http___www.tzmetkovic.hr_hr_smjestaj1_itemlist_category_4-informacije.html_1.xml
1.1 2.1 3.1 3.2 3.3 4.1 5.1 6.1 6.2 6.3 6.4 7.1 8.1 8.2 8.3 8.4 8.5 9.1 10.1 10.2 10.3 10.4 11.1 11.2 11.3 12.1 13.1 13.2 13.3 14.1 15.1 17.1 19.1 21.1 22.1 22.2 22.3 22.4 22.5 22.6 22.7 22.8 23.1 24.1 24.2 24.3 24.4 25.1 26.1 27.1 27.2 28.1 28.2 28.3 29.1 30.1 31.1 33.1 35.1 37.1 39.1 41.1 43.1 45.1 47.1 49.1 51.1 52.1 52.2 52.3 52.4 52.5 53.1 53.2 53.3 53.4 53.5 53.6 54.1 56.1 58.1 60.1 61.1 61.2 61.3 62.1 63.1 63.2 64.1 65.1 65.2 67.1 69.1 71.1 73.1 75.1 77.1 79.1 79.2 81.1 82.1 82.2 82.3 82.4 82.5 83.1 84.1 86.1 88.1 90.1 91.1 92.1 93.1 93.2 94.1 95.1 95.2 95.3 95.4 96.1 97.1 99.1 101.1 103.1 104.1 105.1 105.2 105.3 105.4 106.1 106.2 106.3 107.1 108.1 110.1 110.2 110.3 110.4 111.1 111.2 111.3 113.1 113.2 113.3 115.1 117.1 117.2 119.1 119.2 121.1 123.1 123.2 124.1 124.2 125.1 125.2 125.3 126.1 127.1 127.2 128.1 128.2 128.3 129.1 129.2 130.1 131.1 132.1 132.2 134.1 134.2 134.3 134.4 136.1 136.2 138.1 140.1 140.2 142.1 144.1 145.1 145.2 145.3 146.1 147.1 147.2 147.3 148.1 148.2 148.3 148.4 148.5 148.6 148.7 149.1 149.2 149.3 150.1 151.1 151.2 151.3 151.4 152.1 152.2
Skip to content Introduction - 2021 Reforms In Q4 2021, as part of its 50th Year Anniversary, the UAE announced some of the broadest changes to its legal landscape in many years. It also introduced major practical changes, not least announcing the change of the working week for the public sector from Sunday-Thursday to Monday-Friday – a move that we expect the private sector will follow. In this series of articles, we summarise some of the key changes introduced in the Q4 2021 reforms. A table listing out the key new or updated laws can be downloaded here. This article discusses Federal Decree Law No. 45 of 2021 on the Protection of Personal Data (the DPL). The DPL comprehensively regulates the processing of personal data in the UAE (and potentially overseas) at a nation-wide and cross-sectoral scale for the first time. The DPL operates alongside Federal Decree Law No. 44 of 2021 Establishing the UAE Data Office (the Data Office Law). The UAE Data Office will be the regulator charged with overseeing, implementing and enforcing the DPL and has a wide-ranging mandate under the Data Office Law. The DPL imposes numerous obligations on a vast swathe of UAE businesses for the first time and will present a compliance challenge, in particular, for those businesses dealing with large amounts of customer and employee data. UAE Protection of Personal Data Law We have seen a raft of new data protection laws in the Middle East over recent years. The UAE has, until now, regulated processing of personal data in key industries such as healthcare and banking. Additionally, the two special financial free zones – the Dubai International Financial Centre (DIFC) and Abu Dhabi Global Market (ADGM) – have had their own data protection laws and regulations modelled on European data protection law for some time. There are also various articles of the general criminal law in the UAE which are concerned with violations of privacy and breach of confidence. However, it is only now that all businesses operating in the UAE will need to carefully consider data protection compliance in detail at an enterprise-wide level, and ensure that appropriate data protection practices are implemented in their business arrangements. Basic principles of the DPL The DPL adopts similar concepts to the European General Data Protection Regulation (GDPR) (and the other data protection laws around the globe that have also adopted such principles). As is the case in the GDPR, “Personal Data” is given a broad meaning, effectively capturing any information that can be used to identify a natural person either directly or indirectly (by combining with other data). It is not clear whether the DPL continues to apply to data identifying deceased natural persons or not. For practical purposes, businesses should assume that all data relating to their customers, prospects, staff, directors and shareholders and suppliers is personal data for the purposes of the DPL, unless it is stored in a format which renders it anonymised. The law also uses the concepts of “data subject” (i.e. the natural person identified by the data), “controller” (i.e. the legal entity or person who specifies the method, criteria and purpose of processing) and “processor” (i.e. a legal entity or person who processes data in accordance with the instructions of the controller). “Processing” is a very wide concept which captures any operation performed on the personal data. According to the definition of “processing”, the DPL only appears to apply to processing carried out using electronic means. Effective date The DPL is in effect from 2 January 2022, however it will not be enforced until six months after the publication of further executive regulations. We do not know exactly when the executive regulations will be published but six months is not a huge period of time to prepare, so businesses should start considering and planning for the DPL sooner rather than later. Businesses in Europe had years to prepare for the GDPR, against the backdrop of already having to comply with data protection legislation implementing the European Data Protection Directive since the 1990s, but even then, many were late in completing GDPR compliance programmes. Scope of the DPL The DPL applies to processing conducted by: any data subject residing in or having a place of business in the UAE any controller or processor located in the UAE (regardless of the location of the data subjects whose data are being processed) any controller or processor located outside the UAE who processes the personal data of data subjects inside the UAE The second point means that UAE businesses must maintain the same high-standards even if handling data related to overseas persons. The third point, however, has extremely wide scope. Consider a (heavily simplified) scenario where a UAE-based consumer orders a product online from a business based in Thailand, which uses a cloud service provider located in Indonesia to process online orders and engages with an Indian logistics company to fulfil orders. Taken at face value, the Thai e-commerce business becomes subject to the DPL as a controller and the Indonesian and Indian suppliers become subject to the DPL as processors. This is unworkable in practice; it is not possible for all these businesses to be ready to comply with the DPL on the off-chance that a UAE-based person’s data are submitted to them. The GDPR also has extra-territorial reach but it is nuanced by reference to tests; under GDPR, the Thai e-commerce company, the Indonesian could service provider and the Indian logistics company would only be subject to GDPR if they were targetting their services at Europe-based consumers or were monitoring the behaviour of individuals in Europe. Incidental processing of the data of a person based in Europe is not enough to determine applicability of GDPR. The DPL does not contain such nuance; hopefully this will be developed further when the executive regulations are published to avoid any businesses based outside the UAE, but with only incidental dealings with UAE-based persons, from taking the view that they should