NOTICE ON THE PROCESSING OF PERSONAL DATA

I. INTRODUCITON:

Law Firm VUKUSIC BOKAN and Partners, Ltd. (hereinafter: the Company) processes personal data its clients and third parties for the purpose of performing its business activity, i.e. legal representation upon representation agreements or providing other forms of legal assistance. Personal data are collected, processed and stored in accordance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: the General Regulation on Data Protection) as well as the Act on the Implementation of the General Regulation on Data Protection (Official Gazette No. 42/18, hereinafter: the Act on the Implementation of the General Regulation on Data Protection).

II. OBLIGATION TO KEEP THE LAW SECRET:

The Company, as well as all its employees, pursuant to the provisions of Art. 13. of the Law on Advocacy (Official Gazette Nos. 09/94, 117/08, 50/09, 75/09, 18/11, hereinafter: the Law on Advocacy) has the obligation to keep as legal secrets all information entrusted to it by a client or in another manner collected by means of the representation of the client.

III. ON THE PERSONAL DATA WHICH ARE COLLECTED:

Representing a client requires the collection and processing of certain personal data. The basis for the collection and processing of personal data is the Law on Advocacy, a given power-of-attorney (PoA), a concluded contract or a competent authority decision for the purpose of providing legal assistance. In particular, personal data are collected and processed for the purpose of initiating and conducting proceedings before the competent authorities, drawing up documents, general representation and legal advising. Furthermore, in certain cases, the obligation to processing of personal data arises from the obligation to comply with the legal obligations (e.g., managing and issuing of the accounting documents). Personal data may also be processed for the purpose of managing records of cases.

The Company collects and processes the following personal data, i.e. the following categories of personal data:

• identification data such as: name and surname, PIN (OIB), address, identity card number, photograph, other data contained in the identity card;
• contact information such as: e-mail address, telephone number, mobile phone number;
• bank details such as: IBAN, bank, card type;
• data on other persons – counterparties, representatives, officials conducting the proceedings, court experts, witnesses, recorders, employees of courts and other state bodies, public notaries, employees of notaries and etc., which data is necessary for initiating and conducting proceedings before the competent authorities, general representation and legal advising of the client in accordance with the PoA or the contract, as well as other information that is otherwise collected when representing or providing legal assistance;
• all other data processed before or during the representation or the contractual obligation of providing other forms of legal aid, which are necessary for the Company in providing legal aid services.

The Company processes personal data for the purpose of executing the legal representation contract or providing representation on another basis, as well as for the executing of the contractual obligation of providing another form of legal assistance.

The collection and processing of personal data may be necessary in order to provide the requested legal assistance, i.e. there may be a legal obligation to process certain personal data. If there is no legal obligation to provide personal data, they are not required to be provided, however, in such case the Company may not be able to provide the requested legal assistance. Personal data may also be processed for the purpose of issuing invoices for the provided legal assistance, as well as for the purposes of managing accounting documents in accordance with the relevant regulations.

IV. PERSONAL DATA WHICH ARE NOT COLLECTED AND PROCESSED:

In general, no special personal data relating to racial or ethical origin, political opinion, religious or philosophical beliefs, trade union membership, biometric data, data relating to health, sexual life or sexual orientation are collected or processed.

Exceptionally, this data will be collected and processed if it is necessary for the establishment, realization or defending of the legal claims of the client, or providing other legal service.

No personal data is processed for the purpose of creating a client profile or automated decision-making, especially if this would produce legal effects or significantly affect the party.

V. MEANS OF COLLECTION OF THE PERSONAL DATA:

Personal data for the purpose of representation is collected by means of a direct inquiry from the respondents or via documents received from the client, other participants in the proceedings before the court or other competent authority, courts and other competent authorities, and third parties.

Personal data for the purpose of providing other forms of legal aid are collected by means of a direct inquiry from the respondents or other persons who are in any other way related to the subject of legal aid.

Certain personal data is collected from publicly available sources, and it is also possible that such data will be received on the basis of business communication with third parties.

VI. ACCESS AND TRANSFER OF THE PERSONAL DATA:

Attorneys, legal associates and other employees and associates of the Company are authorized to perform certain personal data processing activities within their work tasks (e.g., employees and associates of the Company in charge of mail delivery, accounting, administration or providing the legal services).

In order to perform the above-mentioned purposes of personal data processing, recipients of personal data may be competent state bodies (such as the Croatian Pension Insurance Institute and the Croatian Health Insurance Institute, the Tax Administration, courts, the Financial Agency, competent police stations and other bodies of the Ministry of the Interior Affairs, etc.), associates of the Company (lawyers and legal associates who provide replacement services in accordance with the Law on Advocacy, providers of bookkeeping and similar services, providers of IT support services, etc.), credit and financial institutions, public notaries, counterparties, their representatives and employers, court experts, court interpreters and translators, and third parties in respect to whom exists a legal obligation to provide personal data, or in respect to whom the purpose of providing legal assistance or pursuing a legitimate interest is related.

The Company will undertake all necessary reasonable actions to ensure that the transfer of personal data to third parties is in accordance with the regulations on personal data protection.

In the event of possible disclosure of personal data outside the European Union, the Company will undertake all necessary reasonable measures to protect personal data in order to ensure that the third party to whom the personal data is transferred provides the same level of personal data protection provided by EU regulations.

