PRIVACY POLICY

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (Official Journal of the European Union L 119, 4.5.2016, p. 1, hereinafter: General Data Protection Regulation), which has been fully applicable since 25 May 2018 in the Republic of Croatia and all EU Member States, as well as the Act on the Implementation of the General Data Protection Regulation (Narodne Novine No. 42/18, hereinafter: the Act), the Labour Act (Narodne Novine No. 93/14 and 127/17), the Occupational Safety Act (Narodne Novine No. 71/14, 118/14, and 154/14), and in accordance with the legal framework for personal data protection in the Republic of Croatia and the European Union and best European practices, SMILE STUDIO KOVAČEVIĆ MIKŠIĆ d.o.o., OIB: 74198576990, Bribirska 2, 51000 Rijeka, registered at the Commercial Court in Rijeka (hereinafter: the Company), as the data controller for users of its services and customers, has adopted this Privacy Policy for the personal data of service users and customers.

The Privacy Policy is a unilaterally binding legal act based on the fundamental principles of personal data processing, regulating which user data is collected, how such data is processed, and for what purposes it is used. The Privacy Policy also informs users and/or customers of their rights regarding the collection and further processing of personal data, all to protect their privacy in a broader sense.

The Privacy Policy is based on the following principles of personal data processing: lawfulness, transparency, and best practice; limited processing and data minimization; accuracy and completeness of personal data; storage limitation; data integrity and confidentiality; accountability; trust and fair processing; purpose limitation; and processing in anonymized form.

The Privacy Policy applies to all services offered by the Company, aiming to clearly and transparently inform users about the processing of their personal data and their rights. Users may at any time contact the Company to request modification, supplementation, and/or updating of their data, as well as withdraw consent and request the cessation of further processing of their personal data.

The data controller is:
SMILE STUDIO KOVAČEVIĆ MIKŠIĆ d.o.o., OIB: 74198576990, Bribirska 2, 51000 Rijeka
Contact for personal data protection:
e-mail: [email protected]

METHODS OF COLLECTION AND TYPES OF PERSONAL DATA COLLECTED

• Directly from users: Users provide data to the Company as the data controller to the extent necessary for the provision of services, sales, or other user-company relationships via www.smilestudio.hr. To provide the relevant services, users must provide the following data necessary for establishing a contractual relationship for the provision of a particular service and/or sale of certain products. The customer/user may provide data orally or in writing at the Company’s headquarters, via email, or through the Company’s website.
• From publicly available sources: Data about companies and individuals in companies from internet portals, telephone directories, and other publicly available services, but only for the purposes for which they were initially collected.
• Automatically by visiting the Company’s website: Data associated with network identifiers (IP addresses, cookie identifiers such as Google Analytics, Facebook Pixel, and Hotjar for tracking user/customer interactions).

A cookie is a small data file stored on a computer or mobile device when visiting a website. Cookies are used to provide a better user experience, save user preferences, make websites work more efficiently, and to track and analyze website usage and visits. Disabling or blocking cookies does not prevent users from browsing the website, but some features or functionalities may not be available, or access times may be longer.

Network identifiers may leave traces that, in combination with other identifiers and information provided by internet service providers, may serve to identify users and/or customers.

The amount and scope of personal data collected depend on the type of service provided and the legal basis for data collection. The Company ensures that only the minimum necessary personal data required for the legally defined purpose is collected.

DATA ON POTENTIAL USERS

The Company also collects data on potential users and/or customers of its services and/or products. This data includes basic information (name and surname, email address), as well as interests of potential users/customers who contact the Company to be informed about or offered certain products and services.

TYPES OF PERSONAL DATA COLLECTED

The most commonly provided data by the Customer/User includes:

• Name and surname
• Address
• Personal identification number (OIB)
• Contact telephone and/or mobile number
• Email address
• Data from personal identification documents
• Bank account and card number for payment purposes

WHERE ARE PERSONAL DATA PROCESSED AND STORED?

