- DATA CONTROLLER AND LEGAL FRAMEWORK
- SCOPE OF APPLICATION
- DATA PROTECTION OFFICER
- PERSONAL DATA PROTECTION PRINCIPLES
- LEGALITY OF PERSONAL DATA PROCESSING
- TYPES OF PERSONAL DATA PROCESSED
- DATA DELIVERY TO THIRD PARTIES
- DATA RETENTION PERIOD
- RIGHTS OF THE DATA SUBJECTS
- PROTECTION OF CHILDREN’S PERSONAL DATA
- PERSONAL DATA SOURCES
- TECHNICAL AND INTEGRATED DATA PROTECTION
- TREATMENT OF PERSONAL DATA INFRINGEMENTS
- LOYALTY PROGRAMME MEMBERSHIP
- PRIZE GAME/SURVEY FORM
- CANDIDATES FOR EMPLOYMENT AND EMPLOYEES
- PERSONNEL SELECTION
- EMPLOYMENT AND OTHER COMPARABLE RELATIONS
- BUSINESS PARTNERS
- PERIOD OF RETENTION
- PUBLIC ANNOUNCEMENTS
- VIDEO SURVEILLANCE
- WEBSHOP JADRANKA-TRGOVINA.COM – ONLINE ORDERS
- WEBSITES, COOKIES AND INTERNET TECHNOLOGIES
- FINAL PROVISIONS
General Section – Basic Information
Data Controller and Legal Framework
As the data controller, JADRANKA TRGOVINA is committed to protecting your personal data. The collection, processing and storage of personal data is carried out in accordance with the provisions of REGULATION (EU) 2016/679 of the EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – GDPR) (hereinafter: Regulation), of the Law on the application of the General regulation of data protection (NN 42/2018) and other regulations governing the subject area, which are applied in the Republic of Croatia.
Scope of Application
Data Protection Officer
JADRANKA TRGOVINA has appointed a personal data protection officer who you can contact at any time via e-mail: email@example.com or by mail to the address JADRANKA TRGOVINA d.o.o., DPO, Dražica 1, Mali Lošinj, Republic of Croatia, for issues related to personal data protection and for exercising your rights guaranteed by the Regulation.
All requests not related to personal data protection, which are delivered to the address of the data protection officer, e.g. job applications of candidates, booking inquiries in JADRANKA TRGOVINA properties, etc. will be forwarded directly to the competent business sectors and/or departments within JADRANKA TRGOVINA, without special response to the sender by the data protection officer.
Personal Data Protection Principles
To JADRANKA TRGOVINA, the principles of data processing are basic values that must be respected throughout the cycle of personal data processing, from their collection to their destruction, deletion or other cessation of processing. JADRANKA TRGOVINA processes data:
- Lawfully – by processing data only if allowed by law and within the limits prescribed by law.
- Fairly – by considering the specific nature of each relationship, applying all appropriate measures to protect personal information and privacy in general and not impeding data subjects in exercising their rights.
- Transparently – by informing data subjects about the processing of personal data. From the start of the data collection process, when data subjects are informed about all aspects of data processing, until its termination, data subjects are provided easy and fast access to their own data, which includes the possibility of accessing and obtaining a copy in accordance with the provisions of the Regulation. Certain information may be restricted only when required by law or when necessary for the protection of third parties.
- Purpose limitation – by processing personal data for the purposes they were collected for and for other purposes only if the conditions of the Regulation are met. Data may be processed for matching purposes only by taking into account (a) any link between the purposes of the collection of personal data and the purposes of the intended continuation of the processing; (b) the context in which the personal data was collected, in particular concerning the relationship between the data subjects and JADRANKA TRGOVINA; (c) the nature of the personal data, in particular whether special categories of personal data are processed in accordance with Article 9 of the Regulation or personal data relating to criminal convictions and criminal offenses in accordance with Article 10 of the Regulation; (d) the possible consequences of the intended continuation of processing for the data subjects and (e) the existence of appropriate protection measures.
- Storage limitation – by storing data in a form which permits identification of data subjects for no longer than is necessary for the initial purposes, and longer only if permitted by the Regulation.
- Data minimization – by processing data if it is adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. Particular attention is given to not collecting data for which there is no justifiable reason for processing.
- Accuracy – by keeping data accurate and up-to-date, and erasing inaccurate data in the scope of possibility.
- Integrity and Confidentiality – by using appropriate technical and organisational measures to ensure appropriate personal data protection, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage. Relevant measures are applied considering the risk of each type of data processing.
Legality of Personal Data Processing
To respect the lawfulness of processing personal data, JADRANKA TRGOVINA processes personal data only if and to the extent that at least one of the following is met:
- Processing is necessary for the performance of the contract to which the data subject is a party or in order to take action at the request of the data subject prior to the conclusion of the contract; this is the most common purpose of data processing with an existing contractual relationship or a contractual relationship in negotiations as its basis.
- Processing is necessary to comply with the legal obligations of the data controller. As a legal entity, JADRANKA TRGOVINA has a number of obligations prescribed by various regulations. This obligation includes the collection and often the submission of data to public authorities.
- Processing is necessary for the legitimate interests of the data controller or a third party, except where those interests are stronger than the interests or fundamental rights and freedoms of data subjects requiring the protection of personal data, taking into account reasonable expectations of data subjects based on their relationship with the data controller, especially if the data subject is a child. In applying this legal basis, JADRANKA TRGOVINA assesses that the processing is appropriate to business needs, that it is the least invasive as possible and that the interests of the data subjects do not exceed the legitimate interests of JADRANKA TRGOVINA or a third party. Examples of such processing are processing for administrative purposes, the purposes of maintaining computer network security, direct marketing, and improving our business. The data subject can always object to such processing in these situations.
