This ordinance on the Protection of Personal Data for the travel agency Adriatic Concierge d.o.o. applies from May 25, 2018 pursuant to Article 3 and Article 7 of the Personal Data Protection Act (Official Gazette No. 103/03, 118/06, 41/08, 130/11, 106/12), travel agency Adriatic Concierge d.o.o. (abbreviated: Agency), take care of the protection of all personal data that it collects on its own in order to fulfill its obligations in the domain of the travel agency's clients, but also their employees. Procedures for receiving, storing, storing confidential personal information, the data of clients and employees are prescribed by this ordinance on collection, processing, use, and protection of personal data of natural persons.

Types of Personal Data We Collect From Clients:

Adriatic Concierge d.o.o. collects the following personal information from its customers:

a) basic personal information: name and surname, citizenship, residence, date of birth and passport number and contact details (email address or cell phone number) for the purpose of registering guests in the e-Visitor system,

b) data of products and services usage of Adriatic Concierge d.o.o.: i.e. time of service (arrival date and departure date), description of additional services (excursions, transfers etc..)

Personal information is taken directly from the client, either verbally or in writing, with a mandatory acceptance of the client.

Types of personal information we collect from employees: Adriatic Concierge d.o.o. collects the following employee personal information:

a) Basic Personal Data: Name and surname, address, personal identification number (OIB), date of birth, sex, cell phone number and contact information (email address, phone number), information on the type of contract relationship and content,

b) Other personal information provided to us by employees while establishing and during the duration of the contractual relationship, such as personal identification data, bank account; underneath it data sensitive from the aspect of data protection, particularly racial or ethnic data affiliation, political or religious attitudes or worldview, genetic data or information about health condition.

Personal data is taken directly from the employee, either verbally or in writing, with a mandatory acceptance by the employee.

Collect (online and off-line) data

The client's personal data may be collected and further processed within the scope of activities and obligations of the agencies business - only under the following conditions:

• Data may only be collected for each individual, individual project (accommodation and alike),
• When the client has information about the purpose of collecting particular data, it is available pre - the web site of the agency and / or a third party in the process (i.e. villa manager) • When the client is undoubtedly familiar with the terms and conditions of the profession / project / travel to the purpose for which his personal information is required,
• When the client has voluntarily accepted the aforementioned terms and, in turn, with his request or by filing, has given the privilege of providing his / her data for the purpose of making the request, to the other stakeholders of the business process.

Purpose of processing

With the prior consent, the client's personal information in accordance with the rights and obligations of the Provision Act services in tourism, and contractual obligations arising from tourism activities, can be collected, processed and used solely for the needs of a project based on each contract and clearly stated in the Terms of Business - which is part of the booking process during which the client leaves their personal information. All processed data is protected by the highest personal data protection standards, and we do not share it unless it is necessary to perform the search service for you.

All types of personal data for the travel agency Adriatic Concierge d.o.o. specifically deals with the following purposes:

a) Realization of contracts and legal obligations, the travel agency Adriatic Concierge d.o.o. handles personal data for providing the following services (for sending confirmation of a booked services, for booking hotel rooms by rooming lists, to notify the booked transfer company of the passenger list, for sending invoices to the client for reserved services, for sending the final invoice of the used services).

b) Collection of claims if you do not fulfill your contractual obligations. In order to protect the travel agency, Adriatic Concierge d.o.o., as a lender, we can forward personal information to legal companies and natural persons for the collection of claims (i.e. law enforcement offices, credit agencies, and alike). Before this, we will specifically inform you about this through the contact information you provided to us, in order to give you an opportunity to resolve it.

c) Contacting

During the contractual relationship, as well as upon the termination of our contractual relationship, through a period of one year, we will contact you through the following communication channels which you have provided us with:

• E-mail,
• In writing (by letter),
• Telephone.

Storage Period

Travel agency Adriatic Concierge d.o.o. will keep your personal information as necessary to fulfill its contractual or legal obligation or legitimate interest, except in the case of processing your personal information based on your consent at the time of your withdrawal processing.

Revocation of provided consent

The consent you have provided for the realization of services, contact and other purposes we have requested from you, are valid until revocation and can be revoked at any time. You can cancel your consent by submitting an application to the email address: [email protected]

Rights of the user / respondent

a) Right to correct data

If we process your personal information that is incomplete or inaccurate, you can request the travel agency Adriatic Concierge d.o.o. to correct or supplement them at any time.

b) Right to delete

From the travel agency Adriatic Concierge d.o.o. you may request to delete your personal information if we have processed them illegally or if this processing represents disproportionate interference with your protected interests. Please note that there are reasons that can disable the immediate deletion of data, such as statutory archiving obligations.

c) The right to limit distribution

As the client of the travel agency Adriatic Concierge d.o.o. you may request a limit on the distribution of your data:

• If you dispute the accuracy of the data over a period that allows us to verify the accuracy of the data,
• If data processing was unlawful, but there is a refusal to delete the data and instead look for a limited of use of the data,
• If the data is no longer needed for its intended purposes, but we still need it for the realization of legal requirements
• If you have filed a complaint about the distribution of this data.

d) Right to transfer data

From the travel agency Adriatic Concierge d.o.o. you may request that the information you have entrusted to us for archiving reasons, be delivered in a structured form, in a standard machine-readable format:

if we process this data based on the consent you have given us, you can revoke it or for the fulfillment of our contract and if processing is done through automated processes.

n

e) Right to Objection

If we distribute your information for the purpose of performing a public interest task or the task of a public body or when we process it we call on our legitimate interests, you can file a complaint against the data processing if there is an interest in protecting your data.

f) Right to Appeal

If you believe that we have violated the Croatian or European regulations when processing your data

To protect the data, please contact us to clarify any questions. You certainly have the right to file a complaint with the Croatian Data Protection Agency, i.e. in the event of a change of validity the regulations of another body that will assume its competence, and from May 25 2018 to the supervisory body within the EU.

g) Realization of rights: If you want to realize any of above mentioned rights, please contact us using following contact information

Contact email: [email protected]

Before collecting any personal data, the travel agency Adriatic Concierge d.o.o. is obliged to inform the client about collected data for the purpose of processing the requested data.

Adriatic Concierge d.o.o. is obliged no later than 30 days from the submission of the request to provide all of the following information to each client at their request, or to their legal representatives or proxies:

• the identity and contact information of the data processing manager and, where applicable, his superior
• if applicable, contact information of the data protection supervisor
• processing purposes for which personal data is used and the legal basis for processing,
• if the processing is based on Article 6 (1) (F), the legitimate interests of the processing manager or third party
• recipients or categories of recipients of personal data.

Personal Data Protection Measures

Adriatic Concierge d.o.o. implements appropriate technical and organizational measures, such as pseudonymization, to enable the effective application of data protection principles, such as reducing the amount of data, and the inclusion of protective measures in processing in order to meet the requirements of the protection regulation of personal data and to protect the rights of all our clients.

The professional and administrative staff of the travel agency Adriatic Concierge d.o.o. are required to take technical, personnel and organizational measures when processing personal data to protect the personal data necessary to protect against accidental loss or destruction, unauthorized access or unauthorized changes, unauthorized disclosure and any other misuse, and establish the obligation of persons who are employed in processing data.

Personal data relating to juveniles may be collected and further processed in accordance with The Regulation on the Protection of Personal Data and Special Protection Measures prescribed by special laws

Personal data relating to juveniles may be collected and further processed in accordance with The Regulation on the Protection of Personal Data and Special Protection Measures prescribed by special laws