Privacy Policy

GENERAL PART

1. GENERAL PROVISIONS

1.1 Content and Purpose of the Regulation

Article 1

This regulation defines the principles and rules for the processing of personal data to ensure the protection of the rights of individuals to whom the personal data relates, to prevent accidental or intentional unauthorized or illegal processing, as well as their alteration, unintentional loss, destruction, or damage.

The specific part of the regulation defines organizational, technical, and logical-technical procedures and measures for securing personal data.

Terms used in the regulation, written in the masculine grammatical form, are used neutrally for both women and men.

1.2 The Company's Position in Personal Data Processing

Article 2

The company acts as a data controller and/or processor during the processing of personal data, with related obligations and responsibilities under the GDPR, ZVOP-1, and this regulation.

1.3 Definition of Terms and Meaning of Expressions

Article 3

For understanding the provisions of this regulation, the terms used in the regulation have the following meanings:

a) "Personal Data" (also PD) means any information related to an identified or identifiable individual, to whom the personal data relates; an identifiable individual is one who can be directly or indirectly identified, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or by reference to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that individual, including: identifying information about the individual (birth details, EMŠO, etc.); data relating to racial or ethnic origin, political, religious, or philosophical beliefs, trade union membership, health, sex life, criminal record, and biometric data.

b) "Sensitive Personal Data" - refers to data on racial, ethnic, or national origin, political, religious, or philosophical beliefs, union membership, health, sexual life, criminal records, and biometric characteristics.

c) "Processing" means any action or set of actions performed on personal data or sets of personal data, whether by automated means or not, such as collection, recording, organizing, structuring, storing, adapting or altering, retrieving, consulting, using, disclosing, transmitting, distributing, or otherwise making accessible, combining, restricting, erasing, or destroying.

d) "Restriction of Processing" means marking stored personal data to limit its processing in the future.

e) "Profiling" means any form of automated processing of personal data, which involves the use of personal data to evaluate certain personal aspects related to an individual, especially to analyze or predict performance at work, economic status, health, personal preferences, interests, reliability, behavior, location, or movements.

f) "Pseudonymization" means the processing of personal data in such a way that personal data can no longer be attributed to a specific individual without additional information, provided that such additional information is stored separately and subject to technical and organizational measures to ensure that personal data cannot be attributed to any specific or identifiable individual.

g) "Data Set" means any structured set of personal data that is accessible according to specific criteria, whether centralized, decentralized, or distributed on a functional or geographical basis.

h) "Controller" means a natural or legal person, public authority, agency, or other body that alone or jointly with others determines the purposes and means of processing.

i) "Processor" means a natural or legal person, public authority, agency, or other body that processes personal data on behalf of the controller.

j) "User" means a natural or legal person, public authority, agency, or other body to which personal data is disclosed, whether or not it is a third party. However, public authorities that may receive personal data for a specific inquiry under the law are not considered users.

k) "Third Party" means a natural or legal person, public authority, agency, or body that is not the individual to whom the personal data relates, the controller, the processor, or persons authorized to process personal data under the direct authority of the controller or processor.

l) "Consent of the Data Subject" means any voluntary, specific, informed, and unambiguous expression of the data subject’s will by which they, by a statement or a clear affirmative action, agree to the processing of personal data related to them.

m) "Data Breach" means a security breach leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted, stored, or otherwise processed.

n) "Data Carrier" means all kinds of media on which data is recorded or stored (documents, records, materials, files, computer equipment including magnetic, optical, or other computer media, photocopies, audio and visual material, microfilms, data transmission devices, etc.).

1.4 Application of the Regulation

Article 4

The provisions of this regulation apply to:

Employees of the company,
External collaborators performing work for the company based on a work contract or other agreements, as well as students and interns working for the company through referrals or internships,
External legal and physical persons with whom the company agrees to carry out all or specific tasks related to personal data processing, particularly for the execution of specific processing activities (contracted processors).

All these individuals must be familiar with the provisions of GDPR, ZVOP-1, relevant sector-specific legislation, and the content of this regulation.

2. GENERAL PRINCIPLES IN PERSONAL DATA PROCESSING

2.1 Legal Basis for Processing PD

Article 5

Personal data may only be processed if there is a legal basis for their processing under the GDPR and/or ZVOP-1 (lawful processing), specifically when:

The data subject has consented to the processing of their personal data for one or more specific purposes;
Processing is necessary for the performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract;
Processing is necessary for compliance with a legal obligation to which the controller is subject;
Processing is necessary to protect the vital interests of the data subject or another individual;
Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Sensitive personal data may only be processed based on Article 13 of ZVOP-1. When processing such data, they must be specifically marked (e.g., as CONFIDENTIAL).

