Privacy Policy
Privacy and Personal Data Protection Policy
ZARAKOP d.o.o., limited liability company for construction and geoengineering, with its registered office at Baričevići 10, 23000 Murvica, Poličnik, Republic of Croatia (OIB: 47945843315), hereinafter referred to as Zarakop, attaches extreme importance to your privacy and the security of your personal data.
The collection, processing, and use of your personal data are carried out in full compliance with the provisions of this Privacy Policy and the applicable regulations of the Republic of Croatia and the European Union governing personal data protection, including the General Data Protection Regulation (GDPR) as the key applicable EU regulation.
The privacy of our clients and business partners is extremely important. We continuously take all necessary measures to ensure the confidentiality and integrity of the collected personal data.
Please regularly monitor this Personal Data Protection Policy due to possible periodic changes and updates.
What type of data is collected?
Zarakop, as the data controller, collects and processes personal data of data subjects collected during the use of services available on the zarakop.hr website and during communication with Zarakop.
Personal data is processed exclusively for the purposes for which it was collected, in accordance with the principle of data minimization, and is limited to data necessary for achieving the legitimate purpose of processing.
Personal data will not be collected or further processed in cases where cooperation has not been agreed upon and when communication between the parties does not continue.
This may include personal data that data subjects voluntarily provide through online forms or otherwise within the scope of using Zarakop’s services, for example, via phone or email, including identification and contact details (such as first and last name, address, phone number, payment details, and similar).
Data that is provided or generated automatically during the use of services may also be collected, including technical and usage data such as access date and time, viewed pages, IP address, type and version of the internet browser, device identifiers, and, if available and permitted, location data.
In certain cases, data on interaction with the website, such as user actions on the page (e.g., clicks or keyboard entries), may also be processed, exclusively if such data is available without the installation of additional software.
Furthermore, data contained in correspondence and other forms of communication with data subjects, including emails and phone calls, may be processed.
Data Subject Consent and Right to Withdraw Consent
Zarakop processes personal data of data subjects that they voluntarily provide and/or consent to. It is considered that by accepting the Terms of Use, of which this Privacy and Personal Data Protection Policy is an integral part, the data subject gives their informed and unambiguous consent for the processing of personal data for the purpose of using the services provided by Zarakop.
The data subject has the right to withdraw their given consent at any time, through a simple, free, and clear procedure, in whole or in part, by sending a written notification, whereby the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
Requests for access, correction, or deletion can be sent via email with the subject line “Request for exercising data subject rights” or by mail, with a signature or electronic signature for verification.
Personal Data Controller
Zarakop is the controller of personal data of data subjects in the sense of applicable personal data protection regulations.
This Privacy Policy applies to all user personal data collected and processed by Zarakop, either directly or through authorized partners involved in providing services.
Personal data is considered any information relating to an identified or identifiable natural person, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, or other factors specific to the identity of that person.
Processing of personal data encompasses any operation or set of operations performed on personal data, whether by automated or non-automated means, including, but not limited to, collection, recording, storage, use, consultation, transmission, or other disposal of data.
This Privacy Policy does not apply to anonymized data, i.e., data that cannot be linked to a specific or identifiable data subject.
Purpose of personal data processing
Zarakop may collect and process personal data of data subjects for the following purposes:
– providing and enabling the use of services offered by Zarakop
– creating analyses and statistical reports related to service usage, including monitoring user interests, comparing services, and improving existing and developing new services
– conducting internal training, quality control, and improving business processes
– establishing, maintaining, and developing business relationships with clients
– ensuring the security, stability, and availability of Zarakop’s information systems and data, as well as the systems of its authorized service providers
– implementing status changes, reorganizations, or other corporate transactions that may affect the processing of personal data
– preventing, detecting, and investigating fraud, abuse, or other illegal activities
– acting upon legitimate requests from competent authorities and asserting, proving, or defending legal claims in judicial, administrative, or other proceedings in which Zarakop participates
Additional processing purposes may arise from applicable legal obligations, specific circumstances of an individual case, or be necessary for the lawful and proper processing of collected personal data.
Informational and Marketing Communication
Zarakop may use the contact details of data subjects to send informational messages necessary for the performance of a contractual relationship or the provision of services, including notifications about service functionality, technical and security information, and other important notices related to service use. Such messages are sent in accordance with applicable regulations and are not considered commercial communication within the meaning of the Electronic Communications Act.
Commercial and marketing communication, including sending brochures, promotional offers, and other advertisements via email, SMS messages, or other electronic communication channels, is carried out exclusively with the prior consent of the data subject, in accordance with the provisions of the Electronic Communications Act and the General Data Protection Regulation (GDPR).
Exceptionally, if a customer/data subject has provided their contact details to Zarakop in the context of the sale of products or services, Zarakop may use that data for direct promotion of its own similar products or services, provided that the data subject is given a clear and free opportunity to refuse further communication at the time of data collection and with each such message.
