PERSONAL DATA PROCESSING AND PROTECTION POLICY

1. GENERAL INFORMATION

EXPONENTIS d.o.o. za usluge, with its registered office at Ulica grada Vukovara 269D, 10000 Zagreb, Republic of Croatia, registered with the Commercial Court in Zagreb under company registration number (MBS) 030191401, OIB 76690229448, is the controller of your personal data (hereinafter: the Controller) within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter: the “GDPR”) and of other regulations of the Republic of Croatia and of the Member States of the European Union governing the protection of personal data.

This Personal Data Processing and Protection Policy (hereinafter: the Policy) applies to the collection and processing of your personal data by the Controller, regardless of how the data is collected. The terms “we”, “us”, “our” and their derivatives, as well as statements in the first person plural in this Policy, refer to the Controller.

The latest version of this Policy is always the one in force (see chapter 16 of this Policy).

If this Policy is translated into other languages, only the Croatian original shall be deemed the authoritative Policy.

Personal data is any information relating to a natural person who is identified or identifiable, directly or indirectly.

Processing of data is any operation performed on personal data, such as collection, storage, use, consultation and transfer of personal data.

This Policy does not apply to anonymous data. Anonymous data is data that cannot be linked to a specific natural person.

2. HOW TO CONTACT US ABOUT THE PROCESSING OF YOUR PERSONAL DATA

If you have a question about this Policy or wish to exercise any of your rights regarding the processing of personal data (see chapter 11 of this Policy), please contact the Controller by email at zastita.podataka@exponentis.pro or in writing at the Controller’s registered office address given at the beginning of chapter 1 of this Policy.

You will receive the reply in the same way in which you sent your enquiry. If you send your enquiry by email, your message must contain a sender field (the “From:” field) showing your correct email address. If you send your enquiry in writing to the Controller’s registered office, the item must bear your correct sender address, or that address must be correctly stated in the enquiry itself.

We will reply to your enquiries as soon as possible. We are not obliged to reply to an enquiry that was not delivered for technical reasons unrelated to our systems or through the fault of the delivery service provider.

The Controller is unable to provide information about data processing by telephone.

3. PURPOSE AND LEGAL BASIS FOR PROCESSING

The Controller processes personal data only where there is a valid legal basis for such processing, namely:

• with your prior consent to processing for a specific purpose (Art. 6(1)(a) GDPR)
• where processing is necessary for taking pre-contractual steps and for concluding and performing a contract with you (Art. 6(1)(b) GDPR)
• where processing is necessary for compliance with the legal or statutory obligations of the Controller (Art. 6(1)(c) GDPR)
• where processing is necessary to protect your vital interests (or those of another natural person) (Art. 6(1)(d) GDPR)
• where processing is necessary for the purposes of the legitimate interests of the Controller (or of third parties), except where your interests, fundamental rights and freedoms override the legitimate interests of the Controller or of third parties (Art. 6(1)(f) GDPR). The legitimate interests of the Controller are deemed to include carrying out all activities within the scope of the Controller’s business.

The collection and processing of your personal data may be necessary for various purposes, for example:

• to answer your questions or requests, including responding to a request to exercise the right of access to information
• to inform you about our services, activities or products, promotional and non-promotional notices and announcements, invitations and the like
• for your participation in congresses, seminars, workshops and other events we organise in our own name or in the name of our clients and users of our services
• for ordering our services and products
• for sourcing your products and services
• for delivering the products and services you have ordered from us
• to understand your interests and needs and to provide effective customer support
• to establish business cooperation with you or with the company or organisation in which you are an employee or associate
• for concluding and performing your contracts with us
• for your employment with us
• for statistical analysis of data on your activities while using our websites and our other services
• for better functioning of all website features and a better user experience
• to keep records of arrivals and departures of business partners, other visitors and employees at our premises
• for video surveillance for the protection of persons and property
• to comply with legal obligations under applicable laws (national and European Union regulations)
• for any other purpose necessary for carrying out all activities within our business

If in a particular case you withhold your personal data, we may be unable to provide the requested service, or to conclude or perform a contract with you, and the like.

