Privacy Policy

Controller and contact details

• Controller: Proprium d.o.o., Josipa Jurja Strossmayera 341, Osijek, Croatia, OIB: 09477327401
• General contact: hello@proprium.agency
• Questions about personal data protection: gdpr@proprium.agency

What the terms mean

Processing: any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing personal data. Unless expressly stated otherwise, the controller under this Privacy Policy is Proprium.

Processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller. This Privacy Policy clearly indicates where Proprium acts as a processor.

Data subject: a natural person whose personal data is processed, regardless of origin, age or nationality.

Third party: a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

Personal data: any information relating to an identified or identifiable individual (“data subject”), directly or indirectly, such as name, age, biometric, health and financial data, education, ethnic and religious affiliation (special categories of personal data), identification numbers, location data, online identifiers or factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.

Applicable law

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation, “GDPR”)
• Act on the Implementation of the General Data Protection Regulation (Official Gazette NN 42/18)
• Other applicable sources depending on the specific situation, regarding compliance with the controller’s legal obligations, as stated in this Privacy Policy (Art. 6(1)(c) GDPR)

Suppliers and business partners

If you are our supplier or business partner, we will ask you for the following data (or obtain or verify it in the relevant public register):

• name and surname of the legal representative (for example a company director or the owner of a sole proprietorship, family farm or comparable activity)
• your OIB, registered address (which may match your residence) and IBAN if you operate as a sole proprietorship, family farm, self-employed person or other comparable form equivalent to a natural person
• your signature
• contact details such as email address and mobile number

This processing is necessary to perform a contract to which you are a party or to take steps at your request before entering into a contract (Art. 6(1)(b) GDPR). Without this data the contracted work cannot be performed.

To meet legal obligations (for example, recording invoices with the tax authorities), certain documents containing your personal data (for example invoices) are passed to our accounting service.

Depending on the circumstances, where necessary to protect our legal or financial interests, we may share this data with providers of legal advice (a law firm), providers of email and newsletter services, auditors, tax advisers and similar bodies, always under a duty of confidentiality or professional secrecy.

This data is not transferred to third countries. Data that forms part of accounting records (for example invoices) is kept for 11 years (Art. 10(2) of the Accounting Act). Other data is kept for as long as necessary for the limitation period for damages claims to expire (5 years after the damage occurred).

Employees of our business partners

If you are an employee of our business partner, we will ask you for the following data (or obtain or verify it in the relevant public register):

• name and surname
• contact details such as email address and mobile number

We need this data to make our cooperation easier and faster to communicate. This processing is based on our legitimate interest (Art. 6(1)(f) GDPR), for which we have carried out a balancing test.

Depending on the circumstances, where necessary to protect our legal or financial interests, we may share this data with providers of legal advice (a law firm), providers of email and newsletter services, auditors, tax advisers and similar bodies, always under a duty of confidentiality or professional secrecy.

This data is not transferred to third countries. We keep it until our cooperation with our partner (your employer) ends, or for a shorter period if your employment with your employer ends. Exceptionally, we may keep documentation containing your data (for example email correspondence) for longer, but no later than 5 years after cooperation with your employer ends, if this is necessary to bring court or similar proceedings.

If you register for our webinar

If you register for one of our webinars, we ask for your name, surname and contact email so that we can identify you as a participant, personalise our communication and send you a registration confirmation and a link to the webinar. If you voluntarily enter your mobile number, we use it to contact you before or after the webinar about our services. If you voluntarily enter your company name, we use it to adapt the webinar content to the participants’ profile.

Purpose and legal basis: name, surname and email address: processing is necessary to provide the webinar participation you requested, including identifying participants and personalising communication (Art. 6(1)(b) GDPR). Mobile number, if you provide it: processing is based on our legitimate interest in contacting participants to present our services before or after the webinar (Art. 6(1)(f) GDPR), for which a balancing test has been carried out; you may object to this processing at any time. Company name, if you provide it: processing is based on our legitimate interest in adapting the webinar content to the participants’ profile (Art. 6(1)(f) GDPR), with the same right to object.

Recipients: Depending on the circumstances, where necessary to protect our legal or financial interests, we may share this data with providers of legal advice (a law firm), providers of email and newsletter services, auditors, tax advisers and similar bodies, always under a duty of confidentiality or professional secrecy.

Transfer to third countries: to protect the form against automated abuse (Google reCAPTCHA), certain technical data may be processed by Google LLC, based in the USA. This transfer is based on the European Commission’s adequacy decision for the United States under the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795 of 10 July 2023), under which Google LLC is a certified organisation.

