Grand Hotel Zagreb

PRIVACY POLICY

Privacy policy:

We hereby inform you about the way in which we collect and process personal data, either directly or through third parties. We recommend that you read our privacy policy carefully to understand how we manage personal data in accordance with applicable laws and regulations.

  1. Introduction

B.M.V. Inženjering d.o.o. with its registered office in Zagreb, Zavrtnica 17, OIB: 51473089399, must collect and use certain data about individuals in its business and is therefore the controller of personal data.

The purpose of this policy is to ensure that B.M.V. Inženjering d.o.o. fully complies with legal, organizational and technical obligations regarding the protection of personal data.

All employees of B.M.V. Inženjering d.o.o. are fully familiar with the content of this policy and ensure its application when handling personal data or processing personal data. Employees whose tasks include handling personal data are adequately trained in their tasks in relation to the protection of personal data.

This policy applies to all personal data held by B.M.V. Inženjering d.o.o. in relation to any person, regardless of whether they were, are currently or will be a client, supplier or contact.

This policy has been developed with the aim of preventing potential damage to B.M.V. Inženjering d.o.o. and its employees and respondents, as well as to ensure that the processing of personal data by B.M.V. Inženjering d.o.o. fully in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (GDPR) and other applicable regulations, such as the Croatian Act on the Implementation of the General Data Protection Regulation (OG 42/2018).

Personal data processed by B.M.V. Inženjering d.o.o. in its business operations are not shared with unauthorized persons, are not offered, sold or transferred outside the Republic of Croatia, to third countries or to humanitarian organizations.

  1. Definition and application:

 Personal data means any data relating to an identified or identifiable natural person, that is, an individual who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Processing of personal data means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use or exploitation, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction, and the performance of logical, mathematical or other operations on such data. Categories of personal data that B.M.V. Inženjering d.o.o. in its business processes the name and surname, address, OIB, year of birth, e-mail address and other personal data for certain categories of respondents.

B.M.V. Inženjering d.o.o. collects and processes personal data primarily for the purpose of providing services in its business. Therefore, B.M.V. Inženjering d.o.o. needs to collect and process certain types of data about individuals who come into contact with B.M.V. Inženjering d.o.o. (respondents). B.M.V. Inženjering d.o.o. treats this personal information appropriately, regardless of how this data was collected, recorded, stored and used – on paper, computer or other material.

B.M.V. Inženjering d.o.o., in order to protect persons and property, collects certain data through video surveillance in its facilities and on the external surfaces of the facilities. Respondents are clearly warned by posted video surveillance signs when entering the recording perimeter. Only the responsible person of B.M.V. Inženjering d.o.o. and the person authorized by the responsible person have access to the specified data under all conditions prescribed by the Act on the Implementation of the General Data Protection Regulation (OG 42/18).

When the data subject sends an e-mail (e-mail) to B.M.V. Inženjering d.o.o. with personal data by which he can be identified, via an e-mail message with a question or comment, B.M.V. Inženjering d.o.o. uses this data to fulfill the data subject’s request or inquiry regarding the provision of services by B.M.V. Inženjering d.o.o. In the event that the data subject does not wish to provide his personal data necessary for the provision of these services, B.M.V. Inženjering d.o.o. will not be able to process such a request or inquiry, nor provide the service.

B.M.V. Inženjering d.o.o. processes certain personal data of the respondents for marketing purposes (name and surname, e-mail address) in order to deliver information about promotions, benefits and actions of B.M.V. Inženjering d.o.o. services, but solely on the basis of the consent of the respondent, which the respondent gives voluntarily by entering his e-mail address in the fields provided for this, confirming that he is familiar with this Policy. B.M.V. Inženjering d.o.o. allows each respondent to withdraw his consent to such data processing at any time, in accordance with the rules set out below. da u bilo kojem trenutku povuče svoju privolu za takvu obradu podataka, sukladno niže navedenim pravilima.

B.M.V. Inženjering d.o.o. has a legitimate interest in using your personal data for advertising purposes, including re-targeting, tracking ad effectiveness, business planning, creating marketing campaigns and business strategies, as well as communicating via social media profiles. The company may also record and photograph events that serve to promote B.M.V. Inženjering d.o.o. The recordings and photographs may be used for internal documentation of these events, as well as for marketing purposes on the website, social networks or promotional materials. With your consent, we may also use user-generated content (such as photographs) from social media for the purpose of advertising on websites or on our own website and applications. All information about personal data is processed in accordance with applicable personal data protection regulations.

