Data Protection and Privacy Policy
DATA PROTECTION AND PRIVACY POLICY
I. Name and Address of the Responsible Party
The responsible party in terms of the General Data Protection Regulation (GDPR) and other national laws of EU member states for data protection, as well as other legal provisions for data protection, is:
ACTION YACHTS d.o.o
Savska cesta 32, 10000 Zagreb
II. General Information on Data Processing
1. Scope of Personal Data Processing
We process the personal data of our users primarily only when necessary to provide a functional website, as well as our contents and services. Personal data is usually processed only after user consent. Exceptions apply in cases where obtaining prior consent is not possible for practical reasons, and processing is permitted by legal provisions.
2. Legal Basis for Personal Data Processing
If we request consent for the processing of personal data, Article 6(1)(a) of the EU Data Protection Regulation (GDPR) serves as the legal basis.
When processing personal data necessary to fulfill a contract to which the data subject is a party, Article 6(1)(b) of GDPR serves as the legal basis. This also applies to processing that is necessary to take pre-contractual measures.
If personal data processing is necessary to comply with a legal obligation to which our company is subject, Article 6(1)(c) of GDPR serves as the legal basis.
If the processing of personal data is necessary to protect the vital interests of the data subject or another natural person, Article 6(1)(d) of GDPR serves as the legal basis.
If the processing is necessary to safeguard legitimate interests pursued by our company or a third party, and the interests, fundamental rights, and freedoms of the data subject do not outweigh the first-mentioned interest, then Article 6(1)(f) of GDPR serves as the legal basis.
3. Data Deletion and Retention Period
Personal data of the data subject is deleted or blocked when the purpose for storage no longer applies. Retention may continue if required by European or national laws, EU regulations, or other legal provisions to which the responsible party is subject. Data blocking or deletion occurs once the legally prescribed retention period has expired, unless further retention is necessary to conclude or fulfill a contract.
III. Preparing Web Pages and Creating Log Files
1. Description and Scope of Data Processing
Each time our website is accessed, our system automatically records data and information from the requesting computer system. The following data is collected:
(1) Information about the type of browser and the version used
(2) The operating system of the user
(3) The internet service provider of the user
(4) IP address of the user
(5) Date and time of access
(6) Websites from which the user's system accesses our website
(7) Websites opened from the user's system via our website
These data are also stored in the log files of our system. The data is not stored together with other personal data of the user.
2. Legal Basis for Data Processing
The legal basis for the temporary storage of data and log files is Article 6(1)(f) of GDPR.
3. Purpose of Data Processing
Temporary storage of the IP address by the system is necessary to enable the website to be displayed on the user's computer. For this purpose, the user's IP address must remain stored for the duration of the connection to the terminal.
Storing data in log files is necessary to ensure the functionality of the website. We use the data for optimizing the website and ensuring the security of our IT systems. The data is not evaluated for marketing purposes.
Our legitimate interest in processing the data according to Article 6(1)(f) of GDPR lies in these objectives.
4. Retention Period
The data is deleted as soon as it is no longer needed for the purpose for which it was collected. For data collected for the preparation of the website, this happens when the corresponding logical connection to the terminal is terminated.
For data stored in log files, this happens no later than 180 days after collection.
5. Objection and Deletion
The collection of data for the purpose of preparing the website and the storage of data in log files is essential for the operation of the website. Therefore, there is no right to object for the user.
IV. Use of Cookies
a) Description and Scope of Data Processing
Our website uses cookies. Cookies are text files stored by the internet browser on the user's computer system. When the user accesses the website, the cookie may be stored on the user's operating system. This cookie contains a unique string of characters that allows the browser to be identified when the website is reopened.
We use cookies to make our website more user-friendly.
Some elements of our website require that the user's browser can be recognized even after changing pages.
