Privacy policy | Fonden Gradnja

Last updated: 17.11.2023

Who is the data controller of your personal data?

The company FONDEN GRADNJA d.o.o., Zagreb (City of Zagreb),Koprivnička 7, OIB: 34824460005 (hereinafter referred to as "Data Controller") respects your privacy and commits to protect it during and after your visit to this website (hereinafter "Site"), visits to our business locations, and when you use any of our products or services. To protect processed personal data, we have implemented appropriate physical, electronic, and managerial procedures. However, due to the inherent open nature of the internet, we cannot guarantee that communication between you and us or information stored on this Site or on our servers will be completely secure from unauthorized access by third parties. Therefore, we have rules that determine how your personal data will be processed and protected.

By accessing the Site, visiting our business locations, and purchasing any of our products or using our services, you accept these Privacy Policy. These Privacy Policy are subject to change, and the date of the last modification is indicated in the title.

As the data controller, we process your personal data in accordance with applicable data protection rules, especially in accordance with the General Data Protection Regulation (EU) 679/2016 (hereinafter: GDPR) and the Law on Implementation of the General Data Protection Regulation (NN 42/2018).

Types of personal data processed, purpose, and legal basis for processing personal data

As the Data Controller, we process your personal data, including information that can directly or indirectly identify you, especially through identifiers such as name, surname, email address, phone number, date of birth, photograph, and video, IP address, and other personal data if you provide them in communication with us, when executing a contractual relationship, participating in events, or accessing our business locations ("Personal Data"), particularly in cases when:

• you contact us via web forms, email, or connect with us through social networks,

• you leave comments or ask questions,

• we process your job application or application for employment,

• you access our Site,

• you visit our business locations,

• we photograph events and activities we organize,

• we send newsletters,

• we issue "R1" invoices for products/services,

• we collaborate with you as our suppliers and business partners.

We process personal data based on your consent, legitimate interests, for the performance of a contractual obligation, and based on a legal obligation. The processing of Personal Data is limited only to the purpose for which it was collected in accordance with the terms of these Privacy Policy. When processing data based on your consent, we only process the personal data voluntarily provided by you during communication with us, for the purpose of responding to your questions or processing your job application. The purpose of processing is to take steps at your request, such as answering questions and comments, receiving offers, communicating about your activities on the Site, processing open job applications and applications for advertised positions, and when you subscribe to receive newsletters. We also process your data for marketing and advertising purposes, but only based on your consent, which you can withdraw at any time, and for such processing, we will specifically ask for your consent. Based on legitimate interests, we process personal data when you access our Site (IP address), when we photograph events and activities we organize. If we organize events and other activities during which we will photograph and record guests, we will do so either based on legitimate interests, of which you will be informed in advance and before entering the recording/photographing space, or your prior consent will be obtained. The purpose of this processing includes investigating suspicions of fraud, harassment, physical threats, or other violations of the rules of the Site or any suspicious behavior that we consider inappropriate. We process images/photos of participants in our events for the purpose of promoting the events. For the performance of a contractual obligation and based on legal and sub-legal regulations, we are obliged to process your personal data when you purchase our products or use our services. This includes the processing of data of business partners and suppliers (e.g., agreements on service execution), as well as the processing of contact information of business partners who are natural persons and their employees (e.g., name, surname, official phone number/mobile, email address), and customers who request the issuance of "R1" invoices.

Open job applications and advertised job positions

We process open job applications from candidates who want to work with us and applications for advertised positions in a way that only authorized persons have access to this personal data, and the data is kept for 2 years from the date of receiving the open job application.

