PERSONAL DATA PROTECTION POLICY

1. General information

Flaster Media d.o.o., Zagreb, Kuzminečka ulica 49, OIB: 87751249463, (hereinafter: „Company“ or „Data controller“) is a media company specialized in measurable out-of-home advertising on branded taxi vehicles.

Protection of personal data is of particular interest to the Company. Towards ensuring a fair and transparent processing, by this Personal Data Protection Policy (hereinafter: “Policy”) the Company wants to provide its users clear information on the processing of their personal data in relation to the use of the Flaster App (link to the Flaster App is available on the Company’s webpage).

The purpose of this Policy is to inform the users of Flaster App in clear and simple terms on which personal data is collected by the Company, for which period they are collected, for what reasons they are collected, what rights do the users have and in which way they can exercise them. When the Company collects personal data of users, i.e. when the users share them with us, the Company will process them in accordance with this Policy.

2. Data controller

By registration and/or using the Flaster App by the driver, Company’s client or other user, the Company assumes the role of Data controller for the data made available for purposes of registering on the App, filling out the App profile, and for other user data for which the Company determines the purpose of processing.

Data protection officer is available via the following email: info@flaster.co.

3. Principles of data processing

The Company processes user personal data abiding by the principles of data processing.

• Lawfulness, fairness and transparency – while processing personal data we act in accordance with the law and afford the user easily accessible and understandable information and communication in relation to processing of personal data.

• Limitation of purpose – personal data are collected and processed only for the specified and lawful purpose and are not further processed in a way incompliant with the purpose for which they were collected.

• Minimizing amount of data – the Company uses user data that is appropriate and necessary for achieving the particular lawful purposes.

• Accuracy of personal data – in order to ensure fair and transparent processing of data and to prevent potential misuse the personal data must be accurate, complete and current. It is very important to the Company that the user informs us immediately or as soon as possible on any change and/or addition to their personal data.

• Limitation of data storage – we store users’ personal data for such an amount of time which is required for performing particular purpose, after which they are deleted from all Company’s records.

• Completeness and confidentiality – personal data are processed in a secure manner, including protection from unauthorized or unlawful use and from accidental loss, destruction or damage (e.g. personal data can be accessed only by authorized persons who require such access to perform their job, but not by other persons).

4. What are personal data?

“Personal data” are information which enable the identification of users directly (e.g. name and surname or OIB of user) or indirectly (e.g. via a pseudonym). In other words, personal data include data such as name and surname, OIB, e-mail address, home address, mobile phone number, financial data and similar. Personal data may include number identifiers such as computer IP address, MAC address of mobile phone or cookies, provided these data enable identification of users.

5. Which personal data are collected and processed by the Company?

• Name and surname, OIB, e-mail address and phone number of the user.
• User’s photograph.
• User’s geolocation and driving routes.
• Vehicles data (including license plate number) and vehicles’ photographs.
• Data from user’s driver’s license.

6. Purpose of data processing

Taking into account the lawfulness of processing, the Company processes user data for the following purposes:

• For purposes of registering on Flaster App – the following data are collected and processed: name and surname, OIB, e-mail address and user’s phone number, vehicle data (including license plate number) and vehicle photographs.

• For purposes of finding opportunity for business cooperation – Company collects data such as geolocation and driving routes in order to potentially offer the user, according to the user’s interest expressed by registering on the App, an opportunity for entering into agreement on business cooperation on marketing campaigns for the Company’s clients. If the user does not wish to reveal his geolocation, he should turn off the Flaster App or designate in the App that he is disconnected and not currently an active driver.

• For purposes of performance of contract – after entering into agreement on business cooperation on marketing campaigns for the Company’s clients, the Company processes: a) name and surname, OIB, e-mail address and user’s phone number, vehicles data (including license plate number) and vehicles photographs – for verifying the proper performance of contract obligations; b) data such as geolocation and driving routes – to be able to perform particular contract obligations, including to be able to pay out to the user, i.e. contractor on whose behalf the driver is acting, the fees which depend on performed mileage, and to enable Company’s clients the insight into the performance of agreed marketing campaign.

• For purposes of compliance with laws – Data from drivers’ license, user photograph, data and photographs of vehicles are processed to determine compliance with legal provisions and adequacy for participating in campaigns.

7. User rights

Each user of the App has the following rights:

• Right to access – user has the right to seek confirmation on whether his data is being processed, the right to access these data and the right to receive information on the purpose of processing, categories of personal data.

• Right to correction – user has the right to obtain correction of inaccurate personal data concerning him and to complete the incomplete personal data.

• Right to deletion – user has the right to obtain deletion of personal data concerning him without undue delay if appropriate conditions for deletion are met. For clarity, in certain situations the deletion will not be possible (e.g. Company cannot agree to the request for deletion of the data the user has provided while registering to the App during a contractual relationship if they are necessary for performance of contract).

• Right to limitation of processing – user has the right to seek limitation of processing if the following conditions are met: user disputes the accuracy of personal data, for the period which enables the data controller to verify the accuracy of personal data; processing is unlawful and the user is objecting to the deletion of personal data and is instead seeking limitation of their use; Company no longer requires personal data for purposes of processing but the user is requesting them for purposes of establishing, exercising or defending legal claims; user has raised appropriate objection to the processing.

• Right to data portability – user has the right to receive the personal data concerning him, which he has provided to the Company, in a structured, machine-readable format, and to transmit it to another controller if the processing is based on consent or performance of contract and is carried out by automated means.

• Right to object – user has the right to object at any time to the processing of his personal data which is carried out on the grounds of public interest or in exercise of official authority vested with the Company and on the basis of so-called legitimate interest of Company. In such case the Company will not process data for said purposes, unless it is proven there are legitimate reasons for processing which supersede the interests, rights and freedoms of the user, or for establishing, exercising or defending against legal claims.

• Right to withdraw consent – user has the right at any time to withdraw his consent if such has been given.

• Right to file complaint to the competent authority – user is entitled to file complaint to the Personal Data Protection Agency, Selska cesta 136, HR – 10 000 Zagreb

• For all the rights stated above and queries on processing of their personal data users can contact us at info@flaster.co or by mail at address Flaster media d.o.o., Kuzminečka ulica 49, 10000 Zagreb.

8. Period for retention of personal data

User’s personal data are processed until the purpose of processing is fulfilled. The Company keeps to the criteria that minimum period of retention of data is also the maximum period and in this respect the Company abides by the statutory rules regulating personal data retention. For each purpose of processing for which no mandatory retention period is statutorily provided, the Company has set out the deadline for deletion or anonymization of data.

9. Sharing personal data

Certain categories of personal data may be shared with a third party or user of data only to the extent encompassed by consent of the App user, or to the extent this is necessary for provision of service and exercising the App functionalities, or there is another statutory ground.

All persons who gain access to App user’s personal data in the above-described way are obliged to keep them in accordance with the terms of applicable contract, general terms and applicable laws.

10. Security

The App uses up-to-date technologies in order to afford its users as high level as possible of protection of privacy and their personal data. The Company allows access to personal data only to the authorized persons, which are contractually bound to maintain their confidentiality.

11. Final provisions

Company reserves the right to amend the Policy for any reason and at any time. All amendments to the Policy shall enter into force once they have been made available to you by email or the App and you continue using the App.

This Policy shall be governed by Croatian law.

Parties shall settle potential disputes amicably. In case of inability to settle the dispute amicably, the court in Zagreb, Croatia shall have jurisdiction.

 

This Policy is in force as of: 08.05.2022.