Ordinance on collection, processing, use and protection of personal data of natural persons
MOTORATIA D.O.O. travel agency
Our website address is: https://motoratia.com.
GENERAL PROVISIONS – Pursuant to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 98/46 / EC (hereinafter: the General Data Protection Regulation), MOTORATIA d.o.o. travel agency will:
- process and
personal data of its users.
LEGAL TERMS IN PERSONAL DATA PROCESSING
„Personal data“ means any data relating to an individual whose identity has been established or can be established.
The General Regulation on Personal Data Protection applies to the processing of personal data that is fully automated and to the non-automated processing of personal data that form part of a storage system or are intended to be part of a storage system.
“Processing“ covers a wide range of actions performed on personal data, including actions by manual or automated means such as collection, recording, organization, structuring, storing, adapting or modifying, finding, performing insights, use, disclosure by transfer, dissemination or otherwise, reconciling or combining, restricting, deleting or destroying personal data.
“Consent” of the respondent means any voluntary, special, informed and unambiguous expression of the respondent’s wishes whereby he / she gives consent by a statement or clear affirmative action to the processing of personal data relating to him / her.
“Violation of personal data “means a breach of security resulting in accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access to personal data transmitted, stored or otherwise processed.
“Data collector “is a natural or legal person that collects personal data of clients, and determines the purpose and manner of their processing and is responsible for the processing of data in accordance with applicable national and European regulations.
“Data processor “is a natural or legal person that processes personal data of clients on behalf of data controller in accordance with applicable legal regulations.
MOTORATIA d.o.o. travel agency within its business scope may act as data controller or data processor, depending on the circumstances of a business deal during which data is processed.
MANNER AND PURPOSE OF COLLECTION, PROCESSING AND RETENTION OF PERSONAL DATA
The lawfulness of data processing – processing is lawful only if and to the extent that at least one of the following items is met:
- the respondent has given consent to the processing of his or her personal data for one or more specific purposes;
- processing is necessary for the execution of the contract wherein the respondent is a contracting party, or in order to take action at the request of the respondent before concluding the contract;
- processing is necessary to comply with the legal obligations of the controller;
- processing is necessary to protect the key interests of the respondent or other natural person;
- processing is necessary to perform a task of public interest or exercise the official authority of the controller;
- processing is necessary for the legitimate interests of the controller or a third party, except where the interests or fundamental rights and freedoms of the respondent requiring the protection of personal data are stronger, especially if the respondent is a child.
Specifically, for the purposes of MOTORATIA d.o.o. travel agency, processing will be performed based on consent (approval) provided that, in accordance with the Regulation, the controller must be able to prove that the respondent has given his or her consent to the processing of his or her personal data (written statement) and when processing is necessary for the performance of the contract (legitimate interest). Also, the respondent has the right to withdraw his / her consent at any time. In addition, the respondent has the right to refuse to provide personal information, but in that case MOTORATIA d.o.o. travel agency may not be able to provide the services in which the respondent is interested, due to the nature of activities performed by MOTORATIA d.o.o. travel agency.
Direct personal data as well as indirect data such as “Cookies”, links and system information are collected.
Certain personal data of respondents necessary for business that are collected are:
- name and surname,
- date and place of birth,
- domicile / residence,
- e-mail address,
- telephone/ cell phone number,
- OIB – national identification number,
- identification document type, number and validity,
- number, date and place of visa issuance,
- debit / credit card information or other means of payment information,
- handwritten signature.
- * Other necessary data.
The following data may also be collected:
- photos and videos
- information on sales, services and maintenance
- information on customer history (degree of customer satisfaction…).
How personal data are collected – personal data are collected directlyfrom the respondentor indirectly (from third parties that MOTORATIA d.o.o. travel agency cooperates with on business terms, or with which it has concluded a Service Agreement – e.g., Associations, Companies, Firms that organize travels for their employees or customers), when booking services, sending a request for services offered by MOTORATIA d.o.o. travel agency via email or inquiry via website.
RESPONDENTS ‘RIGHTS AND COMPLAINT ABOUT THE PROCESSING OF PERSONAL DATA
In accordance with the Regulation on Personal Data Protection, respondents whose personal data are owned by MOTORATIA d.o.o. travel agency are entitled to:
- information on which personal data are owned by MOTORATIA d.o.o. travel agency, how those data were collected and to what purpose (the right to access data)
- information on data collector and data processor (informing)
- correction of respondents’ personal data if there has been a change or supplement incomplete data by providing an additional Statement (the right to correction)
- withdrawal of Consent to data use and processing
- complaint against MOTORATIA d.o.o. travel agency on the processing and use of respondents’ personal data (the right to lodge complaint)
- erasure of respondents’ personal data which are no longer necessary in relation to the purposes for which they were collected and there is no other legal ground for the processing (the right to erasure)
Respondents can exercise all their rights under this Ordinance by sending an inquiry to: firstname.lastname@example.org.
