directors of the Association Mike Michel
1.1 2.1 3.1 3.2 4.1 4.2 4.3 5.1 6.1 7.1 7.2 8.1 9.1 9.2 10.1 11.1 11.2 12.1 13.1 14.1 15.1 16.1 16.2 16.3 17.1 17.2 17.3 17.4 18.1 19.1 19.2 20.1 21.1 21.2 22.1 23.1 23.2 24.1 24.2 25.1 25.2 25.3 25.4 25.5 25.6 25.7 25.8 26.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 34.1 35.1 36.1 37.1 38.1 39.1 40.1 41.1 42.1 43.1 44.1 45.1 46.1 47.1 48.1 49.1 50.1 51.1 52.1 53.1 53.2 54.1 55.1 56.1 57.1 58.1 59.1 60.1 61.1 61.2 62.1 63.1 63.2 64.1 64.2 65.1 66.1 67.1 68.1 69.1 70.1 71.1 72.1 73.1 74.1 75.1 76.1 77.1 77.2 78.1 78.2 79.1 80.1 81.1 82.1 83.1 84.1 84.2 85.1 86.1 87.1 88.1 88.2 88.3 89.1 90.1 90.2 91.1 92.1 93.1 93.2 94.1 95.1 96.1 96.2 96.3 97.1 98.1 98.2 98.3 98.4 98.5 99.1 99.2 99.3 100.1 100.2 101.1 102.1 102.2 102.3 103.1 104.1 105.1 106.1 107.1 107.2 107.3 107.4 108.1 109.1 109.2 110.1 111.1 112.1 113.1 113.2 114.1 114.2 114.3 115.1 116.1 117.1 118.1 119.1 120.1 121.1 122.1 123.1 124.1 125.1 126.1 126.2 127.1 128.1 129.1 130.1 131.1 132.1 133.1 134.1 135.1 136.1 137.1 138.1
POLITIKA PRIVATNOSTI POLITIKA PRIVATNOSTI TZG Metkovića, sa sjedištem u Metkoviću, Ante Starčevića 3, OIB: 24761712785 (u daljnjem tekstu: TZG Metkovića), poštuje privatnost svake osobe čije osobne podatke prikuplja. Željeli bismo Vas obavijestiti o tome koje osobne podatke TZG METKOVIĆA prikuplja, kako štitimo i koja su Vaša prava. TZG METKOVIĆA zadržava sva autorska prava na korištenje fotografija, tekstova i ostalih objavljenih materijala, u smislu pozitivnih zakonskih propisa u Republici Hrvatskoj. Fotografije, tekstovi i ostali materijal ne smiju se objavljivati, prodavati, javno ili privatno publicirati niti na bilo koji drugi način upotrebljavati bez suglasnosti TZG METKOVIĆA. Svako nepridržavanje prethodnih uvjeta povlači za sobom odgovornost i obvezu naknade nematerijalne štete TZG METKOVIĆ po povredi za pojedini materijal. Temeljne informacije Opseg primjene Ova Politika primjenjuje se na svaku obradu osobnih podataka TZG METKOVIĆA, osim ako je drugom politikom TZG METKOVIĆA drugačije propisano. Iznimno, u odnosu na obradu podataka gostiju i korisnika usluga TZG METKOVIĆA ova Politika ima prednost u odnosu na druge politike ako su tim politikama drugačije propisana prava i obveze u vezi obrade podataka. Voditelj obrade i zakonski okvir TZG METKOVIĆA, kao Voditelj obrade Vaših podataka, poštuje Vašu privatnost te se obvezuje na zaštitu Vaših osobnih podataka. Prikupljanje i čuvanje podataka izvodi se u skladu s odredbama Uredbe EU 2016/679 Europskog parlamenta i Vijeća od 27. travnja 2016. o zaštiti pojedinaca u vezi s obradom osobnih podataka i o slobodnom kretanju takvih podataka (Opća uredba o zaštiti podataka), Zakona o provedbi Opće uredbe o zaštiti podataka (NN 42/2018) i ostalih propisa koji uređuju predmetno područje, a imaju primjenu u Republici Hrvatskoj. Službenik za zaštitu podataka TZG METKOVIĆA je imenovala službenika za zaštitu osobnih podataka kojeg svakodobno možete kontaktirati putem adrese: Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite. odnosno putem pošte na adresu TZG Metković, Ante Starčevića 3, Metković, Republika Hrvatska. Primjena načela zaštite podataka TZG METKOVIĆA u okviru primjene ove Politike posebno pazi na poštivanje načela obrade podataka te obrađuje podatke: - Zakonito – obrada će biti moguća ako je ista dopuštena zakonom i to u granicama koje zakon dopušta. - Pošteno – uvažavajući specifičnosti svakog odnosa, primjenjujući sve adekvatne mjere za zaštitu osobnih podataka i privatnosti općenito te ne sprečavajući ispitanika u ostvarivanju svojih prava. - Transparentno – informirajući ispitanike o obradama osobnih podataka. Od samog prikupljanja podataka kada su