{"id":8437,"date":"2026-02-19T09:17:45","date_gmt":"2026-02-19T09:17:45","guid":{"rendered":"https:\/\/www.pasaric.hr?p=8437"},"modified":"2026-05-19T12:30:12","modified_gmt":"2026-05-19T12:30:12","slug":"pravila-zastite-podataka-i-privatnosti3","status":"publish","type":"page","link":"https:\/\/www.pasaric.hr\/en\/pravila-zastite-podataka-i-privatnosti3\/","title":{"rendered":"PRAVILA ZA\u0160TITE PODATAKA I PRIVATNOSTI"},"content":{"rendered":"<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>VULKANIZACIJA PASARI\u0106 d.o.o.<\/strong> \u2014 during the conduct of all its business processes \u2014 places great importance on information security management, taking into account the requirements and expectations of all interested parties.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">The management of VULKANIZACIJA PASARI\u0106 d.o.o. commits that through continuous investment in employee knowledge, establishing a framework for achieving high information security goals, planning, implementing and continuously monitoring the information security management system, complying with all legislative and regulatory requirements as well as all contractual obligations and professional standards:<\/p>\n<ul class=\"[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3\">\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">all information received from all interested parties will be treated at the highest security level in terms of their protection;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">information will be protected from any unauthorized access;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">confidentiality of information will be ensured;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">integrity of information will be maintained;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">availability of information for business processes will be ensured and monitored;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">legislative and regulatory requirements will be met;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">business continuity plans will be regularly maintained and tested;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">information security training will be available to all employees;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">all actual and suspected security breaches will be processed and thoroughly investigated.<\/li>\n<\/ul>\n<hr class=\"border-border-200 border-t-0.5 my-3 mx-1.5\" \/>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>DEFINITIONS<\/strong><\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>Process Owner:<\/strong> a person appointed by an authorized person in the Organization, who is responsible within a defined scope for monitoring and ensuring compliance of personal data processing with the Data Protection Regulation. Each Process Owner may, in accordance with their authority, appoint another Process Owner depending on needs and the managerial role they hold within their specific function and department. Such appointment must specify the tasks for which the delegated person is responsible.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>Advisor:<\/strong> a person\/function whose primary role is to provide advice and support on matters related to compliance with the Data Protection Regulation.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>User:<\/strong> a person who, as an employee or associate of the Organization, is involved in any procedure relating to personal data processing in the course of their work duties.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>Data Subject:<\/strong> a natural (and where specifically provided \u2014 legal) person whose personal data is processed by the Organization or any of its bodies.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>&#8220;Personal Data&#8221;:<\/strong> all data relating to an individual whose identity is established or can be established (&#8220;data subject&#8221;); an identifiable individual is a person who can be identified directly or indirectly, in particular by reference to identifiers such as a name, identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>Special Categories of Personal Data:<\/strong> personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as the processing of genetic and biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person&#8217;s sex life or sexual orientation, and data related to criminal or misdemeanor proceedings.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>Processing:<\/strong> any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction, including the implementation of logical, mathematical and other operations on personal data or sets of personal data.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>Profiling:<\/strong> any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to an individual, in particular to analyze or predict aspects concerning that individual&#8217;s work performance, economic situation, creditworthiness, health, personal preferences, interests, reliability, behavior, location or movements.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>Consent for Processing:<\/strong> means any freely given, specific, informed and unambiguous indication of the data subject&#8217;s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them. This could include ticking a checkbox when visiting a website, or a statement or behavior that clearly indicates that the data subject accepts the proposed processing of their personal data. Silence, a pre-ticked box or inaction should therefore not constitute consent.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>Data Processor:<\/strong> a subject (organization or individual, administrative or other body) that processes personal data on behalf of the data controller. Data Processors are entities outside the Organization that process data on behalf of the latter. Entities within the Organization may also act as data processors when they carry out processing activities on behalf of a client or another entity.