Personal data protection

1 General provisions

Topena d.o.o. reserves the right to amend these data protection rules at any time in line with the applicable positive legal regulations on the protection of personal data.

1.1 Personal data

The personal data you provide voluntarily (during online booking, by telephone, by e-mail or through your authorised coordinator/group leader) will be collected, stored and processed in accordance with the applicable regulations on the protection of personal data (Zakon o provedbi Opće uredbe o zaštiti podataka (NN 42/18), the Croatian act implementing the General Data Protection Regulation, hereinafter: GDPR).

Booking flights, booking hotels and other bookings with the travel agency Topena d.o.o. are not possible without the collection, processing and storage of your personal data. We carry out these activities solely for the purpose of organising and carrying out the booking. Your personal data are shared only with third parties that are directly involved in the booking process and where the organisational procedure makes this necessary, in accordance with the requirements of your booking (for example airlines, hotels, transport companies, insurance companies, etc.).

1.2 photographs / films

By signing a contract and/or booking our services, you agree that the travel agency Topena d.o.o. may record you or persons from your company/organisation/association who are present during the contracted event/trip, through an employee of the travel agency Topena d.o.o. (or our official photographer / travel escort / guide). You likewise agree that we may use the film/photographs so obtained for an indefinite period for marketing purposes, for reports on events and for advertising the same or similar events of an identical or similar character. If you do not wish photographs / films in which you are visible to be published, you may contact us at any time at the e-mail address zadar@topena.hr so that those images/parts of the film can be excluded from publication, blacked out or shaded.

Documents supplied by the travel agency Topena d.o.o. (programme booklets, invitations, information leaflets, etc.) may contain links to certain other websites. The travel agency Topena d.o.o. is not responsible for the data that you make available to other websites in that way. Our partner companies are also subject to the GDPR just as we are, but its implementation is the responsibility of each company separately. This Decision on the protection of personal data relates exclusively to the processing of data for which the travel agency Topena d.o.o. is responsible.

  1. Duty to inform pursuant to Art. 12 to 14 GDPR

The travel agency Topena d.o.o. is obliged to provide you with all information describing the nature, purpose and scope of the processing activities carried out on your personal data.

2.1 Responsible person

Travel agency Topena d.o.o., Gospe Maslinske 1, 23000 Zadar

T: +385 (0) 23 250 838

E-Mail: zadar@topena.hr

Responsible person and coordinator in charge of personal data protection: Dražen Petković

2.2 Purposes of data processing

Depending on the needs of the booking, the traveller’s personal data will be processed for one or more of the following purposes:

Purpose of use Category of data

Booking, additional booking, invoicing and control Name and surname, name and surname of the guardian/custodian and his/her/their data

Telephone number, mobile number, e-mail address Home address

Gender

Account number and bank account details

Credit/debit card details

Accommodation facility

Length/period of stay

Contact person

Identity document details (only if necessary)

Special dietary habits (sensitive data)

Illnesses and allergies (sensitive data)

General organisation / Accounting Name and surname, name and surname of the guardian/custodian and his/her/their data

Telephone number, mobile number, e-mail address Home address

Gender

Account number and bank account details

Credit/debit card details

Accommodation facility

Length/period of stay

Contact person

Identity document details (only if necessary)

Special dietary habits (sensitive data)

Illnesses and allergies (sensitive data)

Marketing & Development Name

Telephone number, mobile number, e-mail address Home address

Photographs/Film

Purpose of use Legal basis

Booking, additional booking, invoicing and control · Binding booking (flight, hotel, rent a car and similar)· Written confirmation from the group representative that the personal data may be used

· Arranging additional insurance for the client, with Topena d.o.o. acting as intermediary

· Consent of the client (sensitive data)

Marketing & development · Legitimate interest of the travel agency Topena d.o.o. (see points 4.1, 4.2 and 4.3)

2.4 Other recipients of data (third parties), categories

Outside the travel agency Topena d.o.o., your personal data may be received by other recipients (third parties) for the purpose of properly carrying out the booking. Such recipients receive only the data necessary for their scope of work, and not complete data records. Your data will be forwarded only if the organisational process makes this indispensable, according to the requirements of your booking, and if a valid legal basis exists.

Purpose of use Category of data Category of recipient

Booking, additional booking, insurance, invoicing and control Name and surname

Contact details

Home address

Gender

Account number and bank account details

Credit/debit card details

Accommodation facility

Length/period of stay

Contact person, identity document details (only if necessary) Airlines, suppliers required to carry out the booking

Insurance companies

Special dietary habits (sensitive data) Airlines, suppliers required to carry out the booking

General organisation, accounting Name and surname of the traveller or of the guardian/custodian and his/her/their data

Telephone number, mobile number, e-mail address Home address

Gender

Account number and bank account details

Credit/debit card details

Accommodation facility

Length/period of stay

Contact person

Identity document details (only if necessary)

Special dietary habits (sensitive data)

Illnesses and allergies (sensitive data) Official bodies, banks, the tax administration, accounting firms, suppliers (assistance in performance)

Marketing Name and surname

Telephone number, mobile number, e-mail address Home address Online Mailing Provider

2.5 Transfer of data to third countries

On the basis of Article 49(1)(b), it is possible to provide certain personal data to third countries, non-member states of the EU, for the purpose of performing the contractual obligations between you and the travel agency Topena d.o.o., as well as for carrying out pre-contractual actions. The transfer of data to third countries is possible, but only the data that are actually necessary for the stated purpose will be forwarded and processed.

