PRIVACY STATEMENT

1. INTRODUCTION

1.1. The Tourist Association of the Municipality of Štrigova with its registered seat in Štrigova, Štrigova 103, OIB: 08099176598 (hereinafter referred to as: “TZO Štrigova”), considered to be the data controller within the meaning of the General Data Protection Regulation (EU) 2016/679 (SL EU L 119 of 4 May 2016, correction L 127/2 of 23 May 2018, hereinafter referred to as: “the GDPR”) and the Act on the Implementation of the General Data Protection Regulation (Official Gazette 42/2018, hereinafter referred to as: “the Act”).

1.2. Pursuant to the Act on Tourist Associations and the Promotion of Croatian Tourism, TZO Štrigova is an organisation acting according to the principle of destination management. It was established for the purpose of promoting and developing tourism in the Republic of Croatia and economic interests of legal entities and natural persons providing catering services and tourism services or performing other business activities directly related to tourism by managing the destination at the level they were established at.

1.3. We hereby wish to explain transparently and publicly which personal information TZO Štrigova collects, in what manner and to what purpose, what your rights are, including other details relevant for the processing and protection of personal data.

1.4. This Statement is applicable to all personal data collected and processed by INFO PULS either directly or through its associates.

2. DEFINITIONS

2.1. In this Statement, the following terms are used, which have the following definitions according to the GDPR:

- “personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

- “processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

3. HOW WE COLLECT PERSONAL DATA

3.1. TZO Štrigova can collect your personal data in the following ways:

1) if you take part in our Photography Contest;

2) if you contact us – via e-mail or if you submit an application for the use of our services in any other manner or if you request and other information or if you contact us for any other reason;

4) if you have used our ecological footprint calculator, i.e. by answering questions, entering data etc.;

5) if you visit or browse or web app;

6) if third parties have forwarded to us your personal data in the permitted manner or if we collect them from publicly available registers or other databases.

3.2. If you submit to us personal data of other persons, you guarantee that you have the necessary authorisation and/or consent for such disclosure from the same person whose data you are submitting to us.

4. TYPES OF PERSONAL DATA WE COLLECT

4.1. Within the scope of the activities on the web app, TZO Štrigova collects and processes personal data of users and other individuals, as the case may be, such as:

1) first and last name;

2) e-mail address;

4) information about the location, if applicable and if you have enabled it;

5) IP address;

6) technical information (number of visits to our web app etc.). [IF1]

4.2. Our principle is to collect only the personal data necessary for us to achieve certain lawful processing purposes.

5. PERSONAL DATA PROCESSING PURPOSE

5.1. We collect and process your personal data in order to:

1) manage and conduct surveys and/or contests and/or marketing campaigns etc.;

6) manage, analyse and administer our web app.

6. LEGAL BASIS FOR PERSONAL DATA PROCESSING

6.1. Contractual performance

If you contract or use our services, we will collect and process your following information: first and last name, user’s e-mail address.

The above personal data are collected for the purpose of performing the services that we offer as well as performing the business processes that involve resolving our client’s requests and disputes with clients as service users.

If you are using our ecological footprint calculator, it is necessary for us to collect certain personal data pertaining to you so that we are able to fulfil our obligations.

6.2. Adherence to legal obligations

The laws and regulations in force on the territory of the Republic of Croatia impose on us as the data controller certain obligations that require us to collect and process certain personal data for legally prescribed purposes as well as to submit them to the competent authorities in certain cases.

6.3. Legitimate interest

In certain cases, we have a legitimate interest to collect and process your personal data.

We collect and process your IP address because we believe that our legitimate interest is to protect ourselves from fraud and to ensure safety. At the same time, we use the data in order to analyse – for statistical purposes among other reasons – the traffic to and use of our web app.

We will carefully keep your personal data and process them only for the aforementioned purpose. We will not transfer your personal data to third parties.

6.4. Consent

In certain cases, we can collect and process your personal data only if you have consented to it. It is important to note that you reserve the right to withdraw your consent at any moment by contacting us as provided for in Article 12 hereof (our contact information and notes).

7. DISCLOSURE OF YOUR PERSONAL DATA

7.1. We may disclose certain personal data that we collect to those operators that perform certain actions on our behalf or provide certain services to us, such as accountants, lawyers etc., which are considered to be data processors within the meaning of the GDPR.

A data processor may be any operator which guarantees, to a sufficient extent, the implementation of the appropriate technical and organisational measures so as to make the processing compliant with the requirements of the Regulation in order to ensure that the data subjects’ rights are protected. Therefore, in such cases, those operators (data processors) are bound to and limited by the data processing agreement concluded with us, stipulating which personal data of yours each of the data processors may process and for what purpose.

7.2. We may disclose your data to reliable business partners, without whose services we would not be able to offer our services or a part thereof, e.g. giving prizes to the winners of the Photography Contest.