Personal data of users/customers are processed in the Republic of Croatia. Data are stored so that all or part of the information about customers/users/data subjects is kept in the data controller’s databases.

OBLIGATIONS OF THE DATA CONTROLLER REGARDING DATA SECURITY

The data controller implements technical and organizational measures to ensure an appropriate level of security. Measures are also taken to ensure that any individual acting under the authority of the data controller who has access to personal data does not process them except on instructions from the data controller.

Taking into account the nature, scope, context, and purposes of processing, as well as the risks of varying likelihood and severity for the rights and freedoms of individuals, the data controller implements appropriate technical and organizational measures in accordance with Security Policies to ensure and be able to demonstrate that processing is performed in accordance with the General Regulation.

PURPOSE OF DATA COLLECTION AND FURTHER PROCESSING

The Company collects and further processes personal data of users and/or customers for the purpose of concluding and executing contracts, completing purchases or service interventions on equipment, delivering ordered products, providing advice and assistance in using products, providing relevant additional and/or extended warranties for products, resolving user/customer complaints, and other actions related to the conclusion and execution of contracts in accordance with applicable regulations.

Processing personal data for the above purposes is necessary and constitutes the legal basis for concluding contracts. If the user or customer refuses to provide essential data, the Company will not be able to conclude a contract and/or undertake certain actions related to the execution of the contract.

Direct marketing:
User/customer contact data may be used to send promotional notifications about the Company’s products and services if the user/customer has given consent.

Video recordings:
The Company uses surveillance cameras for the protection of persons and property.

RETENTION PERIOD FOR PERSONAL DATA

Depending on the purpose and legal basis for which personal data of users/customers are collected, the Company is, in some cases, required to retain personal data for a period prescribed by the relevant regulations or until the purpose for which they were collected ceases. After the statutory period or cessation of the purpose, the data are deleted.

For data collected and processed based on user/customer consent, personal data are retained for 10 years. Data processed based on consent may be deleted before the expiration of this period if requested by the user/customer or if the user/customer objects to such processing in writing via the published email address: [email protected].

EXERCISING RIGHTS

Users can exercise their rights if they believe there has been an irregularity in the processing of their personal data by contacting the Company or via email at [email protected]. Users/customers also have the right to file a complaint with the national supervisory authority.

CONDITIONS AND REASONS FOR DISCLOSURE TO THIRD PARTIES

Personal data of customers/users are disclosed to third parties (including competent authorities) in the following cases:

• To fulfill the Company’s legal obligations
• When such processing is necessary to protect the vital interests of customers/users
• To fulfill contractual obligations, perform work on behalf of the customer/user for which it is necessary to engage a third party (data processor)

PROCESSING OF PERSONAL DATA IN THE CONTEXT OF EMPLOYMENT

Personal data of employees may be collected, processed, used, and disclosed to third parties only if prescribed by law or if necessary for the exercise of rights and obligations arising from employment or in connection with employment. The data controller will, for the purpose of exercising employment rights and obligations, collect, process, use, and disclose to third parties only those personal data necessary for this purpose and will disclose such data only at the request of courts and other state or public bodies.

GDPR AND COOKIES

Your current status: Consent accepted. Manage your consent.