Retention: data collected through webinar registration is kept for one year from the date of the webinar, unless longer retention is necessary to establish, exercise or defend legal claims.

If you are a consumer exercising your right to complain

If you are a consumer who wishes to exercise the right to complain about our services, we will process the following data:

• your name and surname
• your contact details (phone or mobile number and email address)
• depending on the circumstances, other data about the private person’s order

Purpose and legal basis: processing is necessary to comply with the Controller’s legal obligations (Art. 6(1)(c) GDPR), specifically the Consumer Protection Act. We need this data to identify as quickly as possible the service your complaint relates to, examine all relevant circumstances and reply within the time set by the Consumer Protection Act.

Recipients: Depending on the circumstances, where necessary to protect our legal or financial interests, we may share this data with providers of legal advice (a law firm), providers of email and newsletter services, auditors, tax advisers and similar bodies, always under a duty of confidentiality or professional secrecy.

Transfer to third countries: this data is not transferred to third countries.

Retention: we keep this data for one year after the complaint is submitted, and longer if the complaint leads to court or similar proceedings.

If you visit our website

When you visit our website, www.proprium.hr or www.proprium.agency, certain data is processed:

• through cookies; you can read more in our Cookie Policy. The rest of this section concerns the following processing:
• when you complete the general contact form, we ask for your name, surname and contact email (and your website if you have one), so that we know who is contacting us and how to reply
• when you complete the contact form for an initial call, we ask for your name, surname and contact email (and website if you have one), as well as which software you currently use, your level of experience with automation, the platform through which earlier contact was made, a short description of the topics, how you heard about us and your preferred date and time, so that we know who is contacting us and can prepare properly for the meeting
• when you complete the newsletter sign-up form, we ask for your name, surname and contact email, so that we know who is contacting us and where to send the newsletter

Purpose and legal basis: processing is necessary to send the newsletter and other marketing content you subscribed to, including invitations to additional materials and services, and is based on your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time without affecting the lawfulness of processing before withdrawal.

Recipients: Depending on the circumstances, where necessary to protect our legal or financial interests, we may share this data with providers of legal advice (a law firm), providers of email and newsletter services, auditors, tax advisers and similar bodies, always under a duty of confidentiality or professional secrecy. On request, we must also share this data with public authorities (for example the police).

Transfer to third countries: this data is not transferred to third countries.

Retention: data collected through the newsletter form is kept until consent is withdrawn, or until 24 months of subscriber inactivity, after which the list is cleaned automatically.

If you are our employee (or a person in vocational training without employment, and similar), you will receive a detailed notice about the processing of your personal data.

Contacting us via WhatsApp

Our website has a WhatsApp button. It is a plain link: it loads nothing from WhatsApp and sets no cookies until you click it. If you click it and send us a message, WhatsApp (provided in the EU by WhatsApp Ireland Limited, part of Meta) processes your phone number, profile name and messages under its own terms and privacy policy, and we receive and read your message.

We use what you send only to answer your enquiry. This is based on steps taken at your request before entering into a contract, or our legitimate interest in answering enquiries (Art. 6(1)(b) and (f) GDPR). We keep the conversation for as long as needed to handle your enquiry and any cooperation that follows. Prefer not to use WhatsApp? Email us at hello@proprium.agency.

Data protection

Proprium is committed to protecting the personal data of its clients, partners and employees and aims to ensure the highest level of protection. To do so, it takes appropriate technical and organisational measures and, as needed:

• ensures the ongoing confidentiality, integrity, availability and resilience of processing systems and services
• restores the availability of and access to personal data in a timely manner in the event of a physical or technical incident
• regularly tests, assesses and evaluates the effectiveness of technical and organisational measures for ensuring the security of processing

Every Proprium employee is obliged to keep data confidential. As controller, Proprium takes all necessary measures to ensure that data is processed securely, is responsible for protecting personal data and preventing its loss and misuse, and ensures that no unauthorised person can access, disclose, transfer, modify or delete the data being processed.