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>Platform:<\/strong> an automated tool that enables the Organization&#8217;s entities to fulfill the requirements of the General Data Protection Regulation, including but not limited to creating and updating the Data Register, notifications and audits, privacy impact assessments, and personal data breach notification.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>Sub-processor:<\/strong> a subject (organization or individual) appointed by the data processor to carry out processing of personal data on behalf of the data controller, supervised by the data processor. Sub-processors are entities outside the Organization that process data on behalf of the Organization&#8217;s clients.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>Data Controller:<\/strong> a subject (organization or individual, administrative or other body) that, alone or jointly with others, determines the purposes and means of processing personal data.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>Personal Data Breach:<\/strong> a security breach leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>Supervisory Authority:<\/strong> the national supervisory authority for personal data protection that is competent for a given matter. Different Supervisory Authorities may be competent for matters relating to the Organization&#8217;s entities, depending on the specifics of each case.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>Organization Entities:<\/strong> depending on context, collectively the Organization&#8217;s entities operating in the EU, which may act as controllers or processors for a given processing activity, depending on the case.<\/p>\n<hr class=\"border-border-200 border-t-0.5 my-3 mx-1.5\" \/>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>RULES FOR ADEQUATE PROCESSING OF PERSONAL DATA<\/strong><\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>PROCESSING OF PERSONAL DATA<\/strong><\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>General Principles of Personal Data Processing<\/strong><\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">Personal data may be processed, with certain exceptions, for the purposes specified in the privacy notice given to a particular data subject.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">Personal data:<\/p>\n<ul class=\"[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3\">\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">must be processed lawfully, fairly and transparently;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">must be collected and recorded for specified, explicit and legitimate purposes and used in processing operations compatible with those purposes;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">must be accurate and, where necessary, kept up to date;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">must be adequate, relevant and not excessive in relation to the purposes for which they are collected and processed;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">must be stored in a form that allows identification of the data subject for no longer than is necessary for the purposes for which they were collected and processed; and<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">must be processed in a manner that ensures appropriate security, including protection by appropriate technical and organizational measures against unauthorized or unlawful processing, loss, destruction or accidental damage.<\/li>\n<\/ul>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">The General Data Protection Regulation requires that the Data Subject be properly informed about the processing of their data as prescribed in Article 13 of the GDPR. The Data Subject must give their free, informed and unambiguous consent to the processing of their personal data if those personal data will be processed for purposes other than the performance of a contract with the Data Subject.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">Every Data Subject must be provided with the opportunity to contact the data controller or the responsible person.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">VULKANIZACIJA PASARI\u0106 D.O.O. has designated a responsible person within its organization entrusted with overseeing compliance with data protection regulations: the &#8220;Data Protection Officer.&#8221;<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">All employees of the Organization are obliged to comply with the rules of the Personal Data Protection Policy. During the term of the employment\/cooperation agreement, each employee or associate must receive \u2014 in addition to the privacy notice describing the modalities of processing their personal data \u2014 this Personal Data Protection Policy as part of the contractual documents by which they are bound, and must specifically accept it and declare that they have reviewed and understood its terms. The purpose of this Personal Data Protection Policy is to inform all Data Subjects of their obligations when processing personal data on behalf of the Organization.<\/p>\n<hr class=\"border-border-200 border-t-0.5 my-3 mx-1.5\" \/>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>Conditions for Processing Personal Data on Behalf of the Data Controller<\/strong><\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">If the organization carries out data processing on behalf of the Data Controller, it must be appointed as the Data Processor by the Data Controller. In accordance with the General Data Protection Regulation, the processing activities carried out by the Processor must be governed by a contract between the Data Controller and the Processor, which shall stipulate the subject matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects, and the obligations and rights of the Data Controller. The said contract must establish that the organization as Processor:<\/p>\n<ul class=\"[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3\">\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">processes personal data only according to clear and documented instructions from the Controller;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">ensures that persons authorized to process personal data have committed themselves to confidentiality;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">takes all appropriate security measures;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">if authorized by the Data Controller to engage sub-processors, imposes the same data protection obligations set out in the contract with the Controller upon the sub-processor;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">taking into account the nature of the processing, assists the Data Controller using appropriate technical and organizational measures, insofar as this is possible, to fulfill the Controller&#8217;s obligation to respond to requests for the exercise of data subjects&#8217; rights;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">assists the Controller in ensuring compliance with obligations under Articles 32\u201336 of the GDPR (security of processing, notification obligation in the event of a personal data breach, data protection impact assessment, portability), taking into account the nature of the processing and the information available to the Processor;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">at the request of the Data Controller, deletes or returns all personal data to the Data Controller upon completion of the provision of services;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">makes available to the Data Controller and the competent privacy supervisory authority all information necessary to demonstrate compliance with data privacy laws.<\/li>\n<\/ul>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">Every Data Subject who, within the scope of their duties, processes personal data on behalf of the Data Controller must ensure that their actions do not go beyond the scope set out in the instrument by which the processor was appointed.<\/p>\n<hr class=\"border-border-200 border-t-0.5 my-3 mx-1.5\" \/>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>INFORMATION ABOUT PERSONAL DATA<\/strong><\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">Every data subject must receive from the Data Controller all information relating to the processing of their personal data as required by the General Data Protection Regulation. Such privacy information must be presented at the time of collection of personal data. If personal data is obtained from a third party, the privacy information must be delivered:<\/p>\n<ul class=\"[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3\">\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">within a reasonable time after obtaining the personal data, but in any case no later than one month after collection, taking into account the specific circumstances under which the personal data is processed;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">if the personal data is intended for communication with the data subject, no later than at the time of the first possible contact; or<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">if communication is intended with another recipient, no later than at the time of the first communication or collection of personal data.<\/li>\n<\/ul>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">The privacy notice must contain certain information required by the General Data Protection Regulation, including, among other things, the purposes for which personal data are processed, details about the processor, the data subject&#8217;s ability to exercise their rights under the GDPR, the data retention period, and the ability to lodge a complaint with the competent privacy supervisory authority.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">Only the Data Controller must provide privacy information to data subjects, while the Data Processor must process personal data on behalf of the Data Controller in accordance with the Controller&#8217;s instructions and only for the purposes specified by the Data Controller in the written appointment of the Processor.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">When acting as data controllers, VULKANIZACIJA PASARI\u0106 d.o.o. must deliver privacy information to data subjects.<\/p>\n<hr class=\"border-border-200 border-t-0.5 my-3 mx-1.5\" \/>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>CONSENT OF THE DATA SUBJECT<\/strong><\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">The data subject&#8217;s consent is required for processing personal data in all cases, except in the cases defined below under Articles 6 and 9 of the General Data Protection Regulation.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">Processing of personal data that does not constitute special categories of personal data is permitted without the data subject&#8217;s express consent if one of the following conditions exists:<\/p>\n<ul class=\"[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3\">\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">when processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">processing is necessary for compliance with a legal obligation to which the controller is subject;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">processing is necessary in order to protect the vital interests of the data subject or of another natural person;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, especially where the data subject is a child.<\/li>\n<\/ul>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">In addition to the above, processing of special categories of personal data is permitted without the explicit consent of the data subject in the following cases:<\/p>\n<ul class=\"[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3\">\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment law and social security and social protection law (including collective agreements);<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">processing is necessary to protect the life or health of the data subject or of another individual when the data subject is physically or legally incapable of giving consent;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">processing is carried out in relation to their legitimate activities, with appropriate safeguards;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">processing is necessary for the purposes of preventive medicine, medical diagnosis, health management or health services, provided that the personal data are processed by health professionals on the basis of specific regulations and rules of competent authorities;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">processing is necessary for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes, proportionate to the aim pursued and which respects the essence of the right to data protection and provides appropriate and specific measures to safeguard the fundamental rights and interests of the data subject;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">processing relates to personal data which are manifestly made public by the data subject;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">processing is necessary for reasons of substantial public interest.<\/li>\n<\/ul>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">For any processing of personal data for purposes not related to the performance of a contract or law, and in all cases where processing of personal data is carried out for purposes not connected to the specific contract to which the privacy policy relates: explicit and separate consent must be requested from the data subject (e.g. for marketing, promotional purposes, profiling, etc.).<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">Regarding services provided on websites, applications, etc., either confirmation that the data subject is not under 16 years of age \u2014 or a lesser age if so specified by applicable law in the Republic of Croatia \u2014 or parental\/guardian approval must be obtained in relation to services provided to minors.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">The data subject&#8217;s explicit consent must be given in paper or electronic form such that there is appropriate unambiguous evidence that consent was given.<\/p>\n<hr class=\"border-border-200 border-t-0.5 my-3 mx-1.5\" \/>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>DATA SUBJECT RIGHTS<\/strong><\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">Data subjects may request the exercise of their rights by submitting their request in writing by email or by post to the registered address of the contact person designated by VULKANIZACIJA PASARI\u0106 d.o.o. for this purpose, or in person at the organization&#8217;s registered address.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">All data subject requests should be forwarded to the Data Protection Officer within the Organization.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">Likewise, if a data subject&#8217;s request is addressed to a third party (e.g. an IT provider or marketing agency) that processes the data subject&#8217;s personal data on behalf of the Organization, that third party must immediately forward the request to the person within the Organization responsible for that contract, who will then notify the Data Protection Officer. The above obligations (to notify the Controller) must be included in contracts between the Organization\/controller and the third party\/processor. The Data Protection Officer must verify the identity of the data subject who submitted the request and compare the data contained in the request with data already held by VULKANIZACIJA PASARI\u0106 d.o.o.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">If discrepancies are found, the data subject must be contacted using available contact details and asked to send identification data.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">After verifying the identity of the data subject, the following must be done:<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">i) immediately record such a data subject request to ensure coordination and involvement of other departments of the Organization that may be relevant \u2014 depending on the request \u2014 in order to enable identification of the personal data that is the subject of the request and to ensure that the request is fulfilled (e.g. in the case of a right to erasure request). Fulfillment of the request is required in respect of all computer systems and documents of the Organization and suppliers. The Data Protection Officer must ensure that compliance with the data subject&#8217;s request is duly recorded.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">ii) Immediately respond to the data subject in writing (by letter or email) within 30 calendar days of the data subject&#8217;s request.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">If the request is particularly complex, the Data Protection Officer must:<\/p>\n<p class=\"font-claude-response-body break-words whitespace-pre-wrap leading-[1.7]\">i) where applicable, within 30 calendar days of the request, explain in writing to the data subject the reasons why an extension of the response deadline is necessary. ii) In any case, respond in writing to the data subject within 60 calendar days of the extension notice.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">No costs may be charged for fulfilling a data subject&#8217;s request, except in cases where the data subject&#8217;s request is manifestly unfounded or excessive, i.e. repetitive, in the case where the data subject requests additional copies beyond those provided on the first request.<\/p>\n<hr class=\"border-border-200 border-t-0.5 my-3 mx-1.5\" \/>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>Right of Access to Personal Data<\/strong><\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">Data subjects have the right to obtain confirmation as to whether or not their personal data is being processed and, if so, have the right to access their personal data as well as information about the following:<\/p>\n<ul class=\"[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3\">\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">the origin of the personal data;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">the purposes of the processing;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">the categories of personal data concerned;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">where possible, the envisaged period for which the personal data will be stored or, if not possible, the criteria used to determine that period;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">the existence of the right to request rectification or erasure of personal data or restriction of processing of personal data concerning the data subject, or to object to such processing (according to the procedures described in this paragraph);<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">the existence of automated decision-making, including profiling and, in that case, the logic applied and the envisaged consequences of such processing for the data subject;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">the recipients or categories of recipients to whom the personal data have been or will be disclosed (in the case of transfer of personal data), in particular recipients in third countries (or international organizations) and, where applicable, the existence of appropriate safeguards for that transfer;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">the right to lodge a complaint with the competent supervisory authority;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">the right to rectification, consolidation and portability.<\/li>\n<\/ul>\n<hr class=\"border-border-200 border-t-0.5 my-3 mx-1.5\" \/>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>Right to Erasure (&#8220;Right to be Forgotten&#8221;)<\/strong><\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">Data subjects have the right to obtain erasure of personal data concerning them where:<\/p>\n<ul class=\"[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3\">\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">the personal data are no longer necessary in relation to the purposes for which they were collected;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">the data subjects withdraw their consent on the basis of which processing is carried out and where there is no other legal basis for the processing;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">the data subjects object to the processing (see section 8.6) \u2014 the data subject lodges an objection to the processing and there are no overriding legitimate grounds for the processing;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">the personal data have been unlawfully processed;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">the personal data must be erased for compliance with a legal obligation; and<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">the personal data were collected in connection with the offer of information society services \u2014 offering information society services directly to a child.<\/li>\n<\/ul>\n<hr class=\"border-border-200 border-t-0.5 my-3 mx-1.5\" \/>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>Right to Restriction of Processing<\/strong><\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">Data subjects may obtain restriction of processing of personal data concerning them, resulting in the data not being usable for a limited period, in the following situations:<\/p>\n<ul class=\"[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3\">\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">when the data subject contests the accuracy of the personal data, for a period enabling the Organization to verify the accuracy of such data;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">when the processing is unlawful and the data subjects oppose the erasure of the personal data and request the restriction of their use instead;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">when the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defense of legal claims in separate proceedings;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">when the data subjects have objected to processing, pending the confirmation from the Organization as to whether the Organization&#8217;s legitimate grounds override those of the data subject.<\/li>\n<\/ul>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">In the above cases, when acting as data controllers, the Organization&#8217;s entities may process the data subject&#8217;s personal data only for storage purposes, in cooperation with the Data Protection Officer and all other relevant services involved for that purpose.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">In these circumstances, apart from storage, VULKANIZACIJA PASARI\u0106 d.o.o. may process the data subject&#8217;s data \u2014 pending the restriction of processing \u2014 only in the following circumstances:<\/p>\n<ul class=\"[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3\">\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">when the data subjects have given their consent;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">for the establishment or defense of legal claims or the protection of the rights of another natural or legal person;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">to safeguard the rights of the Organization;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">for relevant reasons of public interest.<\/li>\n<\/ul>\n<hr class=\"border-border-200 border-t-0.5 my-3 mx-1.5\" \/>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>Right to Data Portability<\/strong><\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">The data subject has the right to receive the personal data concerning them, which they have provided to the Organization, in a structured, commonly used and machine-readable format and has the right to transmit those data to another controller without hindrance from the Organization where:<\/p>\n<ul class=\"[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3\">\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">processing is carried out by automated means;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">processing is based on the consent of the data subject or on the basis of legitimate interest \u2014 a contract to which the data subject is a party; and<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">the data subject is requesting the transfer of data that they themselves provided or generated (excluding information that VULKANIZACIJA PASARI\u0106 d.o.o. derived or inferred on the basis of information provided by the same data subject).<\/li>\n<\/ul>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">The data subject may also request a copy of the processed data provided that this does not adversely affect the rights and freedoms of other data subjects. Such data must be delivered electronically by the process owner to the requesting data subject via email, or in writing in other cases, and details of third parties must be covered or deleted.<\/p>\n<hr class=\"border-border-200 border-t-0.5 my-3 mx-1.5\" \/>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>Right to Object<\/strong><\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">The data subject has the right to object to the processing of personal data concerning them where VULKANIZACIJA PASARI\u0106 d.o.o. processes those data, among other things, for direct marketing purposes, including profiling.<\/p>\n<hr class=\"border-border-200 border-t-0.5 my-3 mx-1.5\" \/>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>Right to Rectification and Consolidation<\/strong><\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">Data subjects have the right to rectification of inaccurate personal data or consolidation of incomplete personal data. Once the data has been corrected, the process owner will send a confirmation by email or in writing to the data subject who submitted the request, and details of third parties must be covered or deleted.<\/p>\n<hr class=\"border-border-200 border-t-0.5 my-3 mx-1.5\" \/>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>Right Not to Be Subject to a Decision Based Solely on Automated Processing<\/strong><\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">Data subjects have the right not to be subject to a decision based solely on automated processing \u2014 i.e. without human intervention \u2014 including profiling, except in cases where:<\/p>\n<ul class=\"[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3\">\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">it is necessary for the purposes of entering into or performance of a contract between the data subject and the data controller;<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">it is based on the data subject&#8217;s explicit consent.<\/li>\n<\/ul>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">The above scenario is envisaged, for example, if during a recruitment process VULKANIZACIJA PASARI\u0106 d.o.o. implemented an automated screening and selection of candidates who were therefore excluded solely based on an automated decision.<\/p>\n<hr class=\"border-border-200 border-t-0.5 my-3 mx-1.5\" \/>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>MANAGEMENT OF PERSONAL DATA<\/strong><\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">Personal data may not be disclosed to a third party unless the data subject has given their consent or unless there is another legal basis for the purpose of data transfer, for example \u2014 if it relates to a third party processing personal data on behalf of the Organization and whose actions are necessary for the performance of a contract with a customer (e.g. IT services) or for the provision of services to a customer (e.g. further follow-up of a customer request).<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">As a general rule, except in the case of specific exceptions under applicable law, personal data may not be transferred outside the European Economic Area unless arrangements compliant with the General Data Protection Regulation that authorize such transfers have been implemented with the data recipient, such as the EU Standard Contractual Clauses for data transfers.<\/p>\n<hr class=\"border-border-200 border-t-0.5 my-3 mx-1.5\" \/>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>DATA RETENTION \/ STORAGE PERIOD<\/strong><\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">We store and process data only for as long as is necessary for the fulfillment of a specific legitimate purpose, unless applicable regulations provide for a longer or shorter retention period for a specific purpose.<\/p>\n<hr class=\"border-border-200 border-t-0.5 my-3 mx-1.5\" \/>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>COOKIES<\/strong><\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">In order to provide Data Subjects and visitors with the best possible functionality and the most interesting content when visiting our websites or the websites of our partners, and in order to create services and offers that meet the needs and wishes of Data Subjects, we use cookies and\/or other common technologies (hereinafter: cookies) that collect certain data of Data Subjects (e.g. the IP address from which the website is accessed, connection time, etc.). Detailed information about the cookies used by a particular website is provided to Data Subjects immediately upon their first visit to the website. Based on this information, the Data Subject, upon visiting the website, gives or withholds their consent to the use of cookies. Cookie settings can always be adjusted in the internet browser. VULKANIZACIJA PASARI\u0106 d.o.o. is not responsible for cookies on other websites not owned by VULKANIZACIJA PASARI\u0106 d.o.o. Information about Data Subjects obtained through cookies will be combined with other data about the Data Subject in order to better understand Data Subjects and provide a better experience, only on the basis of consent.<\/p>\n<hr class=\"border-border-200 border-t-0.5 my-3 mx-1.5\" \/>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>Statement on the Protection of Personal Data Transfers<\/strong><\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>Statement on the Protection of Personal Data Transfers<\/strong><\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">Protection of personal data in accordance with the General Data Protection Regulation of the European Parliament and of the Council No. 2016\/679 and the implementation of the General Data Protection Regulation.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>Stripe Payments Europe, Limited<\/strong>, as the processor carrying out the authorization and charging of credit cards, processes personal data in the capacity of a data processor and handles personal data in accordance with the General Data Protection Regulation of the European Parliament and of the Council No. 2016\/679 and in accordance with the strict rules of PCI DSS L1 regulations on the protection of data entry and transfer. Stripe uses encryption and TLS cryptographic protocols as the highest levels of protection for data entry and transfer.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>WSPay<\/strong>, as the processor carrying out the authorization and charging of credit cards, processes personal data in the capacity of a data processor and handles personal data in accordance with the General Data Protection Regulation of the European Parliament and of the Council No. 2016\/679 and in accordance with the strict rules of PCI DSS L1 regulations on the protection of data entry and transfer. WSPay uses an SSL certificate with 256-bit encryption and the TLS 1.2 cryptographic protocol as the highest levels of protection for data entry and transfer.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">Personal data used for the purpose of authorization and charging, i.e. for the fulfillment of obligations under or pursuant to the Agreement, are considered confidential data. The following personal data of the buyer are required for the performance of the Agreement (authorization and charging):<\/p>\n<ul class=\"[li_&amp;]:mb-0 [li_&amp;]:mt-1 [li_&amp;]:gap-1 [&amp;:not(:last-child)_ul]:pb-1 [&amp;:not(:last-child)_ol]:pb-1 list-disc flex flex-col gap-1 pl-8 mb-3\">\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">First and last name<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">Email<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">Telephone<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">Address<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">City<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">Postal code<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">Country<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">Card type<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">Card number<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">Card expiry date<\/li>\n<li class=\"font-claude-response-body whitespace-normal break-words pl-2\">Card CVV code<\/li>\n<\/ul>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">Stripe and WSPay do not process or use this personal data except for the purpose of performing the authorization and charging agreement.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">Stripe guarantees fulfillment of all conditions established by applicable personal data protection regulations for processors of personal data, as confirmed by the Data Processing Agreement (DPA) available at stripe.com\/legal\/dpa and the PCI DSS L1 certificate.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">WSPay guarantees fulfillment of all conditions established by applicable personal data protection regulations for processors of personal data, and in particular the implementation of all necessary technical, organizational and security measures, as further confirmed by the PCI DSS L1 certificate.<\/p>\n<hr \/>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">All interested parties may submit all questions and requests relating to the processing of their data or anything else related to data privacy in person at the organization&#8217;s location, in writing to the address, or by email to the contact details listed below.<\/p>\n<hr class=\"border-border-200 border-t-0.5 my-3 mx-1.5\" \/>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\"><strong>VULKANIZACIJA PASARI\u0106 d.o.o.<\/strong><\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">Address: Zagreba\u010dka 123, \u0160ibice, 10290 Zapre\u0161i\u0107<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">Email: <a class=\"underline underline underline-offset-2 decoration-1 decoration-current\/40 hover:decoration-current focus:decoration-current\" href=\"mailto:vulkanizacija@pasaric.hr\">vulkanizacija@pasaric.hr<\/a><\/p>\n<hr class=\"border-border-200 border-t-0.5 my-3 mx-1.5\" \/>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">The Privacy Protection Policy is publicly published. It is binding on all our employees.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">Zagreb, 27 June 2019<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal leading-[1.7]\">Directors: Michael Pasari\u0107 and Petra Pasari\u0107<\/p>\n","protected":false},"excerpt":{"rendered":"<p>VULKANIZACIJA PASARI\u0106 d.o.o. \u2014 during the conduct of all its business processes \u2014 places great importance on information security management,<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":3,"comment_status":"closed","ping_status":"open","template":"","meta":{"footnotes":"","_members_access_role":[],"_members_access_error":""},"class_list":["post-8437","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.pasaric.hr\/en\/wp-json\/wp\/v2\/pages\/8437","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.pasaric.hr\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.pasaric.hr\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.pasaric.hr\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.pasaric.hr\/en\/wp-json\/wp\/v2\/comments?post=8437"}],"version-history":[{"count":5,"href":"https:\/\/www.pasaric.hr\/en\/wp-json\/wp\/v2\/pages\/8437\/revisions"}],"predecessor-version":[{"id":76222,"href":"https:\/\/www.pasaric.hr\/en\/wp-json\/wp\/v2\/pages\/8437\/revisions\/76222"}],"wp:attachment":[{"href":"https:\/\/www.pasaric.hr\/en\/wp-json\/wp\/v2\/media?parent=8437"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}