2.6 Duration of data storage

Credit card guarantees (for example for hotel bookings) are kept for up to two weeks after the booking, after which they are irreversibly deleted. Sensitive data (such as special dietary requirements) that have to be collected in order to complete the booking will be irreversibly deleted after the booking has been completed. All other data are kept for 10 years in order to satisfy the statutory retention period under the Zakon o porezu na dodatnu vrijednost (the Croatian value added tax act).

  1. Right to be informed

As a client you have a right, and the travel agency Topena d.o.o. an obligation, in respect of being informed.

3.1 Right to information arising from Art. 15 GDPR

  • Right to information

  • Right to rectification

  • Right to cancellation / right to be forgotten

  • Right to restriction of processing

  • Right to data portability

  • right to object (if the responsible person has a legitimate interest)

Detailed descriptions of the rights and obligations can be found at the web address:

https://eur-lex.europa.eu/legal-content/HR/TXT/HTML/?uri=CELEX:32016R0679&from=HR

© European Union, http://eur-lex.europa.eu/ 1998-2018

3.2 Right of withdrawal under Art. 7 GDPR

Depending on the service you order, certain data are required for which we need your consent for the processing of data, as well as the completion of certain questionnaires/contracts via the website or directly from you / the travel coordinator or from a representative / company representative authorised by you. Consent to the provision of personal data is not mandatory under the GDPR. Every person has the right to withdraw the consent given at any time. The withdrawal of consent to the processing of personal data does not affect the lawfulness of the actions carried out on the basis of the consent given up to the moment of withdrawal.

3.2 Right to lodge a complaint with the supervisory authority under Art. 77

Every person has the right to complain to the supervisory authority if they consider that the collection of personal data about them is contrary to the GDPR.

The supervisory authority in the Republic of Croatia is:

Agencija za zaštitu osobnih podataka (the Croatian personal data protection agency)

Description of other possible purposes

Legitimate additional interests under Art. 6(1)(f) GDPR

4.1 Advertising / marketing

Processing of your personal data in order to inform you about your booking, as well as to inform you about similar offers.

4.2 Service evaluation

Processing and use of personal data in order to ask you to evaluate the service received, for the purpose of improving it.

4.2 Of a personal nature

Processing and use of personal data in order to wish you a happy birthday, anniversaries, holidays and public holidays.

  1. Note on the use of so-called cookies and the Google Analytics service

Our website uses Google Analytics, a web analytics service provided by Google Inc. (“Google”). Google Analytics uses “Cookies”, text files that are stored on your computer, in order to analyse how users use the website. The information generated by the cookie about your use of our website is normally transmitted to a Google server in the USA and stored there. If IP masking is activated on these pages, the IP address will be truncated within the member states of the European Union or other parties to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be sent to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide other services related to website and internet use to the website operator. The IP address provided by Google Analytics as part of Google Analytics will not be merged with other Google data. You can prevent the storage of cookies by setting your browser software accordingly; however, we point out that, due to a change of setting, some parts of our site may not be fully usable, if at all.

You can prevent the collection of the data generated by the cookie and relating to the use of the website by Google, and the processing of those data by Google, at the link: http://tools.google.com/dlpage/gaoptout?hl=de .

On this website, Google Analytics is installed as “anonymizeIp”, so that the last part of the IP address will be masked in order to ensure your anonymity.

For more information on the Terms of Use and Privacy Protection see http://www.google.com/analytics/terms or https://www.google.de/intl/en/policies

  1. Privacy statement for the use of social networks

6.1 Facebook (Like button)

Links to the social network Facebook, provided by Facebook Inc, 1 Hacker Way, Menlo Park, California 94025, USA, are integrated into our pages. You can recognise the Facebook plugin by the Facebook logo or the “Like Button” on our page. You can find an overview of Facebook plugins at: https://developers.facebook.com/docs/plugins . When you visit our pages, the plugin establishes a direct connection between your browser and the Facebook server. Facebook receives the information that you have visited our website, together with your IP address. If you click on the Facebook “Like” button while you are logged in to your Facebook user account, you can link the content of our pages to your Facebook profile. As a result, Facebook can assign the visit to our pages to your user account. We point out that we, as the owners of the website, have no knowledge of the content of the data transmitted in this way or of its use by Facebook. For more information, please see the Facebook privacy policy at https://de-de.facebook.com/policy.php. If you do not wish Facebook to be able to assign the visit to our pages to your Facebook user account, please log out of your Facebook account before logging in to our website.

6.2 YouTube

Our website sometimes uses plugins from Google’s YouTube site. The operator is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. When you visit one of our web locations on which the YouTube plugin feature is enabled, you will be connected to the YouTube servers. The YouTube server will be informed which of our pages you have visited. If you are logged in to your YouTube account, YouTube is able to link your browsing behaviour directly to your personal profile. You can prevent this by logging out of your YouTube account. For more information on the handling of user data, please see the YouTube privacy policy at http://www.google.com/intl/hr/policies/privacy