Data protection policy is prepared according to these acts of law:
1. European Parliament and Council regulation of 27 of April 2016 (EU) 2016/679 concerning protection of individuals
1. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter – GDPR) https://eur-lex.europa.eu/legal-content/LT/TXT/?uri=CELEX%3A32016R0679;
2. Law of Lithuanian Republic on legal protection of personal data (hereinafter – ADTAI) https://www.e-tar.lt/portal/lt/legalActEditions/TAR.5368B592234C?faces-redirect=true;
3. Law of Lithuanian Republic on electronic communications (hereinafter – ERI) https://www.e-tar.lt/portal/lt/legalAct/TAR.82D8168D3049/asr.
Contact information of responsible person:
According to definition of GDPR and ADTAI and other data protection rules, responsible person is:
Julius Dirma
No. of certificate of individual activity: 772426
Phone number: +370 683 13332
E-mail: info@autopasaulis.com
Address: Kalvariju g. 143, LT-08352, Vilnius
Working hours: I-V 8:00-19:00, VI 9:00-16:00
1. General information about data management
1.1. Scope of personal data management
User’s personal data is collected and used in the scope, which is required to assure appropriate functions and quality of content and services of website www.autopasaulis.com (hereinafter – website). We do this regularly and only after receiving consent of our client to collect and use personal data. Only exceptions are the cases when it is not possible to request prior consent or when data management is provided in requirements of legislation. Personal data is collected only in such cases when personal information is voluntarily provided while ordering goods and/or. In all other cases, website will be able to use Your data without Your consent only for processing and completing Your order. After all formalities of the order will be completed and the sum required to be paid by the client will be paid, it will be forbidden to use Your data, it will be removed after the end of period of retention of tax and commercial information, unless you express the desire to allow us to keep using this data.
1.2. Transmission of personal data
We will provide Your name and surname, address, phone number and e-mail to our contractual shipping services providers for purposes of shipping and supply forwarding and to data managers when it is required to complete supply order and contact you for providing information about supply and to arrange the supply process. Legal basis for managing of data related to above cases is a point of 1st part of 6 article of GDPR, after we receive Your explicit consent. If data must be processed in order to supply the products according to agreement, legal basis is point (b) of 1st part of article 6 of GDPR. Legal basis of processing of data related to it is also point (f) of 1st part of 6th article of GDPR (arrangement of interests, based on our interest to supply the products to You at the time, which is most suitable for You). All above indicated data will be removed not later than at the end of warranty term prescribed by law, unless according to legislative acts in force we will have obligation or right to retain the data for longer period. To complete payment operations Your payment data will be transferred to respective credit institution or to payment services provider selected during the payment process.
1.3. Payment through service provider Paysera
If You pay through Paysera, by credit card through Paysera, direct debit through Paysera or if there is an option to pay from personal bank account through Paysera, Your payment data will be transferred to Paysera (Europe). Paysera charges payment for service of using a credit card trough Paysera, by direct debit through Paysera or when the payment is made from personal account through Paysera – for checking creditworthiness of the client. After checking the client for possible insolvency, Paysera decides about allowing/disallowing the client to use respective payment method. Assessment of risk (calculated in rating) may be credit account. Since assessment of probable risk is reflected in rating of creditworthiness, it must be based on universally recognized science of mathematical statistics. Assessment of creditworthiness includes indication of client’s address. Additional information about data protection, including data used by agencies of credit services, can be found in Privacy Policy of Paysera https://www.paysera.lt/v2/lt-LT/sutartys/privatumo-politika-2020
1.4. Legal framework of personal data processing
1st part of 6th article of GDPR comes into force after subject of data provides consent for his data to be processed. Processing of personal data that is required for signing an agreement with data subject is done according to point (c) of 1st part of article 6 of GDPR. This also applies to data that is required before the signing of agreement. Processing of personal data is carried out according to 1st part of article 6 of GDPR. Processing of personal data is regulated by 1st part of article 6 of GDPR in order to protect vital needs of user or individual. In cases when data is required for protecting our or third party’s legal interests and when processing of such data does not affect the interests, fundamental rights and freedoms of data subject and interests of other persons, processing is carried out according to 1st part of article 6 of GDPR.