- Processing is necessary to protect key interests of the data subject or other natural persons. The right to personal data protection is not an absolute right and JADRANKA TRGOVINA equates it with other fundamental rights in accordance with the principle of proportionality. JADRANKA TRGOVINA acknowledges the possibility that in some situations it is necessary to process personal data in order to protect the key interests of the data subjects or other natural persons.
- The data subject has consented to the processing of his or her personal data for one or more specific purposes. When processing personal data based on the consent, JADRANKA TRGOVINA provides that these are situations in which there are no, formal or informal, consequences for giving, refusing or denying consent. When processing is based on consent, the data subject may withdraw consent at any time without negative consequences. The withdrawal of consent shall not affect the lawfulness of processing personal data of subjects based on the consent before its withdrawal.
Exceptionally, JADRANKA TRGOVINA may process data that would not be processed in regular situations, for example data collection based on the recommendations of the Croatian Institute of Public Health in case of epidemics and similar situations and/or circumstances.
Types of Personal Data Processed
Specific categories of personal data: specific categories of personal data shall be processed only if the conditions set out in Article 9 of the Regulation are met. For example, JADRANKA TRGOVINA processes employee data that fall into specific categories of personal data, such as union membership data (for example, when exercising special rights under relevant regulations), religious or philosophical beliefs (for example, when exercising the right to additional non-working days for religious holidays, if a person has voluntarily disclosed such data for the stated purpose), or health related data (for example according to special regulations on occupational safety or keeping records of workers or when special health certificates are required for certain jobs, etc.)
Data on criminal convictions and criminal offenses: when there is a legal authority to do so, JADRANKA TRGOVINA also processes personal data relating to criminal convictions and offenses, such as certificates confirming the absence of criminal records for workers.
Personal data not included in the previous two categories: such personal data make up the largest part of the processed data, and these are most often identification and contact data such as name and surname, OIB, data generated by movement in rooms and premises under video surveillance.
Data Delivery to Third Parties
JADRANKA TRGOVINA shares personal data with others only when legally permitted.
JADRANKA TRGOVINA is obliged by law to provide data to third parties. For example, delivering employee data to the competent institutions such as the Croatian Pension Insurance Institute, the Croatian Health Insurance Institute, the Tax Administration and the Central Register of Insured Persons and pension companies. In certain cases, JADRANKA TRGOVINA is obliged to submit or make available employment data to the Croatian Employment Service, for example to include workers in active employment policy measures, to the competent police stations or to the ministry responsible for internal affairs, for issuance of work permits, to the ministry responsible for the economy and entrepreneurship when it comes to the use of investment aid, to insurance companies, banks and in other cases required by law.
Also, certain employee data is sent to banks or pension funds as part of salary payments, and data can also be sent to creditors in accordance with enforcement regulations. Sometimes data is sent according to contractual obligations, for example with students in practice, data is exchanged with schools, colleges. We deliver employee data to schools when our employees take part in various events organised by the schools.
Certain personal data is also provided to business entities for the purpose of providing specific services such as the employees’ health examinations (contracted occupational medicine), further, to institutions that organize legally mandatory training (occupational safety, hygiene, toxicology), organisers of other trainings for employees (if they apply for them) as well as hotel and other accommodation facilities providing accommodation to employees during such trainings or audit companies when conducting mandatory audits, notaries when certifying, the financial agency for the purpose of obtaining business certificates, public procurement subjects when JADRANKA TRGOVINA applies for public procurement tenders, for the purpose of awarding and using company cards, company mobile devices or for the purchase of fuel.
It is possible to deliver data to business entities, data processors engaged for data processing on behalf of JADRANKA TRGOVINA, which acts as the data controller. Most often, these are JADRANKA TRGOVINA’s business associates who provide IT services, who store them in their databases or have the possibility of accessing personal data until the end of processing. A detailed written contract is concluded with such subjects regarding their powers and obligations in the processing of personal data, in accordance with the requirements of the Regulation.
In certain situations, it is possible for external entities and JADRANKA TRGOVINA to jointly determine the purposes and methods of personal data processing, in which case these external partners and JADRANKA TRGOVINA are joint data controllers. In these relations, the joint data controllers shall transparently determine their responsibilities for complying with the obligations under the Regulation, in particular with regard to the exercise of data subjects’ rights and their duties to respect the transparency of processing, unless responsibilities are established by law.
If data is transferred to third countries as part of data processing, JADRANKA TRGOVINA ensures compliance with high protection standards in order to comply with the highest possible standard of personal data protection, in accordance with the strict requirements of the Regulation. Hence, when international transfers of personal data are in use, JADRANKA TRGOVINA will inform the data subjects about the intention to disclose personal data to a third country or international organization and about the existence or non-existence of a European Commission’s decision on adequacy. Any transfer of personal data to third countries will be carried out in accordance with Chapter V of the Regulation.
Subjects’ data are processed and stored, in accordance with applicable legal regulations, when the retention obligation is prescribed (for example, the evidence for the issuance of bills is kept for 11 years), and when JADRANKA TRGOVINA is authorized to set retention periods autonomously, data is stored as long as necessary for the purposes for which personal data is processed, taking into account the purpose of processing, the legitimate interests of JADRANKA TRGOVINA and the interests of the data subjects to delete the data.
Rights of the Data Subjects
Regardless of the basis for data collection, all users of our website can exercise the following rights free of charge within the limits prescribed by the Regulation:
Right to information: The data subject has the right to be informed about the processing and its purposes. JADRANKA TRGOVINA provides the data subjects with all the information necessary to ensure fair and transparent processing, depending on the context of processing.