KRAKEN PLATFORMA

General Terms of Use – English Translation

1. Subject of the General Terms of Use
   1.1. These General Terms of Use (hereinafter: “General Terms”) regulate the conditions and manner of use of the KRAKEN PLATFORM (hereinafter: “PLATFORM”) as a service provided to the user by the company Automation Titan Tech d.o.o., Radnička cesta 47, 10000 Zagreb, OIB: 13115572271 (hereinafter: “Kraken”) on the basis of an Agreement concluded between the Client and Automation Titan Tech d.o.o., Radnička cesta 47, 10000 Zagreb, OIB: 13115572271.
   1.2. These General Terms are binding for Kraken and the Client who accepts them for the purpose of using the PLATFORM and form an integral part of the agreement between Kraken and the Client.
2. Definitions
   2.1. The term Client primarily refers to a legal or natural person who has entered into a contractual relationship with Kraken in order to use the PLATFORM’s services, but also includes any legal or natural person who directly or indirectly uses the PLATFORM’s services.
   2.2. PLATFORM refers to the service as described above and represents a software solution used for sending web push notifications, advertising via web push notifications, marketing automation, generating leads for potential Client Users, automated communication with existing and potential Users, upselling to existing Users based on personalized experience, and the option to implement code enabling chatbot advertising functionality on the Client’s portal.
   2.3. User refers to natural persons who are visitors to the Client’s websites.
   2.4. Terms refers to the act within the meaning of Article 28, paragraph 3 of the General Data Protection Regulation (GDPR), which essentially regulates the relationship between the Client as the data controller and Kraken as the data processor regarding the processing of Users’ personal data via the PLATFORM – Data Processing Terms.
   2.5. Applicable Law refers to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) and the Act on the Implementation of the General Data Protection Regulation, Official Gazette No. 42/2018.
   2.6. Ticketing system means the user interface on the PLATFORM used as a channel for receiving reports of technical difficulties and errors on the PLATFORM, through which Kraken processes received reports of technical difficulties and other inquiries.
3. Method of Using the PLATFORM
   3.1. The PLATFORM is a software solution that, according to its purpose, is adaptable to the needs of each Client and the nature of their services. Before use, the PLATFORM is customized to the specific type of marketing, communication, and sales required by the Client’s services.
   3.2. For this purpose, the Client is obliged to provide Kraken with detailed instructions regarding at least the following:

• Data to be collected via the PLATFORM
• Data input channels (Chatbot, email, pixel, and/or import of existing Client databases into the PLATFORM)
• Chatbot configuration
• Whether synchronization of data and User access across multiple devices is required
  3.3. Based on the Client’s instructions, Kraken will open a special user account for the Client on the PLATFORM and configure it according to the Client’s needs. After that, Kraken gives the Client control over the customized user account on the PLATFORM and provides technical support as needed.
  3.4. Kraken ensures that instructions and explanations for using the PLATFORM are available within the user account and accessible to the Client at all times during use.