4. HOW WE COLLECT YOUR DATA

We collect data in various ways, depending on the purpose of collection. Some of these are:

• if you contact us directly, e.g. through the website or by telephone
• if you visit our websites www.exponentis.pro and all other websites of ours that display this Policy
• if you visit websites we manage and maintain on behalf and for the account of our clients who have ordered such a service from us
• if you order a product or service directly from us in any way
• if you respond to our direct marketing campaigns, e.g. by filling in a reply card or entering data online on our website, or if you respond to direct marketing campaigns we run on behalf and for the account of a client who has ordered such a service from us, e.g. by filling in a reply card or entering data online on a website
• if you fill in a registration for a seminar, workshop, congress or other event we organise in our own name or in the name of one of our clients or users of our services
• if other business partners have forwarded your personal data to us in a permitted manner
• if we have obtained your personal data from other sources (e.g. from business address brokers)
• if we have concluded a contract with you, including service contracts or employment contracts
• through photography or recording, where necessary (see chapter 6 of this Policy)
• through video surveillance, where necessary (see chapter 7 of this Policy)
• through recording of telephone calls, where necessary (see chapter 8 of this Policy)
• through systems for automatic data collection on websites, including data such as IP address, information about the internet browser and device you use, so-called cookies and the like (see chapter 9 of this Policy)
• through public services or channels controlled by third parties, such as social networks (see chapter 10 of this Policy)
• in any other manner not prohibited by law that serves legitimate interests and is necessary for carrying out the activities of our regular business

If you provide data on behalf of another person, you must ensure that this person is familiar with this Policy before you do so.

If you are under 18, please do not provide us with any data without the express approval of a parent or guardian.

If parents or guardians become aware that their children have provided us with their personal data, they should inform us immediately. If we establish that personal data was provided to us by a person under 18, that data will be destroyed, unless the parent or guardian has expressly agreed that we process the child’s personal data for a clearly defined purpose.

Help us keep your data up to date by informing us of any changes to your contact details or preferences, as described in chapter 2 of this Policy.

5. DATA WE COLLECT

The data we collect differs depending on the purpose of collection. We always strive to collect only the types of data needed for a given purpose, and no additional data.

We may collect all personal data necessary for the Controller’s business activities, in particular: name and surname, job position, name of the company or organisation in which you are employed, address, email address, telephone, mobile and fax numbers and the like. For certain purposes, additional data may be required, such as date and year of birth, OIB (personal identification number) and other data.

6. PROCESSING OF PERSONAL DATA THROUGH PHOTOGRAPHY AND/OR VIDEO RECORDING, EXCLUDING VIDEO SURVEILLANCE

During the organisation of congresses, seminars, workshops and other events (hereinafter: Events) that we organise in our own name or in the name of our clients, we may photograph or record the Events for promotional or informational purposes.

Photography or recording of such Events will be carried out on our behalf by our employees or by selected provider(s) of video recording and/or photography services (who are considered processors within the meaning of the GDPR).

The resulting photographs or video recordings may, but need not, show the faces and appearance of any Event participant. Any video recording is understood to possibly contain an audio track in which the conversations of the recorded persons can be heard.

The Controller has the right to use photographs and/or video recordings from Events for promotional or informational purposes without restriction, without payment of a fee and without prior notice to the persons photographed or recorded about the use of such photographs or video recordings. The Controller may share photographs or video recordings from an Event with the client on whose behalf it organised the Event, who may use them for promotional or informational purposes without restriction, without payment of a fee and without prior notice to the persons photographed or recorded about the use of such photographs or video recordings.

Such use includes the possibility of publishing photographs or video recordings from Events in the media without restriction, without payment of a fee and without prior notice to the persons photographed or recorded about the use of such photographs or video recordings.

Photographs or video recordings from Events may remain published in the media permanently, without time limit. The Controller expressly states that it does not undertake to request their removal from the media if the persons appearing in the photographs or recordings subsequently request it.

The Controller does not photograph or record those present with the intention and aim of isolating them from their surroundings and time, but exclusively as part of the Event and of the circumstances at the Event venue. The Controller will take measures to ensure that photographs and/or video recordings, including any audio contained in video recordings, contain no personal data of participants other than their appearance and voice (for example, name and surname on an accreditation badge, the content of documents or device screens, and the content of private conversations).