Right to deletion (“right to forget”): The data subject has the right to request JADRANKA TRGOVINA to delete personal data relating to him/her, without undue delay in accordance with the terms of the Regulation. To do so, send your request to us (the data controller) in writing, including an electronic form of communication. Please note that the request needs to specify what data you want us to delete, since we can store your data on different legal bases, for example, the respondent can be both our buyer and a candidate for employment. You have the right to request the deletion of personal data relating to you if one of the following conditions is met:
- Your personal data is no longer necessary for the purpose for which we collected or processed it.
- You have withdrawn the consent on which the processing is based and if there is no other legal basis for processing.
- You have objected to the processing of your personal data and if there are no stronger legitimate reasons for our processing.
- Personal data has been processed illegally.
- Personal data must be deleted to comply with a legal obligation.
In some cases, it will not be possible to fully comply with the deletion request, for example when there is a legal obligation for retention, when the legitimate interest of the data controller are stronger than the interest of the data subjects, when there is an interest of the data controller to set, enforce or defend legal claims.
The right to access data: at the request of the data subject, JADRANKA TRGOVINA will provide him/her with confirmation whether his/her personal data is processed and if such personal data is processed, he/she will be granted access to personal data and the purpose of processing, data categories, potential recipients of the data, and other data in accordance with the Regulation. The data subject is also entitled to receive a copy of the personal data being processed. Access to personal data may be restricted only in cases prescribed by law, i.e. when such restriction respects the fundamental rights and freedoms of others.
Right to rectification: The data subject has the right to obtain, without undue delay, the correction of incorrect personal data relating to him/her from JADRANKA TRGOVINA. With regards to the purposes of processing, the data subject is entitled to supplement incomplete personal data. To do so, send your request to us (the data controller) in writing, including an electronic form of communication. We kindly ask you to specify what data is incomplete or not up to date in your request, and how to correct it, as well as to submit the necessary documentation in support of the allegations.
Right to data portability: The data subject has the right to receive personal data relating to him/her in a structured, commonly used and machine-readable format in accordance with the requirements of the Regulation.
Right to object: When JADRANKA TRGOVINA processes data based on its legitimate interests which are stronger than the interests of the data subjects, then the data subject has the right to object to the processing of personal data at any time.
Right to restricted processing: The data subject can ask JADRANKA TRGOVINA to exercise the right to restrict processing in case he/she disputes the accuracy of personal data, considers the processing to be illegal and opposes the deletion of personal data and instead requests restriction of their use, and has submitted a complaint and awaits confirmation as to whether the legitimate reasons of the data controller go beyond the reasons of the data subject.
In any case, data subjects also have the right to:
- submit a complaint to the Personal Data Protection Officer (DPO),
- file a complaint to the supervisory body (Personal Data Protection Agency) if they believe that their rights to data protection have been violated.
Send your written request to the address of the Personal Data Protection Officer: firstname.lastname@example.org or by mail to the address JADRANKA TRGOVINA d.o.o., DPO Dražica 1, 1550 Mali Lošinj, Republic of Croatia.
JADRANKA TRGOVINA as the data controller has the right to protect the interests both of the data controller and the data subjects and is therefore entitled to establish the identity of the applicant.
JADRANKA TRGOVINA has the right to publish a form that will be used to submit a request in order to process the request as efficiently as possible.
On request, JADRANKA TRGOVINA provides information on the actions taken in relation to the exercise of data subject’s rights without undue delay and in any case within 39 (thirty) days from the date of receipt of the request. This period may be extended by an additional two months, depending on the complexity and the number of applications. JADRANKA TRGOVINA shall notify the data subject of any such extension within 30 (thirty) days from the date of receipt of the request, together with the reasons for the postponement.
If the data subject submits the request electronically, JADRANKA TRGOVINA provides the information electronically, if possible, unless the data subject requests otherwise.
The data subject’s request is generally free of charge, but if the data subject’s request is manifestly unfounded or excessive, and in particular because of their frequent repetition, JADRANKA TRGOVINA is entitled to charge a reasonable fee based on administrative costs or refuse to act on the request.
Protection of Children’s Personal Data
JADRANKA TRGOVINA advises parents and guardians, or legal representatives, to teach children/minors (up to 18 years of age) about safe and responsible handling of personal data, especially on the internet. JADRANKA TRGOVINA processes personal data of children only with the prior consent of parents/guardians (for example: scholarship holders, when children are buyers in our shops etc.).
Personal Data Sources
Technical and Integrated Data Protection
JADRANKA TRGOVINA, as the data controller, provides the highest technical and organizational standards of data protection. Considering the latest developments, the cost of implementation and the nature, scope, context and purposes of processing, as well as risks of different levels of probability and seriousness for the rights and freedoms of individuals arising from data processing, at the time of processing, appropriate technical and organizational measures to enable the effective application of the principles of data protection.
Also, JADRANKA TRGOVINA implements appropriate technical and organizational measures to ensure that only personal data necessary for each specific purpose of processing are processed in an integrated manner. JADRANKA TRGOVINA applies this measure to the amount of personal data collected, the scope of their processing, the retention period and their availability. Specifically, such measures ensure that personal data is not automatically available to an unlimited number of persons, without the intervention of an individual.
Treatment of Personal Data Infringements
As the data controller, JADRANKA TRGOVINA shall, without undue delay, and where feasible, no later than 72 (seventy two) hours after discovering, notify the competent supervisory authority about the breach, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of persons.
The report submitted to the supervisory authority shall contain all information prescribed by the Regulation.
In the event of a personal data breach that is likely to pose a high risk to the rights and freedoms of individuals, JADRANKA TRGOVINA, as the data controller, shall inform the data subjects of the personal data breach without undue delay. Sometimes, in cases where the Regulation prescribes, informing data subjects is not mandatory.
