GENERAL PROVISIONS
IDENTITY is the “data controller” in relation to the personal data that the User provides to IDENTITY when visiting the IDENTITY website and/or submitting data to IDENTITY for the purpose of obtaining information about the Services provided by IDENTITY or obtaining such Services. As such, IDENTITY determines the purposes and means by which the User’s personal data are or will be processed.
This Privacy Policy is intended to provide the User with information about how IDENTITY collects and processes any personal data that it collects from the User or that the User provides to IDENTITY.
Personal data means any information relating to an identified or identifiable natural person. A natural person is identifiable, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier or other identifier.
METHODS OF DATA COLLECTION
IDENTITY collects the User’s personal data through:
- direct interactions, such as completing forms or communicating with IDENTITY in person, by email, telephone, post or otherwise, which includes the personal data that the User provides to IDENTITY when making contact in one of the ways described above;
- automated technologies or interactions with the IDENTITY website (www.identyum.com), through which IDENTITY may automatically collect technical data about the User’s equipment, browsing actions and patterns. This personal data is collected in particular through cookies and other similar technologies, as described below;
- third parties or publicly available sources, for example analytics service providers such as Google.
PERSONAL DATA COLLECTED AND PROCESSED
IDENTITY collects the following User data:
- personal identification and contact data, including name, email address and mobile telephone number;
- technical and usage data automatically collected when the User visits the IDENTYUM website, including, but not limited to, information about the IP address used to connect the User’s computer to the internet, unique cookie and device identifiers, browser and operating system type and version, approximate location (country/city), pages visited, clicks and other interactions with website elements, the time and duration of visits, and the source from which the User arrived at the website.
LEGAL BASIS FOR THE COLLECTION AND PROCESSING OF PERSONAL DATA
IDENTITY will collect and process the User’s personal data in the following circumstances:
- for the performance of an Agreement that Identity will enter into or has entered into with the User (i.e. when the User contacts IDENTITY for the purpose of obtaining Identity’s services);
- on the basis of the User’s consent given to IDENTITY (for example, for marketing);
- for the purposes of the legitimate interests pursued by IDENTITY (or by a third party), where the User’s interests and fundamental rights do not override those interests. Identity will not collect and use the User’s personal data for activities where the User’s interests or fundamental rights and freedoms requiring the protection of personal data override those interests (unless the User has given prior consent to such processing or the processing is necessary for compliance with IDENTITY’s legal obligations);
- for compliance with a legal or regulatory obligation to which Identity is subject.
The following table describes all the ways in which IDENTITY processes and uses the User’s personal data, the legal basis for processing the personal data and IDENTITY’s legitimate interest, where applicable.
| Purpose/Activity | Lawfulness of personal data processing | Types of personal data |
| Entering into a Service Agreement; performance of a Service Agreement | Performance of contractual obligations; compliance with a legal obligation | Personal identification and contact data |
| Marketing activities (sending newsletters and similar communications) | Consent | Personal identification and contact data |
| User participation in research/surveys | Consent | User statements/opinions/reviews |
| Publishing the User’s statements/opinions/reviews on the website | Consent | User statements/opinions/reviews |
| Use of functionality and strictly necessary cookies | Legitimate interests (in operating the website); consent | Technical data |
| Analysing website use and tracking User interactions (e.g. clicks) to improve website content and functionality through analytics cookies and similar technologies (Google Tag Manager, Google Analytics) | Consent | Technical and usage data |
| Retention of business records in accordance with applicable laws and regulations | Compliance with a legal obligation | Documentation relating to the provision of the Service |
IDENTITY may process the User’s personal data on more than one legal basis at the same time, depending on the specific purpose for which IDENTITY uses the data.
ACCESS TO AND TRANSFER OF DATA
The personal data collected and processed by IDENTITY is processed by employees, external associates and other data processors with whom IDENTITY has entered into appropriate agreements. Under those agreements, the processors undertake to use such data solely in accordance with IDENTITY’s instructions and exclusively for the purpose defined by IDENTITY, subject to obligations of confidentiality and data protection.
IDENTITY will not share the collected and processed data with third parties beyond the purpose stated in this Policy and/or outside the scope of the consent. Data may be transferred:
- where necessary to provide the requested services or perform the contractual obligations undertaken;
- where the User has consented to such transfer;
- to third parties, namely other data processors, with whom IDENTITY has entered into appropriate agreements ensuring an equivalent level of personal data protection.
For the purpose of analysing website use, IDENTYUM uses the services of Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), which acts as a processor in relation to that data. Google may transfer the data to its affiliate Google LLC in the United States of America. Google LLC is certified under the EU-U.S. Data Privacy Framework, on the basis of which the European Commission has determined that an adequate level of personal data protection is provided, and the transfer is additionally safeguarded by the standard contractual clauses adopted by the European Commission.
USER RIGHTS
Each User has the right to submit a written request to IDENTITY seeking:
- confirmation as to whether or not personal data concerning the User is being processed;
- information about the data concerning the User that is being processed and the source of that data;
- information about the User’s right to rectification or erasure of personal data, restriction of the processing of personal data concerning the User, or the right to object to such processing;
- information about the right to lodge a complaint with the supervisory authority (Croatian Personal Data Protection Agency, www.azop.hr);
- access to the personal data filing system and copies of the personal data;
- a record of who received the personal data concerning the User, for what purposes and on what legal basis;
- information about the logic involved in any automated processing of data concerning the User;
- completion, rectification and/or erasure of personal data that is incomplete, inaccurate and/or out of date;
- erasure of personal data under the “right to be forgotten”;
- restriction of the processing of personal data;
- receipt of the personal data that the User has provided to IDENTYUM in a structured, commonly used and machine-readable format (the right to data portability);
- withdrawal of consent at any time where processing is based on consent, without affecting the lawfulness of processing based on consent before its withdrawal.
