First Hotel on the Sea in Europe Millennium Deluxe doo
JJ Strossmayer 11,
31000 Osijek
OIB: 76862042766
Introductory provisions
This Policy establishes a responsible and transparent framework for ensuring compliance with the General Data Protection Regulation. The policy applies to all organizational parts of "First Hotel on the Sea in Europe Millenium Deluxe doo" (hereinafter PROCESSING MANAGER) and to all employees, including part-time employees and temporary workers, as well as to all external collaborators acting on behalf of the processing manager .
Policy Statement
The processing manager is dedicated to business in accordance with all laws, regulations and the highest standards of ethical business. This policy sets out the provisions of the expected treatment of employees of the data controller and its external collaborators who deal with the collection, use, storage, transmission, publication or destruction of any personal data belonging to employees, business partners of the data controller and other natural persons. The purpose of the policy is to standardize the protection of the rights and freedoms of the data subject by preserving the privacy of his personal data in all aspects of the controller's operations that include personal data. This policy establishes that the PROCESSING MANAGER will not disclose personal data to a third party without authorization, nor act in a way that endangers them.
Principles of personal data processing
The processing manager adopts the following principles to be followed when collecting, using, retaining, transferring and destroying personal data:
LEGITIMACY, FAIRNESS AND TRANSPARENCY
Personal data will be processed legitimately, fairly and transparently towards the respondents. This means that in all relevant situations, the data controller will inform the respondent about how they will process the data (transparency), and the processing will be carried out exclusively in accordance with what was said (fairness) and in accordance with the purpose prescribed in the applicable law on protection personal data (legitimacy).
LIMITATION OF PURPOSE
Personal data will be collected for clearly defined and legitimate purposes and will not be processed in any way inconsistent with these purposes. This means that the data controller must clearly state what the collected data will be used for and limit the processing of personal data to only those processes that are necessary to achieve these purposes.
DATA MINIMIZATION
Collected personal data will be relevant and limited to what is necessary to achieve the purpose of their processing. This means that the controller will not collect, process or store more personal data than is absolutely necessary.
ACCURACY OF DATA
Collected personal data will be accurate and up-to-date, which means that the controller will have developed procedures for detecting and dealing with outdated, inaccurate and unnecessary personal data.
CAREFUL DATA STORAGE
Personal data will not be stored in a form that enables the identification of the respondent for longer than is necessary for the purpose of processing. This means that the data controller, wherever possible, will store personal data in a way that limits or prevents the identification of the respondent.
DATA SECURITY
Personal data will be processed and stored in a way that ensures adequate protection against violations such as unauthorized and illegal processing and accidental loss, destruction or damage of data. The data controller will implement appropriate technological and organizational measures described in the Personal Data Security Policy to ensure the integrity and confidentiality of personal data at all times.
PRIVACY BUILT INTO SYSTEM DESIGN
When designing new and when reviewing and expanding the existing systems and processes of the data controller, care will be taken to apply all these principles in order to protect the privacy of the respondents as much as possible.
Principles of personal data processing
All respondents whose data is collected and processed by the data controller have the following rights:
RIGHT TO ACCESS INFORMATION
Each respondent has the right to a copy of the data that the data controller has in its archive for inspection purposes. In addition to the right to access their own data, the respondent also has the right to information about:
purpose of processing and legal basis for processing
legitimate interest, if processing is based on it
types and categories of collected personal data
to third parties to whom the data is forwarded
data retention period
source of personal data, if they were not collected from the respondents
All information should be provided to the respondent in clear and simple language, to ensure understanding, and must be clearly indicated and visible so that the respondent does not overlook it. There is a possibility that providing the requested information to the respondent may reveal information about another person. In such cases, it is necessary to anonymize the data or completely withhold it in order to protect the rights of that person.
RIGHT TO CORRECTION OF DATA
Every respondent has the right to correct incorrect or incomplete data that the data controller has in its archive.
THE RIGHT TO BE FORGOTTEN
Respondents can request that their data be removed from the archive. The request will be taken into consideration and will be granted if it does not contradict the legal basis of personal data processing.
THE RIGHT TO LIMIT PROCESSING
Data subjects have the right to limit the scope of processing, in cases where this is applicable.
RIGHT TO DATA TRANSFER
Respondents have the right to a copy of the data for transmission to another controller.