Cookies store and transmit the following data:
(1) Search behavior
Additionally, we use cookies that allow the analysis of the user’s browsing behavior. The following data may be transmitted:
(1) Search terms entered
(2) Frequency of page views
(3) Use of website features
Data obtained in this way is pseudonymized through technical measures. As a result, it is no longer possible to assign the data to the requesting user. Data is not stored together with other personal data of the users.
When opening our website, users are informed via a banner about the use of cookies for analysis purposes and are linked to this data protection declaration. This also includes a link explaining how cookie storage can be prevented in the browser settings.
When opening our website, the user is informed about the use of cookies for analysis purposes and asked for consent regarding the processing of personal data in this context.
b) Legal Basis for Data Processing
The legal basis for processing personal data using technically necessary cookies is Article 6(1)(f) of GDPR.
The legal basis for processing personal data using cookies for analysis purposes is, when the corresponding user consent exists, Article 6(1)(a) of GDPR.
c) Purpose of Data Processing
The purpose of using technically necessary cookies is to simplify the use of the website for the user. Some features of our website cannot be offered without the use of cookies. For these, it is necessary that the browser is recognized even after changing the page.
We need cookies for the following applications:
(1) Recording search terms
User data collected through technically necessary cookies is not used to create user profiles.
Cookies used for analysis purposes aim to improve the quality of our website and its content. By analyzing cookies, we learn how the website is used, which allows us to continuously optimize our offering.
d) Retention Period, Objection, and Deletion
Cookies are stored on the user's computer and transmitted to our side. Therefore, the user has full control over the use of cookies. By changing the settings in their internet browser, the user can deactivate or limit the transmission of cookies. Already stored cookies can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, it is possible that not all features of the website can be fully utilized.
Flash cookies cannot be prevented through browser settings but can be managed by changing the Flash Player settings.
Cookie File List
A cookie is a small data file (a text file) that is stored in the browser of a device when a visitor enters a website. It collects information such as language preferences or user login details. These cookies come from us and are referred to as first-party cookies. We also use third-party cookies, which originate from a domain other than the one of the website you visited, and are used for advertising and promotional purposes. We use cookies and other tracking technologies for the following reasons:
Absolutely Necessary Cookies These are essential for the website to function, so they cannot be turned off. They are typically set in response to actions you have taken, such as requests for services regarding security settings, logins, form submissions, etc. You can set your browser to block cookies or alert you about them. Please note that some pages may not work without these cookies. These cookies do not store any personally identifiable information.
Web Analytics Cookies (US-based provider) We use cookies for web analytics, which is also managed by Google LLC. These may transmit collected data to another country, particularly to the USA, which does not provide an adequate level of personal data protection. If personal data is transferred to the USA, there is a risk that these data may be processed by US authorities for control and surveillance purposes, without the data subject being entitled to legal protection. Furthermore, we explicitly warn that Google LLC may link this data with other information about you, such as search history, personal accounts, or usage data.
The option to withdraw consent early by adjusting "cookie settings" in our privacy policy remains unaffected.
V. Contact Form and Email Contact
1. Description and Scope of Data Processing On our website, a contact form is available that can be used for electronic communication. If the user opts to use this option, the data entered in the form is transmitted to us and stored. This data includes:
(1) IP address of the user
(2) Date and time of registration Data processing requires your consent, which is referenced in this privacy statement during the submission process.
Alternatively, it is possible to establish contact via the provided email address. In this case, the personal data provided via email is stored.
In this context, data is not shared with third parties. The data is used exclusively for processing the communication.
2. Legal Basis for Data Processing The legal basis for processing the data is the user's consent under Article 6(1)(a) of the GDPR. The legal basis for processing the data transmitted in connection with email forwarding is Article 6(1)(f) of the GDPR. If the email contact leads to the conclusion of a contract, the additional legal basis for processing is Article 6(1)(b) of the GDPR.
3. Purpose of Data Processing Processing of personal data from the input mask serves solely to establish contact. In the case of contact via email, there is a legitimate interest in processing the data. Other personal data processed during the submission process is used to prevent misuse of the contact form and to ensure the security of our IT systems.
