Data controller: Golubica parking d.o.o.

OIB (Croatian personal identification number): 20459614645

Address: Krapanjska 12, Zagreb (office: Heinzelova 60, Zagreb)

Tel.: 099 2345 670

Email: cc@parking.hr

We collect the following categories of personal data:

Category of data subjects	Categories of personal data	Purpose and legal basis
Retail customers	First name, surname, email, contact telephone number, CCTV recordings	Invoicing, communication with customers / Croatian VAT Act and related regulations
Wholesale customers	First name and surname of the authorised representative, email, contact telephone number, CCTV recordings	Establishing a business relationship, invoicing Communication with customers / Croatian VAT Act and related regulations
Employees	First name, surname, gender, address, OIB, telephone number, email and other basic information needed to conclude an employment contract and register for pension and health insurance.	Concluding an employment contract / Croatian Labour Act, Contributions Act and all other legislation relating to employment relationships
Suppliers and business partners	First name and surname of the representative, telephone number, email	Establishing and performing contractual obligations (ordering goods and services), communication with partners / Croatian Civil Obligations Act

When you create and use a website account, we process the information you enter in your profile (first name, surname, email, telephone number and address), vehicle details you enter, including registration plates, answers about your parking needs, selected product interests, and records of requested notifications, consents and changes to those choices. These data are used to manage the account and profile, record vehicles and interests, and send notifications requested by the user.

We collect data on the following legal bases:

1. Your consent, which you may withdraw at any time by emailing: cc@parking.hr

• A contract, because processing is necessary to provide the Company’s service to you.

• Statutory and subordinate legislation, because processing is necessary to comply with legal obligations.

• We may process your data where processing is necessary to protect the vital interests of the data subject or another natural person.

• We may process your data where processing is necessary to perform a task carried out in the public interest or in the exercise of official authority vested in the controller.

• We may process your data where processing is necessary for the defined legitimate interests of the controller or a third party.

We may share your personal data with:

• Public authorities and other recipients where relevant regulations require us to do so, to the extent necessary to achieve the stated purpose.

• Providers of information and communication solutions, accounting services and other organisational partners with whom we have concluded contracts specifying the handling of personal data in detail. They therefore may not process your personal data without our instructions or pass them to third parties.

Your personal data will not be passed to other third parties.

Personal data retention period:

We process your personal data until the purpose of processing has been fulfilled. Once the purpose for which they were collected ends, we no longer use your personal data. They remain in our storage system and are retained for as long as required by legal regulations and our Company’s internal rules.

Use of cookies:

The official website www.parking.hr uses cookies — text files placed on the user’s computer by the web server through which the Internet service provider (ISP) displays the website.

Cookies are created when the browser on the user’s device loads a website, which then sends data to the browser and creates a text file (cookie). The browser retrieves the cookie and sends it to the website’s server when the user returns.

IP addresses are retained for security reasons and deleted after one month.

Organisational and technical measures to protect personal data:

We collect and process personal data in a manner that ensures appropriate security and confidentiality during processing and enables the effective application of data protection principles, minimisation of data, the scope of processing, retention periods and availability.

We follow strict security procedures to minimise the risk of data destruction, unauthorised disclosure, unauthorised access to your data and other breaches.

The equipment and premises on or in which we store personal data are located in a secure environment with restricted physical access.

We use a firewall, strong passwords, antivirus software and other technical measures to protect personal data.

Only authorised persons have access to personal data, as regulated by our internal rules.

We regularly train our employees to raise awareness of personal data protection.

We take all appropriate technical and organisational safeguards to prevent accidental or unlawful destruction, loss, alteration, unauthorised use, disclosure, inspection of or access to data.

All employees of Golubica parking d.o.o. are required to protect personal data under a signed confidentiality statement.

As a data subject, you have the following rights concerning the processing of your personal data:

Right to withdraw consent — you may withdraw consent given for a particular processing purpose at any time. In that case, we will no longer use data collected on the basis of that consent for those purposes.

Right to object: you may, on grounds relating to your particular situation, submit a reasoned objection to the processing of your personal data at any time. We will then stop processing your personal data unless there are compelling legitimate grounds that override your interests, rights and freedoms, or the data are processed for the establishment, exercise or defence of legal claims.

If you object to the processing of your personal data for direct marketing, your personal data will no longer be processed for those purposes.

Right to restriction of processing: you may request restriction where you contest the accuracy of personal data; where you consider processing unlawful and oppose erasure, requesting restriction of use instead; or where you have objected to processing and are awaiting verification of whether the controller’s legitimate grounds override yours.

If you believe our processing of personal data is contrary to data protection regulations, please notify us in writing at our address or by email: cc@parking.hr, using the form attached to this document.

You may also submit your complaint to the competent supervisory authority in Croatia — the Croatian Personal Data Protection Agency — at: azop@azop.hr.

Right to erasure (“right to be forgotten”): you may request erasure of your personal data, and we must erase them without undue delay if one of the following conditions is met:

• The personal data are no longer necessary for the purposes for which they were collected or otherwise processed.

• The data subject withdraws the consent on which processing is based and there is no other legal basis for processing.

• The data subject objects to processing and the legitimate grounds for exercising the right to erasure outweigh the group’s legitimate interest in processing and/or retaining personal data.

• The personal data have been unlawfully processed.

• The personal data must be erased to comply with a legal obligation.

Right of access: you may obtain confirmation of whether your personal data are being processed and access to the personal data, the purposes of processing, categories of data, potential recipients to whom data will be disclosed, retention period and similar information.

Right to rectification: you may request correction of inaccurate personal data concerning you. In certain situations, you also have an obligation to update your personal data.

Right to data portability: you may receive personal data concerning you and transfer them to another controller.

How we ensure personal data security: We collect and process your personal data in a manner that ensures appropriate security and confidentiality during processing and enables the effective application of data protection principles, minimisation of data, the scope of processing, retention periods and availability.