Processed information Data Security Policy Data retention policy Data privacy policy Incident response procedure Agreement on terms

Data privacy policy

1. INTRODUCTORY PROVISIONS

Pursuant to the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (Official Journal of the European Union L 119, 04/05/2016, p. 1, hereinafter referred to as „General Data Protection Regulation“), which is in full application as of 25 May 2018 in the Republic of Croatia and the European Union, and the General Data Protection Regulation Implementation Act (Official Gazette number 42/18, hereinafter referred to as 'Act'), i.e. in accordance with the legal framework for the protection of personal data applicable in the Republic of Croatia and the European Union and European best practices, Uniline d.o.o (hereinafter referred to as 'Agency'), as Controller of the processing of personal data of its customers, has developed this Customer Privacy Protection Policy.

Personal data processing is performed under the responsibility of the Agency:

Uniline d.o.o., B. Gumpca 38, HR-52100 Pula

MB: 1228102

OIB: 74786390334

ID: HR-AB-52-040048499

Contact information of the data protection officer:

e-mail: dpo@uniline.hr

2. HOW AND WHICH DATA DO WE COLLECT

The services offered by the Agency require the collection of customers’ personal data. Basic data is collected in the following ways:

- directly: by the customers themselves in such a way that the customers deliver to the Agency, as data processing controller, their personal data in a certain amount of information relevant to the provision of the corresponding services. For the purpose of providing the appropriate services, the customer is obliged to provide the Agency with the following data that is necessary to establish a contractual relationship for the provision of tourism-related or rent-a-car services:

a) name and surname,

b) address,

c) personal identification number (OIB),

d) date of birth,

e) gender,

f) phone and/or mobile number,

g) email address,

h) ID card information (address and country of residence, identity card number,

i) passport number,

j) bank account information and credit card number necessary to make the payment,

k) driving licence number.

- from other sources i.e. from our business partners (for instance, data received by a partner agency for the purposes of accommodation booking),

- from our affiliates Experience, Uniline Celje, Uniline Plus and Uniline Mobility,

- automatically by visiting our website; only personal data associated with online identifiers is collected (internet protocol addresses and cookie identifiers, such as Google Analytics used to track user's and/or customer's engagement).

COOKIES

Cookies are small text files stored on your device when visiting a website. We use them to ensure the proper functioning of the website, improve the user experience, analyse website usage and display relevant offers and advertisements.

We use the following types of cookies:

- necessary cookies: required for the functioning of the website and the booking process and cannot be disabled,

- analytical cookies: used to understand how the website is used (e.g. visitor statistics),

- marketing cookies: enable the display of personalized offers and advertisements.

Certain cookies are also set by third parties who may process personal data such as IP address and device identifiers. Analytical and marketing cookies are used solely based on the user’s consent. Consent can be withdrawn or modified at any time via the cookie settings. Cookies can be disabled through the internet browser settings; however, in that case some website functionalities may not be available.

3. FOR WHAT PURPOSES PERSONAL DATA IS COLLECTED AND PROCESSED FURTHER

The Agency collects personal data in order to provide, maintain, protect and improve its purchase-related services, to understand the ways in which users and/or customers use the services provided and use the Company's website, and to perform its contractual obligations. Such information is collected by the Company on the basis of a consent given by the customer for one or more specific purposes, as well as in one of the cases below.

FULFILMENT OF CONTRACTUAL OBLIGATIONS
The Agency collects and further processes customers' personal data for the purpose of stipulating and delivering contracts and other acts associated with contract conclusion and delivery in accordance with the relevant regulations.
The legal basis for the processing of customers' personal data for the foregoing purposes is the necessity of entering into a contract, i.e. in the event that the customer refuses to provide essential information, the Agency will not be able to enter into a contract and / or undertake certain activities related to execution of the contract concluded.

