This Privacy Notice (“Notice”) describes how we how we carry out data processing practices, how we collect, use or otherwise process personal data. This Notice does not address the processing of personal data of our employees, which is subject to a separate set of rules.
The term “personal data” means any information relating to an identified or identifiable natural person (“data subject”).
We will process your personal data in a manner and for the purposes determined in this Privacy Notice. Collecting and processing of your personal data is carried out in accordance with the data protection legislation in force, especially in accordance with Regulation (EU) 2016/679 (herein: “General Data Protection Regulation”), Act on Implementation of General Data Protection Regulation (OG, no. 42/2018) as amended and other applicable privacy and data protection legislation.
1. Who is data controller?
Data controller for the processing of your personal data in regard to the purposes specified in this Notice is Altus informacijske tehnologije d.o.o., Selska cesta 93, Zagreb, OIB: 83005209824 (herein: “Altus IT”).
In case you have any requests in respect to the processing of your personal data or in case of exercising your rights set out in Article 4 of this Notice, please contact us on phone number: +385 1 3651 342 or send us an e-mail to firstname.lastname@example.org.
2. Which of your personal data we collect? For which purposes and how long we collect personal data?
We process your personal data only to the extent necessary for the services that we provide to you or for other processing purposes, namely:
- For the purposes of protecting persons and property through video-surveillance of the external surface of the facility and premises and parts of data center premises located at the address Selska cesta 93, Zagreb, we can process video recordings of said premises which contain recordings of your face. This processing is based on our legitimate interest. Personal data will be processed for the period prescribed by the applicable legislation and for a maximum period of six months. Only the responsible person authorized by the Altus IT has the right to access to the abovementioned recordings. In addition, to prevent unauthorized access to the recordings, Altus IT has established automated system log for registering the access to video-surveillance system in accordance with the applicable legislation. In case that you do not accept data processing of your personal data through video-surveillance, you may not be able to enter our premises.
- For the purposes of performance of a contract for the provision of data center services with our users, we process personal data of our current users, authorized representatives of our users who are legal persons, their employees, related persons and third parties, such as persons authorized by our users to access data center. Such personal data may include name, surname, personal identification number, date and place of birth, sex, place of residence, e-mail address, vehicle registration number and phone number. Legal basis for such processing is performance of a contract on the provision of data center services or data controller’s legitimate interest. Personal data will be processed for the duration of the contractual relationship and for a maximum of five years from the beginning of the statutory limitation period for each individual case. In case that you as our user do not provide us with all the necessary data, we may not be able to enter into the contract with you or fulfill all our obligations arising from such contract.
- For the purposes of compliance with the obligations laid down in applicable legislation, especially, Act on Accounting, Act on Electronic Communications and General Tax Act, we process your personal data that may include name, surname, personal identification number, date and place of birth, sex, place of residence, e-mail address and phone number. Legal basis for processing is compliance with our legal obligations. Personal data will be processed for the period prescribed by certain legislation.
- For the purposes of employment, we collect personal data of potential employees and other candidates (e.g. students on traineeship). Personal data collected in this regard include resumes and/or other information usually found in the CV and/or usually refer to the employment procedure, such as name, surname, personal identification number, date and place of birth, sex, place of residence, e-mail address, phone number, education information and past work experience and photos. The provided information may also include special categories of personal data (e.g. health status). In the event you do not provide us with such data, we may not be able to enter into contract with you and fulfill all our obligations arising out of such contract. If a candidate is not offered employment or individual role on a given occasion, but we consider that such candidate may be suitable for a different role in the future, with the consent of such candidate, we can keep his/her personal data for future consideration. The personal data collected on the basis of the consent given for the purposes of future employment considerations will be erased after the withdrawal of the consent and/or termination of the processing due to the fulfillment of the purpose and/or termination due to the decision of the supervisory authority.