ispitanici informirani o svim aspektima obrade podataka pa sve do prestanka obrade podataka ispitanicima se pruža jednostavan i brz pristup vlastitim podacima što uključuje mogućnost uvida i dobivanja kopije u skladu s odredbama Uredbe. Određene informacije mogu se ograničiti samo kada je to zahtijevano zakonom ili kada je to nužno za zaštitu trećih osoba. - Uz ograničenje svrhe – obrađujući osobne podatke u one svrhe u koji su prikupljeni a u druge svrhe ako su za to ispunjeni uvjeti iz Uredbe. Podaci se mogu obrađivati u podudarne svrhe samo uzimajući u obzir (a) svaku vezu između svrha prikupljanja osobnih podataka i svrha namjeravanog nastavka obrade; (b) kontekst u kojem su prikupljeni osobni podaci, posebno u pogledu odnosa između ispitanika i TZG Metkovića; (c) prirodu osobnih podataka, osobito činjenicu obrađuju li se posebne kategorije osobnih podataka u skladu s člankom 9. Uredbe ili osobni podaci koji se odnose na kaznene osude i kažnjiva djela u skladu s člankom 10. Uredbe; (d) moguće posljedice namjeravanog nastavka obrade za ispitanike; te (e) postojanje odgovarajućih zaštitnih mjera. - Uz ograničenje pohrane – pohranjujući podatke u obliku koji omogućuje identifikaciju ispitanika samo onoliko dugo koliko je potrebno u svrhe radi kojih se osobni podaci obrađuju, a duže samo ako je dopušteno Uredbom. - Uz smanjenje količine podataka – obrađujući podatke ako su primjereni, relevantni i ograničeni na ono što je nužno. Posebno se pazi da se ne prikupljaju podaci za koje ne postoji opravdana potreba za obradom. - Vodeći računa o točnosti – vodeći računa o točnosti i ažurnosti podataka i brišući netočne podatke u okviru mogućnosti. - Vodeći računa o cjelovitosti i povjerljivosti – pružajući tehničkim i organizacijskim mjerama odgovarajuću sigurnost osobnih podataka, uključujući zaštitu od neovlaštene ili nezakonite obrade te od slučajnog gubitka, uništenja ili oštećenja primjenom odgovarajućih tehničkih ili organizacijskih mjera. Relevantne mjere primjenjuju se vodeći računa o rizičnosti svake vrste obrade podataka. Dostava podataka trećim subjektima Uvid u osobne podatke gostiju, po potrebi i u ograničenoj mjeri također mogu imati i treće strane, izvršitelji obrade (primjerice suradnici TZG METKOVIĆA koji pružaju informatičke usluge ili druge usluge), koji ih čuvaju u svojim bazama do završetka obrade. S takvim subjektima se sklapa detaljan ugovor u pogledu njihovih ovlasti i obveza kod obrade osobnih podataka, a sukladno zahtjevima Uredbe. U određenim situacijama moguće je da vanjski subjekti zajedno s TZG Metkovića zajednički odrede svrhe i načine obrade osobnih podataka, tada su ti vanjski partneri i TZG Metkovića zajednički voditelji obrade. U tim odnosima, zajednički voditelji obrade na transparentan način određuju svoje odgovornosti za poštovanje obveza iz Uredbe, osobito s obzirom na ostvarivanje prava ispitanika i svojih dužnosti poštivanja transparentnosti obrade, osim ako su odgovornosti zakonom utvrđene. Ako u okviru obrade podataka dolazi do iznošenja podataka u treće zemlje, TZG Metkovića osigurava poštivanje visokih standarda zaštite kako bi se poštovao najviši moguć standard zaštite osobnih podataka, a u skladu sa strogim zahtjevima Uredbe. U tom smislu, kada su u primjeni međunarodni prijenosi osobnih podataka, TZG Metkovića će informirati ispitanika o namjeri iznošenja osobnih podataka trećoj zemlji ili međunarodnoj organizaciji te o postojanju ili nepostojanju odluke Europske komisije o primjerenosti. Ujedno, uputit će se ispitanika na prikladne ili odgovarajuće zaštitne mjere i načine pribavljanja njihove kopije ili mjesta na kojem su stavljene na raspolaganje ako prijenos podliježe odgovarajućim zaštitnim mjerama