Privacy Policy

The document “Privacy and Personal Data Protection Statement “of the company Misli More d.o.o. (hereinafter: Statement, English – Privacy policy) refers to the services and business operations of Misli More d.o.o., Valica 15, 52000 Pula (hereinafter “Navela” or “Company”). This Statement indicates which personal data we collect, how do we process it and for what purpose do we use it, as well as what rights you have regarding such data. 

We brought and adopted this document because we consider personal data protection to be very important and a foundational part of all processes and corporate management at the company Misli More d.o.o. The document represents a framework pursuant which we handle all personal data that we collect as part of our business operations, and it was adopted as one of the organizational measures for complying with the requirements of the Regulation (EU 2016/679 of the European Parliament and Council as of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter “the Regulation”). 

This Privacy Policy does not refer to third parties, service providers and suppliers. If we use external service providers for processing your personal data, and if personal data is being processed by them, we call this contracted processing (of personal data). In that case, we, as the Controller, are responsible for the protection of your personal data. 

With this Statement, we want to ensure that we are compliant with the legal requirements and that we take care of all our users and visitors; and with the goal of: 

• enforcing the valid legal regulations for the protection of personal data; 
• protecting the personal data with which we come into contact; 
• openness and transparency towards all users and data subjects; 
• reducing the risk of personal data breach; 
• educating and informing all our users and data subjects; 
• increasing the transparency of personal data processing. 

We treat all the data we access or process with confidentiality and for a purpose, according to the highest security standards. The company responsible for data processing is: 

Name: Misli More d.o.o.  

Address: Valica 15, Pula 

Personal identification No. (OIB): 62558167556 

E-mail address: info@mislimore.com 

Personal data is any data regarding an individual whose identity is known or can be determined. An individual whose identity can be determined, is a person that may be identified directly or indirectly, especially with the help of an identifier such as a name, identification No., location data, network identifier or with the help of one or more factors distinctive of the physical, physiological, genetic, mental, economic, cultural or social identity of that individual. 

As part of regular business operations, we use the following categories of personal data: 

a) Basic personal data: identification data (name, surname, citizen’s unique identity number (JMBG), person identification number (OIB), citizenship, address, photograph); financial information; online identifiers (cookies, IP addresses, MAC addresses, user identifiers, system records); location data (latitude, longitude, altitude, direction of travel, time of recording); information on the type of contractual relationship;

b) Aggregated traffic and transaction data, not including the content of the transactions or communications, nor the identification of the persons participating. We collect data on the usage of our products and the manner they are used.

We collect personal data from several data subject categories during our regular business operations. In accordance with the purpose and the legitimate interest for each processing, we divided the data subjects into the following categories: 

i) Users and buyers – business data on the end users, buyers and owners of our products, collected based on the purchase – sales relationship. 

ii) Service network – business data on the employees of our contracted service network and the certified sales and service network. 

iii) Job candidates – when you apply for a job with us, whether through a job application or through links to open applications on our website. Based on the legitimate interest in carrying out the process of analysis and the selection of job candidates, we must collect and process your personal data, as well (name and surname, personal identification No. (OIB), address, e-mail address, data on previous jobs, data on education). You voluntarily deliver the data for the job application to us through your resume; therefore, you give us the right to do the necessary processing of your application. During the selection process, we can hire processors in the form of specialized services and agencies for talent management and hiring. For all further processing during the selection process, we will request your consent. 

iv) External associates – we collect your data pursuant to the Business Cooperation and Business Communication Agreement. We process basic personal data solely based on the legitimate interest in fulfilling the agreement. We consider external associates those who work through a student employment service, external consultants, contracted external associates and service providers. We request each external associate to sign a confidentiality agreement for all data and information they come into contact with during the business relationship with Navela. We also count our external service providers, with whom we have long-term business cooperation agreements, as external associates. 

v) Third parties – when we are the processors, we collect and process personal data in accordance with the requirements and instructions of the Controller, i.e. our principal. 

vi) Loyalty programme users (loyalty) – for all our engine buyers we offer a loyalty programme they can join through our website. The registration, use and acceptance of the terms is carried out according to special terms of use, and it can be found in the secure part of our website. 

vii) Public interest or the performance of official duties – in the event of a need of public interest or if we are obligated to perform official duties pursuant to legal requirements, we will carry out the processing of personal data only to the extent necessary. 