At the time of submitting the data of the respondent to the company B.M.V. Inženjering d.o.o., the respondent agrees that B.M.V. Inženjering d.o.o. processes his/her personal data, in accordance with the specified purpose. The protection of the privacy of the data subject is permanent, and the data subject can exercise their rights, which are listed and explained below, at any time.

B.M.V. Inženjering d.o.o. keeps personal data of employees from employment and in connection with employment permanently. Personal data from accounting or bookkeeping documents (for example, invoices to customers or guests, but also invoices received from suppliers) B.M.V. Inženjering d.o.o. keeps at least 11 years in accordance with accounting regulations. Personal data of guests necessary for the provision of accommodation services, B.M.V. Inženjering d.o.o. keeps at least two years after the end of the calendar year in which they are entered in the Guest Book or Tourist List, in accordance with regulations on the content and method of maintaining the Guest Book or Tourist List. Contact data of respondents for the provision of marketing services (newsletter) B.M.V. Inženjering d.o.o. processes until the withdrawal of consent on the basis of which it processes them.

Collected data B.M.V. Inženjering d.o.o. keeps in an appropriate manner and ensures their confidentiality. B.M.V. Inženjering d.o.o. The collected data will not be forwarded to third parties without the consent of the data subject, except in cases where this is necessary for the fulfillment of legal obligations of B.M.V. Inženjering d.o.o. (for example, to the Tax Administration, the Croatian Pension Insurance Institute, the Ministry of Tourism and other competent authorities), in cases where this is necessary for the fulfillment of tasks carried out in the public interest or in cases where the data subject himself has published such data, as well as in other cases specified by competent regulations.

The data subject, with regard to personal data processed for him by B.M.V. Inženjering d.o.o., has the following rights:

Rights of the data subject:

Explanation

Right to information

The data subject has the right to request information at any time whether his/her personal data is being processed and for what purpose, who is the data controller, contact details of the data protection officer, which categories of personal data are being processed, for what period they are processed or stored, who is the source for obtaining his/her personal data, who are all the recipients of his/her personal data, as well as the right to information about his/her other rights specified in this policy (right of access, right of rectification, right of deletion, right to restriction of processing, etc.).

Right of access

The data subject has the right to obtain from B.M.V. Inženjering d.o.o. confirmation as to whether personal data relating to him/her are being processed, then to obtain access to this data and information about: – the purpose of the processing; – the categories of personal data that are being processed; – the recipients or categories of recipients to whom the data have been or will be disclosed; – if possible, the period for which the data are stored or the criteria by which that period can be determined; – to request from B.M.V. Inženjering d.o.o. the rectification or erasure of personal data or the restriction of processing of personal data concerning the data subject or the right to object to such processing; – the right to lodge a complaint with a supervisory authority; – if personal data are not collected from the data subject, any available information about their source; – the existence of automated decision-making, which includes profiling, with its consequences.
– svrsi obrade;
– kategorijama osobnih podataka koji se obrađuju;
– primateljima ili kategorijama primatelja kojima su podaci otkriveni ili će biti otkriveni;
– ako je moguće, o razdoblju na koje se podaci pohranjuju odnosno o kriterijima pomoću kojih je moguće utvrditi to razdoblje;
– da od B.M.V. Inženjering d.o.o. zatraži ispravak ili brisanje osobnih podataka ili ograničavanje obrade osobnih podataka koji se odnose na ispitanika ili prava na prigovor na takvu obradu;
– pravu na podnošenje pritužbe nadzornom tijelu;
– ako se osobni podaci ne prikupljaju od ispitanika, svakoj dostupnoj informaciji o njihovu izvoru;
– postojanju automatiziranog donošenja odluka, što uključuje izradu profila, s posljedicama.

Right to rectification

The data subject has the right to obtain from B.M.V. Inženjering d.o.o. the rectification of inaccurate personal data concerning him or her without undue delay. The data subject has the right to complete incomplete personal data, including by providing an additional statement.