prema članku 46. Uredbe, primjeni obvezujućih korporativnih pravila prema članku 47. Uredbe ili ako je primjenjiv članak 49. stavak 1. podstavak 2. Uredbe. Svaki prijenos osobnih podataka u treće zemlje bit će izvršen u skladu s poglavljem V. Uredbe. Svrha prikupljanja Neke Vaše osobne podatke TZG Metkovića je dužna skupljati zbog ispunjenja ugovora o smještaju i zbog propisa koji uređuju ugostiteljsku djelatnost, no neke druge ili iste podatke TZG Metkovića može skupljati i za druge svrhe prvenstveno radi kontakta, odnosno: - ispunjenja ugovora o smještaju - ispunjavanja zahtjeva zakona i ostalih važećih pozitivnih propisa koji uređuju ugostiteljsku djelatnost - u svrhe direktnog marketinga - slanja ponuda i informacija o radu - u svrhe održavanja nagradnih igara - u svrhe unapređenja i personaliziranja usluge Vama kao gostu i članu - u svrhe zaštita imovine i sigurnosti pojedinaca primjenom mjera video nadzora TZG Metkovića jamči da će se prikupljenim podacima koristiti samo u navedene svrhe. TZG Metkovića može koristiti depersonalizirane podatke u statističke svrhe. Pravna osnova prikupljanja Pravna osnova za navedene svrhe prikupljanja su: - zakonska, - ugovorna, - ključni interesi ispitanika, - legitimni interes koji je jači od interesa ispitanika ili - privola ili izričita privola ispitanika,ovisno o svrsi obrade i vrsti osobnog podatka Mjesta prikupljanja podataka TZG Metkovića prikuplja vaše podatke tijekom: - prilikom ispunjavanja zakonske obveze prijave - prijava u eVisitor, ispunjavanjem registracijske kartice - sudjelovanja u nagradnoj igri ispunjavanjem anketnog obrasca Vrijeme čuvanja podataka Podatke koje TZG Metkovića prikuplja na temelju zakona, dužan je čuvati onoliko vremena koliko određuje pojedini zakon ili drugi pozitivni propis. Podatke koje TZG Metkovića prikuplja na temelju ugovornog odnosa čuvat će samo koliko je potrebno u svrhu ispunjenja ugovora odnosno pružanja usluge. Podatke o imenu, prezimenu i e-mail adresi koje TZG Metkovića prikupi temeljem legitimnog interesa u svrhe izravnog marketinga čuvat će u svojoj bazi gostiju 10 godina. Ostale podatke koje TZG Metkovića prikuplja temeljem izričite privole gosta (broj mobitela, broj djece, bračni status, kućni ljubimci, interesi, način putovanja, preferencija smještaja i preferencija destinacije) čuvat će u svojoj bazi gostiju 5 godina. TZG Metkovića također može, temeljem Vaše izričite privole prikupljati i pohraniti podatke o sadržaju koje pregledavate na web stranicama (tzv. cookies), te će ih u tom slučaju čuvati u svojoj bazi u razdoblju od 2 godine. Navedeni podatak TZG Metkovića će koristiti u svrhu obavještavanja o posebnim i personaliziranim ponudama, vijestima i događajima koje organizira putem online kanala (e-mail, web, internet promocija). Prava ispitanika Bez obzira na osnovu prikupljanja podataka, svakodobno možete besplatno tražiti: - pristup, izmjenu ili dopunu podataka u svim bazama osobnih podataka, temeljem čega će TZG Metkovića omogućiti pristup ili izmijeniti vaše podatke u svim svojim bazama ovisno o Vašem zahtjevu, - brisanje ("pravo na zaborav") osobnih podataka u svim bazama osobnih podataka, temeljem čega će Vas TZG Metkovića brisati iz svih svojih baza, osim iz baza koje je TZG METKOVIĆA Dužno imati i čuvati na temelju pozitivnih propisa, te ako ne postoje jači legitimni razlozi za obradu ili ako obrada nije nužna za postavljanje, ostvarivanje ili obrane pravnih zahtjeva, - da se podaci koje smo o Vama prikupili prenesu Vama ili trećim osobama („pravo na prenosivost podataka “), u skladu s pozitivnim zakonskim propisima, - ako su podaci dani na temelju privole, uvijek možete tu privolu povući bez negativnih posljedica, - pravo na