7.3. We are obliged to disclose certain personal data that we collect to the competent authorities when such obligation is provided for in the relevant laws and regulations or if is necessary in order to protect our rights, property or safety.

8. LINKS

8.1. On our web app, you will find links to third-party websites that we include because we believe they could be necessary or useful to our users in relation to the business activities that we perform.

We emphasize that the websites which the links that we include lead to are outside of the scope of this Statement. We cannot bear any liability for them because they are third-party websites, with their own applicable terms & conditions of personal data protection.

9. PERSONAL DATA AND RETENTION

9.1. We will not keep your personal data for longer than necessary for the achievement of the purpose for which they were collected. As a rule, we will keep the personal data of contracting parties permanently, personal data of persons who participated in the Photography Contest until the end of our legitimate interest, personal data of persons who contacted us for some reason – during the communication etc.

9.2. Once your personal data are no longer necessary to us or when there is no more legal basis for their processing, we will delete them from our system or destroy the documents containing them, as the case may be.

9.3. Articles 9.1 and 9.2 shall not apply if the relevant laws and regulations prescribe a longer personal data retention period or if it is necessary and/or permitted for any other reason.

10. SECURITY

10.1. With regard to the security and protection of your personal data, we strive to apply the appropriate technical and organisational measures in order to protect your personal data. Nevertheless, unfortunately nobody can guarantee that the transfer or storage or any other system or measure pertaining to personal data is 100% secure.

11. YOUR RIGHTS IN RELATION TO YOUR PERSONAL DATA

11.1. According to the GDPR, you have certain rights in relation to your personal data, as listed below. You can exercise your rights at any moment by contacting us as prescribed in Article 12 hereof (our contact information and notes).

11.2. Right of access

You have the right to request and receive from us as the data controller a confirmation whether your personal data are being processed, and if they are, access to the personal data and information in accordance with Article 15 of the GDPR.

11.3. Right to rectification

You have the right to request from us as the data controller to rectify inaccurate or incomplete personal data pertaining to you.

11.4. Right to erasure (right to be forgotten)

You have the right to request from us as the data controller to erase data pertaining to you; we will delete them without undue delay subject to the provisions of Article 17(1) of the GDPR.

The right to deletion of personal data is not an absolute right, and it does not supersede our obligations arising from the relevant laws and regulations. Therefore, in certain situations, we will not be able to erase the personal data to the extent necessary for their processing.

11.5. Right to restriction of processing

You have the right to request from us as the data controller to restrict the processing of your personal data if:

1) he accuracy of the personal data is contested by you, for a period enabling us as the data controller to verify the accuracy of the personal data; or

2) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead; or

3) we no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims; or

4) you have objected to the processing pending the verification whether the legitimate grounds of the controller override those of us as the data controller.

11.6. Right to data portability

You have the right to receive from us as the data controller the personal data concerning yourself or her, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller, provided that the conditions laid down in Article 20(1) of the GDPR have been met.

11.7. Right to object

You have the right to object at any moment to the processing of your personal data on the basis of a legitimate interest relating to your particular situation, unless the grounds for such processing override the rights to the protection of your personal data.

11.8. Right to complain to the supervisory authority

We will process your data in accordance with the GDPR as well as other relevant laws and regulations. We will apply organisational and technical measures for personal data protection.

However, if you believe that we process your personal data in an illegal manner, and if you consider that you are unable to find a solution to your situation together with us, you have the right to lodge a complaint with the supervisory authority, i.e. the Personal Data Protection Agency based in Zagreb, Martićeva 14.

for more information, you can visit the official website: www.azop.hr

12. OUR CONTACT INFORMATION AND NOTES

12.1. For any questions, comments and requests connected with the rights pertaining to your personal data, particularly the rights listed in Article 11 hereof, you can contact us in any of the following ways:

1) e-mail at the address tz@strigova.info;

2) by post to the address: Štrigova 103, 40312 Štrigova.

12.2. When submitting your request in connection with any of your rights listed in Article 11 hereof, please state clearly the subject matter of your request and the personal data it relates to. Please bear in mind that we will have to verify your identity before following your request, for both our and your security, therefore we might contact you in connection with your request.

We will consider your every request and strive to take action within a reasonable period of time. Please bear in mind that certain circumstances may cause a certain delay in our action, particularly if we receive a large number of requests at the same time.

If you have requested to exercise one of your rights, e.g. erasure, there is a possibility that we might retain the personal data or a part thereof that we have collected due to legal requirements or necessity due to certain other reasons.

13. AMENDMENTS TO THE PRIVACY STATEMENT

13.1. As the data controller, we will monitor the situation with regard to personal data protection in order to improve the protection measures and other essential matters where necessary. Therefore, we reserve the right to amend this Statement from time to time.

We will notify you of any amendments hereto through our web app, where you can find the valid version of this Privacy Statement.

Done at Štrigova on 4 April 2022.