block all transactions with UAE-based persons. Exemptions The DPL does not apply to government data or government authorities. It is not entirely clear what “government data” means in this context. As it is referred to in its own right, separate from processing conducted by government authorities, so presumably it is intended to have a broader scope and to capture government data in the hands of third parties. Some further clarification under the executive regulations or guidance issued by the UAE Data Office would be welcome. Security and judicial services are also exempted from the DPL. As with GDPR, processing conducted for personal purposes (i.e. non-business domestic purposes) is exempt. The DPL also states that health and banking data are not subject to the DPL to the extent they are already regulated. However, healthcare companies and banks will also process data which are not subject to existing regulations, with respect to their employees, suppliers, prospects and so on, so we assume that those businesses will need to operate dual-compliance regimes; complying with the industry-specific data that relates to their patients/clients, but also complying the DPL with respect to all other personal data. The law confirms that it does not apply to companies and institutions located in UAE free zones which have special data protection legislation. This currently covers the DIFC and ADGM and also Dubai Healthcare City, which has a Patient Personal Data Regulation. It will be interesting to see whether any other free zones which do not currently have a data protection law seek to boost their attractiveness as a low-cost-of-compliance territory by implementing their own data protection laws which operate to a lower standard than the DPL. Interestingly, the DPL also states that the UAE Data Office may introduce de minimis exemptions, so that establishments that process a minimal amount of personal data may be exempted from the DPL. Lawful processing and consent Unless data subject consent has been obtained, personal data may only be lawfully processed in accordance with the following bases, plus any other bases set out in the executive regulations, when published: if the processing is necessary to protect the public interest if the processing is for personal data that has become available and known to the public by an act of the data subject if the processing is necessary to initiate or defend against any claims to legal rights or legal proceedings, or related to judicial or security procedures if the processing is necessary for the purposes of occupational or preventive medicine, for assessment of the working capacity of an employee, medical diagnosis, provision of health or social care, treatment or health insurance services, or management of health or social care systems and services, in accordance with the legislation in force in the state if the processing is necessary to protect public health or for the purposes of ensuring the safety and quality of health care, medicines, drugs and medical devices, in accordance with the legislation in force in the state if the processing is necessary for archival purposes or for scientific, historical and statistical studies, in accordance with the legislation in force in the state if the processing is necessary to fulfil obligations imposed by other laws of the state on controllers if the processing is necessary to protect the interests of the data subject if the processing is necessary for the controller or data subject to fulfil his/her obligations and exercise his/her legally established rights in the field of employment, social security or laws on social protection, to the extent permitted by those laws if the processing is necessary to perform a contract to which the data subject is a party or to take, at the request of the data subject, procedures for concluding, amending or terminating a contract For most businesses, the latter three bases will be the most commonly relevant. It is interesting to observe that there is no “legitimate interests” basis (this is a feature in common with the new personal data protection law in Saudi Arabia), unlike in GDPR and various other data protection laws. This is likely to create a broader reliance on consent to justify non-“necessary” processing. There are practical problems with relying on consent, particularly in relation to a processing activity which is a crucial business activity. In particular, consent can be withdrawn at any time. It remains to be seen how “necessary” will be interpreted by the UAE Data Office. For example, an employer may wish to outsource its payroll function to a specialist provider. It is clearly necessary for the performance of the employment contract and to protect the interests of the employees that payroll is diligently and accurately managed, however it is not clear that outsourcing such processing to a third party is “necessary” in any common understanding of the word. Under GDPR, an employer may be able to balance the efficiencies and other benefits of outsourcing against the rights of the data subjects and conclude that it is in its legitimate interests to conduct the outsourcing, however such a route is not available under the DPL. Under GDPR, European guidance and jurisprudence establishes clearly that consent is not appropriate in an employer/employee relationship, because under GDPR consent must be freely given and it is considered that there is a power imbalance in the relationship between the parties which means that consent cannot be “freely” given by the employee. The DPL is silent on this topic, so it is possible, perhaps, that an employer can build a broad consent into its staff onboarding procedures, however this does not address the difficulty related to the potential withdrawal of consent. The DPL sets out conditions for consent, namely: the controller must be able to prove it has obtained consent (in practice, this means having systems in place to document and maintain a record of consents) the consent must be given in a clear, simple, unambiguous and easily accessible manner the consent must indicate the right of the data subject to withdraw it an easy manner The legitimate interests basis under GDPR can be relied upon by a third party to whom the controller discloses the personal data. The lack of legitimate interests basis in the DPL is also, therefore, potentially problematic for processors, which do not hold a direct relationship with the data subjects whose data are processed and so cannot verify if consent is in place or if the processing fulfils one of the other lawful grounds. Processors dealing with UAE-based controllers will therefore carefuilly want to address the contractual terms on which they provider their services to ensure that appropriate commitments are given by the controller and will also want to consider provisions related to the liability of the controller for ensuring there is a lawful basis in place for the processor to process the personal data. Controller and processor contracts The DPL does not specify mandatory provisions for inclusion in contracts between controllers and processors, however it is in all parties’ interests to consider the risks associated with the processing activity occurring under a