If you do not wish to be photographed or recorded as part of the crowd of participants at any Event organised by the Controller, please do not attend the Event.

For any individual photographs or video recordings focused on a specific person or persons (for example, statements about the Event) and their publication, the Controller will seek the prior written consent of the persons photographed or recorded in this way.

7. PROCESSING OF PERSONAL DATA THROUGH VIDEO SURVEILLANCE

For the protection of persons and property, it is our legitimate interest to record our business premises and vehicles and their immediate surroundings by video surveillance, including audio recording. This legitimate interest applies to all business premises and vehicles that we own or hold under a long-term lease.

Where video surveillance exists in any of our business premises or vehicles, this will be clearly indicated.

Video recordings made in this way may be provided on request to the competent authorities (police, courts) where necessary for proceedings under special regulations.

If you do not agree to being recorded by the video surveillance system, please do not visit our business premises or enter our vehicles.

The regulations applicable to recording public areas apply to our business premises with a video surveillance system that also records the public area in the immediate vicinity of the premises, and to our vehicles with a video surveillance system recording their immediate surroundings, including recording of the surroundings from a moving vehicle.

We keep video recordings (including any audio) obtained through the video surveillance system for no longer than twelve months, or longer if they have been seized as evidence in judicial, administrative, arbitration or other proceedings.

If we organise a congress, seminar, workshop, team building or other event in our own name or in the name of a client in rented premises, those premises may have their own video surveillance. The natural or legal person from whom we have rented the premises is responsible for processing data obtained through such video surveillance.

8. PROCESSING OF PERSONAL DATA THROUGH RECORDING OF TELEPHONE CALLS

For keeping records of orders for our services and for other business purposes, such as surveys on our behalf or on behalf of one of our clients, telephone calls to or from our telephone numbers may be recorded.

Recording telephone calls is not our usual practice.

If we record a call, you will always be informed at the very beginning of the call by the other party or by an automated voice message before the call begins.

9. AUTOMATIC COLLECTION OF YOUR DATA THROUGH COOKIES AND OTHER TECHNOLOGIES, AND OTHER MATTERS CONCERNING YOUR PERSONAL DATA ON OUR WEBSITES

When you visit our websites, the computers hosting them automatically, and without your active involvement, record various data, such as the type and language of your browser, the type of device you use for access and your operating system, your IP address, the address of the website you visited before and after visiting the websites, the name of the search engine or other source that led you to the website, and the links you used on our websites.

On our websites or in emails we may use a technology called a web beacon, which is used to analyse the effectiveness of the website, as well as so-called cookies – text files that the computers hosting our websites send to your computer or device and that uniquely identify each user of our websites, enabling us to improve your user experience and analyse your use of our websites. Our websites may not function properly if you disable cookies in your browser settings.

Web beacons, cookies and other technologies for tracking and analysing user behaviour patterns do not automatically generate personal data that can identify the user; however, if you voluntarily provide personal data by which you can be identified – for example, by filling in a form on our websites – your personal data can be linked to data on how you use the websites obtained through these technologies.

On our websites we may use the following types of cookies:

• technical (mandatory, cannot be disabled), necessary for the websites to function
• functional (can be disabled), which enable us to provide enhanced functionality and personalisation
• marketing (can be disabled), which enable recording of visits and traffic sources so that we can measure and improve the performance of the websites

On our websites that use cookies you will receive a notice about this on your first visit, and on websites that use functional and/or marketing cookies in addition to technical ones, you will also be given the option to disable functional and/or marketing cookies.

Our websites may also use cookies set by the Google Analytics service of Google Inc. This is an analytics service that evaluates your use of the website, providing website managers with reports on website activity, such as the number of visitors, the pages visitors visit, demographic data about visitors and other information. On our websites we use this service in such a way that we do not collect personal data by which we could identify you. For information on the processing and protection of personal data by the Google Analytics service, visit www.google.com. Cookies set by the Google Analytics service are considered technical, as described above.

