1. Introduction and our contact information
GRAND MARINA LAV d.o.o. . is a company with its registered seat in Podstrana, Grljevačka 2/A, personal identification number (further in text: OIB): 22658489524, registration number: 060231716 (further in text: GML), which is considered as a controller within the meaning of the General Data Protection Regulation (EU) 2016/679 dated 27.04.2016 (OJ EU L 119 dated 04.05.2016, Corrigendum L 127/2 dated 23.05.2018; further in text: GDPR) and Act on implementation of General Data Protection Act (Official Gazette 42/2018; further in text: the Act).
GML is engaged in tourism and providing hospitality services within the harbor for nautical tourism – marina Lav in Podstrana, whereby its focus is primarily on providing sea berths for vessels.
Herewith we want to clarify in transparent manner which personal data is collected by GML, how and for what purposes is data being processed, what are your rights related to personal data, and other details significant for processing and protection of personal data.
We process your data in accordance with GDPR and the Act, as well as other applicable laws and regulations.
For all your questions, comments and requests for exercising your rights related to your personal data feel free to contact us by:
- e-mail on address: firstname.lastname@example.org
- letter on address: Grljevačka 2/A, 21 312 Podstrana
- contact form on our website: www.marinalav.hr
The following expressions used in this statement, have the following meaning within GDPR:
- „personal data” – means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
- „processing” – means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
3. How we collect personal data
GML can collect your personal data in the following ways:
- if you contract i.e. use our services;
- if you participate in the program of rewarding client’s loyalty „Captain’s Club“;
- if you participate in the program of rewarding clients “Guest club”;
- if you contact us – for example by completing a contact form on our website, if you submit a request for accommodation of vessel in marina Lav by e-mail or in any other way, if you subscribe for receiving newsletter on our website, if you request delivery of a pro forma invoice or an offer and similar or you request any other information or contact us for any other reason;
- if you participate in our survey, prize contest, marketing campaign or similar, for example by answering questions, entering data and other;
- if you visit or browse/search our website;
- if you visit or follow our pages on social media, for example Facebook, Twitter, Instagram, YouTube and other or you perform certain activity or interaction on our social media (for example “like”, “comment“, “share“ or other);
- if a third party has transferred your personal data to us in an allowed way or we collect such data from publicly available registers or other databases;
- if you find yourself in the area of marina Lav within the perimeter of recording of security cameras i.e. video surveillance.
If you provide us with personal data of another person, we assume that you have authorization and/or consent of the person whose data you deliver to us.
3.1. Video surveillance
Your personal data is also being processed by means of video surveillance i.e. security cameras placed within the area of marina Lav for securing protection and safety of persons and property during the stay in marina Lav, as well as for prevention and detection of committed crimes and offences, alienation and damage of property.
If you find yourself in the perimeter of recording, we can process video recording on which you are recorded, which can also include other persons near you, on or near your vessel, all within the perimeter of recording.
Access to video recordings is available only to the authorized persons and sailor’s service of GML, and in extraordinary cases access can also be allowed to our business partner who provides the service of video surveillance maintenance – NICOMI KOMUNIKACIJE d.o.o. with its registered seat in Split, Vinkovačka 23.
If needed, GML can also engage a company for physical and technical protection of persons and property, so there is a possibility that such business partner is also granted access to video recording in extraordinary cases.
In cases foreseen by applicable laws and regulations, competent authorities of the Republic of Croatia can also have access to video recordings.
4. Types of personal data we process
Within the scope of its business activities, GML collects i.e. processes personal data of its clients and/or contractual parties and partners and other individuals, depending on the case, such as:
- name and surname, OIB, gender, place, state and date of birth, citizenship;
- address of primary/secondary residence (street and street number, city and postal number, state), telephone and/or mobile phone and/or telefax number, e-mail address;
- passport, ID card or other identification document issued by the competent authority and its number;
- data collected from security cameras placed within the area of marina Lav;
- data on location, if applicable and if you enabled collection of such data on your device(s);
- IP address;
- technical data (number of visits to our website and other).