4. Duration of Data Storage Data is deleted when it is no longer necessary to achieve the purpose for which it was collected. For personal data from the input mask of the contact form and those sent via email, this occurs when the relevant conversation with the user has ended. A conversation is considered ended when it can be assumed, based on the circumstances, that the matter has been clarified. Additional personal data obtained during the submission process is deleted after seven days at the latest.
5. Right to Protest and Deletion
The user has the right to withdraw consent to the processing of personal data at any time. If the user contacts us by email, they can object to the storage of personal data at any time. In such a case, the conversation cannot continue.
If you wish to exercise your right to protest, simply send us an email at info@actionyachts.eu.
All personal data stored in connection with initiating contact will be deleted in such a case.
VI. Rights of the Data Subject
If your personal data is being processed, you are considered the data subject under the GDPR and have the following rights with respect to the responsible parties:
- Right to information
- Right to rectification
- Right to restriction of processing
- Right to erasure
- Right to notification
- Right to data portability
- Right to object
- Right to withdraw consent to data protection
- Automated individual decision-making, including profiling
- Right to lodge a complaint with a supervisory authority
VII. Monitored Areas
This information is intended for data subjects whose personal data is processed via the camera surveillance system of companies within the ACTION YACHTS d.o.o group operating in the territory of the Republic of Croatia. The controlling company of the group is ACTION YACHTS d.o.o, and the controlled companies operating in the Republic of Croatia are: ACTION YACHTS d.o.o., OIB: 16033688533, Savska cesta 32, 10000, Zagreb (hereinafter referred to as: "Data Controller").
The Data Controller hereby provides the data subject with the following information prior to obtaining personal data:
a) Purpose and Legal Basis for Processing Personal Data: (i) Protection of the legitimate interests of the data controller in accordance with Article 6(1)(f) of the GDPR – protection of the property of the data controller through electronic monitoring systems, while ensuring strict compliance with legal deadlines for the deletion of such data; (ii) Employee attendance recording; (iii) Fulfillment of the legal obligations of the data controller – maintaining construction and installation logs, proving compliance with employee training and notification obligations, and other persons present at the construction site, as required by special regulations (health and safety at work, environmental protection laws); (iv) Recording the progress of the construction as part of the technical documentation of the building, where personal data may be captured incidentally during the construction process.
b) Scope and List of Processed Personal Data:
Displaying the figure of the data subject in case of electronic monitoring at the construction site.
c) Provision of Personal Data to Third Parties:
Personal data will not be provided to third parties.
d) Disclosure of Personal Data to Recipients:
Control and inspection bodies of state administration, authorities involved in administrative or criminal proceedings, courts, investors/contractual partners of the Data Controller.
e) Publication:
Personal data will not be published.
f) Third Countries:
No transfer of personal data to third countries will take place.
Further information provided to the data subject:
i) Duration of Processing of Personal Data – According to the purpose of processing personal data, a special legal regulation establishes retention periods, or it is tied to the duration of contractual relationships and resulting rights and obligations. After the retention period or the duration of the rights and obligations has expired, or upon the termination of the purpose or decision by the Data Protection Authority, the personal data will be deleted in accordance with applicable legal regulations.
ii) The data subject has the right to request access to their personal data processed by the Data Controller, and also the right to correct or erase inaccurate personal data, the right to erase personal data in cases where the obligation to process or store personal data does not arise from special legal regulations, the right to restrict processing in the cases specified in Article 18 of the GDPR, the right to data portability, and the right to object.
iii) In connection with the processing of personal data, the data subject is entitled to submit a proposal to initiate proceedings at the Data Protection Authority to determine whether there has been a violation of the rights of individuals during the processing of personal data or a violation of the law.
iv) In cases where the processing of personal data is necessary based on the fulfillment of the legal obligations of the Data Controller, or the fulfillment of contractual relationships, where processing is necessary for the execution of the activities of the data subject on the construction site, the data subject is obliged to tolerate the processing of personal data to the extent necessary for the stated purpose.