LOYALTY PROGRAMME MEMBERSHIP
Hatch! – the first open loyalty programme
By joining Hatch!, the first open loyalty programme, members who make a purchase at one of our JADRANKA TRGOVINA stores will gain access to loyalty programme benefits in the manner set out by the general terms and conditions of the loyalty programme. Information on the membership terms and conditions, the obligations of JADRANKA TRGOVINA and the rights of data subjects can be found in the general terms and conditions of the loyalty programme available at https://jadranka-trgovina.com/hatch-program-vjernosti-za-nase-kupce.
Hatch! is an innovative loyalty programme that rewards customer purchases made at JADRANKA TRGOVINA stores and those of other Hatch! partners. It is customers who apply for Hatch! loyalty programme membership in order to obtain various benefits, and they may at any time decide to withdraw from, i.e. cease to be a member of our Hatch! loyalty programme.
You can access Hatch! via a mobile application supported by Android and iPhone mobile devices, or get a Hatch! plastic card. The Hatch! application or card can be used at our points of sale marked by Hatch! stickers.
You can become a Hatch! customer by downloading the mobile app for Android or iPhone from Google Play or App Store. After downloading, please proceed with the registration process via your e-mail, Google or Facebook account.
The application is also available for download from the Hatch! website or by scanning the QR code in Hatch! brochures or the above-mentioned stickers.
If you do not have a smartphone, you can fill out a membership application form at any Hatch! sales point. By doing so you will get a Hatch! card or a sales point card you can use right away.
JADRANKA TRGOVINA d.o.o., Dražica 1, Mali Lošinj, TIN 02198337590, is the data controller of your personal data, while Login d.o.o., Mihačeva Draga bb, Rijeka, TIN 38862460256, is the data processor of your personal data. The data controller and the data processor will handle them in accordance with their respective privacy policies, the relevant Regulation and any applicable piece of legislation of the European Union and the Republic of Croatia. In doing so they will implement adequate security measures aimed at protecting personal data (both physical and technical) from any misuse, unauthorised access and manipulation, loss or destruction. The data controller and the data processor are responsible for the protection of your personal data stated in the consent.
When filling out a membership application form, customers provide us with the following data: a) name and surname, address, date and year of birth; b) sex; c) contact (telephone, e-mail); d) retired person status (proved by presenting a pension payslip or a membership card of the Association of Retired Persons), e) private renter status (proved by presenting a renter’s card); f) association member status (proved by presenting a membership card of the relevant association).
We will store your personal data collected on the basis of consent until you decide to withdraw it. Personal data collected in such a way are entered into the electronic system of the data controller and/or the data processor and/or their Programme Partners. The data controller and the data processor shall ensure that the data collected through the programme remain protected, confidential and secure, protect the privacy of data subjects – programme members and shall not use their personal data contrary to the purpose for which they were collected, or contrary to applicable laws or other legal requirements.
As the data controller, JADRANKA TRGOVINA may, on the basis of legitimate interest and the data provided, send its loyalty programme members newsletters with membership information (special member-only benefits, etc.) as well as information on other Company’s offers and news via e-mail, telephone, text messages and/or an instant messaging platform (such as Viber and Whatsapp), as stated in the consent. You may object to this at any time and request to be removed from the recipients’ list at email@example.com. Unsubscribing from the newsletter does not affect the legitimate interest of JADRANKA TRGOVINA to send customer service e-mails and satisfaction surveys related to specific purchases and facilities of JADRANKA TRGOVINA, as well as other customer service e-mails, to data subjects who are also its customers.
PRIZE GAME/SURVEY FORM
JADRANKA TRGOVINA may organize prize games from time to time, in which case it will only collect your personal data if you decide to take part in the prize game. The data that will be collected in this way and which is necessary for the participation in the prize game, will be determined by the Rules of the prize game, for each separate prize game, and may be different. It is possible that the prize game winners’ data is published. The data collected in this way on the basis of a sort of contractual obligation will be used for the purpose of conducting the prize game, in accordance with the rules of the prize game, and will be deleted within 5 years after the end of the prize game.
It will often be the case that buyers who fill in the survey form for the evaluation of service quality in JADRANKA TRGOVINA’s properties can also participate in the prize game, which will be clearly indicated on the form itself. In case you fill in the survey form for the prize game with data that is not necessary for the participation in the prize game (data may be different in different prize games) JADRANKA TRGOVINA can use all this depersonalized data for statistical purposes.
JADRANKA TRGOVINA has the right, based on a legitimate interest, to collect certain data and use it for direct marketing purposes as described in the Newsletters section.
Candidates for Employment and Employees
As part of the data processing carried out in connection with employment, JADRANKA TRGOVINA identified the following purposes of processing:
- Personnel selection: includes the collection and further processing of relevant tender documents, testing and evaluation, collection and analysis of information on candidates from publicly available sources including information publicly disclosed about the candidate if relevant due to the risks that a particular job entails.
- Reputation risk reduction: collection and analysis of information about employees and persons in a comparable relationship from publicly available sources including information that the respondent has publicly disclosed about himself/herself if relevant due to the risk that a particular job entails.
- Conclusion of the contract: processing for the purpose of concluding an employment contract, a service contract, student contract, professional internship or professional training, scholarship contract with persons not employed in JADRANKA TRGOVINA or any other comparable relationship.
- Exercise of material and other rights: processing is necessary in order to exercise the material and other rights of workers, persons in a comparable relationship or other persons (e.g. children, spouses or insurance beneficiaries), for example to exercise the right to enter active employment policy measures (permanent seasonal employee and others), for the exercise of additional rights of workers under the collective agreement JADRANKA TRGOVINA (for example: birth of a child) and others.
- Fulfilment of the contract: data processing is necessary for the purpose of fulfilment of the contract by the respondents, which includes fulfilment of work obligations, monitoring of their execution and ensuring all relevant measures for their execution.