Our policy is to collect only personal data necessary for achievement of a specific legitimate purpose of data processing.
5. Purpose of personal data processing
We collect and process your personal data in order to:
- fulfill our contractual obligations and provide you with services you ordered/contracted;
- fulfill obligations prescribed by applicable laws and regulations;
- manage our programs of rewarding clients “Captain’s Club“ and “Guest Club“;
- provide you with information and/or offers and/or other you requested from us;
- provide you with a newsletter;
- manage and conduct surveys, prize contests, marketing campaigns or similar;
- manage, analyze and administrate our website;
- manage, analyze and administrate our pages i.e. profiles on social media;
- secure protection and safety of persons and property and for other safety reasons within the area of marina Lav;
- inform you on important news such as, for example, changes and/or amendments of our terms of contract and/or other changes or information important for our business or your stay in marina Lav or other.
6. Legal basis for personal data processing
Performance of the contract
If you contract or use our services, we will collect and process the following personal data: name and surname, OIB, citizenship, address of primary/secondary residence (street and street number, city and postal number, state), telephone and/or mobile phone and/or telefax number, e-mail address of client as users of berth and/or other services in marina Lav.
Stated personal data is being processed for the purpose of entering into and performing contract for usage of berth in marina Lav or other contracts and/or services we provide. Further, part of the stated data is necessary for production of “Captain’s Club“ card, which is foreseen by the contract on usage of berth, and which you need to present in order to use certain benefits from the programs of rewarding clients.
If you have contracted or used our services, collection of certain personal data related to you is necessary in order to fulfill our contractual obligations and provide you with services you ordered or contracted.
Compliance with legal obligations
Laws and regulations applicable on the territory of the Republic of Croatia prescribe certain obligations which demand that we as controller collect and process certain personal data for purposes determined by the law and also, in certain cases, that we provide such data to the competent authorities.
For example, data on your name and surname, gender, place, state and date of birth, type and number of identification document, address of primary/secondary residence, is required to register and deregister your stay with the competent tourist office, within prescribed deadlines, which is one of our legal obligations.
In certain cases, we have the legitimate interest for collecting and processing your personal data.
We collect and process your IP address because we consider it is our legitimate interest to protect ourselves from frauds and to protect and ensure security, but also to use such data in order to analyze visits and usage of our website, among other for statistical purposes.
Your personal data is also being processed by means of video surveillance i.e. security cameras placed within the area of marina Lav because we have legitimate interest to ensure protection and safety of persons and (your) property, preventing and detecting committed crimes and offences, alienation and/or damage of property within the area of marina Lav.
If you are our client or you already use our services, your name and surname, residence address (street and street number, city and postal number, state), telephone and/or mobile phone and/or telefax number, and e-mail address can be used for sending newsletters, marketing messages, information on services and/or benefits, and all because we consider we have the legitimate interest therefor. It is important to emphasize that you can unsubscribe or deregister from this list of receivers at any time.
In certain cases, we can collect and process your personal data only if you gave consent. It is important to emphasize that you have a right to withdraw your consent at any time in a way that you contact us as is foreseen in Article 1 of this statement (Introduction and our contact information). The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
Your name and surname, address of permanent residence/residence telephone number and/or mobile phone number and/or telefax number, and e-mail address are used for sending newsletters, marketing messages, notification on services and/or benefits, if you subscribed for receiving such content i.e. if you gave consent.
We also use the stated data if you joined our program of rewarding clients “Guest Club“ and gave consent for personal data processing, all in order to participate and use certain benefits from the stated program and receive information from us.
7. Recipients of your personal data
Certain personal data collected we can transfer i.e. disclose to those persons who undertake certain actions in our name or provide us with certain services, such as accounting service, lawyers and other, which are considered as processors within the meaning of GDPR.
Processor can only be a person providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that processing will meet the requirements of the GDPR and ensure the protection of rights of the data subject. Therefore, in stated cases such processors are bound and limited by a contract on data processing, which they concluded with us and which determines which personal data certain processor can process and for which purposes.