Right to erasure / right to be forgotten

The data subject has the right to have B.M.V. Inženjering d.o.o. erase personal data concerning him or her without undue delay if the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed, if the data subject withdraws the consent on which the processing is based and there is no other legal basis for the processing, if the data subject objects to the processing, if the personal data have been processed unlawfully, if the personal data have to be erased for compliance with a legal obligation under Union law or Member State law to which B.M.V. Inženjering d.o.o. is subject, if the personal data were collected in connection with the offering of information society services to a child. The above does not apply if the processing is necessary (and to the extent necessary) for the exercise of the right to freedom of expression and information, for compliance with a legal obligation requiring processing under Union law or Member State law to which B.M.V. Inženjering d.o.o. or for the performance of a task carried out in the public interest or in the exercise of official authority vested in B.M.V. Inženjering d.o.o., for reasons of public interest in the field of public health, for archiving purposes in the public interest, for scientific or historical research purposes, for the establishment, exercise or defense of legal claims.
Navedeno se ne primjenjuje ako je obrada nužna (i u mjeri u kojoj je nužna) radi ostvarivanja prava na slobodu izražavanja i informiranja, radi poštovanja pravne obveze kojom se zahtijeva obrada u pravu Unije ili pravu države članice kojem podliježe B.M.V. Inženjering d.o.o. ili za izvršavanje zadaće od javnog interesa ili pri izvršavanju službene ovlasti B.M.V. Inženjering d.o.o., zbog javnog interesa u području javnog zdravlja, u svrhe arhiviranja u javnom interesu, u svrhe znanstvenog ili povijesnog istraživanja, radi postavljanja, ostvarivanja ili obrane pravnih zahtjeva.

Right to lodge a complaint with a supervisory authority

The data subject has the right, on grounds relating to his or her particular situation, to object at any time to the processing of personal data concerning him or her, including profiling, where the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority of B.M.V. Inženjering d.o.o. or where the processing is necessary for the purposes of the legitimate interests pursued by B.M.V. Inženjering d.o.o. or by a third party. B.M.V. Inženjering d.o.o. shall no longer process the personal data unless B.M.V. Inženjering d.o.o. demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims. If personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing purposes, including profiling to the extent related to such direct marketing.
Ako se osobni podaci obrađuju za potrebe izravnog marketinga, ispitanik u svakom trenutku ima pravo uložiti prigovor na obradu osobnih podataka koji se odnose na njega za potrebe takvog marketinga, što uključuje izradu profila u mjeri koja je povezana s takvim izravnim marketingom.

Right to data portability

The data subject has the right to receive personal data concerning him or her, which he or she has been provided by B.M.V. Inženjering d.o.o. in a structured, commonly used and machine-readable format and has the right, without hindrance from B.M.V. Inženjering d.o.o., to transmit those data to another controller if the processing is based on his or her consent and if the processing is carried out by automated means. The data subject has the right to have the data transmitted directly from B.M.V. Inženjering d.o.o. to another controller if this is technically feasible and this right does not adversely affect the rights and freedoms of others.
Ispitanik ima pravo na izravni prijenos od B.M.V. Inženjering d.o.o. drugom voditelju obrade ako je to tehnički izvedivo, a ovo pravo ne smije negativno utjecati na prava i slobode drugih.

Rights related to automated decision-making and profiling

The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her, unless the decision is necessary for entering into or performing a contract between the data subject and B.M.V. Inženjering d.o.o., if permitted by Union law or the law of a Member State to which B.M.V. Inženjering d.o.o. is subject or based on the explicit consent of the data subject.

Right to withdraw consent

The data subject’s consent is one of the legal grounds for processing data relating to the data subject. The data subject has the right to withdraw the consent he/she has given at any time. Withdrawal of consent does not affect the lawfulness of data processing carried out before the withdrawal of consent.

Right to restriction of processing

The data subject has the right to request the restriction of processing of his/her personal data: if he/she disputes the accuracy of his/her personal data – for the period necessary for B.M.V. Inženjering d.o.o. to verify that accuracy, if the processing of his/her personal data is unlawful and he/she does not request erasure but only restriction of processing, if B.M.V. Inženjering d.o.o. no longer needs his personal data, but their existence is necessary for the exercise of his legal claims, if he has objected to the processing, he has the right to request a restriction of processing for the period until it is determined whether the legitimate reasons of B.M.V. Inženjering d.o.o. for the processing outweigh his reasons from the objection.