podnošenje prigovora nadzornom tijelu – Agenciji za zaštitu osobnih podataka (više o tomu na www.azop.hr) Svoj pisani zahtjev uputite na kontakt adresu službenika za zaštitu osobnih podataka: Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite. odnosno putem pošte na adresu TZG Metković, Ante Starčevića 3, Metković, Republika Hrvatska. Osobni podaci koji se prikupljaju od osoba koje prijavljuju boravak u eVisitor Vaše osobne podatke koje morate dostaviti da bi Vam se pružila usluga smještaja, TZG Metkovića kao voditelj obrade čuva u svojoj bazi podataka isključivo u svrhu ispunjavanja zakonskih obveza dostave, kao i prikupljanja osobnih podataka vezanih uz ugostiteljsku djelatnost, te ih može koristiti i u druge svrhe predviđene pozitivnim propisima. U slučaju da ne ustupite TZG Metković minimum podataka potreban za prijavu gosta u svim nadležnim registrima, TZG Metkovića ovlaštena je obavijestiti nadležne službe sukladno zakonu. Osobne podatke koje TZG Metkovića evidentira prikupljeni su temeljem zakona koji uređuju ugostiteljsku djelatnost, te u svrhu pružanja usluge gostima. To su sljedeći podaci (koji se mogu mijenjati obzirom na pozitivne propise): - ime i prezime - adresa prebivališta (hrvatski državljani) - datum rođenja - broj, vrsta identifikacijskog dokumenta i mjesto izdavanja - državljanstvo - ime objekta - broj smještajne jedinice - datum dolaska i odlaska gosta Navedene podatke TZG Metkovića čuva u svojoj bazi gostiju E-visitor (elektronski sustav za prijavu gostiju) nadležnim tijelima Republike Hrvatske, te se navedeni podaci moraju čuvati u sustavu 10 godina. Nadalje, radi ispunjavanja zakonske obveze, TZG Metkovića prikuplja pri otvaranju novog objekta, kao i na registracijskoj kartici prilikom dolaska u objekt, sljedeće podatke: - jezik Ostali podaci vezani uz okolnosti Vašeg boravka kao što su na primjer: način putovanja, s kime putujete, bračno stanje, broj djece, kućni ljubimci, ostali interesi, također će biti prikupljeni ako imaju izravnu vezu s pružanjem usluge smještaja, te će biti brisani nakon Vašeg odlaska iz smještajnog objekta. Vaše osobne podatke (ime i prezime, e-mail adresa), TZG Metkovića kao voditelj obrade ima pravo temeljem legitimnog interesa prikupljati u svoju bazu gostiju i koristiti u svrhu direktnog marketinga i to isključivo u svrhu obavještavanja o ponudama i vijestima TZG Metkovića putem e-maila. U ovom slučaju imate pravo u bilo koje vrijeme i besplatno zahtijevati brisanje (pravo na zaborav) iz baze podataka u tu svrhu. Za vrijeme i nakon boravka, TZG Metkovića Vama kao gostu putem e-maila kojeg smo dobili od Vas, može poslati upitnik o zadovoljstvu koji, ukoliko ga želite ispuniti, dakle isključivo uz vašu privolu, upitnik obrađuje društvo koje odabere TZG Metković, i koji javno objavljuje podatke iz upitnika prema svojim pravilima i politikama za koje TZG Metkovića nije odgovorna. Primarna svrha upitnika o zadovoljstvu je prikupljanje podataka o usluzi radi unaprjeđenja usluge od strane TZG Metkovića te TZG Metkovića te podatke iz upitnike depersonalizira i obrađuje u statističke svrhe. Dodatno, osoba koja rezervira smještaj odnosno gost može dati posebno dopuštenje, privolu, TZG Metković, da sve njegove podatke, poput: - ime - prezime - datum rođenja - država prikuplja i koristi radi daljnjeg profiliranja ispitanika i u svrhu kontaktiranja i obavještavanja o posebnim i personaliziranim ponudama, vijestima i događajima koje organizira TZG Metkovića putem online kanala (e-mail, web, internet promocija). U ovom slučaju ispitanik ima pravo svakodobno povući danu privolu, što uključuje i obradu u svrhe izrade profila u mjeri u kojoj je povezana s takvim izravnim marketingom, bilo u odnosu na