contractual relationship and to build in appropriate protections and obligations. We recommend that all businesses review their standard contract templates accordingly, including terms of sale, terms of supply, terms of engagement with service providers, employment contracts and more. Personal data controls The DPL requires that the following controls must be implemented when personal data are processed. Note that these controls must be implemented by both controllers and processors. Processing must be made in a fair, transparent and lawful manner. Personal data must be collected for a specific and clear purpose, and may not be processed at any subsequent time in a manner incompatible with that purpose, however, personal data may be processed if the purpose of processing is similar or close to the purpose for which such data is collected. Personal data must be sufficient for and limited to the purpose for which the processing is made. Personal data must be accurate and correct and must be updated whenever necessary. Appropriate measures and procedures must be in place to ensure erasure or correction of incorrect personal data. Personal data must be kept securely and protected from any breach, infringement, or illegal or unauthorized processing by establishing and applying appropriate technical and organizational measures and procedures in accordance with the laws and legislation in force in this regard. Personal data may not be kept after fulfilling the purpose of processing thereof. it may only be kept in the event that it is anonymized. Any other controls set by the executive regulations of the DPL. These controls map closely to the key principles of the GDPR. To comply with the controls, businesses need to understand the sources of personal data ingested into the business, the processes used to collect data, the information provided to the data subjects, what happens to the data once it is collected, how long it is stored, how it is kept secure and so on. This is a broader initiative than a “legal” initiative and, in any large business, requires the buy-in of various business units. Many businesses may conclude that their current practices need to change. For example, it is common practice in the UAE for retailers to ask customers for their name, mobile number and/or email address “over the counter” at the point of purchase; in order for such data collection to be lawful once the DPL is in force, the customer needs to be informed of the specific and clear purpose of such collection in order for the first of the two controls listed above to be complied with. Information to be provided to data subjects Before commencing processing, the controller must notify the data subject of: the purposes of data processing any sectors or establishments with which the personal data is to be shared any measures employed to protect the personal data un any cross-border transfers All controllers must therefore have a privacy notice which contains, at a minimum, the above information and must consider how the provision of such information can be incorporated into the data collection processes it undertakes. Record keeping Both controllers and processors must keep a detailed personal data record and make the same available to the UAE Data Office on request. In order to maintain an accurate and complete record, businesses will need to conduct an audit exercise covering data ingestion, data handling and data processing by third parties. Personal data breaches Controllers must immediately report data breaches to the UAE Data Office unless the breach would not prejudice the privacy, confidentiality and security of the data. In such circumstances, the controller must also contact the affected data subjects; this is a matter which requires careful handling in order to manage reputational risk whilst complying with the law. All controllers should have a clear policy or procedure for responding to data breaches ensuring that the breach is escalated rapidly to the appropriate decision makers. Controllers may wish to consider whether such policy requires engagement of third party specialists such as forensic IT security consultants, legal advisors, PR consultants and so on. Data Protection Officer Controllers and Processors must appoint a data protection officer (DPO) in any of the following cases. If their processing activity would cause a high-risk to the confidentiality and privacy of the personal data or data subject as a result of adopting technologies that are new or are associated with the volume of data in question. If the processing will involve a systematic and comprehensive assessment of Sensitive Personal Data, including profiling and automated processing (processing carried out without human intervention or with limited human supervision and intervention). If the processing involves a large amount of Sensitive Personal Data. “Sensitive Personal Data” means any data that directly or indirectly reveals a natural person's family, racial origin, political or philosophical opinions, religious beliefs, criminal records, biometric data, or any data related to the health of such person, such as his/her physical, psychological, mental, genetic or sexual condition, including information related to health care services provided thereto that reveals his/her health status. The executive regulations of the law should provide further detail in relation to the DPO trigger thresholds mentioned above. If a DPO is needed, they can be employed or “authorised” by the controller or processor, which implies that third party DPO service providers will be permitted. The DPO may be located inside or outside the UAE. The contact details of the DPO must be provided to the UAE Data Office. The DPO needs to be engaged in a timely manner in relation to all processing matters and given the necessary resources to perform the role. The DPO is protected against disciplinary actions for a reason related to the performance of his/her duties in accordance with the DPL and must not be assigned duties which create a conflict of interest with the duties of the DPO. The DPO’s contact details should be made available to data subjects who have the right to communicate directly with the DPO in order to exercise their rights (see below). Data subject rights Data subjects have the following rights. Right to request the controller to provide information on the personal data of the data subject that is being processed, including details of sharing of the personal data with third parties, decisions made based on automated processing and profiling, controls and standards for the storage of the personal data, procedures for maintaining the accuracy of the personal data, the method employed to protect personal data in cross-border transfers and procedures for responding to a data breach. Controllers will want to have a clear process for responding to such requests to ensure that responses are appropriately structured and drafted and the information provided is consistent. Controllers may wish to develop template responses for various types of information requests. The controller can refuse a request in certain circumstances. Please note that there is no express right to receive a copy of the personal data being processed. This therefore seems