In order to exercise his rights, the data subject must contact the Personal Data Protection Officer by sending a written notification or request to the Personal Data Protection Officer of B.M.V. Inženjering d.o.o., by e-mail using his e-mail address provided by B.M.V. Inženjering d.o.o. or by land mail to the address: Zagreb, Zavrtnica 17, as well as by delivering a personal statement directly to the business premises of B.M.V. Inženjering d.o.o., with prior notice to the telephone number +38516000520, with identification by a valid personal document.16000520, uz identifikaciju važećim osobnim dokumentom.

  1. Personal Data Protection Officer:

 B.M.V. Inženjering d.o.o. has appointed a Data Protection Officer and each data subject has the right to contact him/her regarding the protection of his/her personal data via:

Telephone: 01 6062 600
e-mail address: info@grandhotelzagreb.com

All questions regarding the protection of personal data should be directed to the Data Protection Officer.

  1. Principles of Personal Data Protection:

 B.M.V. Inženjering d.o.o. believes that the lawful and proper handling of personal data is very important and therefore ensures that personal data is treated lawfully and properly. To this end, B.M.V. Inženjering d.o.o fully supports and adheres to the Data Protection Principles.

The Data Protection Principles require that personal data:

  • must be processed fairly and lawfully and in particular that they may not be processed if the conditions set out in the regulations are not met;
  • are collected only for one or more specified and legitimate purposes and may not be further processed in any way that would be incompatible with those purposes;
  • the processing must be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed, and the data must be accurate and up-to-date;
  • they must not be retained for longer than is necessary for the applicable purpose;
  • they must be processed in accordance with the rights of the data subject in accordance with applicable regulations:
  • appropriate technical and organizational measures must be taken against unauthorized or unlawful processing of personal data and against accidental loss, destruction or damage to personal data;
  • they must not be transferred to a country or territory outside the EU, unless that country or territory ensures an adequate level of protection of the rights and freedoms of the data subject with regard to the processing of personal data.
 
  1. Activities of B.M.V. Inženjering d.o.o. regarding data processing:

B.M.V. Inženjering d.o.o. undertakes the following:

  • fully respects the conditions of fair collection and processing of personal data;
  • fulfills the obligation to specify the purpose for which personal data is processed;
  • collects and processes adequate personal data only to the extent necessary to meet operational needs or in accordance with all legal requirements;
  • submits all necessary data to the Personal Data Protection Agency;
  • strictly checks the length of time personal data is stored;
  • ensures that the rights of persons whose data are processed can be fully exercised in accordance with the protection of personal data;
  • takes appropriate technical and organizational security measures to protect personal data;
  • ensures that personal data are not transferred abroad without insurance coverage;
  • treats all persons fairly and honestly, regardless of their age, religion, disability, gender, sexual orientation or ethnicity, when dealing with their requests for information;
  • establishes clear procedures for responding to requests for information.

 

B.M.V. Inženjering d.o.o. may publish cookie content on its website for advertising and traffic statistics based on the interests and information of visitors to the B.M.V. Inženjering d.o.o. website from social networks. If the data subject uses content on B.M.V. Inženjering d.o.o. social networks or in applications, cookies from the aforementioned networks and applications could be stored on the data subject’s device from which the B.M.V. Inženjering d.o.o. website is accessed. Visitors have the right to disable cookies. Internet browsers are usually programmed to accept cookies by default, but data subjects can easily adjust this by changing their browser settings. If the data subject wishes to restrict or block all cookies that include B.M.V. Inženjering d.o.o. websites/applications (which may prevent the use of certain parts of the website) or other websites/applications, the data subject can do so in the browser settings.

In the event of a personal data breach that is likely to result in a high risk to the rights and freedoms of data subjects, B.M.V. Inženjering d.o.o. shall notify the data subject of the personal data breach without undue delay, unless B.M.V. Inženjering d.o.o. has implemented appropriate technical and organizational protection measures and those measures have been applied to the personal data affected by the personal data breach, in particular those that render the personal data unintelligible to any person not authorized to access them, or unless B.M.V. Inženjering d.o.o. has implemented subsequent measures to ensure that it is no longer likely to result in a high risk to the rights and freedoms of data subjects, or unless this would require a disproportionate effort, in which case B.M.V. Inženjering d.o.o. shall implement a public notice or a similar measure to inform data subjects in an equally effective manner.

  1. Review and Verification:

B.M.V. Inženjering d.o.o. has the right to update this policy if necessary to reflect best practices and to ensure compliance with any changes or modifications regarding the protection of personal data.

Booking Inquiry

Send an Inquiry