- Registration of accommodation: data processing is necessary in case the data subjects stay in the facilities for accommodation of workers in order to register their stay with the competent authorities.
- Performance management: this purpose includes information on the achievement of previously set goals, timely fulfilment of goals, and further analysis to determine future goals, human resources management, determining the number of rewards and other relevant measures.
- Rewarding: this processing includes rewarding or payment of a fixed and variable part of the remuneration. Such processing may include data on violations of ethical and other internal rules, data from the performance management system, on attended trainings, as well as all other relevant data.
- Education: processing for the purpose of educating persons acting under the guidance of JADRANKA TRGOVINA including tests, which comprises all necessary actions for election and registration of respondents, analysis of acquired knowledge and all other relevant information for organizing, implementing and further action pertaining to education.
- Preparation of various reports on employees: some reports are necessary because of the legal obligation of JADRANKA TRGOVINA, some to exercise certain rights, and to fulfil JADRANKA TRGOVINA’s obligations in case of contracting and applying for additional benefits for workers, budgeting, etc.
- Information: data collection and processing for the purpose of quality and timely informing candidates about job vacancies, i.e. employment opportunities within JADRANKA TRGOVINA. Collection and processing of data for the purpose of quality and timely informing all JADRANKA TRGOVINA employees about recent changes or special notices relevant for the exercise of employment rights or important information in the field of general knowledge of events and activities in JADRANKA TRGOVINA regarding the exercise of employment rights or any comparable relationship. For this purpose, information is sent by phone and/or to company e-mails, or private e-mails if the employee has given consent to use his/her private e-mail for this purpose. Furthermore, JADRANKA TRGOVINA may offer employees to install on their mobile devices, on voluntary basis, applications that offer various news related to JADRANKA TRGOVINA or its partners.
- Protection of property and persons: includes monitoring of entry/exit to/from business premises, use of company mobile devices, computer equipment, internet and telephone traffic, cars, premises, and other property of JADRANKA TRGOVINA in accordance with internal acts.
- Termination of employment: data processing due to termination of employment contract or other comparable contract, in order to fulfil legal and contractual obligations.
- Ethical behaviour monitoring: processing includes all proceedings that investigate compliance with ethical conduct or dignity regulations, or in any other disciplinary proceeding, whether the respondent is a reported person or a notifier.
- Work safety: data processing may be required in cases where it is necessary to fulfil the purpose of special work safety regulations, including alcohol and drug testing in accordance with regulations in force.
JADRANKA TRGOVINA has a legitimate interest in realizing various benefits for its employees, as well as facilitating some business processes. In this sense, JADRANKA TRGOVINA can, based on a special decision, decide on various tools that achieve these purposes (for example, issuing ID cards to employees who receive discounts, giving certain instructions via text messages, taking photos in certain cases, etc.) in which case employees will be timely informed.
In addition to the stated purposes, it is possible to process personal data for other specific purposes, but always within the framework prescribed by law or if the processing is necessary for the exercise of rights and obligations arising from employment, or in relation to employment and any comparable relationship.
JADRANKA TRGOVINA’s database on former and current employees, candidates, interns, students, students employed with the so-called “student contract”, scholarship holders and other persons whose data is processed in the framework of employment and related relations is kept in special applications. An appropriate contract is concluded with the application maintenance and support providers as data processors.
JADRANKA TRGOVINA, as a potential employer, collects, processes and stores the data of candidates for employment in JADRANKA TRGOVINA in the candidate database based on their voluntary application in the following ways:
- by application via a web application form used as a sort of CV,
- by signing in via e-mail,
- by coming to the premises of the Human Resources Department and filling out application forms, or
JADRANKA TRGOVINA may obtain information on candidates indirectly, from domestic and foreign employment agencies, in which case these agencies are obliged to inform candidates about the processing of their personal data by JADRANKA TRGOVINA.
Candidates send their job applications:
- as open applications, in which case we process data for the purpose of contacting candidates regarding employment (10 years) considering a legitimate interest of JADRANKA TRGOVINA;
- as applications for specific job vacancies that have a specified deadline, in which case we process the data during the job vacancy and 5 months from the end of the job vacancy to contact candidates with regards to the specific employment (these applications are archived for 10 years). Within the mentioned deadline, the legitimate interest of JADRANKA TRGOVINA is to contact the candidate should a need arise to employ a person for a specific job for which he/she is qualified and meets other conditions.
In the event that candidates who apply for specific vacancies that have a specified deadline give special consent, we process the data to contact candidates with regards to employment until the consent is withdrawn. The same applies to the procedures where candidates send their application letters together with a special consent.
JADRANKA TRGOVINA has a legitimate interest in using the obtained e-mail addresses, as well as other submitted contact information for contacting candidates related to the employment. For example, after applying, candidates can receive an automatic response that their application has been received and that candidates whose qualifications and experience are in line with those required for individual jobs will be contacted. Also, after applying, candidates can receive a message on their mobile phone number with the proposed date of the interview, a message stating the documentation required for employment and the like. Additionally, JADRANKA TRGOVINA has a legitimate interest to contact, in the same way, persons who have worked for a fixed period of time, predominantly seasonal jobs, regarding the future seasonal employment.
The personal data kept is provided by the candidates themselves, but JADRANKA TRGOVINA creates personal data related to employment activities, such as the results of job interviews, tests and assessments, based on the legitimate interest of ensuring the recruitment of the best candidates, and collects personal data from third parties, primarily by data verification obtained during the recruitment process by contacting relevant third parties (for example: employment agencies, education and training providers) or by using publicly available sources.
Employment and Other Comparable Relations
As an employer, JADRANKA TRGOVINA collects, processes and stores all employee data in the employee database kept in the IT programme and in the physical files of employees. The data collected is listed in the Regulation on the content and manner of keeping records on workers published by the ministry responsible for labour and pension system.