to make this right somewhat different to the “DSAR” requests that can be made under GDPR. However, the DSAR is captured, subject to more limited circumstances, under the right to request personal data transfer described below. If the processing is based on consent or is necessary to fulfil a contract obligation and based on automated means, the data subject has the right to obtain his/her personal data in a structured and machine readable format and/or, if technically feasible, to request the transfer of such data to another controller. This right is therefore a mix of the portability and DSAR rights under the GDPR. Again, controllers need to have a policy detailing how they will comply with such requests. Right to correction and completion of personal data. Right to erasure of personal data if no longer required for the processing purposes, if consent is withdrawn (if consent is the basis for processing), if the data subject objects or there are no legitimate reasons for the controller to continue processing or if the data is being processed in violation of the law. There are exceptions to the right to erasure where the data is needed for public health reasons, if the data is needed for legal or investigatory procedures or if the deletion would contravene other laws. Right to restrict processing (i.e. require the controller to stop processing whilst addressing the concerns) if the data subject objects to the accuracy of the data, if the data subjects objects that processing is in violation of the specified purpose, if the processing is in violation of the law. There are exceptions to the right that the controller may be able to rely on. Right to stop processing if the processing is for direct marketing or profiling related to direct marketing, if the processing is for the purpose of conducting statistical surveys (unless such surveys are necessary for the public interest), if the processing is in violation of the processing controls set out in Article 5 of the DPL. Right to object to decisions based on automated processing that have legal consequences or seriously affect the data subject. The right does not apply if the automated processing is included in the terms of a contract between the controller and data subject, is necessary in accordance with laws in force in the UAE or if the data subject has already given his/her consent (in accordance with the DPL) to the automated processing. No timescales are provided for in which data subject requests must be complied with and no sanctions are specified for non-compliance. We assume that the executive regulations of the law will address these subjects. Controllers should ensure that they have a procedure/policy in place for addressing data subject rights requests. This is particularly important when responding for requests to disclose personal information, where there is a risk of disclosing personal data relating to a third party, or where the party making the request is not who they claim to be. Wrongful disclosure in such circumstances will be a breach of the DPL but could also trigger criminal liability under other laws in the UAE. Data security and impact assessments Like most data protection laws, the DPL is not prescriptive as to specific data security standards that must be met, however both controllers and processors are responsible for establishing and taking appropriate technical and organisational measures to protect the data to a level commensurate with the risk. This will be a different standard for a small local shop and a multinational sophisticated IT service provider. Given that a risk-based approach is mandated, controllers and processors will need to assess the risks associated with their activities and respond accordingly. Further, the DPL mandates that controllers must undertake an impact assessment before conducting any new processing using technologies that could pose a high risk to the privacy and confidentiality of the personal data. The DPL specifies that such circumstances include where the processing involves a systematic and comprehensive assessment of the personal aspects of the data subject based on automated processing, including profiling, which would have legal consequences or would seriously affect the data subject, or if the processing will be made on a large amount of Sensitive Personal Data. There are minimum content requirements for an impact assessment. Controllers should have in place a process to enable its business units and compliance stakeholders to assess when an impact assessment is necessary and to properly conduct such assessment, and should have templates for such assessments and a process for logging and retaining the assessments. Cross-border data transfer Article 22 of the DPL suggests that the UAE Data Office will designate certain territories as adequate for the purposes of data transfers from the UAE and that the UAE may enter into bilateral or multilateral agreements for such purposes. In the absence of such decisions and agreements, Article 23 of the DPL provides further grounds on which international data transfers may be lawfully implemented. The grounds are: a contract or agreement is in place between the transferer and transferee which obliges the transferee to implement provisions equivalent to those required under the DPL and which make the controller or processor subject to the jurisdiction of a competent supervisory or judicial authority in the country of the transferee. It is not entirely clear what is required under this provision to ensure compliance. It may be that the UAE Data Office publishes a set of “model” clauses in order for UAE-based entities to demonstrate this provision is satisfied. Such model clauses would be useful to give certainty to businesses in this regard. the express consent of the data subject has been obtained, provided that this cannot be relied on if the transfer could conflict with national security or public interests. Presumably this consent can be withdrawn, therefore consent may not be appropriate for large-scale business-as-usual transfers. the transfer is necessary to fulfil obligations and establish, exercise or defend rights before judicial authorities. the transfer is necessary to enter into or execute a contract between the controller and data subject, or between the controller and a third party to achieve the data subject’s interest. Further guidance on how to assess the data subjects’ interest would be useful, in relation to this provision. the transfer is necessary to perform a procedure relating to international judicial cooperation. the transfer is necessary to protect the public interest. It is worth noting that the relevant provisions of the DPL apply to transfers out of the State. It can therefore be inferred that transfers from “mainland” UAE into the DIFC or ADGM are not subject to the rules relating to transfers in the DPL. This is in contrast with the positions adopted in DIFC and ADGM for the reverse transfer; transfers of personal data out of those freezones to other parts of the UAE are treated in the same way as international transfers (although each of those two financial free zones recognises the other as adequate for transfer purposes). Violations and penalties Complaints can be filed with the