početnu ili daljnju obradu, u bilo koje vrijeme i besplatno kao i pravo u svako doba na promjenu podataka i pravo na zaborav. Podaci se čuvaju u bazi gostiju TZG Metkovića5 godina. TZG Metkovića također može prikupljati osobne podatke putem sustava videonadzora. Osobni Podaci koji se prikupljaju prilikom sudjelovanja u nagradnoj igri / popunjavanja anketnog obrasca TZG Metkovića može povremeno organizirati i nagradne igre, u kojem slučaju će prikupljati Vaše osobne podatke samo ako se odlučite sudjelovati u nagradnoj igri. Podaci koji će se na taj način prikupljati i koji su nužni za sudjelovanje u nagradnoj igri, bit će određeni Pravilima nagradne igre, pri svakoj zasebnoj nagradnoj igri, te mogu biti različiti. Tako prikupljeni podaci temeljem svojevrsne ugovorne obveze koristit će u svrhu provođenja nagradne igre, sukladno pravilima nagradne igre. te brisani u roku od 5 godina nakon završetka nagradne igre. U slučaju da ispunite anketni obrazac za nagradnu igru s podacima koji nisu nužni za sudjelovanje u nagradnoj igri, (podaci mogu biti različiti u različitim nagradnim igrama) TZG Metkovića sve te depersonalizirane podatke može koristiti u statističke svrhe. Podatke o imenu, prezimenu i e-mail adresi, koje ispunite u anketnom obrascu za nagradnu igru, TZG Metkovića ima pravo temeljem legitimnog interesa prikupljati i koristiti u svrhu direktnog marketinga i to isključivo u svrhu obavještavanja o ponudama i vijestima TZG Metkovića putem e-maila. U ovom slučaju ispitanik ima pravo prigovora na takvu obradu, uključujući izradu profila u mjeri u kojoj je povezana s takvim izravnim marketingom, bilo u odnosu na početnu ili daljnju obradu, u bilo koje vrijeme i besplatno. Navedeni podaci se čuvaju u bazi gostiju TZG Metkovića 10 godina. Ispitanik ima pravo na promjenu podataka i pravo na zaborav. Dodatno, osoba koja sudjeluje u nagradnoj igri može dati posebno dopuštenje, privolu, TZG Metković da sve njegove podatke koje daje ispunjavajući anketni obrazac za nagradnu igru (podaci mogu biti različiti u različitim nagradnim igrama) TZG Metkovića prikuplja i koristi radi daljnjeg profiliranja ispitanika i u svrhu kontaktiranja i obavještavanja o posebnim i personaliziranim ponudama, vijestima i događajima koje organizira TZG Metkovića putem online kanala (e-mail, web, internet promocija). U ovom slučaju ispitanik ima pravo svakodobno povući danu privolu, što uključuje i obradu u svrhe izrade profila u mjeri u kojoj je povezana s takvim izravnim marketingom, bilo u odnosu na početnu ili daljnju obradu, u bilo koje vrijeme i besplatno kao i pravo u svako doba na promjenu podataka i pravo na zaborav. Podaci se čuvaju u bazi gostiju TZG Metkovića 5 godina. Kolačići (cookies) i internetske tehnologije Kao što je slučaj i s mnogim drugim portalima, i naš se može koristiti „kolačićima“ (male datoteke koje spremamo na Vaše računalo pri pristupanju našim internetskim stranicama kako bi se omogućila osnovna ili dodatna funkcionalnost tih stranica) i drugim tehnologijama koje nam olakšavaju isporučivanje sadržaja ovisno o Vašim područjima interesa, obrađivanje rezervacija ili zahtjeva, i/ili analiziranje karakteristika Vaših posjeta. Kolačići se ne mogu upotrebljavati za otkrivanje Vašeg osobnog identiteta. Kad pristupate našim web-stranicama, ova informacija našim poslužiteljima identificira svojstva vašeg pretraživača, ali ne i Vas. Koristimo različite vrste kolačića: - Neophodni kolačići – oni su nužni za funkcioniranje web stranice, a koja bez njih ne može funkcionirati. To znači da se internetska stranica bez tih kolačića ne može otvoriti niti prikazati. Ovi kolačići se koriste za svrhu transmisije komunikacije ili su nužni za pružanje usluge