VII. PERSONAL DATA STORAGE PERIOD:

Collected personal data is stored:

• at least 10 (ten) years from the finality of the proceedings in which the Company represented the party or from any other means of ending of the client's representation (cancellation or revocation of power-of-attorney, etc.) or until the client takes over the case file from the Company;
• in the case of enforcement proceedings upon a final and enforceable judgment or ruling, proceedings upon extraordinary legal remedies before the Constitutional Court of the Republic of Croatia and / or the European Court of Human Rights and other relevant institutions, the data shall be kept until all legal remedies have been exhausted for the purpose of protecting the rights and interests of the client;
• wills, contracts and other documents entrusted to the Company for safekeeping will be kept until the conditions for termination of safekeeping of the entrusted documents (wills) are met or until the client takes them over from the Company;
• in the case when the obligation to keep the data is determined by some compulsory regulation, the data shall be kept in accordance with the deadlines from that compulsory regulation;
• depending on the special circumstances of the case, the Company may in a particular case determine a longer period of retention of personal data if the processing of personal data is necessary to protect the legal or legitimate interests of the client.

VIII. PROTECION OF THE PERSONAL DATA:

The Company shall undertake all appropriate reasonable technical and organizational measures to protect the collected personal data and to prevent accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access to the personal data.

The Company will provide the protection of the personal data in accordance with the applicable Rules on the protection of personal data of the Company.

Personal data will be used only for the purpose for which they were collected, the data will be used only by persons authorized to do so, the data will not be disclosed to third parties except in specially determined cases, and the data will be kept only as long as it is necessary.

Lawyers, legal associates and other employees and associates of the Company are adequately educated in the procedures of personal data processing.

If a certain personal data process is carried out by an authorized processing executor of the Company, the Company will undertake all reasonable measures to ensure at least the same level of protection of the personal data as existent during the Company’s data processing.

IX. CONSENT TO PROCESS PERSONAL DATA:

If the processing of a certain type of personal data is based on a consent or a consent is required for the publication or transfer of personal data, the Company will obtain such consent in written form. During obtaining of the consent, the Company will inform the client about the purpose of giving consent and the consequences of refusing to give consent. Consent must be voluntary and unambiguous. Written consent is kept for as long as the personal data to which it relates is kept. The consent to certain process of personal data may be withdrawn at any time. Withdrawal of the consent does not affect the lawfulness of the data processing prior to withdrawal of the consent, of which the Company will inform the client when obtaining a statement of consent. Consent is withdrawn by submitting a written statement to the Company.

X. THE EXERCISE OF RIGHTS:

The respondent has the right to address the Company with a request to exercise certain own right, as follows:

• the right of access to the personal data,
• the right of correction of the personal data,
• the right of deletion of the personal data,
• the right of limitation of the personal data processing;
• the right of transferability of the personal data.

The request for exercising the right is submitted to the Company in written form. The request may be submitted directly at our headquarters, via regular mail or via e-mail. The request is considered valid if it is submitted from the address of the applicant. The applicant must identify himself. If the request is anonymous, and the Company is not able to determine the identity of the applicant in a simple way, the request will not be processed. The Company is obliged to inform the applicant about the decision and the undertaken actions within one month from the day of the receipt of a valid request.

The Respondent who believes that the Company violated any of the above-mentioned rights with its decision, or by any other means, has the right to file a complaint to the supervisory authority for personal data protection in the Republic of Croatia: Croatian Personal Data Protection Agency (PDPA), Martićeva 14, HR-10000 Zagreb, Croatia.

XI. ESPECIALLY IN RELATION TO THE PERSONAL DATA OF THE BUSINESS PARTNERS:

The Company collects, processes and stores personal data of its business partners in accordance with the General Regulation on Data Protection and the Act on the Implementation of the General Regulation on Data Protection.

The basis for the collection of personal data of business partners are the concluded agreement on appropriate business cooperation, the Civil Obligations Act (Official Gazette nos. 35/05, 41/08, 125/11, 78/15, 29/18), the Accounting Act (Official Gazette Official Gazette Nos. 78/15, 134/15, 120/16, 116/18, 42/20, 47/20), Law on Value Added Tax (Official Gazette Nos. 73/13, 99/13, 148/13, 153/13, 143/14, 115/16, 106/18, 121/19) and other relevant tax and accounting regulations.

The data are processed for the purpose of fulfilling the rights and obligations from the concluded contract, respecting the legal obligations of the Company as the personal data controller, and for the purpose of achieving other legitimate interests such as business communication, keeping records of business partners and assessing mutual cooperation.

The Company collects and processes the following personal data of business partners, i.e. the following categories of personal data of business partners:

The collection and processing of personal data may be necessary in order to enter into a business relationship, or there may be a legal obligation to process certain personal data. If there is no legal obligation to provide personal data, they are not required to be provided, however, in such case the Company may not be able to enter into an appropriate business relationship.

The collected personal data will be kept by the Company for 5 (five) years from the fulfilment of rights and obligations from the concluded contractual relationship, but in case of issuing / receiving invoices, the data will be kept during the period of mandatory keeping of accounting documents determined by applicable regulations. In case of business communication, personal data will be kept for 5 (five) years after the termination of business communication, and in case of setting, realizing or defending of legal claims or interests, data will be kept depending on the circumstances of the case in accordance with the deadline determined under special regulations.

With respect to other rights, business partners are referred to the remaining provisions of this notice.

XII. PUBLICATION OF NOTICE:

Notice on the processing of personal data, as well as its possible amendments, are published on the Company's website: www.odvb.hr and at the Company's headquarters. The Company is free to deliver the notice directly to the respondent, if requested.

XIII. DODATNE INFORMACIJE:

For any additional information please contact:
address: Law Firm VUKUSIC BOKAN and Partners, Ltd., Stjepana Radica 8, HR-23000 Zadar, Croatia
tel: +385(23)253 869
fax: +385(23)311 760
e-mail: info@odvb.hr