UAE Data Office by any data subject. We assume the UAE Data Office will also conduct proactive investigations and audits, however the way it will discharge it functions under the Data Office Law, and how quickly it will be in a position to do so, remains to be seen. The Data Office Law provides that the Telecommunications and Digital Government Regulatory Authority in the UAE will provide assistance to the UAE Data Office during its infancy. The DPL does not specify the penalties for violation. It states that the Federal Cabinet will take account of proposals made by the UAE Data Office and will then issue a decision specifying the administrative penalties for violations of the DPL. It is therefore hard for controllers or processors to assess the likely financial impact of violating the law at this time, however it is important to understand that regulatory sanctions are often a relatively small part of the cost of a data breach. A serious data breach will require a controller or processor to incur material costs in investigating and managing the breach. Other costs may include damage to, or inaccessibility of, hardware or demands for ransom payment. Of course, if data is lost or destroyed then that represents loss of a valuable business asset (such as a marketing database or HR information). Further, if a data breach becomes public knowledge – and bear in mind that data breaches will frequently need to be reported to the UAE Data Office and to data subjects – then there are costs associated with harm to business reputation and consumer confidence. Also, the DPL does not repeal other provisions of the UAE’s law which deal with violations of privacy or confidence and which impose criminal penalties. Such laws include the UAE’s cybercrime laws, which have recently been repealed and replaced by Federal Law No. 34 of 2021 Concerning the Fight Against Rumours and Cybercrimes. We have published a separate update on this law, but it is potentially a significant law which includes criminal liability for violating personal data laws in the UAE and its practical intersection with the DPL remains to be seen. Summary and next steps The DPL introduces a comprehensive data regime, similar in scope to regimes such as the GDPR, and brings the UAE in-line with numerous international norms applicable to data protection. The risks under the DPL are commensurate to the volume and sensitivity of data held by businesses in the UAE (and potentially overseas businesses processing UAE-related personal data). Businesses that process a material volume of personal data or are conducting high-risk activities should carefully consider how to approach compliance. Typical compliance programmes will need to involve: understanding and mapping of data ingestion and data transfers; audit of current procedures; audit of current information security processes; development of new procedures, policies, information notices and data processing records; staff training; documenting and potentially improving IT security controls and organisational security controls; reviewing third party contracts and revising contract templates; appointment of a DPO, amongst other things. We will publish a compliance checklist for the DPL and are very happy to discuss any of the issues covered, or how to approach compliance. Please reach out.
1.1 2.1 3.1 3.2 4.1 4.2 4.3 5.1 6.1 7.1 7.2 8.1 9.1 9.2 10.1 11.1 11.2 12.1 13.1 14.1 15.1 16.1 16.2 16.3 17.1 17.2 17.3 17.4 18.1 19.1 19.2 20.1 21.1 21.2 22.1 23.1 23.2 24.1 24.2 25.1 25.2 25.3 25.4 25.5 25.6 25.7 25.8 26.1 27.1 28.1 29.1 30.1 31.1 32.1 33.1 34.1 35.1 36.1 37.1 38.1 39.1 40.1 41.1 42.1 43.1 44.1 45.1 46.1 47.1 48.1 49.1 50.1 51.1 52.1 53.1 53.2 54.1 55.1 56.1 57.1 58.1 59.1 60.1 61.1 61.2 62.1 63.1 63.2 64.1 64.2 65.1 66.1 67.1 68.1 69.1 70.1 71.1 72.1 73.1 74.1 75.1 76.1 77.1 77.2 78.1 78.2 79.1 80.1 81.1 82.1 83.1 84.1 84.2 85.1 86.1 87.1 88.1 88.2 88.3 89.1 90.1 90.2 91.1 92.1 93.1 93.2 94.1 95.1 96.1 96.2 96.3 97.1 98.1 98.2 98.3 98.4 98.5 99.1 99.2 99.3 100.1 100.2 101.1 102.1 102.2 102.3 103.1 104.1 105.1 106.1 107.1 107.2 107.3 107.4 108.1 109.1 109.2 110.1 111.1 112.1 113.1 113.2 114.1 114.2 114.3 115.1 116.1 117.1 118.1 119.1 120.1 121.1 122.1 123.1 124.1 125.1 126.1 126.2 127.1 128.1 129.1 130.1 131.1 132.1 133.1 134.1 135.1 136.1 137.1 138.1
POLITIKA PRIVATNOSTI POLITIKA PRIVATNOSTI TZG Metkovića, sa sjedištem u Metkoviću, Ante Starčevića 3, OIB: 24761712785 (u daljnjem tekstu: TZG Metkovića), poštuje privatnost svake osobe čije osobne podatke prikuplja. Željeli bismo Vas obavijestiti o tome koje osobne podatke TZG METKOVIĆA prikuplja, kako štitimo i koja su Vaša prava. TZG METKOVIĆA zadržava sva autorska prava na korištenje fotografija, tekstova i ostalih objavljenih materijala, u smislu pozitivnih zakonskih propisa u Republici Hrvatskoj. Fotografije, tekstovi i ostali materijal ne smiju se objavljivati, prodavati, javno ili privatno publicirati niti na bilo koji drugi način upotrebljavati bez suglasnosti TZG METKOVIĆA. Svako nepridržavanje prethodnih uvjeta povlači za sobom odgovornost i obvezu naknade nematerijalne štete TZG METKOVIĆ po povredi za pojedini materijal. Temeljne informacije Opseg primjene Ova Politika primjenjuje se na svaku obradu osobnih podataka TZG METKOVIĆA, osim ako je drugom politikom TZG METKOVIĆA drugačije propisano. Iznimno, u odnosu na obradu podataka gostiju i korisnika usluga TZG METKOVIĆA ova Politika ima prednost u odnosu na druge politike ako su tim politikama drugačije propisana prava i obveze u vezi obrade podataka. Voditelj obrade i zakonski okvir TZG METKOVIĆA, kao Voditelj obrade Vaših podataka, poštuje Vašu privatnost te se obvezuje na zaštitu Vaših osobnih podataka. Prikupljanje i čuvanje podataka izvodi se u skladu s odredbama Uredbe EU 2016/679 Europskog parlamenta i Vijeća od 27. travnja 2016. o zaštiti pojedinaca u vezi s obradom osobnih podataka i o slobodnom kretanju takvih podataka (Opća uredba o zaštiti podataka), Zakona o provedbi Opće uredbe o zaštiti podataka (NN 42/2018) i ostalih propisa koji uređuju predmetno područje, a imaju primjenu u Republici Hrvatskoj. Službenik za zaštitu podataka TZG METKOVIĆA je imenovala službenika za zaštitu osobnih podataka kojeg svakodobno možete kontaktirati putem adrese: Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite. odnosno putem pošte na adresu TZG Metković, Ante Starčevića 3, Metković, Republika Hrvatska. Primjena načela zaštite podataka TZG METKOVIĆA u okviru primjene ove Politike posebno pazi na poštivanje načela obrade podataka te obrađuje podatke: - Zakonito – obrada će biti moguća ako je ista dopuštena zakonom i to u granicama koje zakon dopušta. - Pošteno – uvažavajući specifičnosti svakog odnosa, primjenjujući sve adekvatne mjere za zaštitu osobnih podataka i privatnosti općenito te ne sprečavajući ispitanika u ostvarivanju svojih prava. - Transparentno – informirajući ispitanike o obradama osobnih podataka. Od samog prikupljanja podataka kada su ispitanici informirani o svim aspektima obrade podataka pa sve do prestanka obrade podataka ispitanicima se pruža jednostavan i brz pristup vlastitim podacima što uključuje mogućnost uvida i dobivanja kopije u skladu s odredbama Uredbe. Određene informacije mogu se ograničiti samo kada je to zahtijevano zakonom ili