1. Data controller
The data controller is ZEF - Cooperative for Ethical Financing, registered office at Ilica 36, HR-10000 Zagreb, OIB: 26856588936, MBS: 080912237, registered with the Commercial Court in Zagreb (hereinafter: "ZEF", "we" or "our").
For general inquiries about personal data processing, contact us at zef@zef.hr or by phone at +385 95 9065 108.
1.a Data Protection Officer (DPO)
Pursuant to Article 37 of the GDPR, ZEF has appointed a Data Protection Officer. For all questions related to the processing of your personal data and the exercise of your GDPR rights, contact the DPO directly:
- Email: zastita.podataka@zef.hr
- Address: Cooperative for Ethical Financing, Data Protection Officer, Ilica 36, 10000 Zagreb
2. What data we collect
We collect the following categories of personal data:
- Identification data - name, surname, OIB (for cooperative members)
- Contact data - email address, phone number, postal address
- Membership data - date of joining, type of membership, paid membership stakes
- Communication data - content of email communication and inquiries via the contact form
- Technical data - IP address, browser type, operating system (collected automatically when visiting the website)
3. Purpose and legal basis of processing
We process your personal data for the following purposes:
- Membership management - processing applications, maintaining the member register and communicating with members (legal basis: contract performance)
- Responding to inquiries - processing contact forms and email inquiries (legal basis: legitimate interest)
- Sending notifications - informing members about cooperative activities, assemblies and projects (legal basis: legitimate interest / consent)
- Legal obligations - fulfilling accounting, tax and regulatory obligations (legal basis: legal obligation)
4. Data sharing
We do not sell or share your data with third parties for marketing purposes. We may share data with:
- Service providers who help us in our operations (accounting, IT support), who are bound by confidentiality agreements
- Competent authorities when legally required
- Partner organizations within the FEBEA network, exclusively with your consent
5. Retention period
We keep personal data for as long as necessary to fulfill the purpose for which they were collected. We keep membership data during the membership and for 5 years after withdrawal. We keep accounting data in accordance with legal deadlines (11 years).
6. Your rights
Under the General Data Protection Regulation (GDPR), you have the right to:
- Access your personal data (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure of data - "right to be forgotten" (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Object to processing (Art. 21 GDPR)
- Withdraw consent at any time
To exercise these rights, contact the Data Protection Officer at zastita.podataka@zef.hr. ZEF will inform you of actions taken within one month of receiving the request.
6.a Complaint to the supervisory authority
If you believe that we are violating the GDPR through the processing of your personal data, you have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP):
Personal Data Protection Agency (AZOP)
Selska cesta 136, 10000 Zagreb
Phone: +385 (0)1 4609-000
Email: azop@azop.hr · Web: www.azop.hr
7. Data security
We apply appropriate technical and organizational measures to protect your personal data from unauthorized access, loss, or misuse, including data encryption, access control, and regular security audits.
8. Automated decision-making
ZEF does not carry out automated decision-making, including profiling, that produces legal effects or similarly significantly affects data subjects.