2.2 Purpose of Collection and Further Processing

Article 6

Personal data may only be collected for specific, explicit, and legitimate purposes, and may not be further processed in a manner that is incompatible with those purposes unless the law provides otherwise (“purpose limitation”).

2.3 Scope of Collection

Article 7

Personal data may only be collected to the extent necessary for the purposes for which it is processed (“data minimization”).

2.4 Accuracy of Personal Data

Article 8

Personal data must be accurate and, where necessary, kept up to date. All reasonable steps must be taken to ensure that inaccurate personal data is erased or rectified without delay, considering the purposes for which it is processed (“accuracy”).

2.5 Data Retention Period

Article 9

Personal data may be stored in a form which allows identification of the data subject only for as long as necessary for the purposes for which the personal data are processed. For longer periods, data may only be retained for archiving purposes in the public interest, for scientific or historical research purposes, or statistical purposes (“storage limitation”).

Once the processing purpose is fulfilled, personal data must be erased, destroyed, blocked, or anonymized unless the law defines them as archival material. Upon the expiration of the retention period, the data controller must notify the processors to erase all links to personal data, copies, or other reproductions.

2.6 Data Protection

Article 10

Personal data must be processed in a manner that ensures appropriate security, protecting it against unauthorized or unlawful processing and against accidental loss, destruction, or damage. Data protection includes legal, organizational, and logistical-technical procedures and measures to: (1) protect premises, equipment, and system software; (2) protect application software used to process personal data; (3) ensure the security of personal data transmission and transfer; (4) prevent unauthorized persons from accessing devices that process personal data and their data sets.

2.7 Accountability of the Controller/Processor

Article 11

The controller is responsible for the lawfulness of personal data processing and compliance with the general principles and is capable of demonstrating this compliance (“accountability”).

The processor is responsible for processing and damage caused by processing only when failing to meet obligations under the GDPR and/or ZVOP-1, specifically addressed to the processor, or when exceeding the lawful instructions of the controller or acting in contradiction to them.

3. DATA CONTROLLER

3.1 Consent of the Data Subject

Article 12

The data controller guarantees the legal basis for processing personal data.

When the legal basis is consent, it is obtained in such a way that the controller can prove that the data subject has reliably expressed consent to the processing of their personal data by a statement or a clear affirmative action (special written statement, ticking a box on a web form) (Example 1).

Consent must be given in a separate document, clearly and understandably, and must specify which personal data will be collected and the purpose of collection. If there are multiple purposes, the data subject must consent to each one separately.

Providing a service cannot be conditioned on the data subject’s consent to the processing of personal data.

The data subject must be informed in the consent that they can withdraw their consent at any time, and the withdrawal of consent must be as easy as the process for giving consent. Withdrawal of consent does not affect the lawfulness of processing before the withdrawal.

Consent for a person under the age of 18 must be given by their legal representative.

3.2 Data Collections

Article 13

The company maintains a list of personal data collections that it processes as the controller on its behalf (Form 1).

3.3 Personal Data Collection Catalog

Article 14

The legal representative of the company establishes a personal data collection catalog (Example 2) and sets the rules for handling personal data in the collection.

3.4 Notification of the Data Subject about Personal Data Processing (Rules for Handling Personal Data)

Article 15

The data controller must inform the data subject about the processing of their personal data, inform them about the controller, the purpose of processing, the users of their data, whether it will be transferred to a third country, the storage period, and their rights (to access, copy, amend, block, or delete their personal data).

The company must adopt Rules for Handling Personal Data for each personal data collection, informing the data subjects about their rights (Example 3). The data subject must be made aware of the rules by providing them in print or by notifying them of their publication on the company website.

If personal data is collected directly from the data subject, the information must be provided at the time of collection. Otherwise, it must be provided within a reasonable time, not exceeding one month.

3.5 Responsible Person and Authorized Persons

The legal representative of the company is the responsible person for the personal data collections (the responsible person). The responsible person authorizes individuals who can process personal data due to the nature of their work (authorized persons) (Example 2).

The responsible person and authorized persons must be familiar with the provisions of the GDPR, ZVOP-1, and this regulation before processing personal data and must sign a Personal Data Protection Declaration (Examples 3 and 4).

