GDPR policy

GDPR policy - General Data Protection Regulation

DEFINITIONS:

Processor

shall mean any natural or legal person, in particular travel agencies, agents and other intermediaries, that processes personal data on behalf of Orvas;

Processing

shall mean the processing of personal data as defined in the Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);

Personal datum

shall mean a personal datum or, in the plural form, personal data as defined in the Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC;

Regulation

Shall mean the Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC;

General Terms and Conditions

shall mean these General Terms and Conditions of Personal Data Processing;

Orvas

Shall mean Orvas d.o.o., Split, Uvala Baluni 9 Personal Identification Number (PIN): 38192148118;

Services

shall mean tourism-related services that the Processor provides at the request of Orvas, including in particular services related to the promotion of Orvas, services aimed at finding users of accommodation services and vessel charter plus accommodation services managed by Orvas, as well as intermediation services for the purpose of concluding contractual agreements.

2. Introductory provisions

2.1. These General Terms and Conditions shall apply to all Services contractually agreed upon after the above indicated date and provided to Orvas by Processors. These General Terms and Conditions shall apply in addition to other commercial terms of cooperation between Orvas and Processors.

2.2. By relying on these General Terms and Conditions, Orvas and the Processor accept the said Terms and Conditions and undertake to act pursuant to them. These General Terms and Conditions shall be applicable unless otherwise agreed by Orvas and the Processor in writing or unless Orvas and the Processor have agreed in writing upon applicability of other terms and instructions in connection with Services.

3. Personal data

3.1. Processors as providers of Services process personal data of third parties in the name and for the benefit of Orvas as the user of their Services. Personal data that represent the subject-matter of these General Terms and Conditions are therefore personal data of tourists and other users of accommodation and vessel charter services managed by Orvas.

4. Instructions of the Controller

The processor communicates independently and directly with (potential) tourists as well as other users of accommodation and vessel charter services managed by Orvas. In order to meet the requirements of Orvas, the Processor undertakes to do the following:

immediately before collection of personal data or their first usage for the purposes of Orvas, notify the concerned tourists and other users in an appropriate manner about the purpose for which their personal data are being processed; let them know that these activities are performed on behalf of Orvas as Controller; and inform them that all information regarding processing of their personal data on the part of Orvis can be found in the General Communication on Personal Data Processing by Orvas, available at […];
for the purposes of Orvas, collect only the personal data ordered by Orvas; as for all other collected data, the Processor shall be independently liable;
further process exclusively for the purposes of Orvas personal data of tourists and other users collected for the purposes of Orvas;
forward the collected personal data to Orvas at least once on a quarterly basis and after Orvas confirms due receipt of data, delete or anonymise the said personal data permanently;

In case that Orvas has given no instruction with respect to a certain processing task or in case its instruction is unclear, the Processor shall stop the processing and request an instruction or an explanation from Orvas.

5. Processor’s duties

5.1. When processing personal data, the processor shall assume the following obligations toward Orvas:

The processor shall implement its internal organisation and undertake technical and organisational measures, taking due account of the requirements referred to in Article 32 of the Regulation. The processor shall notify Orvas about the measures it has undertaken and Orvas shall approve them or, if needed, request implementation of additional measures;
The processor shall permanently keep the confidentiality of personal data in question. These personal data shall not be made public by the Processor. When being stored, personal data shall always be duly protected. The processor shall independently propose to Orvas appropriate protection measures to control access, whereas Orvas shall either approve them or, if needed, request additional measures;
The processor shall ensure that all persons that fall under the scope of its liability and that process or have access to the personal data in question have undertaken to permanently maintain confidentiality thereof; • The processor shall not engage another subcontractor that would have access or exercise more rights with respect to the personal data in question without obtaining a prior written consent from Orvas;
The processor shall not transfer the personal data in question outside of the jurisdiction where the place of its registered office is located, apart from Croatia as the location where Orvas is seated;
The processor shall notify Orvas in case it becomes subject to control, measures or investigation of a supervisory authority for personal data protection;
The processor shall notify Orvas immediately and no later than 24 hours after learning about such event, in case of a breach of the applicable data protection regulations or provisions of these General Terms and Conditions either on the part of the Processor, its employees or subcontractors as well as in case of a suspected personal data breach or irregularities in the processing of personal data.

Notwithstanding the measures that the Processor proposes and that Orvas approves provided that the measures are adequate, the Processor hereby undertakes to at least abide by the following minimum requirements:
All personal data as well as their source shall be stored exclusively in electronic form;
Access to data in question must be protected by a security password;
If personal documents are scanned or photographed, the scan or photograph shall include only the necessary data, whereas all other data shall be illegible; • At the first request of Orvas, delete or modify personal data that represent the subject-matter of these General Terms and Conditions.

6. Right to supervision

6.1. Orvas shall have the right to directly supervise technical and organisational measures undertaken by the Processor in line with the assumed obligations. Orvas shall announce supervision at least 15 (fifteen) days before its intended start. The processor hereby undertakes to provide Orvas access to all requested relevant documentation as well as, if needed, insight into the manner in which the Processor implements its technical and other security measures.

6.2. The processor shall ensure that its subcontractors that play a major role in the processing of personal data in question, give their consent and participate in this procedure.

6.3. Orvas shall be entitled to appoint a third impartial party to conduct the prescribed supervision, whereas the Processor undertakes to allow any such supervision and provide any requested information.

7. Liability

The Processor that determines purposes or means for processing that are contrary to the provisions of the Regulation and thus breaches the instructions provided by Orvas, shall become the person liable for such processing. In this case, the Processor shall compensate any damage incurred by Orvas due to omission on the part of the Processor.
If the Processor collects and processes personal data of persons in question for other purposes as well, liability for any such actions shall be borne exclusively by the Processor.

8. Cooperation

8.1. In case of any request or complaint filed by a data subject in connection with his or her personal data, which are the subject-matter of these General Terms and Conditions, the Processor shall immediately notify Orvas thereupon, but no later than 24 hours from the receipt of such a request.

The Processor shall provide Orvas with adequate support, so that the latter may duly respond to or meet the subject data’s request.

Final provisions

These General Terms and Conditions shall be governed by the substantive law of the Republic of Croatia. In case of any dispute arising from these General Terms and Conditions, as well as in case of the question of validity of these General Terms and Conditions, the relevant court shall be the competent court in Split, Croatia.
Orvas shall have the right to unilaterally amend these General Terms and Conditions. In such a case, Orvas shall notify all Processors in an adequate manner about amendments at least 7 (seven) days before their entry into force. Any Processor that finds the adopted amendments to be unacceptable shall be entitled to unilaterally terminate its agreement on services concluded with Orvas, within 3 (three) days from the date of receipt of the notification on amendments to the General Terms and Conditions.
Upon termination of the commercial relationship between Orvas and the Processor, these General Terms and Conditions shall cease to be applicable to the Processor in question. Notwithstanding, the Processor shall hand over to Orvas all personal data that represent the subject-matter of these General Terms and Conditions and, after Orvas confirms due receipt thereof, permanently delete or anonymise the said personal data.