Sharing data

Proprium does not sell or rent personal data to third parties. However, there are certain circumstances (as described above for each type of processing) in which we may share personal data without further notice to data subjects:

• with partners or other service providers to fulfil an obligation
• with public authorities and regulators where required by law
• with other recipients with a legal basis, such as courts, to fulfil a legal obligation to cooperate and provide data
• with providers of legal advice, auditors, tax advisers and similar bodies, always under a duty of confidentiality or professional secrecy

Legal basis for processing

As described above for each type of processing, Proprium processes data on the following legal bases:

• the data subject’s consent to the processing of personal data for one or more specific purposes (Art. 6(1)(a) GDPR)
• performance of a contract to which the data subject is a party, or steps taken at the data subject’s request before entering into a contract (Art. 6(1)(b) GDPR)
• processing necessary to comply with the controller’s legal obligations (Art. 6(1)(c) GDPR)
• processing necessary for the legitimate interests of the controller or a third party (Art. 6(1)(f) GDPR)

Your rights

We respect the rights and freedoms of data subjects. Under the GDPR, all data subjects have the following rights:

Right to be informed and of access. You have the right to obtain confirmation from the controller as to whether personal data concerning you is being processed and, if so, access to that data and to information about: the purposes of processing; the categories of personal data concerned; the recipients or categories of recipients to whom the data has been or will be disclosed, in particular recipients in third countries or international organisations; where possible, the envisaged storage period or the criteria used to determine it; the right to request rectification or erasure, restriction of processing or to object to processing; the right to lodge a complaint with a supervisory authority; where the data is not collected from you, any available information about its source; and the existence of automated decision-making, including profiling under Article 22(1) and (4), with meaningful information about the logic involved and the significance and envisaged consequences for you (Art. 15 GDPR). Where data is transferred to a third country or international organisation, you have the right to be informed of the appropriate safeguards. The controller provides a copy of the personal data being processed; for any further copies you request, a reasonable fee based on administrative costs may be charged. If you make the request electronically, the information is provided in a commonly used electronic form unless you request otherwise.

Right to rectification. You have the right to obtain from the controller, without undue delay, the rectification of inaccurate personal data concerning you and, taking into account the purposes of processing, to have incomplete data completed, including by means of a supplementary statement.

Right to erasure (“right to be forgotten”). You have the right to obtain the erasure of personal data concerning you without undue delay, and the controller must erase it without undue delay where one of the following applies:

• the personal data is no longer necessary for the purposes for which it was collected or otherwise processed
• you withdraw the consent on which processing is based
• you object to the processing and there are no overriding legitimate grounds, or you object to processing for direct marketing
• the personal data has been unlawfully processed
• the personal data must be erased to comply with a legal obligation under EU or Member State law to which the controller is subject
• the personal data was collected in relation to the offer of information society services to a child

Right to restriction of processing. You have the right to obtain restriction of processing where: you contest the accuracy of the data, for a period enabling the controller to verify it; the processing is unlawful and you oppose erasure and request restriction instead; the controller no longer needs the data but you need it to establish, exercise or defend legal claims; or you have objected to processing under Article 21(1), pending verification of whether the controller’s legitimate grounds override yours.

Right to data portability. You have the right to receive the personal data concerning you that you provided to the controller in a structured, commonly used and machine-readable format and to transmit it to another controller without hindrance, where processing is based on consent or a contract and is carried out by automated means.

Right to withdraw consent. Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

Right to object. You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you based on Article 6(1)(e) or (f) GDPR, including profiling based on those provisions. The controller may no longer process the data unless it demonstrates compelling legitimate grounds that override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims. Where personal data is processed for direct marketing, you have the right to object at any time to such processing, including profiling related to direct marketing; if you object, the data may no longer be processed for that purpose.

Complaints and requests

All complaints and requests to exercise the rights above may be submitted at any time:

• by email to gdpr@proprium.agency
• in writing to Proprium d.o.o., Josipa Jurja Strossmayera 341, Osijek, Croatia, marked “Personal data protection”

The controller begins investigating a complaint when it is submitted to the addresses above. We reply to your questions or complaints without undue delay and in any event within one month of receiving the request. This period may be extended by two further months where necessary, taking into account the complexity and number of requests. You will be informed of any extension within one month of receiving the request, together with the reasons for the delay.

If requests are manifestly unfounded or excessive, in particular because of their repetitive character, we may charge a reasonable fee taking into account the administrative costs of providing the information or taking the action requested, or refuse to act on the request.

Every data subject has the right to lodge a complaint with the supervisory authority if they consider that the processing of their personal data infringes the GDPR. Complaints can be submitted to the Croatian Personal Data Protection Agency (AZOP):

• in person (oral statement for the record)
• in writing to: Agencija za zaštitu osobnih podataka, Ul. Metela Ožegovića 16, 10000 Zagreb, Croatia
• by completing the online form on the Agency’s website
• by email: azop@azop.hr
• by fax: +385 1 4609 099

No appeal is allowed against a decision of AZOP, but an administrative dispute may be brought before the competent administrative court.