Certain personal data collected we can transfer to our business partner and affiliated company GRAND HOTEL LAV d.o.o. who is owner of „Le Meridien Lav“ hotel within which complex marina Lav is located. Cooperation with the stated company enables you to achieve and use certain benefits from the programs of rewarding clients “Captain’s Club“ and “Guest Club“ in the stated hotel, and also enables the client to park her/his vehicle in the garage of the hotel, and all of which requires certain personal data for production of a certain card which needs to be presented in order to use the service, but also for verifying your identity.
We can transfer or disclose your personal data to our reliable business partners without whose services we would not be able to provide our services or part of our services, for example real time authorization of your credit and debit cards or other.
When such obligation is foreseen by applicable laws and regulations or if necessary for protecting our rights, property or safety, we are obliged to transfer or disclose certain personal data we collect to the competent authorities.
Only authorized persons from GML and processors who act in the name and on behalf of GML have the right to access personal data collected by means of video surveillance.
On our website you can find links to the websites of third parties, which we place because we find them necessary or useful to our clients, for example forecast of weather, wind and other information.
Please note that such third parties’ websites are out of the scope of this statement and we cannot bear any kind of responsibility for them because those websites are of third parties and therefore rules and terms of personal data protection of such third parties apply accordingly.
9. Cookies and IP addresses
Our website uses temporary cookies or session cookies that are removed from the computer when you close the Internet browser. We use temporary cookies to enable you to access the content.
We also use permanent or stored cookies that stay on the computer after closing the Internet browser. Our website uses permanent cookies for functionalities such as “Stay signed in” which makes it easy to access the website as registered user. We also use permanent cookies in order to understand habits of our users better, so that we can adjust our website according to your habits. This information is anonymous – we do not see individual/personal data of the user.
We also use third party cookies that come from advertisements of other websites (such as pop up or any other advertisement) which are placed on website you are visiting. There are several different services that save limited cookies. These cookies are placed for normal functioning of certain possibilities that enable easier access to the user.
Cookies can also be placed if you use social media, if you visit or follow our pages on social media or similar or you have performed a certain activity or interaction (for example “like“, “comment“, “share“) through social media, such as Facebook, Twitter, Instagram, YouTube and others.
Preferences and cookie settings can vary, depending on the device, operating system and Internet browser you use.
For more information please visit www.allaboutcookies.org and www.youronlinechoices.eu.
Data on your IP address we primarily collect due to safety and technical reasons, but also for statistical and analytical purposes, as well as for improvements of quality of services we provide.
Our website uses Google Analytics for tracking data on website visits. Data is collected with third party cookies and IP addresses. Google Analytics keeps the data permanently, and user can erase and/or disable such data.
For more information please visit https://tools.google.com/dlpage/gaoptout.
For general information how Google uses data collected from our website please visit https://policies.google.com/privacy/google-partners?hl=en.
10. Keeping of personal data and retention
We will not keep your personal data longer than it is necessary for fulfilling or achieving the purpose for which such data is collected. Generally, we will keep personal data of our contracting parties permanently, personal data of persons who applied for receiving a newsletter – until they withdraw their consent or unsubscribe from the list of recipients, personal data of persons who contacted us for some reason – during the communication, etc.
When your personal data is no longer necessary or basis for processing no longer exists, we will erase such data from our system or. destroy all documentation in which your data is contained, depending on the case.
Previous provisions of this Article do not apply if applicable laws and regulations prescribe longer period for keeping of personal data for a specific purpose or it is necessary and/or allowed due to some other reason.
With regard to safety and protection of your personal data, we strive to apply appropriate technical and organizational measures in order to protect them. Nevertheless, unfortunately, no one can guarantee that transfer or keeping or any other system or measure related to personal data is 100% safe.
12. Newsletter and marketing messages
Newsletters and marketing messages will be sent to you if you gave consent for such purpose or if that is in accordance with our legitimate interest, all in order to inform you on our products and services.