IDENTITY must comply with the User’s request referred to in the preceding point without delay and no later than 30 (thirty) days from the date on which the written request is received. Written requests must be sent in writing to IDENTITY’s registered office, delivered in person or by registered post with acknowledgement of receipt, or sent by email.
IDENTITY must inform the User of the completion, rectification or erasure of personal data no later than 30 (thirty) days from the date on which the written request is received, and must also inform all recipients to whom the personal data has been disclosed, provided that this is possible and does not involve disproportionate effort.
The User has the right to request that IDENTITY erase personal data concerning the User, and IDENTITY must comply with that request where one of the following conditions applies:
- the personal data is no longer necessary in relation to the purposes for which it was collected;
- the User has withdrawn the consent on which the processing is based;
- the User objects to the processing;
- the personal data has been unlawfully processed.
The User has the right to obtain from IDENTITY restriction of the processing of personal data where one of the following applies:
- the User contests the accuracy of the personal data, in which case processing is restricted for the period required for Identity to verify the accuracy of the personal data;
- the processing is unlawful and the User opposes the erasure of the personal data and instead requests the restriction of its use;
- IDENTITY no longer needs the personal data for the purposes of processing, but the User requires it for the establishment, exercise or defence of legal claims.
The User has the right to object at any time to the processing of personal data concerning the User. IDENTITY may no longer process such personal data unless it demonstrates compelling legitimate grounds for the processing that override the User’s interests, rights and freedoms, or where the processing is required for the establishment, exercise or defence of legal claims.
All requests, enquiries, objections or other matters relating to IDENTITY’s processing of personal data must be submitted:
- by post to Trogirska ulica 2, 42000 Varaždin, Republic of Croatia;
- by email to [email protected].
DATA RETENTION
IDENTITY will retain the User’s personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting or reporting requirements.
Data collected through analytics cookies and similar technologies is retained for no longer than 14 months from the date of collection, after which it is automatically deleted. The duration of individual cookies is specified in the cookie notice on the IDENTYUM website.
LINKS TO OTHER WEBSITES
The IDENTYUM website may include links to third-party websites, plug-ins and applications. These include certain social media features, such as the Facebook “Like” button, or interactive mini-programs that run on the website. Selecting those links or enabling third-party features may allow the User’s personal data to be collected or shared. For example, such features may collect the User’s IP address or the page that the User is visiting, and may set a cookie to enable the feature to function properly. These social media features and widgets are generally hosted by a third party or hosted directly on the website. IDENTITY does not control these third-party websites or features and is not responsible for their privacy statements. The User’s interactions with such features are governed by the privacy policy of the third party providing them.
COOKIES AND OTHER TRACKING TECHNOLOGIES
A cookie is a text file containing a small amount of information that is sent to the User’s browser when the User visits a website. The cookie is then sent back to the originating website on each subsequent visit, or to another website that recognises it.
A web beacon is an often transparent graphic image, usually no larger than 1 pixel by 1 pixel, which is placed on a website or in an email and is used to monitor the behaviour of a User who visits a website or sends an email. It is often used in combination with cookies.
IDENTITY may collect data using cookies, web beacons or similar analytics-based technologies.
IDENTITY uses the following cookies:
- strictly necessary cookies are cookies required for the operation of the website. They include, for example, cookies that allow the User to log into secure areas of the website;
- analytics/performance cookies allow Identity to recognise and count the number of visitors to the website and to see how visitors move around the website when using it. This helps Identity improve how the website works, for example by ensuring that Users can easily find what they are looking for;
- functionality cookies are used to recognise the User when the User returns to the website. This enables Identity to personalise content for the individual User, greet the User by name and remember the User’s preferences;
- targeting cookies record the User’s visit to the website, the pages visited and the links followed. Identity will use this information to make the website and the advertising displayed on it more relevant to the User’s interests. Identity may also share this information with third parties for that purpose.
Third parties (including, for example, advertising networks and providers of external services such as web traffic analytics services) may also use cookies over which IDENTYUM has no control. These cookies are likely to be analytics/performance cookies or targeting cookies.
On its website, IDENTYUM uses Google Tag Manager to manage analytics tools and Google Analytics 4, provided by Google, to analyse how Users use the website, including tracking clicks on individual website elements and other interactions. Based on this data, IDENTYUM produces statistical reports on website use in order to improve its content and functionality. Analytics cookies are set only after the User has given consent through the cookie notice.
Strictly necessary cookies are set without the User’s consent because they are essential for the operation of the website. All other cookies (analytics/performance, functionality and targeting cookies) are set only with the User’s prior consent, which the User may give or withhold through the cookie notice on the IDENTYUM website and may withdraw at any time through the Change or withdraw cookie consent link, without affecting the lawfulness of processing carried out before consent was withdrawn. The User may additionally block or delete cookies through their browser settings. However, if the browser settings are used to block all cookies (including strictly necessary cookies), the User may be unable to access all or parts of the IDENTYUM website.
CHANGES TO PERSONAL DATA AND THIS PRIVACY POLICY
IDENTITY may amend this Privacy Policy from time to time, in particular to reflect any material changes to its Services or to comply with the requirements of regulatory authorities. Any changes to this Privacy Policy will be published on the IDENTITY website.