1.5. Removal of data and duration of retention
User data is deleted and removed when reasons for its retention no longer exist. Legislators of European Union or national states reserve the right to retain such data with accordance to directives of European Union, legislation and other normative acts of law that apply to data controllers. Data is deleted and removed after expiration of retention period or when reasons for retaining the data for purposes of concluding future agreements or meeting contractual obligations no longer exist.
2. Introduction to the website and creation of information files
2.1. Definition and scope of data processing
Each time You visit our website, system automatically collects data and information from operational system of Your computer. Such data is collected:
1. Type and versions of browser in use;
2. user’s operational system;
3. user’s internet service provider;
4. user’s IP address;
5. date and time of connection;
6. addresses of websites from which the user was directed to our website;
7. addresses of websites that can be accessed by user from our website.
Information files contain IP addresses and data of other persons, that can be accessible to user.
For example, using a link to website providing internet access to user, or link to website, from which user can access other website, provides the ability to see data of other persons. Data is also saved in our information files. Retention of such data does not affect IP address of user or other data that is allowed to be used. Mentioned data combined with other personal data of user is not protected.
2.2. Legal regulation of data processing
Order of temporary retention of data and information files is regulated by 1st part of article 6 of GDPR.
2.3. What is the purpose of data processing?
It is necessary to save IP address in the system for temporary use so that user would be able to reach the website from computer or another device. For this reasons user’s IP must be retained throughout the duration of website browsing session. Information files are saved in files in order to enhance website’s functions and to assure the safety of our information technologies. Information is also collected for marketing purposes. It is managed according to 1st part of article 6 of GDPR.
2.4. Duration of retention
Data will be deleted when its use will become inappropriate. Data required for correct operation of website is retained throughout the duration of browsing session. Data in information files can be stored for up to 7 days. Otherwise user’s IP addresses will be deleted and user will lose the ability to connect to his/her account.
2.5. Withdrawal of consent and data deletion tool
In order to assure optimal operation of the website it is necessary to collect data and store it in information files. User’s complaints related to such use cases would be considered unreasonable.
3. Use of cookies
3.1.1. Definition and scopes of data processing (analysis of search habits)
Website uses cookies that help us to analyze user’s search habits. Such information can be collected for mentioned purpose:
1. search phrases;
2. frequency of page browsing;
3. information about use of specific features of the Website.
Collected user data will be encrypted using technical means and user will not be able to access this data. Data will not be stored with other user data.
3.1.2. Definition and scopes of data processing (shopping cart)
Some cookies remain in Your computer so that the Website could recognize You on Your every visit (persistent cookies). We do not allow our contractual partners to collect, process and use personal data using our Website’s cookies. Some browsers enable the use of standard cookies. Privacy settings enables You to allow or prohibit the use of temporary or persistent cookies. Some functions of the Website can become unsupported after turning off the cookies, therefore some pages of the website may operate inappropriately. Use of our shopping cart is only possible after enabling temporary cookies! Without your explicit consent, data contained in our cookies will not be related to Your personal data (name, address and other).
3.2. Data collection using Google Analytics services
Our Website uses Google Analytics internet analysis, including Google, service, which uses special cookies. These are technical folders stored in Your computer and used to analyze their use in website. For example, they collect information about operational system, browser, internet site, which you used previously (redirection URL), Your IP address, date and time of your visit in our Website. Information about use of our Website created by this text folder is transferred to be stored in Google server in USA. This information will be useful for Google to assess your use of the website, collect reports of website use, which are provided to website managers, and to provide other services related to Website operation and use of internet space. If such activity is provided by law or if third parties manage such data on behalf of Google, Google will also provide such data to third parties. Such usage of data will be anonymous, or user will introduce himself/herself using fake name. More information can be found https://policies.google.com/privacy.
3.3. Legal regulation of data management
Management of personal data using cookie folders regulated by 1st part of article 6 of GDPR.
3.4. What is the purpose of data management?
By analyzing data of cookie folders, we aim to improve the quality of our Website and its content. After analyzing the results, we can see who is using our Website, therefore we can constantly optimize its functions and operation.
3.5. Duration of retention, withdrawal of consent and possibility to remove data
Cookies recorded in user’s computer are automatically transferred to our Website. Therefore, you as a user, can control the usage of cookies. You can limit their use or turn them off by changing the settings of Your internet browser. Saved cookies can be deleted at any time. This action is performed automatically. It is probable that after disabling the Cookies you will not be able to use all functions of our Website. Flash-Cookies cannot be adjusted in browser settings, it can only be done by changing the settings of these cookies.
4. Newsletter
4.1. Definition and scopes of data management
You can subscribe to free newsletter on our Website. Data provided during registration will be transferred to us. For this reason, we collect such data:
1. IP address of user’s computer.
2. Date and time of registration.
At the time of registration, You will be asked for consent to management of Your data according to Privacy policy. Data related to newsletter subscriptions is only used for purposes of sending the newsletter. For sending our newsletter we use sending service provider “MailChimp”. “MailChimp” – (“Rocket”) service of “Rocket Science Group, LLC”, 512 Means Street, Suite 404, Atlanta, Georgia 30318. “Rocket” is used as so called “Safe harbor agreement” – data protection agreement between European Union and United States of America. Data collected at the time of registration is transferred to “Rocket” and stored by “Rocket”. Data provided at the time of registration will not be transferred to third parties. After registration, “MailChimp” will send you an e-mail to confirm the registration. Additionally, “MailChimp” offers various possibilities of analysis of opening and using of newsletters, i.e., for how many users the newsletter was sent, if the newsletter was rejected and if the user who received the newsletter did unsubscribe the newsletter. However, these analyses are only related to a group and we do not use them for individual assessment. Additionally, “MailChimp” uses “Google, Inc.” analysis tool “Google Analytics” and can include it in newsletter. More information about “Google Analytics” privacy policy can be found by using the link: https://support.google.com/analytics/answer/4597324. More information about data protection using “MailChimp” can be found using the link: http://mailchimp.com/legal/privacy/.
4.2 Legal regulation of data management.
After newsletter subscription is registered under the consent of user, legal procedure of data processing is regulated according to point (a) of 1st part of article 6 of GDPR.
4.3. What is the purpose of processing of personal data?
E-mail address is needed for newsletter to be able to reach the user. Other data provided during registration will be useful when trying to prevent misuse of Website’s services or user’s e-mail address.
4.4. Duration of retention
Data will be deleted if its use will be inappropriate. User’s e-mail address will be retained throughout the period of newsletter subscription.
4.5. Withdrawal of consent and possibility to remove data
User can cancel the subscription at any time by sending an e-mail using this address: info@autopasaulis.com .
5. Registration
5.1. Definition and scopes of data processing
We offer our users a possibility to register on our Website by providing personal data. Data is saved in encrypted template and transferred only to internet service provider.
Such data must be provided at the time of registration:
1. e-mail;
2. password;
3. name, surname.
Additionally, this data will be saved at the time of registration:
1. user’s IP address;
2. data and time of registration.
At the time of registration of data, user’s consent for data processing must be received.
5.2. Legal regulation of data processing
After receiving user’s consent, legal regulation of data processing is regulated by (a) point of 1st part of articles 6 of GDPR. If, at the time of registration, data is provided in order to complete user’s order or other pre-contractual obligation, actions are based on point (b) of 1st part of article 6 of GDPR.
5.3. What is the purpose of data processing?
At the time of registration, user must provide personal data if such data is related to completion of order or other pre-contractual obligations. This information is required when ordering goods from electronic shop of the Website.
5.4. Duration of retention
Data will be deleted when its use will become inappropriate. For example, if at the time of conclusion of contract or fulfilling any other pre-contract obligations You were registered on the Website, but later this data became redundant. Sometimes retaining of personal data of party of contract remains important even after the expiration of contract, when it is necessary to fulfill contractual obligations or obligations to legal institutions.
5.5. Withdrawal of content and possibility to delete data
User has the right to cancel registration. Also, you can recover your data at any time by contacting e-mail info@autopasaulis.com or address Kalvariju g. 143, LT-08352, Vilnius. When data is required for conclusion of contract or for fulfilling of pre-contractual obligations, its premature removal is only possible when they it does not interfere with contractual or legal obligations.
6. Contact form, comment function, contacting by phone and e-mail
6.1. Definition and scopes of data management
Our website has a contact page where user can connect to our e-mail. If user decides to use this possibility, data entered by user will be encrypted, saved and this information will be transferred to us. It is:
1. order number;
2. phone number;
3. name and surname;
4. item code and other numbers.
Such data is saved during the sending of message:
1. IP address of the user;
2. date and time of registration.
Your data will be processed only after receiving Your consent and introducing you to the Rules of use and Privacy policy of our Website. You can also contact us using e-mail address provided on our Website. In such case, data sent with e-mail message will be saved. This information will be used for processing the content of communication. You can also contact us using a phone. If at the beginning of phone conversation You will give us Your consent, the phone call will be recorded. Information shared during the phone call will be used for improving client support services. Recording of the phone call will be removed in period of 6 months, unless longer period of retention is required by law. Your consent is legal basis for recording, which complies with point (a) of 1st part of article 6 of GDPR.
6.2. Ratings with comment function and star rating system
We provide the ability to publicly rate our products and services on our Website. For this purpose, we collect and use this personal information: name, e-mail address, time of submitting the rating and country. If You are participating in star rating system, we calculate the average rating according to our rating scale, where all stars mean the highest rating. By using commenting function, Your comment can be published in our Website together with Your initials or chosen nickname. Data processing related to rating procedures is meant to provide the users with ability to rate our services on the internet and provide reliable feedback for potential new clients about the quality of our products and services. Processing is done according to point (f) of 1st part of article 6 of GDPR, based on interest to receive user’s ratings and to create reliable basis for use of the Website. You can refuse to give Your consent to manage Your data according to point (f) of 1st part of article 6 of GDPR at any time, based on reasons arising from your own situation. Data management and transmission is based on our legal interests according to point (f) of 1st part of article 6 of GDPR. Our legal interest is to make our sale ratings transparent to other clients and to make sure that they are based on real purchases. Data is removed after it becomes unnecessary for this purpose.
6.3. Legal regulation of data processing
After receiving user’s consent, legal regulation of data processing is regulated by (a) point of 1st part of articles 6 of GDPR. Order of processing of data that is provided by user at the time of sending an e-mail message is regulated according to point (f) of 1st part of article 6 of GDPR. If e-mail message is sent in order to conclude a contract, data management is additionally regulated by point (b) of 1st part of article 6 of GDPR.
6.4. What is the purpose of data processing?
Processed encrypted personal data is important only as long it is required to save contacts. If our Website is contacted by e-mail, data provided by user will also be retained. Other data that user provides at the time of sending a message will be useful in preventing misuse of provided contact information and in assuring the safety of our website’s informational technologies.
6.5. Duration of retention
Data will be deleted when its use will become inappropriate. Personal account credentials provided in contact page and data provided at the time of sending e-mail message will be deleted only after ending the communication with user. Communication is considered ended after user’s issues has been solved.
Additional data recorded during communication will be deleted not later than after 7 days.
6.6. Withdrawal of consent and possibility to remove data
User can at any time withdraw his/her consent for us to use his/her personal data. If user communicates with us using e-mail, he/she can at any time forbid to save his/her personal data. In such case communication within website will become impossible.
It will only be possible to contact us using a phone, regular mail or by arriving at location:
Julius Dirma
Certificate of individual activity No. 772426
Phone no: +370 683 13332
E-mail: info@autopasaulis.com
Address: Kalvariju g. 143, LT-08352, Vilnius
Working hours: I-V 8.00-19.00, VI 9.00-16.00
In such case, all personal data saved in Website during communication session will be deleted.
7. Social media
7.1. “Google+”
Our website uses “Google +1” functions. Service provider is “Google Inc.”, 1600, Amphitheatre Parkway, Mountain View, CA 94043-1351, USA. Gathering and sharing of information: by pressing the button “Google +1” You can share the information all over the world. “Google + 1” buttons allows You to share personal content with “Google” and other partners. “Google” stores information of “+1” content as well as information about the page, which You viewed by pressing “+1”. Your “+1” together with Your profile name and picture can be used as a link for using “Google” services, for example, search page or Your “Google” profile or other websites and advertisements. “Google” saves information about Your activity during your visit in “Google +1” to improve offered services for you and other users. To be able to use “Google +1” button, user has to have public “Google” profile (visible to everyone) and selected username. This username will be shown while using all of “Google” services. In some cases it can be replaced by other name, which you have previously used to share content through your “Google” account. Your profile will be shown to users, who know Your e-mail or have any other information about Your identity. Usage of collected information: Apart from mentioned purposes, information collected from You will be used according to data protection rules defined by “Google”: https://policies.google.com/privacy. “Google” can announce statistical data about activity of “+ 1” users or transfer them to users and to partners such as computer game publishers, ad creators or related websites.
7.2. “Facebook”
Our pages contain “Facebook” network service provider’s plugins, Inc., 1 Hacker Way, Menlo park, California, 94025, JAV. “Facebook” plugins within our Website are marked with “Facebook” logo or “Like” button. Follow this link developers.facebook.com/docs/plugins/ if you want to know more about “Facebook“ plugins. During your visit in our Website, plugin will automatically connect Your browser and „Facebook“ server. “Facebook” will receive information about Your visit in our Website and Your IP address. If you will click on “Facebook” “Like” button after connecting to “Facebook” account, you will be able to share the content of our Website using Your “Facebook” profile. We would like to highlight the fact that our Website does not collect information about the content and use of data downloaded from “Facebook”. More information about “Facebook” privacy policy can be found: de-de.facebook.com/policy.ph. If you don’t want “Facebook” plug-ins to be used on our Website, disconnect Your “Facebook” user account from it.
7.3. “Twitter”
Our Website contains functions of “Twitter” services. These functions are provided by „Twitter Inc.“, 1355 Market Street, Suite 900, San Francisco, CA. 94103, USA. By using “Twitter” and “Re-Tweet” function You will be able to visit the websites that are linked to your “Twitter” account, and which is known to other visitors. This data is also transferred to “Twitter”. We want to highlight that our Website does not collect information about content and use of data that is transferred through “Twitter”. More information can be found in “Twitter” privacy policy twitter.com/privacy. Privacy settings can be changed in your “Twitter” account twitter.com/account/settings.
7.4. “Instagram”
“Instagram” functions are active in our Website. Service provider „Instagram Inc.“, 1601 Willow Road, Menlo park, CA, 94025, USA. After connecting to your “Instagram” account You can share the content of our Website by pressing “Instagram” button. Then, by using Your account, you will be able to connect to our Website in “Instagram” website. We want to highlight the fact that our Website does not collect information about content and usage of data sent through “Instagram”. More information about “Instagram” privacy policy can be found http://instagram.com/about/legal/privacy/.
7.5. “Pinterest”
Our Website contains plugins of social network “Pinterest”. Provider of these services is Pinterest Inc. 635 High Street, Palo Alto, CA, 94301, USA („Pinterest“). If you will open the page of the Website that contains such plugins, Your browser will be automatically connected to “Pinterest” server and will transfer Your data to “Pinterest” server in USA. It can be Your IP address, addresses of pages containing plugins that you visited, information about your internet Browser and settings, date and time of the search, Your methods of using “Pinterest” and plug-ins. More information about the purpose and scope of usage and management of Your data by “Pinterest”, also about Your rights and possibilities to assure Your privacy can be found https://about.pinterest.com/de/privacy-policy.
7.6. “YouTube”
There are “YouTube” components installed on the Website. “YouTube” is internet video website, which enables video content creators and other users to publish video content for free, also view, rate, and comment them. “YouTube” allows to publish all kinds of videos, therefore users now can easily access movies, tv shows, music videos, commercial ads and videos created by users within the website. “YouTube” operator is „YouTube“, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA. „YouTube, LLC“ is subsidiary of „Google Inc.“, 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA. At the time of visiting any page of the Website that has “YouTube” components installed, system of information technologies will automatically enable internet browser to download required “YouTube” components for user. More information about “YouTube” can be found: https://www.youtube.com/intl/en/yt/about/. Such innovative technologies enable “YouTube” and “Google” to know the exact date of Your visit on our Website. If data subject has his/her own “YouTube” account and browses a webpage containing “YouTube” videos, Website knows, which specific page he/she visited. This information is collected by “YouTube” as well as “Google” and is then linked to “YouTube” account of respective user. “YouTube” and “Google” always receives information from “YouTube” components about the data subject visiting the website, if data subject at that time is connected to “YouTube”, regardless of the fact if he clicked or did not click on “YouTube” video. If data subject does not want “YouTube” and “Google” to collect such information, he/she should close “YouTube” account before visiting our website. It is stated in confidentiality provisions (which can be found https://www.google.com/intl/lt/policies/privacy/) of “YouTube” that “YouTube” and “Google” reserve the right to collect, process and use personal data of internet users.
8. Rights of data subjects
If you manage your personal data yourself, that means that according to GDPR definition you are data subject and have the right to address data controller. This Privacy policy lists all the rights of data subjects, that are assured by GDPR according to data controllers defined in this Privacy policy. No other rights, that could be relevant to data subjects in case when other possible data controllers are indicated in this Privacy policy, are defined in this Privacy policy.
8.1. Right to obtain information
You have the right to address data controller for confirmation if Your data was really processed by us. If mentioned data is not yet processed, You can request data controller to provide such information:
1. purpose of personal data processing;
2. which specific personal data will be processed;
3. for which person or categories of persons Your personal data was and will be revealed;
4. what is the determined period of retention of Your personal data or what are the criteria of determining the period of retention if the retention period cannot be determined at that time;
5. do You have the right to clarify or delete the data related to You, also to restrict the action of Your data controller or completely forbid to perform these actions;
6. about the right to address respective surveillance authority with a complaint;
7. all present information about unknown data, which was not collected by data subject;
8. information about the ability for data subject to decide about automatic profiling of personal data, including data profiling carried out according to requirements of 1st and 4th parts of GDPR and – at least in listed cases – information about personal data profiling considerations, also information about the consequences that such processing could have on data of data subject.
You have the right to request information about the possible transmission of Your data to third parties or international organization and/or to request guarantees applicable to data subject, which are provided in art. 46 of GDPR.
8.2. Right to correct errors
You have the right to address data controller, who processed Your data, for clarification or elimination of errors if such data is incorrect or inaccurate. Data controller must immediately carry out such corrections.
8.3. Right to limit the scope of processing
You have the right to limit the scope of processing of your personal data, if:
1. Period during which data controller would be able to verify the information related to Your personal data is inappropriate for You;
2. if processing was done illegally, but You don’t want to delete Your data and demand to limit access to Your data;
3. if data controller no longer sees purpose in processing Your data, but it will be useful for You in case You would need prove or defend rightful requests or
4. if You made claims according to 1st part of article 21 of GDPR but are unsure if reasonable and legal reasons provided by data controller doesn’t interfere with Your interests.
If processing of Your personal data will be limited, mentioned data, if it was saved, will only be processed with Your consent or with intervention of legal authorities, or for purpose of protecting the rights of other individual or legal person or according to important public interest of European Union or its member.
If processing of Your personal data was limited because of above mentioned reasons, data controller must inform You about it before such limitations comes into force.
8.4. Right to delete the data
8.4.1. Obligation to delete the data
On your request for data controller to immediately delete the data related to You, data controller will be obliged to immediately delete such data, if:
1. There is no longer a reason to retain or any other way process the data related to You;
2. You withdraw Your consent according to point (a) of 1st part of article 6 or point (a) of 2nd part of article 9 of GDPR concerning the data processing or if there is no other legal basis for data processing;
3. You make a claim according to 1st part of article 21 of GDPR concerning data processing and there is no other serious legal basis for processing of this data, or You make a claim concerning data processing according to 2nd part of article 21 of GDPR;
4. data related to You as identified or identifiable person was processed illegally;
5. data related to You as identified or identifiable person was deleted by fulfilling the legal obligations to European Union or other member states, that are also mandatory to data controller;
6. Data related to You as identified or identifiable person was used by information agencies whose legal activity is defined according to 1st part of article 8th of GDPR.
8.4.2. Information for third persons
If data controller made data related to You as identified or identifiable person public, which he/she is obliged to delete according to 1st part of article 17 of GDPR, he/she with accordance to available technological and technical measures and related expenses must take appropriate action to inform other data controllers processing Your data about Your, as the concerned person’s, request to delete the data related to You as identified or identifiable person from all links, copies or synchronized programs.
8.4.3. Exceptions
You have no right to delete personal data that was processed according to defined requirements if:
1. it is necessary to assure the freedom of expression or right to information;
2. it is necessary to fulfil legal obligations, defined by legislation of European Unions or its member states, that are mandatory to data controller or if data controller is obliged to carry out the task in the name of public interest or to perform the functions of public government that are assigned to data controller;
3. it does not interfere with public interest in field of public health according to 2nd and 3rd part of article 9 of GDPR;
4. it is related to public interest of storing information in archives or for purposes of scientific or historical research or statistics, as it is provided in article 89 of GDPR, that such aim may become impossible to achieve because of appropriate implementation of rights of data subject or it may become serious obstacle for achieving such aim;
5. data will be necessary for data subject to state, fulfill and defend legal requirements.
8.5. Right to be informed
If data subject has the right to clarify, delete or limit the actions of data controller in terms of personal data processing, he/she must request all persons, who were granted access to data related to You as identified or identifiable person, to clarify or delete or to limit the data processing in any other way, even if it is impossible or may cause disproportionate expenses. You have the right to request the data controller to provide you information about mentioned persons.
8.6. Right to relocate the data
You have the right to receive the data, related to You as identified or identifiable person, that you provided to the data controller in systemized, regularly usable format that is readable by computer or another device. Additionally, You have the right to transfer this data to another data controller while data controller who initially received your personal data from you has no right to interfere with this action, if:
1. data management is done according to your consent based on (a) point of 1st part of article 6 or (a) point of 2nd part of article 9 of GDPR or agreement according to (b) point of 1st part of article 6;
2. data is managed using automated measures.
By exercising the right to transfer own data, data subject has the right to request one data controller to directly transfer Your personal data to another data controller if it is technically possible and does not interfere with freedoms and rights of other persons. Right to transfer own data cannot be exercised during the management of personal data if data controller is obliged to perform the task in the name of personal interest or to perform the functions of public administration that have been assigned to data controller.
8.7. Right to object
In case of special situation, You have the right to object to Your data being managed according to (f) and (e) points of 1st part of article 6 of GDPR, same applies to data profiling that is also carried out according to mentioned provisions. In such case data controller stops managing the data related to You as identified or identifiable person, except for cases when data controller proves that data must be managed because of urgent important matters that are superior to interests, freedoms, and rights of data subject or if data must be managed in order to state, fulfill or defend legal requirements. If personal data is managed for marketing purposes, You, as data subject, have the right to object to Your data being managed for these purposes, same applies to profiling of personal data if it is directly related to marketing. If You object to Your data being managed for marketing purposes, such data will no longer be managed for marketing purposes. If You use services of Information Society, You have the right – regardless of Directive 2002/58/EG of European Union – to exercise the right to prevent the use of automated measures (that have technical specification applied to them) against you.
8.8. Right of withdrawal of consent to retain data
You have the right to withdraw Your consent to retain Your data at any time. Such action will not cause adverse legal consequences to Your personal data that was managed until that point.
8.9. Automated decision-making including profiling of personal data
At the time of making one or other decision You have the right to object if it is based only on automated management of personal data, including profiling of personal data, and it causes legal inconsistencies, or if such method interferes with Your other interests. You have no right to choose another method of solution, if:
1. contract between data subject and data controller must be concluded and fulfilled;
2. such right is exercised by European Union or its member states in their own countries and if data controller takes respective measures to protect the rights and freedoms and legal interests of data subject;
3. data subject supports this decision.
Such decisions shouldn’t be based on personal data of special categories, as it is provided in 1st part of article 9 of GDPR, if (a) and (g) points of 2nd part of article 9 are invalid in this case and if respective measures are taken to protect Your rights, freedoms and legal interests.
In first and third case data controller takes appropriate measures to protect Your rights, freedoms and legal interests and to assure that You will have the right to request data controller for human intervention, right to express your opinion and right to challenge the decision.
8.10. Right to lodge a complaint to surveillance authority
Without it limiting your options to take different legal measures, You have the right to lodge a complaint to respective surveillance authority against inappropriate actions, in territory of specific member state or in other location, in which, according to Your opinion, infringement of Your rights was committed by failing to comply to GDPR in terms of management and protection of personal data. After receiving the complaint respective surveillance institution informs the applicant about the course of examination as well as results and about a possibility for him/her to go to court according to article 78 of GDPR.