Privacy notice

We collect, process and use such data in accordance with the relevant data protection regulations, and the terms used in this Notice have the meanings as defined under Regulation (EU) 2016/679.

More precisely, pursuant to Regulation (EU) 679/16 ZUBAK GRUPA may have different roles with regard to your personal data, i.e. it may be the controller and/or the processor. This Notice serves to inform you, our users, of:

• the identity and contact details of the controller and/or processor (Section 1);
• the legal bases for processing personal data of data subjects, the purposes for such processing, and for which purposes do we use them (Section 2);
• the recipients of personal data (Section 3);
• the period for which your personal data are stored (Section 4),
• the personal data safeguards in place, and online security of personal data (Section 5),
• your rights with regard to the processing of your personal data and the manner in which you can exercise those rights (Section 6),
• your obligation to provide personal data (Section 7),
• whether automated decision-making and profiling are used or not (Section 8), and
• the application of cookies on our web pages (Section 9).

1. Basic information about ZUBAK GRUPA Ltd. as the controller and/or processor

1.1. Identity and contact details:

ZUBAK GRUPA Ltd., Velika Gorica, 117 Zagrebačka Street, PIN: 39135989747, Republic of Croatia; www.zubakgrupa.hr, www.autozubak.hr, www.oryx-asistencija.hr, www.oryx-rent.hr, www.oryx-tehnicki.hr

1.2. Contact details of the data protection officer – email: zastita.podataka@zubakgrupa.hr

2. How do we collect your data, on what basis do we process them, and for which purposes do we use them?

2.1. ZUBAK GRUPA collects personal data directly from you: (1) when concluding and executing mutual agreements/contracts, as well as during actions preceding the conclusion of contracts (offers; inquiries; reservations; requests regarding products or services; sending inquiries or requests related to our products or services); (2) by your expressed consent through the ZUBAK GRUPA web site; (3) indirectly when you want to buy and/or use our services and goods through intermediaries or agencies; (4) when you exercise the right or use our services or buy our products as part of the business cooperation we have with our business partners; (5) on any other lawful basis. In addition, we collect personal information when you make it available to us, e.g. as part of registering as a user of our services or creating your profile on our site, as a member of our assistance services or a user of other services, by filling out forms or sending us email, and in similar situations in which you choose to provide us with information.

2.2. Use of services and goods: When you want to enter into a contract with ZUBAK GRUPA, make a request for a quote, request a reservation of services and goods of ZUBAK GRUPA, and in any case when entering into a contractual or business relationship with ZUBAK GRUPA, we will need your personal information to provide you with a service or enable us to use our products or services in accordance with your request or to respond to your request. When placing your request for services or products or entering into a contractual relationship with ZUBAK GRUPA, you will be familiar with the type and amount of information that you are obliged to provide to us in order to fulfill your request or to conclude and execute the contract (personal information we collect for the purposes of this item may include your first and last name, PIN, company or business name, address, telephone, e-mail address, driver’s license information, your bank card details, and other information when required by a specific contractual relationship).

2.3. Use of the Website: Our websites www.zubakgrupa.hr, www.autozubak.hr, www.oryx-asistencija.hr, www.oryx-rent.hr, www.oryx-tehnicki.hr you can view and use anonymously since we do not collect any data which could identify you as an individual when you view our pages, and you are also not required to provide your personal data as a precondition for using our website. When you use our website, we may, however, store certain data associated with you for various security reasons. Such data may include the name of your internet service provider, the website that linked you to our website, the web pages you have visited while using our website, and your IP address. The mentioned data could allow us to identify you, but we do not use them for that purpose. We use such data from time to time for statistical purposes, but we also ensure that user data are anonymized, thus rendering the users unidentifiable. Furthermore, by entering your personal data in the designated fields available on our web pages, you confirm that you have voluntarily put such data at our disposal and that you allow us to use them for the purpose for which they are given.

2.4. Consent: We may ask you to give us your consent to the processing of your data for a purpose which, considering its ultimate intention, is not a precondition for the execution of a contract, does not represent a statutory obligation of ZUBAK GRUPA, is not necessary for entering into or executing a contract, or is not in your legitimate interest (e.g. for the purpose of marketing activities, offering services, sending personalized offers, and similar). You are not required to provide such consent, but you are free to give it if you are willing and have the right to withdraw it at any time. The request for consent must be presented to you in a manner which ensures that it is clearly distinguishable from other matters, in an intelligible and easily accessible form, using clear and simple language.