We established the information system security principles and we set the basic guidelines we apply in all business aspects and by applying them, we ensure a high level of information system and personal data processing security. By applying organizational and technical measures, protocols and procedures, your personal data is processed in a way that ensures an appropriate level of security, including protection from unauthorized or illegal processing and from accidental loss, unavailability or disclosure. 

Furthermore, we are oriented towards constant improvement of our security measures in accordance with technological development and changes in the business environment and our environment. 

In our business and corporate culture and information security, we carry out the following information, organizational and technical measures: 

• protection of the system from internal and external risks 
• protection from unauthorized access 
• protection of physical data 
• minimising processing, pseudonymisation  

• laying down the data protection rules – policy 
• the purview and responsibilities of the data owner 
• continuous training and education of employees 

Every collection of personal data is based on legitimate interest and for the purpose of business operations, and every processing of personal data is based on a legal, fair and transparent processing that takes into consideration the rights of the data subjects. 

The data subject will be informed of each processing of personal data, on how the personal data of that subject are collected, used, made available or otherwise processed and to what extent is that personal data processed or will be processed. Each piece of information and communication regarding the processing of personal data will be made easily available to the data subject in an understandable format and in simple language. 

We will always inform the data subject of the identity of the controller, as well as the purposes of the processing on the website of the controller or at the premises of the headquarters/commercial space of the controller. We will inform the data subject of the risks, rules, protective measures and rights regarding the processing of personal data through the website of the controller or at the premises of the headquarters/commercial space of the controller. 

We collect the data based on: 

• acceptance through a consent form (legitimate interest for the purpose of the processing) 
• exercising the rights arising from the employment relationship (legitimate interest of the employer) 
• enabling and ensuring smooth business operations (legitimate interest of Misli More – justified other interests) 
• protection of people and property (video surveillance) (legitimate interest of Navela) 
• cooperating with external associates (necessary for fulfilling the agreement) 
• having a business relationship with third parties (suppliers, users and clients) (necessary for fulfilling the agreement) 
• the registration for the loyalty programme and acceptance of the terms of use (legitimate interest) 

In each processing where we are the controller or the processor, we always process on a legal basis and according to the purposes. We also only process the amount of personal data necessary for accomplishing the purpose of the personal data processing. 

Automated processes of application processing are used during processing. Where this is not possible, the personal data is processed manually. The collected data will not be forwarded to third parties (neither directly nor through other representatives), unless this is otherwise regulated by a third-party Agreement and with your express consent. There is a possibility of disclosure of your personal data in accordance with legal regulations, if a government body (police, courts) requested such a disclosure in accordance with the law. 

We do not collect nor process data from special categories in our business operations. 

Our website offers options for the use of cookies, small text files that are set on your device through the browser, which web providers can later retrieve in the domain that set the cookie. We use cookies to save your selections and settings, to help with logging in, to offer targeted advertising and to analyse web site operations. Click here for more technical information on the cookies used. 

We and our service provider use this information for your safety, for improving the quality of navigation, for the best possible exchange of information and personalisation of your experience when using our website. Cookie files cannot be used to start programmes or insert viruses into your computer. Cookies are assigned individually and can be read only by the website provider in the domain that recorded such a file. 

The data is kept for as long as it is necessary to fulfil the obligations and the services for which you gave us your consent, unless otherwise provided for by the law or if this is defined by the contractual relationship. 

We cannot delete the data: 

i. if it is necessary for fulfilling the contractual obligations or other legal requirements (ex. Accounting Act);

ii. if the data is actively used in processes where there is a legal purpose for processing personal data;

iii. if we are legally required to reject your request, we will do so and inform you of the reasons for the rejection. 

You can request information on your personal data at our disposal and you can request a change or the update of such data, at any time. Before accessing the data, we will determine the identity of the applicant for each request and the justifiability of the request itself. You can withdraw the consent given for the processing of your personal data at any time. All you have to do is send a request to the address listed below. 

For each request, we will determine the identity of the applicant and the justifiability of the request itself before accessing the data. In the event of doubt, we can request additional information for the purpose of verifying your identity. If we are legally required to reject your request, we will do so, and inform you of the reasons for the rejection. 

All your requests will be received and processed in accordance with our Rules and the Rules of the Regulation, if they are sent according to the indicated instructions. This is for the protection of your rights. If you were to exercise some of your rights too often and with an obvious intention of abuse, we can charge an administrative fee and reject your request. 

