Policies

Data controller: Liburnia Pomorska Agencija d.o.o., V. C. Emina 3, 51410 Opatija, Croatia, OIB: 69441170749
Data protection contact: marketing@liburnia.com, +385 (0)51 703 540
Last updated: 19.10.2023.

The Data Controller, LIBURNIA POMORSKA AGENCIJA D.O.O., OPATIJA, V. CARA EMINA 3, OIB: 69441170749 (hereinafter referred to as the “Company”), hereby adopts this PRIVACY POLICY in Rijeka on 19 October 2023.

Through this Privacy Policy, the Company protects the privacy of its clients/customers/users (hereinafter referred to as the “Users”) and demonstrates its commitment to their personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC – the General EU Data Protection Regulation 2016/679/EU (the “Regulation”), the Croatian Act on the Implementation of the General Data Protection Regulation (Official Gazette No. 42/2018), Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (the ePrivacy Directive), as revised by Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009 amending Directive 2002/22/EC on universal service and users’ rights relating to electronic communications networks and services (the Universal Service Directive), Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector (the ePrivacy Directive), and Regulation (EC) No. 2006/2004 on cooperation between national authorities responsible for the enforcement of consumer protection laws.

Through this Privacy Policy, the Company undertakes to process personal data exclusively in accordance with the principles established by the aforementioned legislation.

This Privacy Policy is based on the following principles of personal data processing: the principle of lawfulness, transparency and best practice; the principle of limited processing and data minimisation; the principle of accuracy and completeness of personal data; the principle of storage limitation; the principle of data integrity and confidentiality; the principle of accountability; the principle of trust and fair processing; the principle of purpose limitation; and the principle of processing in an anonymous form.

This Privacy Policy applies to all services offered by the Company. Its purpose is to inform Users, in a clear and transparent manner, about the procedures for processing their personal data and their rights.

Users may, at any time, contact the Company with a request to amend, supplement and/or update their personal data, as well as with a request specifying the purposes for which they do or do not wish their personal data to be processed.

Personal Data

According to the Regulation, personal data means any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or by reference to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Accordingly, any information by which an individual may be identified, whether independently (directly) or in conjunction with other information (indirectly), constitutes personal data.

Processing

According to the Regulation, processing means any operation or set of operations performed on personal data or on sets of personal data, whether by automated means or not, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Data Collection

Certain services provided by the Company require the collection of Users’ personal data. Such data is collected in the following ways:

1. Data Provided Directly by Users

Users voluntarily provide personal data to the Company, as the Data Controller, within the scope necessary for the provision of specific services.

For the purpose of providing services, establishing a contractual relationship and/or selling certain products, Users are required to provide the following information:

• First and last name;
• Address;
• Personal Identification Number (OIB);
• Contact telephone and/or mobile phone number;
• Email address;
• Bank account details for the purpose of payment processing.

2. Data Collected Automatically Through Website Visits

Certain data is collected automatically when visiting our website. This includes information associated with online identifiers, such as Internet Protocol (IP) addresses and cookie identifiers.

The website places cookies, accesses general and non-sensitive information from your device, and uses such information to improve website products and website content. You may accept all or only part of these processes.

Directive 2009/136/EC and the Croatian Electronic Communications Act provide that consent is not required for cookies that are technically necessary for communication between the user’s terminal equipment and the website being visited, or for providing a service explicitly requested by the user.

These include:

User Input Cookies

These are first-party session cookies typically used to track user input when completing online forms across multiple pages, items selected when clicking the “Add to Cart” button during online shopping, language preferences, and similar functions.

Authentication Cookies

These are usually session cookies used to identify users after they log in to websites, such as online banking platforms. These cookies enable users to access authorised content, such as account balances and transactions, without needing to re-authenticate for each authorised function.

User-Centric Security Cookies

These are generally persistent cookies with a limited lifespan extending beyond the session. They are used, for example, to detect repeated failed login attempts or similar mechanisms designed to protect login systems against abuse.

Multimedia Player Session Cookies

These are session cookies used to store technical information required for video or audio playback, such as image quality, network connection speed, and buffering parameters.

Load Balancing Session Cookies

These are session cookies that allow communication to be redirected to a less heavily loaded server depending on the load of individual web servers hosting the content of the website being visited.

Social Plug-In Content Sharing Cookies

These are session cookies that enable users who are actively logged into a social network to share website content with their friends through social network plug-ins when visiting a website.

The legal basis for collecting and processing all other data is the User’s consent.

Users have the right to withdraw their consent for the processing of personal data through cookies at any time.

Collected data is not used for automated decision-making.

Personal data will be processed in accordance with applicable regulations and appropriate technical and organisational security measures will be implemented to protect personal data against unauthorised access, misuse, disclosure, loss or destruction.

The Data Controller maintains the confidentiality of your personal data and permits access to and disclosure of personal data only to those employees who require such data for the performance of their business activities, and to third parties only in cases expressly prescribed by law.

Purpose of Processing and Access to Data

Performance of Contractual Obligations

The Company collects and further processes Users’ personal data for the purpose of entering into and performing contracts, handling User complaints, and carrying out other activities related to the conclusion and performance of contracts and/or the provision of our services in accordance with applicable regulations.