2.5. Processing on the basis of legal, regulatory or other grounds: ZUBAK GRUPA as a legal entity is subject to legal and regulatory obligations, which may mean the obligation to process data for the purpose of fulfilling the legal and regulatory obligations of ZUBAK GRUPA. In this case, the ZUBAK GRUPA performs its obligation to process your data in accordance with these laws and regulations (e.g. accounting/bookkeeping; providing the law enforcement with your information in case there was an offense or accident in one of our vehicles, etc.)

3. Do we share your data with third parties – recipients of personal data?

3.1. The data collected from you and other data that concern you remain stored in ZUBAK GRUPA’s databases. Your data may be shared with third parties:

a) in cases where we are required by law to disclose such data or where disclosure of such data is necessary in order to respond to a legal action or to a request made by competent law enforcement institutions in connection with minor offense, criminal offense or court procedures (on the basis of a written order);

b) for the purpose of protecting our rights, privacy, safety or property, and that of the public;

c) for the purposes of administrative or technical support (e.g. to our partners performing accounting, information system maintenance, and similar operations), or for other business purposes with a view of facilitating transactions with you;

d) for the purpose of analyzing our data, conducting mobile analytical services, or for the purpose of maintaining or improving our services (subject to non-disclosure agreements, where appropriate);

e) for the purpose of finding appropriate legal remedies and limiting possible damage;

f) for the purpose of complying with the terms and conditions of any contract or our business relationship with you, or with the terms and conditions applicable to our online service (e.g. for the purpose of providing accommodation reservations services, for the purpose of providing accommodation services, and similar);

g) for the purpose of processing transactions with our branches, business partners, agents or agencies whose services you have used to arrange or request our services;

h) in other cases subject to your consent.

3.2. Your personal data may be transferred to another legal entity in the event of a transfer, change of ownership, reorganization or merger of ZUBAK GRUPA Ltd. or a certain part of that company with another legal entity, or in the event of a transfer of the company’s property to another legal entity.

3.3. Your personal data may be disclosed to third parties – service providers (e.g. to a payment service provider for the purpose of collecting our service charges, to an e-mail service provider responsible for sending you e-mail notifications on our behalf or to subcontractors responsible for performing operations from the scope of our customer service). Such service providers may be located in some other country (i.e. not your home country), such as the US or an EU member state, and they are contractually bound to protect the confidentiality and security of your data. However, if required under applicable laws, your data may be made available to certain state authorities.

3.4. In cases where it shares your data with third parties, ZUBAK GRUPA will require that such third parties refrain from using your data for purposes other than the agreed one, and will also obligate its business partners to protect the confidentiality of personal data.

4. Period for which your personal data will be stored

4.1. The period for which your data will be stored/retained depends on the type/category of data, the purpose for which they were provided or collected, and the laws or legal obligations that ZUBAK GRUPA is required to comply with. The personal data will be kept for a period prescribed by the law, or for a period deemed necessary to provide the requested service or perform the service or purpose for which you have given your consent, unless otherwise required by the law (e.g. in connection with an ongoing court procedure).

4.2. The data that refer to statutory and legal obligations of ZUBAK GRUPA are stored for the period prescribed by the respective laws (e.g. the obligation to store and the period for which invoices and bookkeeping records (which, among other, contain your data) are to be retained is prescribed under the Accounting Act. Accordingly, such invoices and records are kept for 11 years.

4.3. The data in respect of which a specific storage (retention) period is not prescribed under any laws or regulations will be stored and retained for a period deemed reasonable depending on the category of the relevant data and the purpose for which they were collected in the first place. The data collected for a specific purpose will be used for that purpose only. After the expiry of the reasonable period of storage (retention) and after the relevant purpose is fulfilled, such data will no longer be actively used. However, anonymized data may continue to be used for statistical and marketing purposes, as well as for archiving and other analytical purposes. When providing such data, you will be informed of the applicable storage (retention) period, and the criteria in accordance with which such period is determined.