Storage of personal data

We process personal data only for the time necessary to achieve the purpose of processing. Personal data processed based on consent is processed only until you withdraw your consent, and you can object to the processing of personal data based on legitimate interests. Open job applications and applications for advertised positions are kept for 2 years from the date of receiving them. Other Personal Data processed based on your inquiries, applications, etc., are kept for a maximum of 6 months from receiving them, and the data of business partners and suppliers are kept until the end of business cooperation and are not provided to third parties or transferred to third countries. In doing so, we do not collect any private nature data, only data related to the fulfillment of work tasks. All other personal data processed based on the performance of a contractual relationship and based on a legal obligation are stored in accordance with positive regulations, where the storage time is determined (e.g., Accounting Act). Exceptionally, we will keep your personal data longer than the specified deadlines when it is necessary to fulfill mutual legal requirements. After the expiration of the storage deadlines, personal data printed on paper will be securely destroyed, for example, by cutting or burning, while data in electronic form will be permanently deleted.

Your Personal Data may be disclosed in the following cases:

• to entities necessary for the execution of events - photographing events,

• to authorized PR and marketing agencies and entities directly involved in the implementation and realization of specific events,

• to entities maintaining our information systems,

• to entities authorized to process Personal Data, subject to the appropriate legal obligation of confidentiality (e.g., accounting service),

• to law enforcement agencies and public authorities when required by applicable law or in good faith (for the purpose of protecting and defending our rights and/or property or in emergencies to act to protect the personal safety of our guests, employees, Site, or the public),

• to our legal advisors in case of the need to forward data for legal proceedings,

• to business partners for their needs only in accordance with the appropriate legal grounds,

• to media companies and digital marketing agencies for the purpose of publishing photos in printed media, on websites, and social networks.

Transfer of Personal Data to third countries

The data we collect is stored within the European Union (EU) and the European Economic Area (EEA) except for Switzerland, but it may also be transferred and processed in a country outside the EU and EEA. Any such transfer of personal data will be carried out in accordance with applicable legal regulations. For transfers outside the EEA, we use Standard Contractual Clauses, adequacy decisions, and appropriate protective measures to ensure adequate protection of personal data.

Consent Management

You can always revoke the consents given to us. If you revoke the consents given, we will no longer process your data for the specified purposes, but this does not affect the lawfulness of the processing before the revocation of the consent.

Your Rights

a) Right to rectification: If we process your personal data that is incomplete or inaccurate, you can request correction or supplementation at any time.

b) Right to access: You have the right to obtain confirmation as to whether we process your personal data and, where that is the case, you have the right, under the conditions of Article 15 of the GDPR, to access that data.

c) Right to erasure: You can request the erasure of your personal data from us if we have processed it unlawfully or if such processing represents a disproportionate interference with your protected interests. Please note that there are reasons that prevent immediate erasure, such as fulfilling a legal obligation requiring processing.

d) Right to restriction of processing:

You can request the restriction of the processing of your data from us:

• if you dispute the accuracy of the data for a period that allows us to verify the accuracy of that data;

• if the data processing was unlawful, but you refuse deletion and instead request a restriction on the use of the data;

• if the data is no longer needed for the intended purposes, but you still need it to assert legal claims, or;

• if you have objected to the distribution of this data.

e) Right to data portability:

You can request us to provide you with the data you have entrusted to us for archiving in a structured format, in a commonly used machine-readable format:

• if we process this data based on the consent you have given and which you can withdraw or for the performance of a contract, and

• if the processing is carried out using automated processes.

f) Right to object:

If we distribute your data to perform tasks of public interest or tasks of public authorities or invoke our legitimate interests in processing, you can object to such data processing if there is an interest in protecting our data.

g) Right to complain: If you believe that we have violated Croatian or European data protection regulations in the processing of your data, please contact us to clarify any questions. You certainly have the right to file a complaint with the competent supervisory authority, the Personal Data Protection Agency, Selska cesta 136, Zagreb.

Exercising Rights

If you want to exercise any of the above rights, please contact us using the contact information in these privacy rules. When submitting a request to exercise your rights, we are first obliged to verify your identity, and for that purpose, we will request additional information to verify it. This serves to protect your rights and privacy. If you use any of the mentioned rights too often and with an obvious intention of abuse, we may charge an administrative fee or refuse to process your request.

Changes and Updates to our Privacy Policy

We reserve the right to change or update these Privacy Policy at any time and without prior notice. Please check for any changes or updates to our Privacy Policy from time to time.