4. Responsibility for Use of the PLATFORM
   4.1. The Client is responsible for using the PLATFORM in accordance with these General Terms and as defined by the Terms and mutual agreements between Kraken and the Client during the setup of the Client’s user account. The Client will compensate Kraken for any damage resulting from use of the user account in a manner inconsistent with these General Terms and the Terms.
   4.2. The Client will be liable to Kraken for any damage resulting from entering into the user account data that was collected without authorization and personal data for which there is no legal basis for processing under Applicable Law. The Client is not authorized to collect any data via the PLATFORM except those recorded as the required data set for the purposes for which the Client uses the PLATFORM, either in the initial or subsequently modified user account settings.
   4.3. The Client is not authorized to alter the basic settings of the PLATFORM in any way to enter or process data for which the PLATFORM is not intended (e.g., storing the User’s IP address). The Client will be liable to Kraken for any damage resulting from such actions.
5. Responsibility for Content
   5.1. Kraken does not in any way influence the creation, filtering, obtaining, or distribution of content advertised via the PLATFORM and has no control over the source of such content.
   5.2. By using the PLATFORM, the Client acknowledges and accepts that Kraken bears no responsibility for any content (texts, images, websites, etc.) advertised via the PLATFORM, whether by Clients or third parties.
   5.3. By using the PLATFORM, the Client accepts sole responsibility for all content (texts, images, websites, etc.) they advertise via the PLATFORM.
   5.4. If the Client becomes aware of any content contrary to the laws of the Republic of Croatia or any other applicable regulations, or if such content may constitute a breach of contract or these General Terms, the Client shall immediately notify Kraken, who is authorized to remove such content from the PLATFORM without delay or consent from the Client or any third party. If it is unclear whether content is contrary to applicable law, Kraken may, in good faith, decide and remove such content. The Client waives all claims against Kraken arising from such actions.
   5.5. Kraken is authorized, upon learning of any content contrary to applicable law by any means, to remove such content from the PLATFORM without further approval or consent from the Client or any third party. The Client waives all claims against Kraken arising from such actions.
   5.6. Kraken is not obliged to compensate, in whole or in part, any damage suffered by the Client, User, or any third party arising from or related to the use of the PLATFORM by the Client, or any actions by the Client using or misusing its content, or any damage related to the use or misuse of content on the PLATFORM.
6. Technical Support
   6.1. Kraken provides continuous technical support to the Client throughout the use of the PLATFORM service via the Ticketing system and the email address [email protected].
   6.2. Upon receiving notice of a PLATFORM error or any inquiry via the above channels, Kraken will immediately begin processing the request. Any PLATFORM error will be resolved within 24 hours. If the error cannot be resolved within 24 hours, Kraken will inform the Client of the reasons and further steps.
7. Personal Data Protection
   7.1. As the PLATFORM processes a set of Users’ personal data tailored to the Client’s needs, the PLATFORM is adapted to the personal data protection system as prescribed by Applicable Law.
   7.2. Since Kraken is the data processor and the Client is the data controller for the purpose of providing the PLATFORM service, the Terms are included as Annex 1 to these General Terms. The Terms specifically regulate the subject and duration of processing, nature and purpose of processing, types of personal data and categories of data subjects, and the obligations and rights of the data controller.
   7.3. Kraken will be liable under Applicable Law only for damage caused to the Client, User, or any third party due to Kraken’s non-compliance with the Terms and these General Terms.
   7.4. As the Client collects Users’ personal data via the PLATFORM, the Client is obliged to appropriately inform Users about the personal data collected in accordance with Articles 13 and 14 of the General Data Protection Regulation. Kraken will not be liable or obliged to compensate for any damage to the Client, User, or any third party if the Client has not provided Users with appropriate information about the data processed via the PLATFORM as required by Applicable Law.
8. Final Provisions
   8.1. These General Terms and the Terms will be made available to Clients when contracting the PLATFORM service, either online or otherwise.
   8.2. These General Terms enter into force on the date of publication, 01.01.2020.
   8.3. Any amendments or additions to these General Terms and the Terms will be made available to Clients in the same manner, and Clients will be appropriately notified of the nature of the changes. All amendments and additions will apply to Clients in the same way.
   8.4. If any provision of these General Terms or the Terms is found to be legally invalid or unenforceable, the obligations under these General Terms and the Terms will continue to be performed in the remaining part, and the contracting parties will immediately replace such provision with a legally valid one.