5. Personal data safeguards and online security of personal data

5.1. When we process your personal data, we implement appropriate technical, organizational and legal personal data protection safeguards to prevent unauthorized access and any further unauthorized processing.

5.2. On our websites, your personal data are protected from unauthorized access, use or disclosure. The data stored on computer servers are kept in a controlled and safe environment, with safeguards against unauthorized access, use or disclosure in place.

6. Your rights with regard to data processing

6.1. With regard to all your personal data stored in our databases and depending on the purpose and legal basis for storing and retaining such data, you have the following rights:

a) the right to access your personal data – you have the right to request and receive information from us regarding whether your personal data are being processed. If they are being processed, in addition to the right to access such data, you have the right to receive additional information regarding the purpose of processing, the categories of personal data that are being processed, the recipients or categories of recipients of personal data, the period for which personal data are stored (retained), the rights you have as data subjects, the right to lodge a complaint with a supervisory authority, the source of your personal data if not collected directly from you, the use (or non-use) of automated decision-making and profiling, as well as the transfer of personal data to third countries or international organizations;

b) the right to rectify or supplement your personal data – without undue delay, you will have the right to rectify inaccurate or supplement incomplete personal data which concern you;

c) the right to erase your personal data (“the right to be forgotten”) – you have the right to request that your personal data be erased at any time, and we will honor your request and act upon it if the relevant personal data are no longer needed for the purposes for which they were collected, if you withdraw the consent on the basis of which such data are processed, if you object to the processing performed on the basis of a legitimate interest, if the data are unlawfully processed, or if they are contrary to the provisions of the Regulation on any other basis. The right to erasure is not an unrestricted right. More precisely, we will not be able to honor your request and act upon it if there is a legal or some other obligation on the basis of which we are required to store and retain your personal data (e.g. storing and retaining invoices and book-keeping records), of which you will be informed timely;

d) the right to restrict the processing of your personal data – you will have the right to request that the processing of your personal data be restricted if you believe that the data are inaccurate (for a period allowing us to check the accuracy of the relevant data); if the processing is unlawful, without requesting erasure, however; if we no longer need the relevant data but you need them for the purpose of establishing, exercising or defending a legal claim; or if you have objected to the processing on the basis of a legitimate interest (e.g. restricting the use of an e-mail address for sending certain notifications/information);

e) the right to data portability – if you have provided your personal data in a structured, commonly used and machine-readable format, you have the right to obtain such data and transmit them to another controller, provided the processing is based on consent or on a contract, and provided the processing is carried out by automated means. If technically feasible, you may request that your data be directly transmitted to another controller;

f) the right to object to the processing – you have the right to object to the processing performed on the basis of a legitimate interest at any time (e.g. direct marketing);

g) the right to lodge a complaint with the relevant supervisory authority – if you consider that any of your rights, which arise in connection with the processing of your personal data, is breached, you may lodge a complaint with the Personal Data Protection Agency (AZOP), 14 Martićeva Street, 10 000 Zagreb, azop@azop.hr), in accordance with the applicable personal data regulations;

h) if the processing of your personal data is based on consent, you have the right to withdraw your consent at any time, where such withdrawal will take effect on the date it is made.

6.2. Requests to exercise the rights from the preceding section (except for requests under point g)) may be submitted in writing and sent to the address specified in Section 1 or via e-mail to zastita.podataka@zubakgrupa.hr. If you cannot be identified as the owner of the relevant personal data, your request may be denied.

7. Are you required to provide your personal data to us?

7.1. When you request ZUBAK GRUPA’s services, submit a particular request, ask for an offer to be made to you, file a complaint in connection with a particular agreement or execution thereof, you must provide to us such personal data that allow us to identify you as a user of our services, and to enter into and execute a contract with you, handle your request, or resolve your complaint. In such situations, provision of your personal data represents your legal and contractual obligation, and a precondition for entering into and executing a contract, for handling a request, or resolving a complaint.

8. Does ZUBAK GRUPA use automated decision-making and profiling?

8.1. ZUBAK GRUPA does not use automated decision-making or create profiles for data subjects.

9. Application of cookies