Our websites may also use cookies of other internet services, of which you will be informed on the websites themselves.

Websites to which this Policy applies may contain links to external third-party websites outside our control. This Policy does not apply to such websites, and we recommend that you consult the personal data processing and protection policy of such websites on those websites.

Everything stated in chapter 9 of this Policy also applies to websites we manage and maintain on behalf and for the account of our clients who have ordered such a service from us.

10. YOUR PERSONAL DATA PROVIDED TO US THROUGH CHANNELS CONTROLLED BY THIRD PARTIES

We may collect some data through channels or public services controlled by third parties, such as social networks. Where this is the case, it will always be stated in the specific situation in which such data is collected.

This Policy applies to data collected in this way to the extent that the data is under our control (for example, it is located in parts of the channel or service that we can access or modify).

However, please note that channels and public services controlled by third parties, such as social networks, usually have their own personal data processing and protection policy, which may also apply to the data you provide to us through them and for which we are not responsible.

You can usually find out about the personal data processing and protection policy of each such public service when signing up to it. If you do not agree to their policy and their processing and protection of personal data, please do not provide us with your data through them. Please note that in that case we may be unable to provide the requested service, or to conclude or perform a contract with you, and the like.

Everything stated in chapter 10 of this Policy also applies to channels or public services controlled by third parties, such as social networks, that we manage and maintain on behalf and for the account of our clients who have ordered such a service from us.

11. YOUR RIGHTS REGARDING THE PROCESSING OF PERSONAL DATA

To exercise your rights, you may contact us as described in chapter 2 of this Policy.

Your rights are:

Right of access to personal data
You have the right to access the personal data we process about you and may request detailed information, in particular about the purpose of processing, the type/categories of personal data processed, including access to your personal data, the recipients or categories of recipients, and the envisaged period for which the personal data will be stored. Access to personal data may be restricted only in cases provided for by Union law or our national legislation, or where such a restriction respects the essence of the fundamental rights and freedoms of others.

Right to rectification of personal data
You have the right to request the rectification or completion of personal data if your data is not accurate, complete and up to date. To do so, send your request to us as the Controller as described in chapter 2 of this Policy.

Please note that the request must specify what exactly is not accurate, complete or up to date and in what way it should be corrected, and must be accompanied by the necessary documentation supporting your statements.

Right to erasure
You have the right to request the erasure of personal data concerning you if one of the following conditions is met:

• your personal data is no longer necessary in relation to the purpose for which we collected or processed it
• you have withdrawn the consent on which the processing is based in accordance with Article 6(1)(a) or Article 9(2)(a) GDPR, and there is no other legal ground for the processing
• you have objected to the processing of your personal data in accordance with Article 21(1) GDPR and there are no overriding legitimate grounds for the processing on our part
• the personal data has been unlawfully processed
• the personal data must be erased for compliance with a legal obligation under Union law or the law of the Member State to which the Controller is subject
• the personal data has been collected in relation to the offer of information society services referred to in Article 8(1) GDPR

These rights do not apply to the extent that processing is necessary:

• for exercising the right of freedom of expression and information
• for compliance with a legal obligation which requires processing under Union or Member State law to which the Controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) GDPR, in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing
• for the establishment, exercise or defence of legal claims.

Right to restriction of processing of personal data
You have the right to obtain restriction of processing if:

• you contest the accuracy of the personal data
• the processing is unlawful and you oppose the erasure of the personal data
• the Controller no longer needs the personal data, but you have requested it for the establishment, exercise or defence of legal claims
• you have objected to the processing of your personal data

Right to data portability
You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format and to transmit it to another controller, where the processing is based on your consent or on a contract and is carried out by automated means. Where technically feasible, you may request that we transmit your data directly to another controller.

Right to object
If we process your data for the performance of tasks carried out in the public interest or in the exercise of our official authority, or if we rely on our legitimate interests when processing it, you may object to such processing.