FULFILMENT OF LEGAL OBLIGATIONS
Following a written request submitted by a customer to the above indicated data protection officer's address, the Agency is obliged to provide the customer access to the personal data being processed, rectification of inaccurate personal data, erasure of personal data or restriction of processing of his/her personal data, and to inform the customer of the right to object to processing personal data concerning him or her and of the right to data portability.

DIRECT MARKETING
Customer's contact details may be used for sending advertising notifications about the Agency's services, if the customer has given a consent for this type of processing or if there is a legitimate interest of the Agency for this type of actions, unless such interest is overridden by customer's interests or fundamental rights and freedoms that require personal data protection.
The Agency may use contact details and personally turn to customers whose personal data it already has based on a legitimate interest for sending advertising notifications about all products and services provided by the Agency, using all available marketing channels, unless the customer objects to such processing.
In order for a customer to receive notifications in line with his/her wishes and habits, it is required that the Agency uses certain customer's data to create personalised advertising notifications, as long as the customer does not expressly object to such processing of data i.e. withdraw his/her previously given consent for processing.

INTERNAL PURPOSES
The Agency uses certain customers' data only for its own records, for the purposes of protection of legitimate interests of customers and/or the Agency. For instance, the above includes the use of personal data for creation of offers that satisfy customers' needs and wishes, market research and analysis.

INFORMATION OF POTENTIAL USERS
The Agency is also entitled to collect information of potential users of its services. Such data include the basic data (name and surname, email address), but also the interests of potential customers that turn to the Agency wishing to be informed and/or sent an offer for certain products and services.
In the above case, the legal basis for data collection is the customer's consent.

4. PERSONAL DATA STORAGE AND PROCESSING PERIOD

Depending on the purpose and the legal basis on which the customer’s personal data is collected, the Agency is in some cases obliged to keep personal data for a period of time that for a particular purpose is prescribed by applicable regulations or until the termination of the purpose for which they were collected.

In cases where the basis for data collection and processing is legitimate interest of the Agency or customer's consent, the personal data is kept for the following time periods:

- data on existing customers: during the contractual relationship and 10 years after termination,

- data on potential customers: 10 years.

Data processed based on a legitimate interest of the Agency and/or customer's consent may be deleted even before the expiration of the time limit specified in this Policy, if such deletion is requested by the customer or if the customer objects to such processing.

5. CUSTOMER'S RIGHTS

Customer has:

- right of access to personal data,

- right to rectification of inaccurate data,

- right to erasure of personal data,

- right to restriction of data processing,

- right to object.

Customer may exercise his/her rights in writing, by sending a filled request to the Agency's address.

LOCATION OF PERSONAL DATA PROCESSING
The Agency processes customers’ personal data in the Republic of Croatia.

CONDITIONS ON WHICH PERSONAL DATA ARE SHARED WITH THIRD PARTIES
Customers' personal data are transferred by the Agency to third parties (partner agencies, associated companies, and competent authorities) only in the following cases:
- based on customer's consent,
- for the purpose of fulfilling a contractual obligation towards the customer, provision,
- for the purpose of fulfilling legal obligations of the Company,
- when such processing is required for the protection of customer's key interests.

CONSENT MANAGEMENT
The active role of the customer in the protection of privacy is reflected in his/her giving of consent as a freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data. The consent management implies the possibility that the customer, by an active and unambiguous action, authorises the Agency to collect and process specific personal data for one or more purposes (consent of the data subject), or that the customer withdraws, in the same way, his or her previously given consent to collection and processing of personal data, for one or more purposes.

WHO CAN YOU TURN TO
In the event of any questions about the protection of personal data by the Agency, customers may contact the Personal Data Protection Officer via email at the e-mail address specified in this Privacy Policy or in writing at the following address:
Uniline d.o.o., B. Gumpca 38, 52100 Pula

AMENDMENTS TO THE PRIVACY PROTECTION POLICY
The Agency reserves the right to amend this Policy at any time, without giving any special notice to the persons concerned. For this reason, it is recommended to all interested parties to regularly review the Agency’s website content for information on the updated content of this Policy.