The legal basis for processing personal data for the above purposes is the necessity of entering into and performing a contract. Accordingly, if a User refuses to provide essential information, the Company will not be able to enter into a contract and/or undertake certain activities related to the performance of the concluded contract.

Direct Marketing

Users’ contact information may be used to send promotional notifications regarding the Company’s products and services if the User has given consent for such processing.

The legal basis for processing personal data for these purposes is the consent of the User and/or customer.

Consent Management

The active role of Users in protecting their privacy is reflected in the granting of consent as a freely given, specific, informed and unambiguous indication of their wishes, by which they, through a statement or clear affirmative action, signify agreement to the processing of their personal data.

Consent management includes the possibility for a User, through an active and unambiguous action, to authorise the Company to collect and process specific personal data for one or more purposes (data subject consent), as well as to withdraw previously given consent for the collection and processing of personal data for one or more purposes in the same manner.

Website Cookies 

Our website uses standard web cookies.

Cookies are small files that a web browser stores on a computer, mobile device, or other device used by a User to visit a website. They are stored at the request of that website and for its future needs. These needs may vary depending on the purpose of the cookie.

Cookies may be classified according to their duration, source, and function.

Read more about cookies in our Cookie Policy.

Storage and Protection of Personal Data

Personal data collected on the basis of consent shall be stored and processed for a period of five (5) years.

Data processed on the basis of the User’s consent may be deleted before the expiry of the period specified in this Policy if such deletion is requested by the User or if the User objects to such processing.

The right to access collected personal data is granted only to those employees of the Company designated by a separate Company decision.

The Company processes Users’ personal data within the Republic of Croatia.

Personal data is not transferred to third countries (countries outside the European Union and the European Economic Area) or to international organisations.

The Company implements appropriate safeguards for the protection of personal data; however, it cannot guarantee the protection of any information during transmission to or from the website and cannot be held responsible for the actions of any third party that may receive such information.

We make every effort to protect your personal data after receiving it and apply strict procedures and security measures to prevent unauthorised access.

As data transmission over the Internet is not entirely secure, we cannot guarantee the security of data transmitted to our website. Any such transmission is carried out at your own risk.

In accordance with Regulation (EU) 2016/679 of 27 April 2016, the Company does not permit registration by persons under the age of 16. Consequently, no part of this website is designed to attract individuals under the age of 16.

Data Subject Rights

Data Subjects have the right to information, rectification of personal data, erasure of personal data, and withdrawal of consent.

Information, Rectification and Erasure

In order to exercise your right to information, access to personal data, rectification of inaccurate data, erasure of personal data, or restriction of processing, please contact us using the email address provided in this Privacy Policy.

Your request will be processed as soon as reasonably possible.

You have the right, at any time, to contact us and obtain information regarding whether your personal data is being processed and to what extent. If such data is being processed, you may request access to your personal data and the information to which you are entitled under applicable personal data protection regulations.

Right to Restriction of Processing

You have the right to request restriction of the processing of your personal data:

• if you contest the accuracy of personal data, for a period enabling us to verify its accuracy;
• if the processing is unlawful and you oppose the erasure of the data and request the restriction of its use instead;
• if we no longer require the personal data for processing purposes, but you require it for the establishment, exercise, or defence of legal claims;
• if you have objected to the processing of your personal data.

Right to Object

You may object at any time to the processing of your personal data.

Right to Rectification

If we process personal data that is inaccurate, you may request correction of such data at any time. If the data is incomplete, you have the right to request that it be completed.

Right to Erasure

To request the erasure of your personal data, please contact us using the email address specified in this Privacy Policy.

Please note that even if you request erasure, we will only delete data that we are not legally or contractually required to retain.

Your request will be processed as soon as reasonably possible.

Data Export in a Standard Format

Upon request by the Data Subject, we will export all personal data we store relating to you in XML format and deliver it to you via email as soon as reasonably possible.

Right to Withdraw Consent

Where processing is based on consent, you have the right to withdraw your consent at any time.

Withdrawal of consent shall not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

Consent may be withdrawn by notifying the Company in writing, either:

• by email; or
• by post to the Company’s registered address,

using the contact details specified in this Privacy Policy.

Right to Compensation

If you have suffered material or non-material damage as a result of a breach of applicable data protection legislation, you have the right to claim compensation for such damage from the Company.

Resolution of Disputes, Additional Questions and Right to Lodge a Complaint

If you believe that, through the processing of your personal data, we have violated the General Data Protection Regulation or any other regulations relating to the protection of personal data, we kindly ask you to contact us so that we may clarify the matter and resolve any disputed issues.

To resolve any misunderstandings or to submit additional questions, please use the email address specified in this Privacy Policy.

Please note that the Company reserves the right to amend and supplement this Privacy Policy at any time without providing any special notice to interested parties.

For this reason, all interested parties are advised to regularly review the contents of the Company’s website in order to remain informed of the current version of this Policy.

Controller Contact Details

Liburnia Pomorska Agencija d.o.o., V. C. Emina 3, 51410, Opatija, Croatia
Telephone: +385 (0)51 703 540
Email: marketing@liburnia.com