TERMS OF PERSONAL DATA PROCESSING VIA THE PLATFORM

1. Subject of the Terms
   1.1. The subject of these Terms is the processing of personal data via the PLATFORM, where Automation Titan Tech d.o.o., Radnička cesta 47, 10000 Zagreb, OIB: 13115572271 acts as the data processor (hereinafter: “Data Processor”), while the Client acts as the data controller (hereinafter: “Data Controller”) as defined by Applicable Law.
   1.2. The provisions below and the processing of personal data apply only when the Data Processor processes Personal Data on behalf of the Data Controller under the General Terms and agreed terms of cooperation, i.e., during the use of the PLATFORM.
2. Definitions
   2.1. For the purpose of these Terms, the following expressions have the following meanings:
   2.1.1. “Processing System” means records of data and selected PLATFORM configuration options chosen by the Data Controller and implemented in the user account on the PLATFORM. This particularly includes: (i) categories of Personal Data processed within the PLATFORM service; (ii) input channels of Personal Data; and (iii) other data on selected options and PLATFORM configuration. Records of these items are stored within the user account on the PLATFORM and are appropriately available to both the Data Controller and Data Processor. The Processing System is an integral part of these Terms.
   2.1.2. “Data Subject” means the User as defined in the General Terms, i.e., a natural person visiting the Data Controller’s website whose identity is determined or can be determined.
   2.1.3. “Personal Data” means any information relating to an individual whose identity is determined or can be determined (the Data Subject). An individual whose identity can be determined is one who can be identified directly or indirectly, especially by reference to an identifier such as a name, identification number, location data, online identifier, or by one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity (as defined in Applicable Law) processed by the Data Processor on behalf of the Data Controller when providing PLATFORM services. Categories of Personal Data processed within the PLATFORM service will be defined within the Processing System.
   2.1.4. “Processing” means any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction, in accordance with Applicable Law. Processing of Personal Data under the General Terms and agreed terms of cooperation is also stated within the Processing System.
   2.1.5. “Personal Data Breach” means any breach of security or privacy leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data. This includes any breach caused by employees or subcontractors of the Data Processor or any person acting under the authority of the Data Processor (e.g., consultants, etc.).
   2.1.6. “Third Country” means a country that is not a member of the European Union (EU) and/or the European Economic Area (EEA).
   2.2. Other terms, definitions, and concepts defined in the General Terms apply accordingly in these Terms.
3. Purpose of Personal Data Processing
   3.1. The purpose of personal data processing subject to these Terms is to provide the PLATFORM service, i.e., to enable the Data Controller to use the PLATFORM service for marketing, communication, and sales.
4. Obligations of the Data Controller
   4.1. The Data Controller shall implement appropriate technical and organizational measures to ensure and be able to demonstrate that processing is carried out in accordance with Applicable Law.
5. Obligations of the Data Processor
   5.1. The Data Processor will process Personal Data solely in accordance with the General Terms, these Terms, and the needs and instructions of the Data Controller as essentially contained in the Processing System, unless certain Processing is required by Applicable Law. In such a case, the Data Processor will inform the Data Controller of this legal obligation before Processing, unless prohibited by law for important public interest reasons.
   5.2. The Data Processor will keep Personal Data confidential and ensure that persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
   5.3. The Data Processor will take and implement all necessary measures in accordance with Article 6 of these Terms (Security of Processing).
   5.4. The Data Processor will maintain records of Personal Data Processing as per Article 30(2) of the GDPR.
   5.5. The Data Processor will appoint a Data Protection Officer if the conditions of Article 37 of the GDPR are met.
   5.6. Taking into account the nature of the Processing, the Data Processor will assist the Data Controller through appropriate technical and organizational measures, as much as possible, in fulfilling the Data Controller’s obligation to respond to requests for exercising Data Subjects’ rights as established by Applicable Law.
   5.7. The Data Processor will assist the Data Controller in ensuring compliance with obligations under Applicable Law, considering the nature of the Processing and information available to the Data Processor.
   5.8. Upon the Data Controller’s choice, the Data Processor will delete or return all Personal Data to the Data Controller after the end of the use of the PLATFORM service and delete existing copies unless storage is required by Union or Member State law.
   5.9. The Data Processor will make available to the Data Controller all information necessary to demonstrate compliance with the obligations set out in this Article 5 of these Terms and allow for audits carried out by the Data Controller or another auditor authorized by the Data Controller. In this regard, the Data Processor will promptly inform the Data Controller if, in its opinion, a particular instruction infringes Applicable Law or other relevant EU Member State data protection provisions.
   5.10. The Data Processor will amend the provisions of the General Terms and/or these Terms to comply with obligations under Applicable Law.
6. Security of Processing
   6.1. Taking into account the state of the art, implementation costs, nature, scope, context, and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Data Processor will, prior to any Processing, implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including, as appropriate:

• Pseudonymization and encryption of Personal Data
• The ability to ensure ongoing confidentiality, integrity, availability, and resilience of Processing systems
• The ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident
• A process for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures for ensuring the security of Processing
  6.2. In assessing the appropriate level of security, particular account shall be taken of the risks presented by Processing, especially risks from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed.
  6.3. The Data Controller and Data Processor will ensure that any natural person acting under the authority of the Data Controller or Data Processor who has access to Personal Data does not process them except as instructed by these Terms, Applicable Law, and the initial instructions and wishes of the Data Controller regarding PLATFORM configuration, except where required by EU or Member State law.
  6.4. The Data Processor will notify the Data Controller within 24 (twenty-four) hours if it becomes aware of any Personal Data Breach. Such notice will be sent to the Data Controller’s contact address used in regular PLATFORM communication, with a copy to [email protected]. If it is not possible to provide all information about the Personal Data Breach at once, the remaining information may be provided in phases, but without undue further delay.

