Notice on the processing of personal data through this website

DATA CONTROLLER
Komunalno društvo AUTOTROLEJ društvo s ograničenom odgovornošću za prijevoz putnika, Školjić 15, Rijeka

Contact
Tel.: +385 51 311 400
E-mail: autotrolej@autotrolej.hr

 

DATA PROTECTION OFFICER (DPO)

The Data Controller has appointed a professional data protection officer who is a recognized member of the European Association of Data Protection Professionals, a member of the International Association of Privacy Professionals with the internationally recognized CIPP/E privacy certificate, and acts as the Croatian representative in the European Federation of Data Protection Officers. His expertise and membership in prestigious organizations confirm his dedication and ensure high standards of data protection in the organization.

Contact details of the data protection officer:
feralis@feralis.hr
www.feralis.hr

 

INFORMATION ABOUT DATA BEING PROCESSED

Purpose of collecting personal data

Personal data through this website may be collected for the following purposes:

  • to respond to a submitted inquiry or request (data and information you provide yourself via email)
  • for user registration to perform a service
  • for purchasing or renewing a monthly ticket
  • for submitting a Request for issuing an RCC Torpedo card and registration of the right to use public transport services
  • for submitting a Request for issuing a zone certificate for an employer
  • for better functioning of features of these websites (cookies).

Categories of personal data The categories of personal data that may be collected through this website are as follows:

  • Identification data (e.g., user's name);
  • contact data (e.g., user's email);
  • company data (e.g., name, company address)
  • data on the use of this website (cookies).

Lawful basis for processing personal data For collecting personal data, this website uses the following lawful bases:

  1. Performance of a contract/service: Data is processed to enable the performance of the requested service or to take steps at your request before providing the requested service (for example, responding to your submitted request)
  2. Legitimate interests: Data is processed based on our legitimate interests or those of third parties, except when the interests, rights and freedoms of the data subject override those interests. (for example, video surveillance)
  3. Consent: Data is processed based on your prior consent. (for example, cookies)

Data collected for the purpose of responding to a submitted inquiry, for the purpose of user registration to perform a service, for the purpose of purchasing or renewing monthly tickets, for the purpose of submitting a Request for issuing an RCC Torpedo card and registration of the right to use public transport services, and for the purpose of submitting a Request for issuing a zone certificate for an employer are considered necessary data. That is, such data processing is necessary to perform the requested service or to take actions before providing the requested service, which makes this processing lawful in accordance with the provisions of the General Data Protection Regulation. We note that in case of failure to provide necessary data, we will not be able to comply with your request.

From a passenger who is found in the vehicle without a valid travel ticket or is using a subscription right that is not in their name, the authorized person of the Carrier has the right to request data about their identity and confiscate the RCC Torpedo card.

LEGITIMATE INTERESTS

In certain situations, personal data may be processed based on our legitimate interest. We note that we will not be able to restrict or suspend such processing in cases where there are compelling legitimate reasons for such processing that override the interests, rights and freedoms of the data subject, or when such processing is necessary for establishing, exercising or defending legal claims. Processing carried out on this basis:

  1. VIDEO SURVEILLANCE – The purpose of processing through video surveillance is the protection of persons and property. The retention period for recordings is a minimum of 168 hours, and in case of an incident up to 6 months. A longer retention period is possible if the recordings are needed as evidence in judicial, administrative, arbitration or other proceedings. Other recipients of video recordings may be competent authorities upon request, when necessary for conducting official proceedings.
  2. USER PHOTOGRAPH ON RCC CARD VISUAL – The purpose of processing this photograph is to create a deterrent effect with the aim of preventing travel without a valid ticket. This processing has a significant impact on reducing unauthorized travel, which results in a substantial reduction of potential damage that the company could suffer on an annual basis. At the same time, the quality of service to users is improved through enhanced system security.

Collected data is not processed for other purposes.

RECIPIENTS OF PERSONAL DATA

Collected personal data may be forwarded for use to providers of information and communication solutions and services who act as our data processors. These processors provide reasonable guarantees and have taken appropriate technical and organizational protection measures to adequately ensure data protection and compliance with the requirements of the General Regulation. An agreement/contract on personal data processing has been concluded with such processors based on Commission Implementing Decision (EU) 2021/915 on standard contractual clauses between controllers and processors as a special part of the contract. This agreement/contract prescribes in detail the handling of personal data, therefore they are not able to process personal data without our instruction and forward it to third parties. Personal data is not forwarded to third parties for direct marketing purposes.

DATA RETENTION PERIOD

Personal data collected through this website is processed until the purpose for which the data was collected is fulfilled. After the purpose ceases, personal data is no longer processed except in cases where legal regulations oblige us to such processing or the processing is based on our legitimate interest. In case of processing based on legitimate interest, it is carried out as long as such interest exists, the user does not restrict it or completely suspends it based on an objection. Data we process based on consent is stored until the purpose of processing is achieved or until you withdraw your consent. However, certain data may remain in our storage system as long as a specific law or other regulation obliges us to do so. After such period expires, the data is deleted. Your privacy and trust are extremely important to us, and therefore we ensure that your personal data is treated with care and responsibility.

DATA COLLECTED THROUGH SOCIAL NETWORKS

The pages and profiles we manage on social networks (Facebook or others) are always under the exact and full name of this Data Controller. Personal data about our contacts that we collect using them is only used in case of responding to an inquiry or comment, and the data is not processed for other purposes.

COOKIE USAGE

On these websites, necessary (technical) cookies are used as well as non-necessary cookies when the user has previously consented to their use.