kada je to nužno za zaštitu trećih osoba. - Uz ograničenje svrhe – obrađujući osobne podatke u one svrhe u koji su prikupljeni a u druge svrhe ako su za to ispunjeni uvjeti iz Uredbe. Podaci se mogu obrađivati u podudarne svrhe samo uzimajući u obzir (a) svaku vezu između svrha prikupljanja osobnih podataka i svrha namjeravanog nastavka obrade; (b) kontekst u kojem su prikupljeni osobni podaci, posebno u pogledu odnosa između ispitanika i TZG Metkovića; (c) prirodu osobnih podataka, osobito činjenicu obrađuju li se posebne kategorije osobnih podataka u skladu s člankom 9. Uredbe ili osobni podaci koji se odnose na kaznene osude i kažnjiva djela u skladu s člankom 10. Uredbe; (d) moguće posljedice namjeravanog nastavka obrade za ispitanike; te (e) postojanje odgovarajućih zaštitnih mjera. - Uz ograničenje pohrane – pohranjujući podatke u obliku koji omogućuje identifikaciju ispitanika samo onoliko dugo koliko je potrebno u svrhe radi kojih se osobni podaci obrađuju, a duže samo ako je dopušteno Uredbom. - Uz smanjenje količine podataka – obrađujući podatke ako su primjereni, relevantni i ograničeni na ono što je nužno. Posebno se pazi da se ne prikupljaju podaci za koje ne postoji opravdana potreba za obradom. - Vodeći računa o točnosti – vodeći računa o točnosti i ažurnosti podataka i brišući netočne podatke u okviru mogućnosti. - Vodeći računa o cjelovitosti i povjerljivosti – pružajući tehničkim i organizacijskim mjerama odgovarajuću sigurnost osobnih podataka, uključujući zaštitu od neovlaštene ili nezakonite obrade te od slučajnog gubitka, uništenja ili oštećenja primjenom odgovarajućih tehničkih ili organizacijskih mjera. Relevantne mjere primjenjuju se vodeći računa o rizičnosti svake vrste obrade podataka. Dostava podataka trećim subjektima Uvid u osobne podatke gostiju, po potrebi i u ograničenoj mjeri također mogu imati i treće strane, izvršitelji obrade (primjerice suradnici TZG METKOVIĆA koji pružaju informatičke usluge ili druge usluge), koji ih čuvaju u svojim bazama do završetka obrade. S takvim subjektima se sklapa detaljan ugovor u pogledu njihovih ovlasti i obveza kod obrade osobnih podataka, a sukladno zahtjevima Uredbe. U određenim situacijama moguće je da vanjski subjekti zajedno s TZG Metkovića zajednički odrede svrhe i načine obrade osobnih podataka, tada su ti vanjski partneri i TZG Metkovića zajednički voditelji obrade. U tim odnosima, zajednički voditelji obrade na transparentan način određuju svoje odgovornosti za poštovanje obveza iz Uredbe, osobito s obzirom na ostvarivanje prava ispitanika i svojih dužnosti poštivanja transparentnosti obrade, osim ako su odgovornosti zakonom utvrđene. Ako u okviru obrade podataka dolazi do iznošenja podataka u treće zemlje, TZG Metkovića osigurava poštivanje visokih standarda zaštite kako bi se poštovao najviši moguć standard zaštite osobnih podataka, a u skladu sa strogim zahtjevima Uredbe. U tom smislu, kada su u primjeni međunarodni prijenosi osobnih podataka, TZG Metkovića će informirati ispitanika o namjeri iznošenja osobnih podataka trećoj zemlji ili međunarodnoj organizaciji te o postojanju ili nepostojanju odluke Europske komisije o primjerenosti. Ujedno, uputit će se ispitanika na prikladne ili odgovarajuće zaštitne mjere i načine pribavljanja njihove kopije ili mjesta na kojem su stavljene na raspolaganje ako prijenos podliježe odgovarajućim zaštitnim mjerama prema članku 46. Uredbe, primjeni obvezujućih korporativnih pravila prema članku 47. Uredbe ili ako je primjenjiv članak 49. stavak 1. podstavak 2. Uredbe. Svaki prijenos osobnih podataka u treće zemlje bit će izvršen u skladu s poglavljem V. Uredbe. Svrha prikupljanja Neke Vaše osobne podatke TZG Metkovića je dužna skupljati zbog ispunjenja ugovora o smještaju i zbog propisa koji uređuju ugostiteljsku djelatnost, no neke druge ili iste podatke TZG Metkovića može skupljati i za druge svrhe prvenstveno radi kontakta, odnosno: - ispunjenja ugovora o smještaju - ispunjavanja zahtjeva zakona i ostalih važećih pozitivnih propisa koji uređuju ugostiteljsku djelatnost - u svrhe direktnog marketinga - slanja ponuda i informacija o radu - u svrhe održavanja nagradnih igara - u svrhe unapređenja i personaliziranja usluge Vama kao gostu i članu - u svrhe zaštita imovine i sigurnosti pojedinaca primjenom mjera video nadzora TZG Metkovića jamči da će se prikupljenim podacima koristiti samo u navedene svrhe. TZG Metkovića može koristiti depersonalizirane podatke u statističke svrhe. Pravna osnova prikupljanja Pravna osnova za navedene svrhe prikupljanja su: - zakonska, - ugovorna, - ključni interesi ispitanika, - legitimni interes koji je jači od interesa ispitanika ili - privola ili izričita privola ispitanika,ovisno o svrsi obrade i vrsti osobnog podatka Mjesta prikupljanja podataka TZG Metkovića prikuplja vaše podatke tijekom: - prilikom ispunjavanja zakonske obveze prijave - prijava u eVisitor, ispunjavanjem registracijske kartice - sudjelovanja u nagradnoj igri ispunjavanjem anketnog obrasca Vrijeme čuvanja podataka Podatke koje TZG Metkovića prikuplja na temelju zakona, dužan je čuvati onoliko vremena koliko određuje pojedini zakon ili drugi pozitivni propis. Podatke koje TZG Metkovića prikuplja na temelju ugovornog odnosa čuvat će samo koliko je potrebno u svrhu ispunjenja ugovora odnosno pružanja usluge. Podatke o imenu, prezimenu i e-mail adresi koje TZG Metkovića prikupi temeljem legitimnog interesa u svrhe izravnog marketinga čuvat će u svojoj bazi gostiju 10 godina. Ostale podatke koje TZG Metkovića prikuplja temeljem izričite privole gosta (broj mobitela, broj djece, bračni status, kućni ljubimci, interesi, način putovanja, preferencija smještaja i preferencija destinacije) čuvat će u svojoj bazi gostiju 5 godina. TZG Metkovića također može, temeljem Vaše izričite privole prikupljati i pohraniti podatke o sadržaju koje pregledavate na web stranicama (tzv. cookies), te će ih u tom slučaju čuvati u svojoj bazi u razdoblju od 2 godine. Navedeni podatak TZG Metkovića će koristiti u svrhu obavještavanja o posebnim i personaliziranim ponudama, vijestima i događajima koje organizira putem online kanala (e-mail, web, internet promocija). Prava ispitanika Bez obzira na osnovu prikupljanja podataka, svakodobno možete besplatno tražiti: - pristup, izmjenu ili dopunu podataka u svim bazama osobnih podataka, temeljem čega će TZG Metkovića omogućiti pristup ili izmijeniti vaše podatke u svim svojim bazama ovisno o Vašem zahtjevu, - brisanje ("pravo na zaborav") osobnih podataka u svim bazama osobnih podataka, temeljem čega će Vas TZG Metkovića brisati iz svih svojih baza, osim iz baza koje je TZG METKOVIĆA Dužno imati i čuvati na temelju pozitivnih propisa, te ako ne postoje jači legitimni razlozi za obradu ili ako obrada nije nužna za postavljanje, ostvarivanje ili obrane pravnih zahtjeva, - da se podaci koje smo o Vama prikupili prenesu Vama ili trećim osobama („pravo na prenosivost podataka “), u skladu s pozitivnim zakonskim propisima, - ako su podaci dani na temelju privole, uvijek možete tu privolu povući bez negativnih posljedica, - pravo na podnošenje prigovora nadzornom tijelu – Agenciji za zaštitu osobnih podataka (više o tomu na www.azop.hr) Svoj pisani zahtjev uputite na kontakt adresu službenika za zaštitu osobnih