informacijskog društva koja je izrijekom zahtijevana od korisnika takve usluge. Također, ovi kolačići će nam omogućiti bazičnu analizu web stranica s ciljem poboljšanja rada web stranica putem podataka koji su u potpunosti anonimizirani, odnosno nisu bazirani na vašim osobnim podacima ili podacima koje je moguće na bilo koji način povezati s vama. Za ove kolačiće nije potrebna i ne tražimo Vašu privolu. - Funkcionalni kolačići – pomoću njih provodimo napredniju analizu rada web stranica. Ovi kolačići služe analizi ponašanja korisnika te na temelju dobivenih anonimnih podataka možemo utvrditi što posjetitelji internetske stranice najviše žele i pregledavaju, pa smo onda u mogućnosti prilagoditi internetsku stranicu i učiniti njezin sadržaj i funkcionalnost što jednostavnijem za korištenje. Za ove kolačiće tražimo Vašu privolu. - Oglašivački kolačići – pomoću njih analiziramo Vaše interese i želje, a oni nam služe kako bismo Vam plasira informacije koje su Vama zanimljive i kreirali ponude prilagođene Vašem korištenju internetskih stranica TZG Metkovića. Za ove kolačiće tražimo Vašu privolu. TZG Metkovića pohranjuje kolačiće u bazu i da ih čuvamo najduže 2 godine u svrhu obavještavanja o posebnim i personaliziranim ponudama, vijestima i događajima koje organizira putem online kanala (e-mail, internet, internetske promocija). Ukoliko ste se predomislili vezano za postavke kolačića na web stranicama TZG Metkovića u bilo kojem trenutku ih možete promijeniti. Uvijek možete obrisati kolačiće koje su spremljeni na Vašem računalu, na taj način onemogućavate daljnju obradu Vaših osobnih podataka putem takve tehnologije. Svaki internetski preglednik ima svoj postupak brisanja kolačića, a ovdje donosimo postupke za najpopularnije internetske preglednike: Google Chrome: https://support.google.com/chrome/answer/95647?co=GENIE.Platform%3DDesktop&hl=hr Mozilla Firefox: https://support.mozilla.org/hr/kb/Brisanje%20kola%C4%8Di%C4%87a Microsoft Edge: https://privacy.microsoft.com/en-us/windows-10-microsoft-edge-and-privacy Zaštita osobnih podataka djece TZG Metkovića savjetuje roditeljima i skrbnicima da poduče djecu o sigurnom i odgovornom postupanju s osobnim podacima na internetu. TZG Metkovića ne želi i nema namjeru prikupljati osobne podatke djece, neće ih ni na koji način rabiti niti će ih odati trećima. Dijete može dati svoju privolu isključivo u odnosu na eventualne usluge informacijskog društva i to dijete starije od 16 godina. Svaka druga obrada podataka djece ispod navedene dobne granice i druga obrada osim izričito navedene ovdje, za djecu do 18 godine života, dozvoljena je TZG Metković isključivo uz prethodnu privolu roditelja. Promjena podataka U svakom nam se trenutku možete obratiti radi pregleda svojih osobnih podataka, kao i radi ažuriranja, ispravka ili brisanja podataka. Do tog se trenutka u navedene svrhe koristimo Vašim prethodno evidentiranim podacima. Vaša suglasnost Prilikom davanja informacija TZG Metković, na bilo koji način, jamčite nam da su informacije koje ste priložili točne, da ste poslovno sposobni i ovlašteni raspolagati danim informacijama te da ste u cijelosti suglasni da TZG Metkovića Vaše podatke upotrebljava i prikuplja u skladu sa zakonom i uvjetima ove politike privatnosti. Tehnička i integrirana zaštita podataka TZG Metkovića, kao voditelj obrade vodi računa o najvišim organizacijskim i tehničkim standardima zaštite podataka. Stoga, uzimajući u obzir najnovija dostignuća, trošak provedbe te prirodu, opseg, kontekst i svrhe obrade, kao i rizike različitih razina vjerojatnosti i ozbiljnosti za prava i slobode pojedinaca koji proizlaze iz obrade podataka, u vrijeme određivanja sredstava obrade i u vrijeme same obrade, provodi