The necessary information for employment is usually: a copy of the ID card, a copy of the current account or payment instructions from the bank, a copy of the protected account (if the employee has it), a certificate confirming the absence of any criminal record, Personal Identity Number (OIB), proof of education (copy of certificate or diploma), e-book : certificate of pensionable service, (obtained from the HZMO or via the e-Citizens service), electronic record of the tax card form, so-called PK form (obtained from the Tax Administration or through the e-Citizens service, persons who are employed for the first time, do not have an electronic record of the tax card form and must open it at the Tax Administration), birth certificate of a child under 15 years.
In addition to the above data, third-country nationals (i.e. persons who are not nationals of the EEA member states (the European Union, the Principality of Liechtenstein, the Kingdom of Norway, Iceland) or the Swiss Confederation, but are third-country nationals or stateless persons), are required to submit the following for employment purposes: a copy of the passport, the name of the person’s father and/ or mother, and the date and place of birth.
The necessary data for concluding pupil or student contracts are usually: a certificate issued by the school / faculty for the current year as proof of student status or a copy of the index confirming the enrolment for the current year, a copy of the ID card, a certificate of enrolment for the Student Centre (not all student centres), a statement on the bank account number and a bank keeping the account, one photo or X-ica card, Personal Identity Number (OIB).
In addition to these data, JADRANKA TRGOVINA may keep in the employee’s file other data collected in the employment process, as well as other data collected during employment determined by JADRANKA TRGOVINA regulations (for example: awards, reminders, warnings, certificates, etc.).
All employee data is stored in the employee database on the date of employment and are kept up to date until the termination of employment and are kept as documentation of permanent value in accordance with the relevant regulations.
JADRANKA TRGOVINA also keeps in its database the data of other persons in a business relationship comparable to the employment relationship or internship from the commencement of work and keeps them until the termination of employment, in accordance with relevant regulations. A special case is the data of interns who may be minors and need special care and whose data is collected and stored in accordance with special regulations with the approval of the school and parents.
Salary data and payrolls are subject to special storage regulations. In any case, all workers and other persons in a business relationship comparable to the employment relationship or internship have all the rights of a data subject.
In its business operations, JADRANKA TRGOVINA also processes data from business partners or potential business partners, which are:
- natural persons who are, can become or have been business partners of JADRANKA TRGOVINA, e.g. craftsmen, persons who operate as independent professionals (e.g. lawyers, doctors, etc.), persons with whom work contracts are concluded (e.g. singers, painters, photographers, etc.) and other natural persons who have the status of entrepreneurs and
- natural persons who are partly legal entities with which JADRANKA TRGOVINA has, may have or have had a business relationship (e.g. persons who perform delivery for their employer company, persons to whom invoices are sent for their employer (legal entity), signatories of contracts for companies representing persons who perform handover for the company, persons who organize events for their legal entity, etc.)
As part of the data processing of data subjects, JADRANKA TRGOVINA identified the following purposes of processing:
- Conclusion of the contract: processing for the purpose of concluding the contract from any area of JADRANKA TRGOVINA’s activity (for example: sending inquiries, sending special offers, requesting data on the signatories of the contract, sending tenders for legal entities represented by data subjects, etc.).
- Fulfilment of the contract: data processing is necessary for the purpose of fulfilling the contract, which includes fulfilling obligations, monitoring their execution and ensuring all relevant measures for their execution (for example: to agree on time and place of delivery of equipment under the contract, to send invoices, etc.).
- Information: data collection and processing for the purpose of quality and timely information.
In addition to the stated purposes, it is possible to process personal data for other specific purposes, but always within the framework prescribed by law or if necessary for the exercise of rights and obligations arising from the business relationship.
Personal data collected from data subjects:
- name and surname,
- e-mail address,
- phone number,
- data on the function within the legal entity represented (ex. singer, painter, photographer, lawyer, doctor…),
- occupation when the data subject is a natural person with whom a contractual relationship is entered into (for example: singer, painter, photographer, lawyer, doctor …),
- sometimes references and CVs (especially for consultants),
- data stated on the forms of blank promissory notes, promissory notes, bills of exchange,
- bank account number (IBAN) when the business partner is a natural person with whom a contractual relationship is entered into, and
- other information depending on the nature of the business relationship.
How personal data is collected from data subjects:
- received offers for business cooperation from data subjects,
- data received from data subjects in the context of selling JADRANKA TRGOVINA products / services or purchasing products / services from a business partner (for example: fairs, events, etc.),
- business correspondence related to a previous or current business cooperation (for example, correspondence performed as part of the execution of a contract),
- publicly published data (for example: court register, business partner websites, magazines, newsletters, etc.).
In addition to the stated type and place of data collection, it is possible to process personal data for other specific purposes, but always within the framework prescribed by law or if the processing is necessary for the exercise of rights and obligations arising from the business relationship.
Data kept from data subjects who are natural persons in a business relationship with JADRANKA TRGOVINA are kept in accordance with applicable legal regulations (for example, JADRANKA TRGOVINA is obliged to keep all invoices, as well as the evidence for issuing invoices in accordance with legal regulations.).
When JADRANKA TRGOVINA is authorized to set deadlines for data retention autonomously, these are determined taking into account the purpose of processing and the interests of data subjects to destroy the data, and in those cases, data are to be kept for a maximum of 10 (ten) years from the termination of the contractual relationship (if any).
JADRANKA TRGOVINA publishes information of interest to existing and potential employees, buyers, business partners, therefore the public, through its website, social media profiles, newsletter, video walls and bulletin boards in its properties. Such disclosures may contain a limited set of personal information, such as first and last names, functions, professional information, videos, statements and photographs.