You can withdraw your consent at any time in a way that you contact us as is foreseen in Article 1 of this statement (Introduction and our contact information) or by simply unsubscribing from our list of recipients with “unsubscribe” or “deregister” option on our website.
13. Your rights related to personal data
According to GDPR you have certain rights related to your personal data as stated below. You can exercise your rights at any time by contacting us as foreseen in Article 1 of this statement (Introduction and our contact information).
Right of access
You have a right to request and receive from us as controller a confirmation as to whether or not personal data concerning you is being processed and which personal data is being processed, access to personal data and information, all in accordance with Article 15 of GDPR.
Right to correction
You have a right to request from us as controller a correction of personal data concerning you, and which data is incorrect or incomplete.
Right to erasure (Right to be forgotten)
You have a right to request from us as controller an erasure of personal data concerning you, and we will erase such data without undue delay if any of the conditions from Article 17 paragraph 1 of GDPR is fulfilled.
Right to erasure of personal data is not an absolute right and it does not supersede our obligations arising from applicable laws and regulations. Therefore, in certain cases we will not be able to erase personal data to the extent in which its processing is necessary.
Right to restriction of processing
You have a right to request from us as controller a restriction of processing of your personal data where one of the following applies:
- you contest the accuracy of the personal data, for a period enabling the controller to verify the accuracy of the personal data; or
- the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead; or
- we as controller no longer need the personal data for the processing purposes, but you request them for the establishment, exercise or defense of legal claims; or
- you have objected to processing expecting the verification whether the legitimate reasons of us as controller supersede your reasons.
Right to data portability
You have a right to request and receive from us as controller personal data concerning you, and which you provided to us in a structured, commonly used and machine-readable format and you have the right to transmit this data to another controller, if conditions from Article 20 Paragraph 1 of GDPR are fulfilled.
Right to object
You have the right to object at any time on your personal data processing, which is based on legitimate interest because of your specific situation, unless the reasons for such processing supersede the right of protection of personal data.
Right of complaint to the supervisory authority
We will process your data in accordance with GDPR, other applicable laws and regulations and apply technical and organizational measures for protection of personal data.
However, if you find that we process your data in an unlawful way and do not consider you can find a solution of your situation together with us, you have a right to file a complaint to the supervisory authority i.e. Croatian Personal Data Protection Agency with its registered seat in Zagreb, Martićeva 14.
For more information, please visit the official site www.azop.hr.
14. Instructions and contact details of data protection officer
For all your questions, comments and requests for exercising your rights from Article 13 of this statement, you can contact us in ways stated in Article 1 of this statement (Introduction and our contact information).
When submitting a request for exercising any of your rights from Article 13 of this statement, please state a clearly what is the subject of your request and which personal data does it refer to. Please have in mind that we will have to verify your identity before acting upon your request, due to ours and yours safety reasons, therefore there is a possibility that we revert to you regarding your request.
We will consider your request and strive to act on it within a reasonable time period. Please have in mind that certain circumstances can cause a certain delay in action, such as large number of requests received within the same time period.
If you requested exercising of some right, for example erasure, or if you withdraw your consent, there is a possibility that we keep personal data or part of a personal data we collected because the need therefor arises from laws and obligations, or the necessity arises from certain other reasons, e.g. in order to finish a transaction which began before you submitted request.
For all questions and information regarding the personal data processing and exercising your rights, you can also contact our data protection officer by:
- e-mail on address: email@example.com
- letter on address: GRAND MARINA LAV d.o.o., Grljevačka 2/A, 21 312 Podstrana, Croatia with indication “Attn: Data protection officer“.
15. Changes and amendments of privacy statement
As controller, we will monitor the status of personal data protection and improve our protection measures and other important issues, if needed, therefore we reserve the right to change and/or amend this statement from time to time.
Information on changes and/or amendments of this statement will published on our website where you can find applicable version of the statement.
In Podstrana on 25.05.2018