Pursuant to the Regulation, you can exercise the following rights regarding your personal data, at any time: 

 a) Right to a correction: 

If we are processing your personal data which is incomplete or incorrect, you can request us to correct or complete the data, at any time. 

b) Right to a deletion: 

You can request the deletion of your personal data if we processed it illegally or this processing constitutes a disproportionate invasion of your protected interests. Please consider that there are reasons preventing immediate deletions, such as legally required obligation to archive. 

c) Right to access: 

You can receive a confirmation from us on whether your personal data is being process and whether such personal data is processed, as well as be given access to such data and you can receive the following information: information on the purpose of the processing, the categories of concerned personal data, the recipients or categories of recipients to whom the personal data has been disclosed or to whom it will be disclosed, information on the estimated period for the retention of data or the criteria used for determining such a period, information on the existence of your rights which are listed in this item of the Statement, information on the existence of automated decision-making, including the creation of profiles and information on the logic, importance and the foreseen consequences of processing, information on the protective measures applied if the personal data is transferred to third countries or international organizations. 

d) Right to a limitation of the processing: 

You can request that the processing of your data be limited: 

• if you dispute the accuracy of the data during a period that allows us to verify the accuracy of such data; 
• if the data is no longer necessary to us for the intended purposes, however, you still need them to fulfil legal claims; 
• if you submitted a complaint for the distribution of such data. 

e) Right to the option of transferring the data: 

You can request we deliver the data you entrusted us for the purpose of archiving, in a structured format, in a regular machine-readable format: 

• if we process such data based on a consent you have given us and that you can withdraw; 
• for the purpose of fulfilling an agreement; 
• if the processing is carried out through automated processes. 

f) Right to object: 

If we distribute your data for the purposes of completing tasks of public interest or the tasks of public bodies or we refer to our legitimate interests during the processing of your data, you can submit a complaint against such a processing of data if there is an interest in protecting your data. 

g) Right to an appeal: 

If you believe that we violated Croatian or European data protection regulations while processing your data, please contact us in order to clear up any questions. You certainly have the right to file a complaint with the Croatian Personal Data Protection Agency. 

h) Exercising the rights: 

You can exercise any of the indicated rights with us, at any time. Contact us through our communication channels aimed at the protection of personal data. 

i) Identity verification: 

For each request, we will determine the identity of the applicant and the justifiability of the request itself, before accessing the data. In the event of doubt, we can request additional information for purpose of verifying your identity. If we are legally required to reject your request, we will do so, and inform you of the reasons for the rejection. 

j) Abuse of rights: 

All your requests will be received and processed in accordance with our Rules and the Rules of the Regulation, if they are sent according to the indicated instructions. This is for the protection of your rights. If you were to exercise some of your rights too often and with an obvious intention of abuse, we can charge an administrative fee and reject your request. 

We can forward your personal data that we collect pursuant to the provisions here, to companies, for the purpose of the personal data processing controller, and as part of the provision of the services we render. The indicated companies may use such data solely in the manner provided for herein. If we process personal your data based on consent, the withdrawal of the consent will also apply to the indicated companies. 

When we are the controller, we do not transfer personal data outside of the EU. If there is a need to transfer personal data processing outside of the EU, we will undertake all the necessary activities and verifications in accordance with Chapter V of the Regulation. We will inform you of the transfer of data to the processor, during the collection of the data. 

Navela will ensure an appropriate level of protection for each data transfer to third countries, outside of the EU, and provide the data subjects with all enforceable rights and an efficacious legal protection in those countries. Navela has a contractual relationship with all the suppliers and the principal, located outside of the EU, to whom the data is transferred, in accordance with Art. 47 of the Regulation. 

If you have any questions regarding the collection and processing of your personal data or you want access to your personal data in our possession, for the purpose of verifying, changing or deleting, please contact us in writing at the following address: 

Name: Misli More d.o.o.  

Address: Valica 15, Pula, Hrvatska 

You can also contact the head of the Personal Data Protection Department at: info@mislimore.com  

We will handle your request confidentially and respond as soon as possible after we analyse it. We defined the detailed rules for handling personal data processing requests in the Regulation for Handling Requests and in other applicable internal documents of the company Misli More d.o.o. 

The Privacy and Personal Data Protection Policy applies as of 25 May 2018. We will adjust all our internal documents regarding security management, for the purpose of continuous information security management, the protection of personal data processing and for the management of legal regulations. This includes the Privacy and Personal Data Protection Policy. The Policy is published on the website of the controller and is publicly available. We reserve the right to modify this document without special notice. Therefore, we advise you to occasionally check and read this Privacy and Personal Data Protection Policy.