This Ordinance on the Protection of Personal Data for travel agency Adriatic Concierge d.o.o. Applies from May 25, 2018 Pursuant to Article 3 and Article 7 of the Personal Data Protection Act (Official Gazette No. 103/03, 118/06, 41/08, 130/11, 106/12), travel agency Adriatic Concierge d.o.o. (abbreviated: Agency), take care for the protection of all personal data that it collects from its own in order to fulfill its obligations in the domain of travel agency travel agencies clients, but also their employees. Procedures for receiving, storing, storing confidential personal information the data of clients and employees are prescribed by this Ordinance on collection, processing and use, and protection of personal data of natural persons.

Types of Personal Data We Collect From Clients:

Adriatic Concierge d.o.o. collects the following customer's personal information:

a) basic personal information: name and surname, citizenship, residence, date of birth and passport number and contact details (email address or cell phone number) for the purpose of registering guests in the e-Visitor system,

b) data of products and services usage of the Adriatic Concierge d.o.o.: ie time of service (arrival date and departure date), description of additional services (excursions, transfers ..)

Personal information is taken directly from the client, either verbally or in writing, with a mandatory acceptance of client.

Types of personal information we collect from employees: Adriatic Concierge d.o.o. collects the following employee's personal information:

a) Basic Personal Data: Name and Surname, Address, Personal Identification Number (OIB), Date of Birth, sex, cell phone number and contact information (email address, phone number), information on the type of contract relationship and content,

b) other personal information provided to us by employees when establishing and the duration of the contractual relationship, such as personal identification data, bank account; underneath it data sensitive from the aspect of data protection, particularly racial or ethnic data affiliation, political or religious attitudes or worldview, genetic data or information about health condition.

Personal data is taken directly from the employee, either verbally or in writing, with a mandatory acceptance by employee.

Collect (online and off-line) data

The client's personal data may be collected and further processed within the scope of activities and obligations of the Agencies business - only under the following conditions:

• Data may only be collected for each individual, individual project (accommodation and alike),
• When the client has information about the purpose of collecting particular data, it is available pre - the web site of the Agency and / or a third party in the process (ie Villa Manager) • When the client is undoubtedly familiar with the terms and conditions of the profession / project / travel to the purpose for which his personal information is required,
• When the client has voluntarily accepted the aforementioned terms and, in turn, with his request or by filing, has given the privilege of providing his / her data for the purpose of making the request, to the other stakeholders of the business process.

Purpose of processing

With the prior consent, the client's personal information in accordance with the rights and obligations of the Provision Act services in tourism, and contractual obligations arising from tourism activities, can be collect, process and use solely for the needs of a project based on each other contracts and clearly stated Terms of Business - which are part of the booking process during which the client leaves his personal information. All data processed are protected by the highest personal data protection standards, and we do not share it unless it is necessary to perform the search service to you.

All types of personal data travel agency Adriatic Concierge d.o.o. specifically deals with the following purposes:

a) Realization of contracts and legal obligations Travel agency Adriatic Concierge d.o.o. handle personal data for providing following services (for sending confirmation of booked services, for booking hotel room by rooming list, for notice to the transfer company of the booked transfer service as passenger list, for sending the invoices to the client for reserved service, for sending the final invoice of the used services).

b) Collection of claims If you do not fulfill your contractual obligations, in order to protect travel agency Adriatic Concierge d.o.o. as a lender, we can forward personal information to legal company and natural person for the collection of claims (eg Law Enforcement Offices, Credit Agencies, and alike). Before we do that measure, we will specifically inform you about this through the contact information you provided to us, in order to give you an opportunity to resolve it.

c) Contacting

During the contractual relationship, as well as upon termination of our contractual relationship, in period of one year, we will contact you through the following communication channels for which you have provided us:

• E-mail,
• In writing (by letter),
• Telephone.

Storage Period

Travel agency Adriatic Concierge d.o.o. would keep your personal information as much as it is necessary to fulfill its contractual or legal obligation or legitimate interest, except in case of processing your personal information based on your consent at the time of your withdrawal processing.

Revocation of provided consent

The consent you have provided for the realization of services, contact and other purposes we have requested from you are valid until revocation and can be revoked at any time. You can cancel your consent by submitting an application to email address: [email protected]

Rights of the user / respondent

a) Right to data correct

If we process your personal information that are incomplete or inaccurate, you can request travel agency Adriatic Concierge d.o.o. to correct or supplement them at any time.

b) Right to delete

From travel agency Adriatic Concierge d.o.o. you may request to delete your personal information if we have processed them illegally or this processing represents disproportionate interference with your protected interests. Please note that there are reasons that can disable the immediate data erase, such as statutory archiving obligations.

c) The right to limit the distribution

As the client of travel agency Adriatic Concierge d.o.o. you may request a limit on the distribution of your data:

• If you dispute the accuracy of the data over a period that allows us to verify the accuracy of these data,
• If data processing was unlawful, but refuse to delete and instead look for it limitation of use of data,
• If the data is no longer needed for the intended purpose, but we still need it realization of legal requirements or
• If you have filed a complaint about the distribution of this data.

d) Right to transfer data

From travel agency Adriatic Concierge d.o.o. you may request that the information you have entrusted to us for archiving reasons, to be delivered in a structured form, in a standard machine-readable format:

if we process this data based on the consent you have given us, and you can revoke it or for the fulfillment of our contract and if processing is done through automated processes.

n

e) Right to Objectio

If we distribute your information for the purpose of performing a public interest task or the task of a public body or it is when we process them we call on our legitimate interests, you can file a complaint against it data processing if there is an interest in protecting your data.

f) Right to Appeal

If you believe that we have violated Croatian or European regulations when processing your data

To protect the data, please contact us to clarify any questions. You certainly have the right to file a complaint with the Croatian Data Protection Agency, ie in the event of a change of validity the regulations of another body that will assume its competence, and from 25 May 2018 to the supervisory body within the EU.

g) Realization of rights: If you want to realize any of above mentioned rights, please contact us using following contact information

Contact email: [email protected]

Before collecting any personal data, travel agency Adriatic Concierge d.o.o. is obliged to inform the client about collected data for purpose of processing the requested data.

Adriatic Concierge d.o.o. is obliged no later than 30 days from the submission of the request to provide all the following information to each client at his request, or his legal representatives or proxies:

• the identity and contact information of data processing manager and, where applicable, his superior
• if applicable, contact information of data protection supervisor
• processing purposes for which personal data are used and the legal basis for processing,
• if the processing is based on Article 6 (1) (F), the legitimate interests of the processing manager or third party
• recipients or categories of recipients of personal data.

Personal Data Protection Measures

Adriatic Concierge d.o.o. implement appropriate technical and organizational measures, such as pseudonymization, to enable effective application of data protection principles, such as reducing the amount data, and the inclusion of protective measures in processing to meet the requirements of the Protection Regulation personal data and protect the rights of all our clients.

The professional and administrative staff of the travel agency Adriatic Concierge d.o.o. processing personal data is required to take technical, personnel and organizational measures to protect the personal data necessary to protect personal data against accidental loss or destruction, unauthorized access or unauthorized changes, unauthorized disclosure and any other misuse, and establish the obligation of persons who are employed in processing data.

Personal data relating to juveniles may be collected and further processed in accordance with The Regulation on the Protection of Personal Data and Special Protection Measures prescribed by special laws

Personal data relating to juveniles may be collected and further processed in accordance with The Regulation on the Protection of Personal Data and Special Protection Measures prescribed by special laws