The legal basis for processing is the legitimate interest of informing the public, but also marketing, during which the interest of the data subjects is always taken into account, so personal data is not published if it is determined that the interest of data subjects not to publish certain personal data is stronger than the interest of JADRANKA TRGOVINA to publish them. In some situations, the disclosure of information may be based on consent in accordance with the highest standards.
Announcements have a permanent character, which ensures information about current events as well as insight into previous activities.
Processing shall cease if, on the basis of the data subjects’ objection, it is established that such objection is justified or if the data subject has withdrawn the consent in situations where the consent is applicable in a manner that can be enforced.
JADRANKA TRGOVINA has a legitimate interest in the processing of personal data that is carried out for the purposes of direct marketing, primarily for the purpose of sending offers and news of JADRANKA TRGOVINA via e-mail – newsletter. Based on a legitimate interest, JADRANKA TRGOVINA may send different newsletters depending on the relationship that data subjects have with JADRANKA TRGOVINA. For this purpose, personal data is collected from the buyers and persons who used the services of JADRANKA TRGOVINA, persons who participated in the prize game, joined the loyalty programme, filled out a satisfaction questionnaire, persons who have made a purchase in the webshop or had a similar relationship with JADRANKA TRGOVINA. Personal data collected are primarily name, surname and e-mail address, but also basic data related to the relationship with us (for example: venue, data of the purchase, purchased experience, etc.). Data subjects have the right to object to such processing, including profiling, if it is related to such direct marketing, either in relation to initial or further processing, at any time and free of charge in accordance with paragraph 70 of the introductory provisions of the Regulation.
JADRANKA TRGOVINA has the option of subscribing to the newsletter on some of its websites. To ensure that there is no error or abuse when entering the e-mail address, we use the so called Double-Opt-In process (double verification): after the e-mail address is entered in the login field, JADRANKA TRGOVINA sends a confirmation link to the e-mail. Only after you have clicked on the e-mail confirmation link, your e-mail address is added to the database to send a specific newsletter. Such newsletters are sent based on your consent given to us by filling in and confirming the form on the website. The content of the newsletter and the purpose will be stated during your application (for example: notifications about current special offers in our properties, job offers, etc.).
If data subjects provide additional information when updating the profile on the website, JADRANKA TRGOVINA will, based on your consent, use this information when sending the newsletter.
Data subjects may also give special consent to the collection of additional personal data (for example: country, date of birth, interests and preferences) that JADRANKA TRGOVINA collects and uses to profile data subjects and to contact and inform about offers designed just for you.
Data subjects who are members of the Hatch! loyalty programme can also receive newsletters as described in the Loyalty Programme chapter.
The deadline for processing personal data for the purpose of sending a newsletter is 10 (ten) years, counting:
- from the day of the last business relationship with us (when newsletters are sent based on a legitimate interest),
- from the date of your consent (when newsletters are sent based on your consent).
If the data subject has given consent, it has the right to withdraw the given consent at any time, which includes processing for the purpose of creating a profile, either in relation to initial or further processing, at any time and free of charge and the right to change data at any time and the right to be forgotten.
At any time, regardless of the legal basis for receiving the newsletter, you can unsubscribe from receiving newsletters by clicking on the link at the bottom of each newsletter/text message, free of charge and any other consequences, in which case you will no longer receive newsletters, but your data will remain archived. Unsubscribing from the newsletter is not related to JADRANKA TRGOVINA’s legitimate interest in sending service e-mails and satisfaction questionnaires, as well as other service e-mails to data subjects for whom there is another legal basis (e.g. job candidates).
As the data controller, JADRANKA TRGOVINA has a legitimate interest in implementing video surveillance measures to protect facilities, persons and property, and is required by law to install surveillance cameras that record employee activities on certain jobs as well as those of persons moving within the range of the surveillance camera.
JADRANKA TRGOVINA will properly mark all the spots in which video surveillance is installed.
Being aware that the footage contains personal data of all persons moving within the camera range (customers, employees, business partners, etc.), JADRANKA TRGOVINA stores them with due care, has in place a security and availability system, and applies a deletion policy in accordance with its internal security rules.
Surveillance camera footage is overwritten on a regular basis and is deleted automatically after a maximum of six (6) months from the recording date. As an exception, video recordings may be kept longer if they serve as evidence in the proceedings before a competent authority. Such recordings will be stored within a centrally managed alarm system with restricted access.
JADRANKA TRGOVINA may use them in court and/or criminal proceedings. Third parties, data processors, and contractual partners of JADRANKA TRGOVINA providing professional security services may also have access to recorded personal data solely for the purpose of ensuring the security of centrally managed surveillance and alarm systems. Any other matters related to video surveillance are governed by special provisions.
SHOP.JADRANKA-TRGOVINA.COM – ONLINE ORDERS
When you make a purchase on JADRANKA TRGOVINA’s webshop www.shop.jadranka-trgovina.com, we process your personal data that you have entered in the web form (name, surname, e-mail, telephone number, address, delivery address) in order to identify you as a Buyer, enter into and fulfil a one-time distance sales contract and delivery contact. The legal basis is precisely the fulfilment of the sales contract in which the buyer is a party. Processing is necessary to comply with the legal obligations of the data controller.
You must be at least 18 years old to register or use the services of shop.jadranka-trgovina.com. Customers are responsible for the accuracy and completeness of the data entered during the registration and/or purchase. Should there be any change to the data entered during the registration and/or purchase, customers are required to update their account immediately, or notify us of the changes via the firstname.lastname@example.org e-mail. Customers are responsible for the accuracy of all data entered during the purchase.
The general terms and conditions for e-commerce (hereinafter: General terms and conditions) regulate the use of our online store services, available at www.shop.jadranka-trgovina.com.
Customers place online purchase orders through the shop.jadranka-trgovina.com domain. By clicking the ‘ORDER’ icon, the selected product is added to the shopping cart. Orders will be deemed accepted once the customer has completed the billing process.