4. CONTRACTED DATA PROCESSOR

4.1 Data Processing Agreement

Article 16

The company concludes a written data processing agreement that includes the components of Article 28 of the GDPR and Article 11 of ZVOP-1, and defines the rights and obligations in the processing of personal data to ensure appropriate data protection during processing (Example 4), when the company processes personal data on behalf of the controller and with external legal and physical persons with whom the company agrees to carry out all or specific tasks related to personal data processing.

4.2 Conditions for Contracted Processor

Article 17

The company collaborates only with contracted processors who provide adequate guarantees to implement appropriate technical and organizational measures to ensure processing complies with the requirements of the GDPR, ZVOP-1, and this regulation, ensuring the protection of the rights of the individual to whom the personal data relates.

Contracted processors may not employ another processor without prior specific or general written permission from the company.

4.3 Processor’s Responsibility

Article 18

A contracted processor may only process personal data within the scope of the authorized agreement and must not process or use the data for any other purpose.

The processor is responsible for processing and any damage caused by processing only when failing to meet obligations under the GDPR and/or ZVOP-1 or when exceeding the lawful instructions of the controller or acting

contrary to them.

When a second processor is engaged with the company’s consent, the first processor remains fully responsible for fulfilling the obligations of the second processor.

4.4 Technical and Organizational Measures

Article 19

Contracted processors performing agreed services outside the company premises must ensure at least the same level of technical protection for personal data as prescribed by the specific part of this regulation and must implement organizational and logical-technical measures prescribed in the specific part of this regulation.

SPECIFIC PART

5. ORGANIZATIONAL PROCEDURES

5.1 Record of Processing Activities

Article 20

The controller and processor each maintain a record of processing activities for the type of processing activities they perform. The record is maintained in written form, including in electronic form, and contains the information

required by Article 30 of the GDPR (Examples 5 and 6).

5.2 Personal Data Disclosure

Article 21

Personal data may only be disclosed to those users who have been notified of the disclosure and have given their consent before the personal data is collected, or who have given subsequent written consent, or who provide a

valid legal basis for the disclosure.

The user must submit a request for personal data disclosure in writing, clearly stating the legal provision that authorizes them to obtain the personal data or providing the written consent of the data subject.

5.3 Method of Transmitting/Sharing Personal Data

Article 22

Personal data may only be transmitted in physical form, and using information, telecommunications, and other means only when procedures and measures are implemented to prevent unauthorized persons from acquiring, destroying, or gaining access to the data, or from improperly learning about its content.

Sensitive personal data may only be transmitted over communication networks if they are specifically protected with cryptographic methods and electronic signatures, ensuring that the data is unreadable during its transmission.

Personal data transmitted to the user in physical form must be sent in an envelope that prevents the contents from being visible under normal lighting or when the envelope is illuminated with ordinary light. The envelope must also ensure that its opening and access to its contents cannot be made without visible signs of tampering. Personal data is sent by registered mail; sensitive personal data is sent to recipients in sealed envelopes with a signature in the delivery book or by hand delivery.

Original documents containing personal data are never transmitted, except in the case of a court order, which must be replaced with a physical (photocopy) or electronic (scanned) copy during the absence.

5.4 Record of Personal Data Disclosures

Article 23

Every disclosure of personal data is recorded in the Record of Personal Data Disclosures (Form 5), which includes the following information:

Personal name/company name/address/headquarters of the person to whom personal data was disclosed,
Date and time of personal data disclosure,
Which personal data were disclosed,
The legal basis on which the personal data were disclosed.

The record of this is also documented in the personal data collection to which the disclosed personal data belongs, under a special section labeled "Record of Personal Data Disclosures."

5.5 Acceptance of Mail Containing Personal Data

Article 24

The employee responsible for receiving and recording mail opens and reviews all postal mail and packages arriving at the company (brought by clients or couriers, etc.) that are addressed to the company. However, they do not open mail addressed to another body or organization, which has been delivered by mistake, nor mail addressed directly to an individual or packages that contain personal data as indicated on the envelope.

The employee responsible for receiving and recording mail must not open packages addressed to the employee, which are marked as personal delivery, nor mail where the personal name of the employee is listed first without indicating their position at the company.

5.6 Use of Personal Data by Employees/External Collaborators in the Company

Article 25

Employees of the company and external collaborators who, in performing their work duties, copy, print, or otherwise reproduce documents containing personal data on devices used by multiple employees must ensure that, after copying or printing, no personal data remains on or near the devices.

5.7 Storage and Destruction of Personal Data

Article 26

Personal data may only be stored as long as necessary to achieve the purpose for which it was collected or further processed. The data retention period is determined by the data controller.