podataka: Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite. odnosno putem pošte na adresu TZG Metković, Ante Starčevića 3, Metković, Republika Hrvatska. Osobni podaci koji se prikupljaju od osoba koje prijavljuju boravak u eVisitor Vaše osobne podatke koje morate dostaviti da bi Vam se pružila usluga smještaja, TZG Metkovića kao voditelj obrade čuva u svojoj bazi podataka isključivo u svrhu ispunjavanja zakonskih obveza dostave, kao i prikupljanja osobnih podataka vezanih uz ugostiteljsku djelatnost, te ih može koristiti i u druge svrhe predviđene pozitivnim propisima. U slučaju da ne ustupite TZG Metković minimum podataka potreban za prijavu gosta u svim nadležnim registrima, TZG Metkovića ovlaštena je obavijestiti nadležne službe sukladno zakonu. Osobne podatke koje TZG Metkovića evidentira prikupljeni su temeljem zakona koji uređuju ugostiteljsku djelatnost, te u svrhu pružanja usluge gostima. To su sljedeći podaci (koji se mogu mijenjati obzirom na pozitivne propise): - ime i prezime - adresa prebivališta (hrvatski državljani) - datum rođenja - broj, vrsta identifikacijskog dokumenta i mjesto izdavanja - državljanstvo - ime objekta - broj smještajne jedinice - datum dolaska i odlaska gosta Navedene podatke TZG Metkovića čuva u svojoj bazi gostiju E-visitor (elektronski sustav za prijavu gostiju) nadležnim tijelima Republike Hrvatske, te se navedeni podaci moraju čuvati u sustavu 10 godina. Nadalje, radi ispunjavanja zakonske obveze, TZG Metkovića prikuplja pri otvaranju novog objekta, kao i na registracijskoj kartici prilikom dolaska u objekt, sljedeće podatke: - jezik Ostali podaci vezani uz okolnosti Vašeg boravka kao što su na primjer: način putovanja, s kime putujete, bračno stanje, broj djece, kućni ljubimci, ostali interesi, također će biti prikupljeni ako imaju izravnu vezu s pružanjem usluge smještaja, te će biti brisani nakon Vašeg odlaska iz smještajnog objekta. Vaše osobne podatke (ime i prezime, e-mail adresa), TZG Metkovića kao voditelj obrade ima pravo temeljem legitimnog interesa prikupljati u svoju bazu gostiju i koristiti u svrhu direktnog marketinga i to isključivo u svrhu obavještavanja o ponudama i vijestima TZG Metkovića putem e-maila. U ovom slučaju imate pravo u bilo koje vrijeme i besplatno zahtijevati brisanje (pravo na zaborav) iz baze podataka u tu svrhu. Za vrijeme i nakon boravka, TZG Metkovića Vama kao gostu putem e-maila kojeg smo dobili od Vas, može poslati upitnik o zadovoljstvu koji, ukoliko ga želite ispuniti, dakle isključivo uz vašu privolu, upitnik obrađuje društvo koje odabere TZG Metković, i koji javno objavljuje podatke iz upitnika prema svojim pravilima i politikama za koje TZG Metkovića nije odgovorna. Primarna svrha upitnika o zadovoljstvu je prikupljanje podataka o usluzi radi unaprjeđenja usluge od strane TZG Metkovića te TZG Metkovića te podatke iz upitnike depersonalizira i obrađuje u statističke svrhe. Dodatno, osoba koja rezervira smještaj odnosno gost može dati posebno dopuštenje, privolu, TZG Metković, da sve njegove podatke, poput: - ime - prezime - datum rođenja - država prikuplja i koristi radi daljnjeg profiliranja ispitanika i u svrhu kontaktiranja i obavještavanja o posebnim i personaliziranim ponudama, vijestima i događajima koje organizira TZG Metkovića putem online kanala (e-mail, web, internet promocija). U ovom slučaju ispitanik ima pravo svakodobno povući danu privolu, što uključuje i obradu u svrhe izrade profila u mjeri u kojoj je povezana s takvim izravnim marketingom, bilo u odnosu na početnu ili daljnju obradu, u bilo koje vrijeme i besplatno kao i pravo u svako doba na promjenu podataka i pravo na zaborav. Podaci se čuvaju u bazi gostiju TZG Metkovića5 godina. TZG Metkovića također može prikupljati osobne podatke putem sustava videonadzora. Osobni Podaci koji se prikupljaju prilikom sudjelovanja u nagradnoj igri / popunjavanja anketnog obrasca TZG Metkovića može povremeno organizirati i nagradne igre, u kojem slučaju će prikupljati Vaše osobne podatke samo ako se odlučite sudjelovati u nagradnoj igri. Podaci koji će se na taj način prikupljati i koji su nužni za sudjelovanje u nagradnoj igri, bit će određeni Pravilima nagradne igre, pri svakoj zasebnoj nagradnoj igri, te mogu biti različiti. Tako prikupljeni podaci temeljem svojevrsne ugovorne obveze koristit će u svrhu provođenja nagradne igre, sukladno pravilima nagradne igre. te brisani u roku od 5 godina nakon završetka nagradne igre. U slučaju da ispunite anketni obrazac za nagradnu igru s podacima koji nisu nužni za sudjelovanje u nagradnoj igri, (podaci mogu biti različiti u različitim nagradnim igrama) TZG Metkovića sve te depersonalizirane podatke može koristiti u statističke svrhe. Podatke o imenu, prezimenu i e-mail adresi, koje ispunite u anketnom obrascu za nagradnu igru, TZG Metkovića ima pravo temeljem legitimnog interesa prikupljati i koristiti u svrhu direktnog marketinga i to isključivo u svrhu obavještavanja o ponudama i vijestima TZG Metkovića putem e-maila. U ovom slučaju ispitanik ima pravo prigovora na takvu obradu, uključujući izradu profila u mjeri u kojoj je povezana s takvim izravnim marketingom, bilo u odnosu na početnu ili daljnju obradu, u bilo koje vrijeme i besplatno. Navedeni podaci se čuvaju u bazi gostiju TZG Metkovića 10 godina. Ispitanik ima pravo na promjenu podataka i pravo na zaborav. Dodatno, osoba koja sudjeluje u nagradnoj igri može dati posebno dopuštenje, privolu, TZG Metković da sve njegove podatke koje daje ispunjavajući anketni obrazac za nagradnu igru (podaci mogu biti različiti u različitim nagradnim igrama) TZG Metkovića prikuplja i koristi radi daljnjeg profiliranja ispitanika i u svrhu kontaktiranja i obavještavanja o posebnim i personaliziranim ponudama, vijestima i događajima koje organizira TZG Metkovića putem online kanala (e-mail, web, internet promocija). U ovom slučaju ispitanik ima pravo svakodobno povući danu privolu, što uključuje i obradu u svrhe izrade profila u mjeri u kojoj je povezana s takvim izravnim marketingom, bilo u odnosu na početnu ili daljnju obradu, u bilo koje vrijeme i besplatno kao i pravo u svako doba na promjenu podataka i pravo na zaborav. Podaci se čuvaju u bazi gostiju TZG Metkovića 5 godina. Kolačići (cookies) i internetske tehnologije Kao što je slučaj i s mnogim drugim portalima, i naš se može koristiti „kolačićima“ (male datoteke koje spremamo na Vaše računalo pri pristupanju našim internetskim stranicama kako bi se omogućila osnovna ili dodatna funkcionalnost tih stranica) i drugim tehnologijama koje nam olakšavaju isporučivanje sadržaja ovisno o Vašim područjima interesa, obrađivanje rezervacija ili zahtjeva, i/ili analiziranje karakteristika Vaših posjeta. Kolačići se ne mogu upotrebljavati za otkrivanje Vašeg osobnog identiteta. Kad pristupate našim web-stranicama, ova informacija našim poslužiteljima identificira svojstva vašeg pretraživača, ali ne i Vas. Koristimo različite vrste kolačića: - Neophodni kolačići – oni su nužni za funkcioniranje web stranice, a koja bez njih ne može funkcionirati. To znači da se internetska stranica bez tih kolačića ne može otvoriti niti prikazati. Ovi kolačići se koriste za svrhu transmisije komunikacije ili su nužni za pružanje usluge informacijskog društva koja je izrijekom zahtijevana od korisnika takve usluge. Također, ovi kolačići će nam