odgovarajuće tehničke i organizacijske mjere za omogućavanje učinkovite primjene načela zaštite podataka. Također, TZG Metkovića provodi odgovarajuće tehničke i organizacijske mjere kojima se osigurava da integriranim načinom budu obrađeni samo osobni podaci koji su nužni za svaku posebnu svrhu obrade. Tu mjeru TZG Metkovića primjenjuje na količinu prikupljenih osobnih podataka, opseg njihove obrade, razdoblje pohrane i njihovu dostupnost. Točnije, takvim se mjerama osigurava da osobni podaci nisu automatski, bez intervencije pojedinca, dostupni neograničenom broju pojedinca. Evidencije o aktivnostima obrade TZG Metkovića kao voditelj obrade vodi evidencije o aktivnostima obrade sa sljedećim podacima: - ime i kontaktne podatke voditelja obrade, ako je primjenjivo, zajedničkog voditelja obrade, i službenika za zaštitu podataka; - svrhe obrade; - kategorije primatelja kojima su osobni podaci otkriveni ili će im biti otkriveni, uključujući primatelje u trećim zemljama ili međunarodne organizacije; - ako je primjenjivo, prijenose osobnih podataka u treću zemlju ili međunarodnu organizaciju, uključujući identificiranje te treće zemlje ili međunarodne organizacije te, u slučaju prijenosa iz članka 49. stavka 1. drugog podstavka, dokumentaciju o odgovarajućim zaštitnim mjerama; - ako je to moguće, predviđene rokove za brisanje različitih kategorija podataka; - ako je moguće, opći opis tehničkih i organizacijskih sigurnosnih mjera Postupanje po povredama osobnih podataka TZG Metkovića kao voditelj obrade osigurava da slučaju povrede osobnih podataka bez nepotrebnog odgađanja i, ako je izvedivo, najkasnije 72 sata nakon saznanja o toj povredi, izvješćuje nadležno nadzorno tijelo o povredi osobnih podataka, osim ako nije vjerojatno da će povreda osobnih podataka prouzročiti rizik za prava i slobode pojedinaca. Izvješće koje se dostavlja nadzornom tijelu sadržava sve informacije sukladno Uredbi. U slučaju povrede osobnih podataka koje će vjerojatno prouzročiti visok rizik za prava i slobode pojedinaca, TZG Metkovića kao voditelj obrade bez nepotrebnog odgađanja obavješćuje ispitanika o povredi osobnih podataka. Ispitanike se neće obavijestiti u slučajevima kada Uredba propisuje da isto nije obvezno. Procjena učinka na zaštitu podataka Ako je vjerojatno da će neka vrsta obrade, osobito putem novih tehnologija i uzimajući u obzir prirodu, opseg, kontekst i svrhe obrade, prouzročiti visok rizik za prava i slobode ispitanika, TZG Metkovića kao voditelj obrade, prije obrade provodi procjenu učinka predviđenih postupaka obrade na zaštitu osobnih podataka. Jedna procjena može se odnositi na niz sličnih postupaka obrade koji predstavljaju slične visoke rizike. TZG Metkovića provodi procjenu učinka na zaštitu podataka u slučaju: - sustavne i opsežne procjene osobnih aspekata u vezi s pojedincima koja se temelji na automatiziranoj obradi, uključujući izradu profila, i na temelju koje se donose odluke koje proizvode pravne učinke koji se odnose na pojedinca ili na sličan način značajno utječu na pojedinca; - sustavnog praćenja javno dostupnog područja u velikoj mjeri, - u drugim situacijama koje određuje nadležno nadzorno tijelo. TZG Metkovića osigurava adekvatnu uključenost službenika za zaštitu podataka u postupku procjene učinka. U skladu s odredbama Uredbe, po potrebi nakon postupka procjene učinka provest će se postupak prethodnog savjetovanja s nadzornim tijelom. Transparentnost Ova Politika privatnosti dostupna je na stranicama www.tzmetkovic.hr te također i u prostorima TZG Metković. Ako odlučimo mijenjati svoju politiku privatnosti, promjene ćemo postaviti i objaviti na internet stranicama www.tzmetkovic.hr te također i u prostorima TZG Metković.