The data subject has the right at any time, free of charge and in a simple manner, to object to or withdraw their consent for receiving marketing messages, for example, via an unsubscribe link in the received message or by sending a request to Zarakop, after which such communication will be immediately ceased.
Forwarding Personal Data to Third Parties
As a rule, Zarakop does not forward personal data of data subjects to third parties, except in the cases mentioned below.
Personal data may be entrusted to authorized processors who process personal data exclusively on behalf of and according to Zarakop’s instructions, for the purpose of enabling regular business operations and providing services (e.g., IT service providers, analytics, or market research). In such cases, Zarakop ensures that appropriate personal data processing agreements are concluded with the processors and that adequate technical and organizational protection measures are applied.
Furthermore, personal data may be provided to third parties when it is necessary to fulfill the data subject’s request or provide the requested service, when the data subject explicitly requests it, or when the data subject has been informed in advance of such transfer. Exceptionally, personal data may also be forwarded for the purposes of preventing abuse, protecting the rights and interests of Zarakop or third parties, as well as for asserting or defending legal claims, in accordance with applicable regulations.
Personal data may also be forwarded to competent public authorities when such processing is prescribed or permitted by applicable laws.
Zarakop may make anonymized data available to third parties, whereby such data does not allow for the identification of the data subject nor can it be reasonably linked to a specific natural person.
All Zarakop employees, as well as business partners and related persons involved in the processing of personal data, are obliged to act in accordance with the principles of privacy and confidentiality protection, based on contractual and legal obligations applicable to Zarakop and its affiliated companies.
Where and how personal data is stored
Zarakop applies appropriate technical and organizational protection measures when storing and processing personal data, with the aim of preventing unauthorized access, loss, misuse, alteration, or other forms of unlawful processing of personal data. These measures are regularly reviewed, monitored, and, if necessary, adapted in accordance with technological developments and risk assessment.
The same levels of protection are required from authorized processors and other third parties involved in the maintenance or management of Zarakop’s information systems.
Personal data is stored in a form that allows identification of data subjects only for as long as necessary to achieve the purpose of processing, or in accordance with applicable legal obligations regarding retention periods.
To ensure the confidentiality, integrity, and availability of personal data, Zarakop applies various security measures, including, where appropriate, data encryption, authentication mechanisms, and other technical and organizational protection measures.
Access to data is controlled, and risks are periodically assessed.
Among the measures applied are, among others:
– strictly limited access to personal data based on the “need-to-know” principle, exclusively for authorized persons and for purposes of which data subjects have been informed
– secure channels for the transmission of personal data
– monitoring and recording access to information systems, to the extent appropriate to the level of risk, for the protection of personal data.
Personal Data Retention Period
Zarakop stores and processes personal data of data subjects only for as long as necessary to achieve the legitimate and predetermined purpose of processing, except in cases where a longer retention period is prescribed for specific data categories by applicable regulations.
Personal data processed based on consent for marketing purposes is stored until the consent is withdrawn.
In cases where cooperation has not been established and consent for marketing communication has not been given, personal data collected for the purpose of preparing or submitting an offer is stored for a maximum of one year, unless the data subject requests its deletion earlier, in which case the data will be deleted without delay.
Upon expiration of the retention period, or when personal data is no longer needed for processing purposes, it is permanently deleted, irreversibly anonymized, or securely destroyed, in accordance with applicable technical and organizational protection measures.
Questions, Suggestions, and Exercising Data Subject Rights
Data subjects have the right at any time to exercise the rights guaranteed by the General Data Protection Regulation (GDPR), including:
– the right to access personal data and obtain information about its processing
– the right to rectification of inaccurate or completion of incomplete personal data
– the right to erasure of personal data, when legal conditions are met
– the right to restriction of personal data processing
– the right to data portability, where applicable
– the right to object to the processing of personal data, especially for direct marketing purposes
– the right to withdraw consent at any time, when processing is based on consent, whereby the withdrawal of consent does not affect the lawfulness of processing before its withdrawal
Requests related to exercising these rights can be submitted in writing via email to [email protected] or by mail to the address: Baričevići 10, 23000 Murvica, Poličnik, Croatia.
The data subject has the right at any time to object to the processing of personal data for direct marketing purposes, after which personal data will no longer be processed for those purposes.
Zarakop is not obliged to appoint a data protection officer in accordance with applicable regulations. For all questions, suggestions, or requests regarding the processing of personal data, data subjects can contact us using the provided contact details.
If the data subject believes that their rights regarding personal data processing have been violated, they have the right to file a complaint with the competent supervisory authority – the Croatian Personal Data Protection Agency (AZOP).
Data Protection Officer Contact Details:
Email: [email protected]
Phone: +385 993106977
ZARAKOP d.o.o. for construction and tourism agency
Address: Baričevići 10, 23000 Murvica, Poličnik, Croatia
OIB: 47945843315