Necessary technical cookies are essential for the functioning of the website and cannot be disabled.

Non-essential "cookies", typically statistical and marketing ones, are used when the user consents to them for the purpose of improving system performance and enhancing user experience. At any time, the user can manage such cookies and withdraw consent and stop further processing without negative consequences.

Currently, there are several websites for disabling cookie storage for various services. You can find additional information on this topic on the following pages:

More information about cookies

What are cookies?

Cookies are small files that a web browser stores on a computer, mobile device or some other device with which a user has visited a website. They are stored at the "request" of that website, for its further needs. These needs can vary and depend on the purpose of the cookies, so for example cookies can collect data such as which language the visitor chose for displaying pages on multilingual sites, the sequence of visited pages so that the user can be returned to pages in the same sequence backwards, a list of items the user has added to the cart in an online store, to for example the user's IP address, username and password, email address, user's geolocation, whether they are using a computer or mobile device, which pages of a website they have visited, and more.

Types of cookies by duration

According to duration, cookies can be:

  • Persistent Cookies – these are cookies that remain on the computer or device with which a website was visited after closing the web browser. Through them, websites store data such as login name and password, language settings or cookie settings so that the user does not have to re-enter them on each subsequent visit. Persistent cookies can remain on the computer or device with which a website was visited for days, months, even years.
  • Session Cookies – these are cookies that are removed from the computer or device with which a website was visited upon closing the web browser. Through them, websites store temporary data, such as the last few pages the user opened on the website they are visiting or items in the shopping cart if they are on a website specialized in online sales.

Types of cookies by source

According to source, cookies can be:

  • First party cookies – these are cookies stored by the original website that the user primarily visits, for example an online store if they are shopping online.
  • Third party cookies – these are cookies stored by other websites or web services that are parts of the primary website the user primarily visits. Usually other websites use them to track user habits on the primary website or they can be used by a web service to provide quality service (for example, a website for user interaction uses a so-called web chat service which stores the user's identification number for its needs so that the service knows to whom to forward which message).

Cookies by function

According to function, there are several types of cookies, and the most common are:

  • Technical/necessary cookies – these are cookies that are essential for the very functionality of the website as well as its fundamental operating purposes such as the session identifier of the user's current visit to the website or the contents of the cart that the user "filled" when purchasing products through an online store.
  • Functional cookies – these are cookies that enable the website to provide enhanced functionality and personalization such as remembering the language in which the content of the website pages is displayed.
  • Statistical cookies – these are cookies that collect information about how users visit the website and web pages of that site. In principle, data is collected in aggregated form without identifying the user themselves.
  • Marketing cookies – these are cookies that collect information about user habits and behavior on the website in order to publish personalized advertisements.

SECURITY OF PERSONAL DATA PROCESSING

We collect and process personal data in a manner that ensures appropriate security and confidentiality in their processing, and enables effective application of data protection principles. This includes reducing the amount of data, limiting the scope of their processing, determining storage periods and ensuring data availability. For this purpose, we have implemented appropriate technical and organizational protection measures that provide a level of security proportionate to the risks of data processing and the nature of the personal data being stored. In doing so, we particularly take into account the characteristics and costs of implementing these measures. We ensure users the highest level of data protection. For secure data transfer, the PCI DSS standard with TLS 1.2 cryptographic protocols is used. All personal data, personal document numbers, credit card numbers or other means of payment provided by users are transferred exclusively via a secure connection with 256-bit data encryption. The data controller does not have access to data used for payment. We regularly review processes that may pose a risk to the rights and freedoms of individuals and have taken appropriate protective measures to protect personal data from accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, particularly in cases where processing involves the transfer of personal data via a network, and from all other unlawful forms of processing.

EXERCISING YOUR RIGHTS

Right of access

At any time, you can request confirmation as to whether your personal data is being processed and detailed information about the processing, in particular about its purpose, about the type/categories of personal data being processed including access to your personal data, about the recipients or categories of recipients, and about the anticipated period for which the personal data will be stored.

Right to rectification

We ensure the right to rectification and without delay you can obtain the correction of inaccurate and completion of incomplete personal data.

Right to erasure

You have the right to request the erasure of your personal data. In case the request is justified and if legal regulations do not oblige us to store the data, the data will be deleted without undue delay.

Right to restriction of processing

You have the right to request restriction of processing of your personal data in cases provided for by the General Regulation. In particular, we emphasize that you can restrict the processing of personal data based on legitimate interest as a lawful basis for processing.

Right to object

You have the right to object to the processing of your personal data in all cases provided for by the General Regulation. We particularly emphasize that you can object to processing based on legitimate interest as a lawful basis for processing and restrict or completely prohibit the processing.

Right to lodge a complaint

In case you believe that the processing has resulted in a violation of your personal data and a breach of the provisions of the General Regulation, you may lodge a complaint with the supervisory authority, the Personal Data Protection Agency in Zagreb, Selska Street 136.

CONTACT INFORMATION

For additional information about the processing of personal data or to exercise your rights, feel free to contact us through the data protection officer or other available contact channels. After your identification, we will provide a response within 30 days in the usual electronic form unless otherwise requested.

OTHER INFORMATION

This privacy policy is regularly reviewed, supplemented and amended to always reflect the actual state of collection and processing of personal data through this website. Please check for such changes regularly. In case of significant changes or changes that could affect the rights and freedoms of users of this site, we will inform you about them in a pop-up window immediately upon arrival at this website.