Online shopping gives customers the opportunity to view item prices, product descriptions and notes, or filter them by categories and featured products. In agreement with the sales representative of JADRANKA TRGOVINA, the customer placing an online order can join the existing loyalty programmes (special promotions, sales or discounts) that encourage online shopping.
After creating and confirming their order, customers will receive an order confirmation e-mail from Jadranka trgovina d.o.o. Such e-mails are automatically generated by the server and forwarded to the customer at the time of order confirmation.
JADRANKA TRGOVINA, as the data controller, has the right to send the customer the so called service messages – confirmations of the concluded contract, invoices, order confirmations and other notices closely related to the specific purchase (e-mail, text message, and/or instant messaging platforms) in order to fulfil the contract, but also to fulfil the legal obligation.
Also, after the purchase, JADRANKA TRGOVINA as the data controller has the right, based on the legitimate interest, to send customers satisfaction questionnaires and ask customers to rate its service and products, if they wish (by e-mail, text message and/or instant messaging platforms). Completed questionnaires will be processed by JADRANKA TRGOVINA or contracted associates. The primary purpose of the service satisfaction questionnaire is to collect service data for the legitimate interest of service improvement by JADRANKA TRGOVINA, and JADRANKA TRGOVINA may depersonalize and process this data from the questionnaire for statistical purposes to analyse and improve its services.
By calling the webshop’s contact phone number, JADRANKA TRGOVINA may collect information related to the purpose of your call, for example, if it is a purchase, we will ask for your name, surname, order number so that we can respond to your request. Also, based on a legitimate interest, we keep records of calls.
With regard to any inquiries about data subject rights (such as the right to data rectification, updates and deletion) customers may have in connection with the processing and protection of personal data provided to us in the context of an online purchase through the Company’s website www.shop.jadranka-trgovina.com, they can e-mail us to email@example.com, contact our CALL center at +385 (0) 51 661 179 or mail a letter to Jadranka trgovina d.o.o. Dražica 5, 51550 Mali Lošinj, Croatia.
JADRANKA TRGOVINA has the right, based on a legitimate interest, to collect certain data and use it for direct marketing purposes as described in the Newsletters section.
WEBSITES, COOKIES AND INTERNET TECHNOLOGIES
JADRANKA TRGOVINA has a website (https://jadranka-trgovina.com) and possibly will create more to provide the best possible service and allow users easier and faster access to the content of their interest.
Visitors to the JADRANKA TRGOVINA website as well as users of JADRANKA TRGOVINA applications may obtain personal data that is used for the purposes for which they were provided in accordance with the information provided at the time of collection (or an obvious purpose that can be derived from the collection context). Users have control over the personal data they enter into web forms, applications, and the exception may be automatic processing due to cookies on the website as explained below.
For example, on the JADRANKA TRGOVINA website, you can subscribe to the JADRANKA TRGOVINA newsletters to receive information or offers of JADRANKA TRGOVINA. Also, on the JADRANKA TRGOVINA website, you are offered the possibility of applying for a job at JADRANKA TRGOVINA etc. In each case, you provide the information that JADRANKA TRGOVINA needs to fulfil the purpose of each individual case. Also, in case you have posted a comment on social networks or other online platforms, JADRANKA TRGOVINA may ask you a permission to quote your comment with a mention of your name.
The legal basis for the processing of personal data of visitors to the JADRANKA TRGOVINA website is a legitimate interest or consent if the data subject is required to give consent.
JADRANKA TRGOVINA can also use a wide range of new tools on its website to improve the user experience. In each case, contracts are concluded with the service providers which describe in detail the possible processing of personal data.
JADRANKA TRGOVINA uses different types of cookies:
Cookies by function
- Necessary cookies – necessary for the functioning of the website, which cannot function without them. This means that a website cannot be opened or displayed without these cookies. These cookies are used for the purpose of transmitting communication or are necessary to provide an information society service that is explicitly required of the user of such service. Also, these cookies enable basic analysis of websites with the aim of improving their functioning through data that is completely anonymized, i.e., not based on your personal data or data that can be linked to you in any way. These cookies do not need and do not require your consent.
- Functional cookies – used to perform a more advanced analysis of the website functionalities. These cookies are used to analyse user behaviour and can determine what website visitors view and want, based on the anonymous data, so as to enable JADRANKA TRGOVINA to customize its website and make its content and functionalities as easy to use. These cookies require your consent.
- Advertising cookies – they are used to analyse your interests and wishes, and they serve the purpose of informing you about special and personalized offers, news and events organized through online channels (e-mail, internet, online promotion). These cookies require your consent.
Cookies by source
- First party cookies come from the website you are viewing and can be permanent or temporary. With these cookies, websites can store data that will be used again during the next visit to the website.
- Third party cookies come from other websites, which are located on the website you are viewing. With these cookies, other websites can track online use of the webpage you are viewing for marketing or analytical purposes.
Cookies by duration
- Persistent cookies – Persistent or saved cookies remain on your computer after you close your web browser programme. They help websites store information, such as login and password, language settings, or cookie settings, so you don’t have to re-enter them each time you visit. Persistent cookies can stay on your computer or mobile device for days, months, even years.
- Temporary cookies – Temporary cookies or session cookies are removed from your computer when you close your web browser. Websites use them to store temporary information, such as the last few pages you opened on the website you visited, or items in your shopping cart if you are on a website that specializes in online sales.
JADRANKA TRGOVINA’s cookies are stored in the user’s browser for a maximum of 2 years.
You can always delete cookies stored on your computer, thus preventing further processing of your personal data through such technology. Each web browser has its own procedure for deleting cookies, and below are links to deletion procedures for the most popular web browsers: