Privacy and personal data protection rules

This Privacy and Personal Data Protection Policy (hereinafter: Policy), based on Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: General Data Protection Regulation), explains what personal data is collected in connection with the provision of our services and products, how we process, use and protect this data, for what purposes we use it, as well as what your rights are.

Which Controller is responsible for processing of your data depends on where you are located or which website are you browsing:

In order to know how and for what purposes the Controller processes your data, please read this Policy. Your privacy and the protection of personal data are of utmost importance to us.

This Policy also applies to the mobile application owned by the Controller, except in the part of data processing through cookies, i.e. in the part related to cookies.

If you wish to contact us regarding this Policy or your personal data, please use the contact information in accordance with the table above.

1. Who processes your personal data?

The Controller collects personal data for marketing purposes, for the purposes of improving business operations and your user experience. The Controller complies with all applicable regulations in order to protect the privacy of its Customers or Users.

This document describes how the Controller processes personal data of customers and/or potential customers or other users.

The Controller takes care of ensuring all security measures for your personal data.

For any questions regarding personal data, you can contact the corresponding Data Protection Officer via the e-mail contact listed above in the table.

Customers of the Controller (hereinafter: Customers) or Users of Controller’s products and services and Users who access Controller’s websites (hereinafter: Users) are instructed to read the Policy in its entirety in order to better understand what data the Controller collects and processes, for what purpose, under what legal basis, with whom and why it shares the data, what protective measures it implements, and what the rights of Customers or Users as data subjects are.

2. What categories of personal data do we process?

When carrying out activities for which we are registered as a company, the Controller process different categories of personal data.

1. a) Customer support

If you contact us through our office or customer support or through any other means of communication available to you, we need your contact information to resolve the issue you have presented. In addition, we will need to identify you in a manner that is detailed in our other internal acts. We will only use the information you provide for the stated purpose. In certain cases, we will use the services of other legal entities to whom we entrust your data only to the extent necessary to resolve your case (e.g. authorised companies that provide customer support or maintain the system for us or make certain repairs).

1. b) Website

When you submit any type of inquiry through our website, we collect your full name and contact information (e-mail address, phone number). The Controller automatically collects personal data from your computer, and there are situations in which we also collect other types of data such as the date and time of access to our website, information about the hardware, software or Internet browser you use, as well as your computer’s operating system, application version and your language settings. We may collect information about clicks and your access to our pages displayed to you.

1. c) Employees and associates

The Controller collects and processes personal data of its employees and other associates for the purpose of executing employment contracts signed with employees and consulting contracts and/or service contracts signed with associates, relating to personnel, administrative or other business/contractual purposes. In the latter case, we collect and process data such as: name, surname, gender; marital status, citizenship, residence, date and place of birth, personal identification number; profession, occupation, professional training data, health insurance data, work experience; account number (IBAN) data, signature, etc.

1. d) Suppliers and our business partners

We collect and process data from suppliers and other clients, that is, associates and business partners, for the purpose of performing contractual obligations, such as: name and surname of the responsible person in the legal entity; contact information of the person in charge of communication and performance of contractual obligations.

1. e) Employment procedure

For the purpose of possible employment, the data collected and processed by the Controller from job candidates may include: name, surname, address, contact information, level of education, nationality, profession and occupation, data on previous work experience, data on professional development and training, and test results that may reflect the candidate’s ability to perform all work obligations that a particular position to which he/she is applying entails. The processing is based on consent for a clearly indicated purpose of data collection. We will inform you about everything when initiating the employment procedure.

1. f) Receiving notifications about our services and products/ newsletter

We collect information such as the e-mail address from subscribers to our newsletter for the purpose of informing you about our new products and the benefits you can obtain. The processing of this category of data is based on consent or on our legitimate interests, primarily to control and ensure a high quality standard for our services and products, and thus to achieve your satisfaction, in particular for the purpose of sending you information about our products and services that may help you generate additional savings, reduce electricity costs and to increase your satisfaction with our services.

1. g) Exercising the rights of data subjects and responding to the requests of Users and Customers

When processing your rights protection requests, your personal data such as your name, surname, OIB (PIN) or address will be processed. We need to process the data in order to perform the obligations arising from the applicable regulations.

3. What are your rights in terms of personal data protection?

The Controller respects that each user should have the possibility to ensure the accuracy, completeness and up-to-dateness of their personal data. If the user considers that their personal data is incomplete, inaccurate or not up-to-date, they can contact the Controller by using the corresponding e-mail listed above at the table.

Please note that you have the right to request the following from the Controller at any time:

To exercise any of the above rights, please use the contact information provided at the beginning of this Policy.

4. Competent authorities for the protection of personal data

If you are not satisfied with how we have collected or used your personal data, you can file a formal complaint to the one of the competent authorities for the protection of personal data:

• For Croatia: Agencija za zaštitu osobnih podataka, Selska cesta 136, 10000 Zagreb, azop@azop.hr;
• For Serbia: Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti, Bulevar kralja Aleksandra 15, 11120 Beograd, office@poverenik.rs
• For Bosnia and Herzegovina: Agencija za zaštitu ličnih podataka u Bosni i Hercegovini, Dubrovačka broj 6, 71000 Sarajevo, azlpinfo@azlp.ba
• For North Macedonia: Agencija za zaštitu osobnih podataka, bul. “Goce Delchev” br. 18 (zgrada Makedonske radio televizije MRTV – kat 14), poštanski pretinac 417, 1000 Skoplje, info@privacy.mk
• For Kosovo: Agencija za informacije i privatnost, Rr. Zejnel Salihu br. 22, 10000 Priština, aip@rks-gov.net
• For Montenegro: Agencija za zaštitu ličnih podataka i slobodan pristup informacijama, Bulevar Revolucije 11, Podgorica, azlp@t-com.me

5. Where is your personal data stored and who has access to it?

The personal date we collect about you is stored in a secure environment. Your personal data is protected against unauthorised access, disclosure, use, alteration or destruction by any organization or individual.

The processed data is stored on our premises and IT systems, but we sometimes store data on the servers of our trusted service providers.

The Controller shall ensure that personal data is kept in a secure place (which includes reasonable administrative, technical and physical protection to prevent unauthorized use, access, disclosure, copying or alteration of personal data), which can only be accessed by authorised persons.

The data collected for the purposes set out in this Policy will only be stored for as long as necessary to fulfil the stated purposes. Your personal data will not be stored in a form that allows you to be identified for a period longer than the Controller reasonably believes is necessary for the achievement of the purpose for which it was collected or processed. If you are interested in specific data retention periods, you can always contact our Data Protection Officer.

The Controller will keep certain personal data for a period of time prescribed by the law or other regulation that obliges the Controller to keep the data.

In case you have given us your consent, we will process your personal data until you withdraw your consent. If you raise a well-founded objection to the processing of personal data based on a legitimate interest, we will not process your personal data in the future.

In addition to all of the above, it is important to point out the following – if judicial, administrative or extrajudicial proceedings have been initiated, personal data may be stored until the end of such proceedings, including a possible period for the declaration of remedies. Hence, the Controller will keep certain personal data for a period of time prescribed by the law or regulation that obliges the Controller to keep the data.

Privacy protection is important to us, so we will never share your personal data with third parties except for the purposes described in this Policy.

6. Does the Controller share data with third parties?

The Controller cooperates with other companies. This means that we sometimes share your personal data, using secure IT systems. When we do so, the data is transmitted to servers located in the EU or in a country that ensures an adequate level of protection in accordance with EU legislation.

The Controller may transmit personal data outside the EU if the data is necessary for the performance of a contract between the Controller and the processor and/or other controller or for the fulfilment of legal obligations. In the latter case, the Controller transmits personal data only to countries that provide an adequate level of protection through a model contract containing binding provisions or through binding corporate rules; or in accordance with an approved certification mechanism and/or privacy protection framework when transmitting personal data from the European Union and Switzerland.

The Controller uses tools and services of social networks that  operate also outside of the territory of the European Union and is therefore obliged to inform you that these third parties that manage social networks may transfer your data to third countries outside of the European Union therefore outside of the EEA. Transfer of data to social networks owned by Google Ireland Ltd., LinkedIn Ireland Unlimited Company and Meta Platforms Ireland Limited as independent controllers that can transfer data outside of the USA is done in accordance with the appropriate Adequacy decision for the EU-US Data Privacy framework.

The Controller shall send a special notice to Users or Customers in cases where:

• the transfer of data is necessary for the performance of a contract or the implementation of pre-contractual measures at the request of the data subject; or
• the transfer is necessary for the conclusion or performance of a contract concluded in the interest of you as the Customer or User, between us as the Controller and another natural or legal entity; or
• the transfer is necessary for the establishment, exercise or defence of certain legal claims.

Your personal information the Controller may provide to its trusted partners who maintain their IT system or provide services on behalf of the Controller, for example, for the purposes of marketing, delivery, finance, advertising, servicing, collection of overdue claims, legal services and other services, without which the Controller would not be able to ensure the adequate performance of our obligations and contracted services. These service providers are nevertheless obliged, under the relevant contracts, to use the data entrusted to them only in accordance with our guidelines and solely for the purpose strictly defined by us We also oblige them to adequately protect your data and to consider it a business secret. In addition, you do not have to worry because regular audits check compliance of our partners with the applicable regulations.

7. The period and place of data storage

The storage period of the personal data we collect depends on the purpose of the processing for which it was collected.

We retain your personal data during the process of concluding a contract and during the use of our services or products, and delete them upon the termination of the contractual relationship, upon the expiration of all legal obligations or the termination of the existence of legal grounds from the General Data Protection Regulation, related to the processing of your personal data. Therefore, we must inform you that in certain situations we will not be able to delete your data because we are bound to keep it by other applicable regulations.

In the event that the procedure of enforced collection of unpaid claims has been initiated, we retain your personal data until the final conclusion of the procedure or, if an objection to a product or service has been filed within the deadline, until the final completion of the proceedings on the objection in accordance with the applicable regulations.

8. Other websites

This Privacy Policy applies only to the purpose and use of data collected by the Controller from users (data subjects). Other websites that can be accessed through the the Controller’s website have their own confidentiality and data collection statements and ways of their use and publication.

The Controller is not responsible for the manners and conditions of operation of third parties. You can also read more about third parties’ privacy policies on their websites.

If you have any questions regarding the collection and processing of data by Facebook, YouTube, Instagram and/or LinkedIn or if you wish to exercise any of your rights guaranteed by the General Data Protection Regulation, please contact:

9. Use of Internet cookies

In order to maintain the website and ensure its functionality, the Controller uses a technology commonly known as “cookies”.

A cookie is a small text file that is stored on your computer or mobile device when you visit a particular website. With the help of cookies, the website can remember your actions and settings (such as login, language, font size and other display-related settings) for a given time, so you do not have to re-enter them each time you return to the site or browse through various other Controller’s pages. Cookies can be temporary or permanent, for example, JavaScript or Flash technology. Thanks to the cookies on our site, you can search for content without difficulties and you will be shown the results that are relevant to you.

Read more in our Cookie Policy.

10. Use of Google Analytics tools

For statistical analysis and measurement of the effectiveness of this website we use Google Analytics – a service for measuring visits and related Google services.

You can find out more about Google’s privacy policy at: https://policies.google.com/privacy?hl=en.

This policy does not apply to services and third parties that have separate privacy policies, however, in accordance with the regulations relating to the protection of personal data, the Controller is obliged to inform its users about the data collected by Google by providing its services to other natural and legal entities.

The Controller cannot fully influence the processing of data by Google as part of your use of their services. Please read the sections of this Policy carefully to find out how Google processes your personal data.

The data collected by Google includes unique identifiers, browser type and settings, device type and settings, operating system, mobile network information including carrier name and phone number, and application version number.

In addition, Google collects data on the interaction of applications, browsers and devices with Google’s services, including IP address, crash reports, system activity and the date, time and referring URL of the data subject’s web request.

Google collects data when a Google service on your device contacts Google’s servers – for example, when you install an application from the Play Store or when the service checks for automatic updates. If you are using an Android device with Google applications, your device periodically contacts Google’s servers to provide device information and connect to their services. This includes information such as device type, carrier name, crash reports, and applications you have installed.

Please read our Cookie Policy for detailed information about Google cookies and other cookies in use.

11. Data processing by means of a mobile application

This Policy also applies to data processing by means of a mobile application owned by the Controller, except in relation to chapters: „7. Other websites, 8. Use of Internet cookies, 9. Use of Google Analytics tools“.

These categories of data will be processed by means of mobile application: the mobile identifier, i.e. information about the mobile device, information about the operating system of the mobile device, contact information of the registered user, information about the legal entity on whose behalf its employee uses the mobile application, first and last name of the registered user if these data can be obtained from the name of the e-mail, e-mail and also official mobile number or other phone number.

12. Processing of personal data in the process of payment by credit and debit cards and directly from the accounts of business partners of M SAN Grupa via IBAN

M SAN Grupa at the time of payment on the webshop https://webshop.msan.hr/hr/ i.e. when using the mobile application MSAN, as a prerequisite for payment of products and services either directly from the accounts of buyers/business partners via IBAN (CorvusPay by IBAN service) or by credit or with debit cards must require from the buyers/business partners data to activate the payment process via Corvus Pay d.o.o. Buzin, Buzinski prilaz 10, which is a service provider for processing and payment by (credit or debit) cards, a contractual partner of M SAN Grupa and the Processor of personal data.

For the above purpose, the personal data of the buyer (for the credit or debit card payment service: buyer’s first and last name, address, data from the buyer’s card; for the CorvusPay by IBAN service: buyer’s first and last name, address, IBAN, OIB or number of the authentification device provided by the bank to the buyer) are temporarily stored at Corvus Pay d.o.o. Buzin, Buzinski prilaz 10, which stores this data in accordance with PCI DSS certification, which guarantees the highest level of protection and preservation of confidential data.

The buyer activates the processing and payment by credit or debit cards by clicking on the „pay“ button. M SAN Grupa does not dispose, collect or in any form process personal data entered for the purpose of processing and payment by cards i.e. payments directly from buyer’s accounts. In case you are interested in the details of your personal data collected for the aforementioned purpose please inform yourselves about the processing of personal data by Corvus Pay d.o.o. on the website where the payment process takes place https://www.corvuspay.com/politika-zastite-osobnih-podataka/.

M SAN Grupa warns the buyer to take care of the data listed on the credit/debit card so that this data is not accessible to third parties and is not misused.

The webshop and mobile application enables the buyer to pay within Corvus Wallet. Corvus Wallet is a separate service for payment and storage of card data owned by Corvus Pay d.o.o. In order for the buyer to be able to use this service a registration during or before the purchase process is obligatory within Corvus Wallet. M SAN Grupa does not dispose, collect or in any form process personal data entered for the purpose of processing and payment by cards within Corvus Wallet. In case you are interested in the details of your personal data collected within Corvus Wallet please inform yourselves about the processing of personal data by Corvus Pay d.o.o. on the website where the payment process takes place https://www.corvuspay.com/politika-zastite-osobnih-podataka/.

13. Entry into force and change of Policy

This Policy shall enter into force upon publication on the website and/or mobile application.

The Controller reserves the right to amend this Policy, after which it will be published on the website. In the event that the change greatly affects your rights or poses a risk in relation to the exercise of your rights, we will inform you of the changes in another most appropriate way, depending on the specific situation.

Last revised 18th September 2024