7. Data Processor’s Subcontractors
   7.1. By using the PLATFORM services, the Data Controller acknowledges that the Data Processor uses subcontractors for the needs and functionality of the PLATFORM and that it may be necessary to engage additional or replace existing subcontractors in the future. The Data Controller consents to the engagement of such subcontractors as sub-processors.
   7.2. To maintain a high level of personal data protection and PLATFORM security, the Data Processor will carefully choose sub-processors, applying a high standard of professional diligence. The Data Processor will not subcontract any Personal Data Processing without a written agreement with the sub-processor containing data protection obligations as set out in these Terms.
   7.3. If the Data Controller does not agree with the Data Processor’s subcontracting, the Data Controller may terminate cooperation with the Data Processor regarding the PLATFORM services.
8. Supervision and Audit
   8.1. The Data Controller has the right, independently or by appointing an independent third party (not a competitor of the Data Processor and with the Data Processor’s acceptance), to supervise the Data Processor’s compliance with these Terms and the initial requirements and instructions of the Data Controller. The Data Processor will cooperate and assist the Data Controller or third party auditor by providing requested information, documentation, and access to business premises, IT systems, and other resources necessary for effective supervision of compliance with these Terms.
   8.2. The Data Processor will ensure that the Data Controller has the same rights regarding all selected sub-processors. The Data Processor may offer alternative supervision solutions, such as an audit by an independent third party, which the Data Controller may accept or reject.
   8.3. Supervision under this article must be announced to the Data Processor at least 30 days in advance and conducted based on a framework plan agreed upon by the Data Controller and Data Processor. If they cannot agree, the Data Controller may determine the plan independently.
   8.4. The Data Processor will allow the competent data protection supervisory authority at the level of the Republic of Croatia or the EU to conduct supervision at the Data Processor’s business premises.
   8.5. If any data protection authority or other (supervisory) body initiates a review of Personal Data Processing by the Data Controller, or if a Data Subject files a complaint against the Data Controller regarding processing presumed to be performed by the Data Processor, the Data Processor will assist the Data Controller with documentation and other information to enable the Data Controller to comply with the authorities and respond to any complaint.
9. Additional Safeguards
   9.1. Notification: The Data Processor will continuously and promptly provide the Data Controller with all current information on Processing reasonably requested by the Data Controller to fulfill its obligations under Applicable Law.
   9.2. Personal Data Breaches: At the Data Controller’s request, the Data Processor will cooperate with the Data Controller and provide information on the nature, circumstances, and causes of any Personal Data Breach. The Data Processor will take all necessary actions to prevent further loss or otherwise limit the consequences of a Personal Data Breach. The Data Processor will conduct a professional forensic and security review and audit regarding the Personal Data Breach. The breach will be resolved in accordance with Applicable Law and the instructions the Data Controller may give to the Data Processor.
   9.3. Obligation to cooperate to ensure Data Subjects’ rights: The Data Processor will, if requested by the Data Controller, at no additional cost to the Data Controller or Data Subjects:

• Immediately provide the Data Controller with a copy of Personal Data in an intelligible form, and/or
• At the Data Controller’s discretion, at any time enable access to Personal Data, and/or
• Immediately modify, correct, block, or delete Personal Data as prescribed by Applicable Law

9.4. Handling requests and complaints from public authorities: subject to what is permitted by Applicable Law, if the Data Processor receives a request or complaint from a competent authority regarding any Personal Data, it will promptly notify the Data Controller, indicating the authority, scope, and basis of the request or complaint. The Data Processor will promptly forward the request or complaint to the Data Controller so that the Data Controller may respond after consulting with the Data Processor, unless otherwise required by Applicable Law or other law applicable to these Terms.