- For the purposes of providing information about our services, we may process the personal data of our users, potential users and their employees, including the name and surname, e-mail address, telephone number, workplace. These personal data are collected during our business contacts based on consent or processed on the basis of our legitimate interest. However, at any time, you may refuse to receive such notifications about our offers and services (or you may request exclusion from the database). The consent for the purposes of providing information on our services is valid until the withdrawal and/or termination of the processing due to the fulfillment of the purpose and/or termination due to the decision of the supervisory authority.
- For the purposes of ensuring IT system and network security, we may process your personal data in the scope necessary to ensure access to physical premises and information systems and to establish mutual confidentiality obligations. The legal basis for such processing is our legitimate interest or third party legitimate interest. Your personal data will be processed for the time necessary for the fulfillment of this purpose.
- For the purposes of answering the inquiries from the users of our web pages https://datacentar.hr/en via contact form, we can process your personal data, including name and surname, e-mail address, telephone number and IP address. Such processing is based on a legitimate interest or action taken at the request of the data subject prior to entering into a contract. Your personal data will be processed for the time necessary for the fulfillment of this purpose.
- Furthermore, we may process and store your personal data including name, surname, phone number, e-mail address, contract identification number, for the purposes of fulfillment of our potential claims in the future. This processing is based on our legitimate interest or on third party legitimate interest. Personal data will be processed for the period necessary for the fulfillment of this purpose, however, not longer than a period of ten years from the beginning of the statutory limitation period in each individual case.
3. With whom do we share your personal data?
In certain cases, your personal information may be shared with trusted third parties providing us with administrative and technical support, or data processors implementing appropriate technical and safety measures and mechanisms to ensure personal data protection. We may also share your personal data with public authorities when such obligation is prescribed by applicable legislation and in accordance with their legal powers, as well as with external counsels and with other staff which is bound by confidentiality obligations. We carefully select and monitor the work of providers of such services.
Only a limited number of our employees will have access to your personal data. Employees shall keep your personal data and measures taken for their protection strictly confidential. They have the right to handle personal data only according to our explicit instructions.
4. What are your rights in regard to the processing?
At your request, we will inform you about the processing of your personal data and which data are processed. If all legal requirements are met, you have the right to rectification, erasure or restriction of processing of personal data. You can withdraw all declarations of consent that you have given and object the processing. For this purpose, you can contact us through the channels indicated in section 1. You also have the right to obtain the information you have provided to us in a structured, updated and machine-readable format; and you may request the transfer of this data to you or to third parties. We have obligation to respond to your request within one month from the date of receipt of your request, unless a longer period of time is required for the same, in which case the same period may not exceed two months.
You also have the right to lodge a complaint with the Personal Data Protection Agency, Martićeva 14, 10000 Zagreb, www,azop.hr, if you consider that an infringement has occurred during the processing of your personal data.
If you give us your consent to process your personal information, you are doing so completely voluntarily and you have the right to withdraw or restrict your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. If your personal data is processed for direct marketing purposes or based on a legitimate interest, you also have the right to object to such processing at any time.
5. How long do we keep your personal data?
We store your personal data only as long as necessary for the fulfillment of the purpose of respective processing, usually for the duration of the contractual relationship or for the period as expressly required by the applicable legislation. If we process your personal data based on your consent, such personal data will only be processed for the duration of the consent which you can withdraw or restrict at any time. If you do so, we will stop processing respective personal data for the purposes for which you have given your consent.
After that, these data are deleted or anonymized, unless the same data shall be stored for a specified period, in accordance with company law, taxation or other regulations, in which case the same data will no longer be processed for other purposes.
6. Links to third-party websites
Our website may contain links to third-party websites. If you click on such links, such third parties may collect certain information about you, such as IP address or search history, and may place cookies on visitor browsers. Please note that the processing of collected data is governed by the rules adopted by operators of such third parties and, therefore, this Notice does not apply.
7. What if there are any changes to the processing?
Any changes to this Notice will be posted on our web pages https://datacentar.hr/en and available through the usual communication channels.
This Notice was last updated on May 25, 2018.