Your rights under GDPR
- Right of access. You have the right to know what data we collect about you and how we use it. Upon request, we will provide you with a copy of all your personal data.
- Right to rectification. If your data is inaccurate or incomplete, you have the right to request its correction or completion.
- Right to erasure. You can request the deletion of your personal data when they are no longer needed for the purpose for which they were collected ("right to be forgotten").
- Right to restriction. You have the right to request restriction of processing of your data in certain situations, for example while your objection is being resolved.
- Right to portability. You can request that we provide your data in a machine-readable format or transfer it to another data controller.
- Right to object. You have the right to object to processing based on legitimate interest or for direct marketing purposes.
Our protective measures
Technical measures
- SSL/TLS encryption of all data in transit
- Encryption of sensitive data at rest
- Regular security audits and system updates
- Access control based on the principle of least privilege
- Regular data backups
Organizational measures
- Records of processing activities in accordance with Art. 30 GDPR
- Data processing agreements with all processors
- Data Protection Impact Assessment (DPIA) for high-risk processing
- Training of employees and associates on personal data protection
- Personal data breach notification procedure within 72 hours
Data processing principles
All personal data is processed in accordance with the following principles:
- Lawfulness, fairness and transparency - data is processed in a lawful, fair and transparent manner
- Purpose limitation - data is collected only for specified, explicit and legitimate purposes
- Data minimization - we collect only data that is necessary to achieve the purpose
- Accuracy - data must be accurate and up to date
- Storage limitation - data is kept only for as long as necessary
- Integrity and confidentiality - we ensure protection against unauthorized processing, loss or damage
Exercising your rights
To exercise any of the above rights, send a request to zef@zef.hr. We will respond to your request within 30 days. In exceptional cases, the deadline may be extended by an additional 60 days, about which you will be notified.
If you believe your rights have been violated, you have the right to file a complaint with the competent supervisory authority:
- Personal Data Protection Agency (AZOP)
- Selska cesta 136, HR-10000 Zagreb
- Web: azop.hr
- E-mail: azop@azop.hr