RIGHT TO OBJECT
Respondents have the right to object, especially in the case when the processing is based on the legitimate interest of the controller. Then it is necessary to review the purpose of the processing and establish its legal basis and, in cases where it is applicable, enable the subject to withdraw consent for data processing and/or stop processing his data.
RIGHT TO EVALUATION
Respondents have the right to request from the supervisory authority an assessment of violations of the provisions of the Regulation and the internal policies of the data controller.
THE RIGHT TO OBJECT TO PROFILING
Respondents have the right to object to automatic profiling and other forms of automated decision-making. In the event that the data controller rejects the request of the data subject, the reason for the rejection will be stated in the response, which the data subject can appeal to the competent authority for the protection of personal data (AZOP).
Legal basis
The legal bases for the collection and processing of personal data of respondents are as follows:
LEGAL OBLIGATION
The laws governing the business of the obligor prescribe sets of data that are necessary for the execution of the legal obligation. For the collection and processing of data prescribed by law, the data controller will not ask for consent from the subject, but will only collect data prescribed by law and will not use it for other purposes. This especially applies to data collected on the basis of the following laws and their related ordinances, among which we single out:
accounting law
accounting law
Value Added Tax Law
Law on income tax
Labor Law
Rulebook on the content and method of keeping records on workers
PERFORMANCE OF CONTRACTUAL OBLIGATION
Personal data necessary for the fulfillment of the contractual obligation will be collected by the processing manager without the consent of the respondent, in the minimum amount necessary for the fulfillment of the obligation.
LEGITIMATE INTEREST
In the following text, the data controller will publish a list of its legitimate interests on the basis of which it collects and processes personal data for the purpose of enabling and/or improving its services or products.
PROTECTION OF VITAL INTERESTS OF RESPONDENTS
The data controller may collect and process personal data without the consent of the data subject if this is for the purpose of protecting his vital interests.
PUBLIC INTEREST OR EXECUTION OF THE OFFICIAL AUTHORITY OF THE PROCESSING MANAGER
In the case when the activity of the data controller includes activities on behalf of the public interest or the data processing is based on another type of official authority, it is not always necessary to inform the respondent about the collection of personal data.
CONSENT
In all other cases, the data controller will ask for consent from the data subject for the collection and processing of personal data, in which the purpose of the processing will be clearly stated. The subject can withdraw his consent at any time and thus his data must be automatically removed and the processing terminated. The processing manager will keep records of active and withdrawn consents for the purpose of ensuring the correctness of operations.
Legitimate interest
The controller declares the following legitimate interests:
PROTECTION OF PERSONAL DATA GDPR
Respondents have the right to object to the processing of personal data based on these legitimate interests.
Terms and definitions
GENERAL REGULATION ON THE PROTECTION OF PERSONAL DATA (GDPR)
The General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) is a regulation by which the European Parliament, the Council of the European Union and the European Commission intend to strengthen and unify the personal data protection processes of all individuals within the European Union (EU). The regulation also applies to the transfer of personal data outside the EU.
PROCESSING MANAGER
The entity that determines the purpose, conditions and method of personal data processing.
PERFORMER OF PROCESSING
The entity that performs data processing on behalf of the controller.
PERSONAL DATA PROTECTION AGENCY
State agency whose task is to protect data and privacy, supervise the processes of application of the Regulation, and actively implement the Regulation on the protection of personal data within the European Union.
PERSONAL DATA PROTECTION OFFICER
A data protection professional acting independently to ensure that the business entity operates in accordance with the policies and procedures set out under the Regulation.
EXAMINEE
A natural person whose personal data is processed by the manager or executor of data processing.
PERSONAL INFORMATION
Any information related to a natural person, i.e. to the respondent and which can be used to directly or indirectly identify a person.
PERSONAL DATA PROCESSING
Any activity carried out on personal data, whether automatic or not, which includes the collection, use, creation of records and the like.
PROFILING
Any automated data processing for the purpose of evaluating, analyzing or predicting the behavior of the data subject.
RIGHT OF ACCESS OF RESPONDENTS
Known as the 'right of access', it allows the data subject to access personal data concerning him or her held by the data controller.
Legislation
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals in connection with the processing of personal data and on the free movement of such data and on the repeal of Directive 95/46/EC (General Data Protection Regulation)
Law on the Implementation of the General Regulation on Data Protection.