Article 27

After the retention period has expired, personal data must be deleted, destroyed, blocked, or anonymized, unless the law or another regulation specifies otherwise for certain types of personal data.

To delete personal data in electronic form, methods must be used that make the reconstruction of all or part of the deleted data impossible. Personal data in physical form, such as documents, files, or lists, must be deleted by destroying the media so that the personal data becomes unrecognizable and irretrievable (e.g., using a shredder).

The same method must be used to delete and destroy auxiliary documentation or computer products containing personal data.

Personal data must be deleted by ensuring that all links to personal data, copies, or other reproductions of personal data are erased.

It is forbidden to discard data carriers containing personal data in a way that allows for the recovery or recognition of personal data (e.g., in a trash bin).

When transferring data carriers containing personal data to the destruction site, appropriate security must be ensured during the transfer, especially to prevent the recognition or recovery of personal data.

The transfer of data carriers containing sensitive personal data to the destruction site, as well as the destruction of such data carriers, is supervised by a special three-member committee appointed by the responsible person. The committee consists of employees of the company, with one member being the responsible person. A relevant record of the destruction is created.

6. TECHNICAL AND LOGICAL-TECHNICAL PROCEDURES

6.1 Securing the Premises

Article 28

Premises containing data carriers with personal data, hardware, and software (hereinafter referred to as "protected premises") must be secured with organizational and/or technical measures as specified in this regulation, preventing unauthorized persons from accessing the data.

Protected premises containing data carriers with sensitive personal data must be secured in such a way that full control over activities and movements within the premises is ensured.

Offices must always be under the supervision of employees working in them. In their absence, employees must lock the office. Keys should not be left in the door lock.

In protected premises, after working hours or after business hours, cabinets and desks containing personal data carriers must be locked, and computers and other hardware must be turned off and physically or electronically locked.

Cabinets, desks, and other furniture with personal data carriers located outside the protected premises (e.g., hallways, common areas) must be constantly locked.

Individuals who are not employees of the company (e.g., maintenance personnel, technical staff, visitors, business partners) are only allowed to move within protected areas with the knowledge of the employee supervising the protected space.

Employees such as cleaners and security personnel can move only in protected areas where there is no access to personal data (data carriers are stored in locked cabinets, and computers and other hardware are turned off or locked).

6.2 Securing Data Carriers Containing Personal Data

Article 29

Employees of the company must not leave data carriers containing personal data in visible places (e.g., on desks) in the presence of individuals who are not authorized to access them.

Data carriers containing sensitive personal data must not be stored outside protected premises.

Employees of the company may only take data carriers containing personal data outside the company premises with the permission of the company director or an authorized representative of the company.

Employees of the company may not take data carriers containing sensitive personal data outside the company premises except in exceptional cases with the director’s permission, or by an authorized person, if it is necessary to resolve a matter containing such sensitive personal data.

In areas designated for customer business, data carriers containing personal data and computer displays must be positioned in such a way that customers cannot view them.

6.3 Securing Hardware and Software

Article 30

Maintenance and repairs of computer hardware and other equipment are only allowed with the approval of the person responsible for the operation of the computer information system. The work can only be carried out by authorized service providers and maintenance staff who have entered into an appropriate agreement with the company.

Access to software must be protected in such a way that only employees of the company or legal or natural persons who provide agreed services in accordance with the contract are allowed access.

Repairing, modifying, and supplementing system and application software is only allowed with the approval of the person responsible for the operation of the computer information system, and it can only be carried out by authorized services, organizations, and individuals who have an appropriate agreement with the company. Contractors must adequately document changes and additions to system and application software.

For storing and securing application software, the same provisions apply as for other data in this regulation.

The contents of the network server and local workstations, where personal data is stored, must be checked daily for the presence of computer viruses. In case of a computer virus, it must be immediately removed with the help of the appropriate expert service, and the cause of the virus occurrence in the computer information system of the personal data controller must be determined.

All data and software intended for use in the computer information system and arriving at the company on media for transferring computer data or through communication channels must be checked for the presence of computer viruses before use.

Employees of the company are not allowed to install or remove software from the company's premises without the knowledge of the person responsible for the operation of the computer information system.

Access to data through application software is protected by a password system for authorization and identification of users of programs and data. The password system must also allow for the subsequent identification of when individual personal data was entered into the data set, used, or otherwise processed, and by whom.

The person responsible for the operation of the computer information system determines the method of assigning, storing, and changing passwords and informs all employees of the company.