omogućiti bazičnu analizu web stranica s ciljem poboljšanja rada web stranica putem podataka koji su u potpunosti anonimizirani, odnosno nisu bazirani na vašim osobnim podacima ili podacima koje je moguće na bilo koji način povezati s vama. Za ove kolačiće nije potrebna i ne tražimo Vašu privolu. - Funkcionalni kolačići – pomoću njih provodimo napredniju analizu rada web stranica. Ovi kolačići služe analizi ponašanja korisnika te na temelju dobivenih anonimnih podataka možemo utvrditi što posjetitelji internetske stranice najviše žele i pregledavaju, pa smo onda u mogućnosti prilagoditi internetsku stranicu i učiniti njezin sadržaj i funkcionalnost što jednostavnijem za korištenje. Za ove kolačiće tražimo Vašu privolu. - Oglašivački kolačići – pomoću njih analiziramo Vaše interese i želje, a oni nam služe kako bismo Vam plasira informacije koje su Vama zanimljive i kreirali ponude prilagođene Vašem korištenju internetskih stranica TZG Metkovića. Za ove kolačiće tražimo Vašu privolu. TZG Metkovića pohranjuje kolačiće u bazu i da ih čuvamo najduže 2 godine u svrhu obavještavanja o posebnim i personaliziranim ponudama, vijestima i događajima koje organizira putem online kanala (e-mail, internet, internetske promocija). Ukoliko ste se predomislili vezano za postavke kolačića na web stranicama TZG Metkovića u bilo kojem trenutku ih možete promijeniti. Uvijek možete obrisati kolačiće koje su spremljeni na Vašem računalu, na taj način onemogućavate daljnju obradu Vaših osobnih podataka putem takve tehnologije. Svaki internetski preglednik ima svoj postupak brisanja kolačića, a ovdje donosimo postupke za najpopularnije internetske preglednike: Google Chrome: https://support.google.com/chrome/answer/95647?co=GENIE.Platform%3DDesktop&hl=hr Mozilla Firefox: https://support.mozilla.org/hr/kb/Brisanje%20kola%C4%8Di%C4%87a Microsoft Edge: https://privacy.microsoft.com/en-us/windows-10-microsoft-edge-and-privacy Zaštita osobnih podataka djece TZG Metkovića savjetuje roditeljima i skrbnicima da poduče djecu o sigurnom i odgovornom postupanju s osobnim podacima na internetu. TZG Metkovića ne želi i nema namjeru prikupljati osobne podatke djece, neće ih ni na koji način rabiti niti će ih odati trećima. Dijete može dati svoju privolu isključivo u odnosu na eventualne usluge informacijskog društva i to dijete starije od 16 godina. Svaka druga obrada podataka djece ispod navedene dobne granice i druga obrada osim izričito navedene ovdje, za djecu do 18 godine života, dozvoljena je TZG Metković isključivo uz prethodnu privolu roditelja. Promjena podataka U svakom nam se trenutku možete obratiti radi pregleda svojih osobnih podataka, kao i radi ažuriranja, ispravka ili brisanja podataka. Do tog se trenutka u navedene svrhe koristimo Vašim prethodno evidentiranim podacima. Vaša suglasnost Prilikom davanja informacija TZG Metković, na bilo koji način, jamčite nam da su informacije koje ste priložili točne, da ste poslovno sposobni i ovlašteni raspolagati danim informacijama te da ste u cijelosti suglasni da TZG Metkovića Vaše podatke upotrebljava i prikuplja u skladu sa zakonom i uvjetima ove politike privatnosti. Tehnička i integrirana zaštita podataka TZG Metkovića, kao voditelj obrade vodi računa o najvišim organizacijskim i tehničkim standardima zaštite podataka. Stoga, uzimajući u obzir najnovija dostignuća, trošak provedbe te prirodu, opseg, kontekst i svrhe obrade, kao i rizike različitih razina vjerojatnosti i ozbiljnosti za prava i slobode pojedinaca koji proizlaze iz obrade podataka, u vrijeme određivanja sredstava obrade i u vrijeme same obrade, provodi odgovarajuće tehničke i organizacijske mjere za omogućavanje učinkovite primjene načela zaštite podataka. Također, TZG Metkovića provodi odgovarajuće tehničke i organizacijske mjere kojima se osigurava da integriranim načinom budu obrađeni samo osobni podaci koji su nužni za svaku posebnu svrhu obrade. Tu mjeru TZG Metkovića primjenjuje na količinu prikupljenih osobnih podataka, opseg njihove obrade, razdoblje pohrane i njihovu dostupnost. Točnije, takvim se mjerama osigurava da osobni podaci nisu automatski, bez intervencije pojedinca, dostupni neograničenom broju pojedinca. Evidencije o aktivnostima obrade TZG Metkovića kao voditelj obrade vodi evidencije o aktivnostima obrade sa sljedećim podacima: - ime i kontaktne podatke voditelja obrade, ako je primjenjivo, zajedničkog voditelja obrade, i službenika za zaštitu podataka; - svrhe obrade; - kategorije primatelja kojima su osobni podaci otkriveni ili će im biti otkriveni, uključujući primatelje u trećim zemljama ili međunarodne organizacije; - ako je primjenjivo, prijenose osobnih podataka u treću zemlju ili međunarodnu organizaciju, uključujući identificiranje te treće zemlje ili međunarodne organizacije te, u slučaju prijenosa iz članka 49. stavka 1. drugog podstavka, dokumentaciju o odgovarajućim zaštitnim mjerama; - ako je to moguće, predviđene rokove za brisanje različitih kategorija podataka; - ako je moguće, opći opis tehničkih i organizacijskih sigurnosnih mjera Postupanje po povredama osobnih podataka TZG Metkovića kao voditelj obrade osigurava da slučaju povrede osobnih podataka bez nepotrebnog odgađanja i, ako je izvedivo, najkasnije 72 sata nakon saznanja o toj povredi, izvješćuje nadležno nadzorno tijelo o povredi osobnih podataka, osim ako nije vjerojatno da će povreda osobnih podataka prouzročiti rizik za prava i slobode pojedinaca. Izvješće koje se dostavlja nadzornom tijelu sadržava sve informacije sukladno Uredbi. U slučaju povrede osobnih podataka koje će vjerojatno prouzročiti visok rizik za prava i slobode pojedinaca, TZG Metkovića kao voditelj obrade bez nepotrebnog odgađanja obavješćuje ispitanika o povredi osobnih podataka. Ispitanike se neće obavijestiti u slučajevima kada Uredba propisuje da isto nije obvezno. Procjena učinka na zaštitu podataka Ako je vjerojatno da će neka vrsta obrade, osobito putem novih tehnologija i uzimajući u obzir prirodu, opseg, kontekst i svrhe obrade, prouzročiti visok rizik za prava i slobode ispitanika, TZG Metkovića kao voditelj obrade, prije obrade provodi procjenu učinka predviđenih postupaka obrade na zaštitu osobnih podataka. Jedna procjena može se odnositi na niz sličnih postupaka obrade koji predstavljaju slične visoke rizike. TZG Metkovića provodi procjenu učinka na zaštitu podataka u slučaju: - sustavne i opsežne procjene osobnih aspekata u vezi s pojedincima koja se temelji na automatiziranoj obradi, uključujući izradu profila, i na temelju koje se donose odluke koje proizvode pravne učinke koji se odnose na pojedinca ili na sličan način značajno utječu na pojedinca; - sustavnog praćenja javno dostupnog područja u velikoj mjeri, - u drugim situacijama koje određuje nadležno nadzorno tijelo. TZG Metkovića osigurava adekvatnu uključenost službenika za zaštitu podataka u postupku procjene učinka. U skladu s odredbama Uredbe, po potrebi nakon postupka procjene učinka provest će se postupak prethodnog savjetovanja s nadzornim tijelom. Transparentnost Ova Politika privatnosti dostupna je na stranicama www.tzmetkovic.hr te također i u prostorima TZG Metković. Ako odlučimo mijenjati svoju politiku privatnosti, promjene ćemo postaviti i objaviti na internet stranicama www.tzmetkovic.hr te također i u prostorima TZG Metković.