The right to object – the respondent has the right to object to the processing of their personal data at any time. If personal data are processed for the purposes of direct marketing, the respondent has the right to object to the processing of personal data relating to him/her for the purposes of such marketing at any time or if the respondent no longer wishes to be on the Agency’s marketing activities mailing list (electronic and postal leaflets or brochures and information on the Agency’s products and services). If the respondent objects to the processing for direct marketing purposes, personal data may no longer be processed for such purposes.
The right to complain to the supervisory authority – Each respondent has the right to lodge a complaint with the supervisory authority if he/she considers that the processing of personal data concerning him / her violates the Regulation (Personal Data Protection Agency).)
CORRECTION AND ERASURE
The right to correction –The respondent has the right to obtain the correction of inaccurate personal data relating to him / her from the controller without undue delay.
The right to erasure (“the right to be forgotten “) – The respondent has the right to obtain the erasure of personal data relating to him / her from the controller without undue delay and the controller shall erase personal data without undue delay.
Processing under data controller or data processor – the processor and any person acting under the direction of the controller or processor with access to personal data shall not process that data unless requested to do so by the controller.
Records of processing activities
Given the number of employees MOTORATIA d.o.o. travel agency is not obliged to keep records of processing activities.
Data Protection Officer – in accordance with Art. 37 of the Regulation MOTORATIA d.o.o. travel agency is not obliged to appoint a data protection officer.
Personal data of respondents are collected and processed for marketing activities (information on products and services) with their approval, by granting consent, and without the respondents’ consent in cases when personal data are necessary for the provision of services and carrying out of contractual obligations in which the respondents are a contracting party, or to take the necessary actions for concluding the contract.
MOTORATIA d.o.o. travel agency indefinitely collects, uses and stores personal data collected for marketing activities by consent, i.e., for the duration of the consent. Promotional materials include information about services, special offers and news in the form of electronic or tangible leaflets, brochures or newsletters. MOTORATIA d.o.o. travel agency undertakes to collect, use and store personal data exclusively for the purpose for which consent was granted. The respondent may disable the marketing service at any time by activating the “UNSUBSCRIBE” link at the bottom of the electronic newsletter, or by sending a written request for termination and removal from MOTORATIA d.o.o. travel agency marketing activities users list.
THE TRANSFER OF PERSONAL DATA TO THIRD PARTIES
In order to achieve the stated purposes and for the service to be fully provided, in some cases MOTORATIA d.o.o. travel agency must make the respondents’ personal data available to third parties, that continue to handle their personal data as data processors. These can be: bus companies, airlines, accommodation and catering facilities, insurance companies, banks, or other travel agencies. Also, in order to achieve the stated purposes, personal data may be available to third parties that handle customer data as personal data processors, which may be other travel agencies or companies that perform various services (e.g., IT companies) for MOTORATIA d.o.o. travel agency.
If MOTORATIA d.o.o. travel agency provides travel organization services to EU and non-EU countries, the respondents’ personal data may be available to third parties within the EU or companies outside the EU, only if they are necessary for the fulfilment of contractual obligations and the provision of services or part of services that are an integral part of the concluded package tour contract. The data may be made available to third parties in these cases exclusively for business purposes for the provision of services provided by the company in question (e.g., other travel agency acting as a subagent or facility used to accommodate the service user). In that case MOTORATIA d.o.o. travel agency will not make the respondents’ personal data available to entities that do not have the authority to process them.
SAFETY AND RESTRICTIONS IN USING THE COMPANY’S WEBSITE
Only MOTORATIA d.o.o. travel agency employees may access the respondents’ personal data obtained through MOTORATIA d.o.o. travel agency website and they use them for regular business activities. In case of termination or closure of MOTORATIA d.o.o., the travel agency will delete all received personal data and will not transfer them to other legal and natural persons.
This Ordinance on the collection, processing and use and protection of personal data of natural persons is published on MOTORATIA d.o.o. travel agency website and is valid from 16/07/2021.
MOTORATIA d.o.o. travel agency