All passwords and procedures used for accessing and administering the personal computers' network (administrator passwords), managing email accounts, and administering application programs are stored in sealed envelopes and protected from access by unauthorized persons. They are only to be used in exceptional circumstances or in urgent cases. Every use of sealed envelopes is documented. After each such use, new passwords must be established.

For the purpose of restoring the computer system in case of failures and other exceptional situations, regular backups of the contents of the network server and local workstations, where the data is stored, must be made.

Backups from the previous paragraph are stored in designated places, which must be fireproof, protected from flooding and electromagnetic interference, within prescribed climatic conditions, and locked.

7. RESPONSIBILITY FOR IMPLEMENTING DATA PROTECTION MEASURES

7.1 Implementation of Procedures and Measures

Article 31

Anyone who processes personal data is obliged to protect the personal data they become familiar with during their work, to handle it carefully and diligently, and in accordance with the procedures and measures defined by this regulation to prevent the misuse of personal data.

The obligation to protect the data does not end with the termination of the employment relationship or the termination of the contract.

7.2 Personal Data Protection Statement

Article 32

Before performing work that involves processing personal data, employees/contracted service providers must sign a statement committing them to protect personal data.

The signed statement must indicate that the signatory is familiar with the provisions of this regulation, the GDPR, and ZVOP-1. The statement must also include information about the consequences of violating these rules.

A provision in the employment contract/service agreement is considered as a statement referred to in the previous paragraph.

7.3 Regular Testing, Evaluation, and Monitoring of Measures

Article 33

The company will regularly test, evaluate, and assess the effectiveness of technical and organizational measures for ensuring the security of personal data processing. For this purpose, the legality of personal data processing will be checked annually, including internal audits of records, consultations with information security experts, etc.

Supervision over the implementation of procedures and measures for securing personal data is carried out by the company director or an authorized person.

7.4 Responsibility for Violations

Article 34

Employees of the company are disciplinarily responsible for violating the provisions of this regulation, and others based on contractual obligations.

Serious violations of duties are considered, particularly if an employee:

Discloses personal data without authorization, to colleagues or others;
Fails to supervise and care for personal data carriers during work hours, allowing unauthorized access;
Makes unauthorized copies of personal data carriers;
Takes personal data carriers out of the company without explicit permission from the responsible person;
Fails to log the transfer of personal data in the record of personal data processing;
Unlawfully modifies, changes, or supplements collected personal data;
Installs or removes software from the company premises without explicit permission.

The responsibility outlined in the previous paragraphs does not exclude liability under criminal, administrative, or compensation law.

8. ACTIONS IN CASE OF SUSPICION OF PERSONAL DATA MISUSE

8.1 Documenting Security Incidents

Article 35

The company ensures a consistent and effective system for handling security incidents, documenting, and reporting security events.

An information system is provided that can monitor event detection (e.g., firewall, intrusion detection) and allow for their documentation.

The company maintains a record of security incidents, which are entered chronologically, regardless of the severity and type of risk (Form 6).

The company director authorizes the responsible person to maintain this record and also designate them as the person responsible for reporting the supervisory authority in case of a security incident (Form 7).

Employees of the company who learn or notice a breach of personal data (disclosure of personal data, unauthorized destruction, unauthorized alteration, damage to the data set, theft of personal data) or a breach of the personal data collection must immediately inform the responsible person or supervisor and try to prevent such activity through legal means. The same applies to individuals who are not employees but detect these activities during their work.

8.2 Reporting in Case of Security Incident

Article 36

In the event of a personal data breach, the controller must immediately, and at the latest within 72 hours of becoming aware of the breach, notify the competent supervisory authority (Information Commissioner).

When the breach occurs with a data processor, they must notify the controller.

When it is likely that the breach will result in a high risk to the rights of individuals, the controller must also notify the individual concerned.

The company director must take appropriate action against anyone who misused personal data or unlawfully accessed a personal data collection, in accordance with labor law or contractual obligations. If there is suspicion that the misuse of personal data or a breach of the personal data collection constitutes a criminal offense, the matter must be reported to the authorities.

9. FINAL PROVISIONS

Article 37

This regulation is adopted after prior notification of employees regarding its content.

The company director may change or amend this regulation at any time if required by the company's business needs.

Changes are valid when accepted in writing by the company director as an amendment to this regulation.

This regulation is valid from the date of adoption.

Maribor, May 24, 2018 ZADRGA, d.o.o. Director: Dejan Vlaisavljević