Right to withdraw consent
If the processing of your personal data is based on consent, you may withdraw your consent at any time as described in chapter 2 of this Policy. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Right to lodge a complaint with a supervisory authority
If you consider that your personal data is being processed in breach of the General Data Protection Regulation, you have the right to lodge a complaint with a supervisory authority. In the Republic of Croatia, this is the Croatian Personal Data Protection Agency (AZOP), Ulica Metela Ožegovića 16, 10000 Zagreb, www.azop.hr.

12. LINKING YOUR DATA

We may link personal data you have provided to us in one way with data you have provided to us in another way.

We may also link personal data you have given us directly with your personal data contained in the records of third parties.

13. DISCLOSURE AND SHARING OF YOUR PERSONAL DATA

All our employees and associates for whom this is necessary to carry out the business activities for the purposes of which your data is collected have the right to access your personal data. Employees of our affiliated companies may also have access to your personal data if necessary. In that case, this Policy also applies to your data.

We may provide your personal data for use to providers of information and communication solutions and services and of other services acting as processors, for the purpose of carrying out the Controller’s business activities. These processors include, for example, providers of technical data processing solutions, delivery service providers, marketing communication service providers, providers of photography, recording or video surveillance services and the like. Before forwarding your data, we conclude contracts with these processors setting out in detail how personal data is to be handled, so they are unable to process your personal data without our instructions or to forward it to third parties.

If your data has been collected in the course of business activities we carry out on behalf and for the account of one of our clients and users of our services (for example: promotional and marketing activities, surveys, prize competitions and games, organisation of business events and all other business activities we carry out on clients’ orders), we may share your data with the client or user who ordered the service. We will do so only to the extent strictly necessary for carrying out business activities with the client who ordered the service. Your data shared in this way will be accessible to employees and associates of the client and/or of companies affiliated with the client for whom this is strictly necessary to perform the service the client ordered from us.

In certain circumstances, we have a legal obligation to forward your personal data, and the processing of personal data may also include its international transfer. The legal obligation may arise from national regulations or from EU regulations. For example, joint supervisory activities of the supervisory authorities of Member States are sometimes required, or steps must be taken to collect an imposed but unpaid fine. Your data is therefore forwarded to other recipients when relevant regulations oblige us to do so, to the extent necessary to achieve the specified purpose.

Your personal data will not be forwarded to third parties for direct marketing purposes, unless you have given your explicit consent to this through a separate form or in another appropriate manner.

Some personal data may be stored or processed on computers in countries outside the European Economic Area (EEA), including the United States of America, which do not offer the level of protection that is mandatory in the EEA. We will carry out such transfers only with appropriate safeguards in place, to ensure that data processors in such countries provide a level of personal data protection in line with the standards applicable in the EEA and in Croatia.

If you would like more detailed information about the circumstances of transfers of your personal data outside the EEA (if any), or would like a copy of the safeguards, contact us as described in chapter 2 of this Policy.

14. HOW WE KEEP YOUR DATA SECURE

We use various security measures, including encryption and multi-factor authentication of access, to protect and maintain the security, integrity and availability of your data.

Among other things, we use the following measures:

• strictly limited personal access to your data on a “need-to-know” basis
• secure transfer of collected data
• firewalls on IT systems to prevent unauthorised access
• continuous monitoring of access to IT systems to detect and prevent misuse of personal data
• other technical and organisational measures available to us

All employees and associates of the Controller undertake to keep personal data confidential by signing a confidentiality statement.

15. HOW LONG WE KEEP YOUR DATA

We process your personal data until the purpose of processing has been fulfilled. Once the purpose for which they were collected has ceased, we no longer use your personal data and erase it, except for data we are required to retain under statutory regulations, and then for no longer than those regulations require.

If you request erasure, the data will be erased immediately, or within the shortest technically feasible time, except where there is an obstacle to erasure (see chapter 11 of this Policy, under “Right to erasure”).

16. UPDATES TO THIS POLICY

The Controller reserves the right to amend this Policy at any time without prior notice. The current version of this Policy is available on the Controller’s website (www.exponentis.pro) and at its registered office, and you can always request it by contacting us as described in chapter 2 of this Policy.

Previous versions of this Policy are available on request sent to zastita.podataka@exponentis.pro.

Last amended: 29 October 2026.

  Back to home page