Policies & compliance

Data controller: Velebit-Promet, Industrijska ul. 5, 10370, Dugo Selo, Croatia, OIB: 67912509737
Data protection contact: marketing@velebit-promet.hr, +385 (0)1 2755 558
Last updated: 12.01.2026.

Velebit-Promet d.o.o., as the data controller, issues this Privacy Policy. This Privacy Policy safeguards the privacy of users and is implemented in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “General Data Protection Regulation” or “GDPR”), the Croatian Act on the Implementation of the GDPR, Directive 2002/58/EC, and other applicable regulations.

Velebit-Promet processes personal data in accordance with the principles of lawfulness, transparency, data minimisation, accuracy, storage limitation, integrity and confidentiality, accountability, trust and fair processing, purpose limitation, and anonymisation where possible. This Privacy Policy applies to all services provided by Velebit-Promet d.o.o.

Velebit-Promet d.o.o. (the “Company”) explains in this Privacy Policy how it collects, uses, stores, and protects personal data and what rights data subjects have.

Personal Data

Personal data means any information relating to an identified or identifiable natural person.

Processing

Processing means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

We process personal data only to the extent that at least one of the following conditions is met: the data subject has given consent to the processing of their personal data for one or more specific purposes; processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract; processing is necessary for compliance with a legal obligation to which the controller is subject; processing is necessary in order to protect the vital interests of the data subject or of another natural person; processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

Collection of Data

We collect and process the following categories of personal data:

a) Employees’ personal data, in accordance with applicable laws
PURPOSE OF PROCESSING: performance of rights and obligations arising from the employment relationship. Provision of such data is a statutory and contractual obligation of the data subject and a condition for the establishment and continuation of the employment relationship.

b) Personal data of individuals participating in a recruitment or other procedure (open applications) related to employment, including: name and surname, address of permanent/temporary residence, personal identification number (OIB), date of birth, and other data submitted by the individual in connection with the recruitment or other procedure.
PURPOSE OF PROCESSING: recruitment for a position. Provision of such data is a condition for the potential employment of the data subject.

c) Personal data of clients and other individuals, including: name and surname, address of permanent/temporary residence, OIB, and contact details
PURPOSE OF PROCESSING: execution of legal transactions and provision of quotations/offers.

d) Personal data of individuals with whom we maintain business cooperation in the course of our activities, including: name and surname, OIB, address of residence, bank account number, and other data related to the performance of mutual contractual obligations and legal obligations arising therefrom
PURPOSE OF PROCESSING: acquisition of goods and services in legal transactions and performance of rights and obligations arising from such legal relationships. Provision of such data is a statutory and contractual obligation of the data subject and a condition necessary for entering into a contract.

e) Marketing: contact data (email, telephone) and behavioural data (cookies). If you provide us with personal data, e.g. in the context of registration, chat, contact form, survey, or competition, we will use such data for the stated purposes, for user management, market management, business analysis, and profitability.
PURPOSE OF PROCESSING: marketing, newsletters, personalised offers, and market analysis.

Users’ contact details may be used to send promotional notifications about products and services if the user has provided consent for such processing.

We process personal data exclusively for the purposes set out above and will not use or otherwise process such data for other (incompatible) purposes.

Legal Bases

Within the meaning of the GDPR, we process the above personal data on the following legal bases, which may apply individually or cumulatively in a specific processing case:

Data under (a): processing necessary for the performance of a contract to which the data subject is a party / processing necessary for compliance with a legal obligation (employment regulations, health and pension insurance regulations, tax regulations, etc.).

Data under (b): processing necessary in order to take steps at the request of the data subject prior to entering into a contract.

Data under (c): processing necessary for the performance of a contract / taking steps prior to entering into a contract / compliance with a legal obligation / legitimate interests of the controller or a third party / protection of vital interests (system security, protection against abuse, conducting business communications, etc.).

Data under (d): processing necessary for the performance of a contract / compliance with a legal obligation (accounting regulations, etc.) / legitimate interests of the controller or a third party.

Data under (e): legal basis: consent.

How We Collect Data

We collect data:

• Directly from users, with consent or where necessary to conclude and perform a contract.
• Automatically, when visiting the website, via cookies. Consent is not required for technically necessary cookies. Examples of necessary cookies include cookies for user input, authentication cookies, security cookies, multimedia session cookies, load-balancing cookies, and cookies for sharing content via social plugins for logged-in users. Other cookies and similar technologies are based on the user’s consent, which can be withdrawn at any time.
• The collected data is not used for automated decision-making. We apply appropriate technical and organisational security measures. Access to data is limited to authorised employees and contracted processors (hosting/IT providers, attorneys), to the extent necessary to perform the relevant tasks and in accordance with law. We enter into appropriate written data processing agreements with contracted processors, under which the processor, inter alia, undertakes to apply all data protection standards prescribed by the GDPR.

Web Cookies

Our official websites use so-called cookies — text files placed on a user’s computer by a web server, through which the internet service provider (ISP) displays a website.

Cookies are generated when the browser on the user’s device loads a visited web destination, which sends data to the browser and creates a text file (cookie). The browser retrieves and sends the cookie to the website server when the user returns to the website.

More information is available in our Cookie Policy.

We automatically collect certain information when you visit, use, or browse our websites. This information does not reveal your identity (such as your name or contact information) but may include device and usage data, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, and information about how and when you use our website, as well as other technical information. This information is primarily needed to maintain the security and operation of our websites and for internal analytics and reporting.

Storage and Security of Data

We process your personal data until the purpose of processing has been fulfilled. After the purpose for which it was collected has ceased, we no longer use your personal data; however, it remains stored in our systems and is retained for as long as required by applicable legislation on the retention of archival and other records.

Data collected on the basis of consent is retained for up to 5 years or less if you withdraw your consent. Data necessary for contract performance is retained in accordance with accounting regulations and limitation periods.

Processing is carried out within the territory of the Republic of Croatia. Personal data is not transferred to third countries (outside the European Union and the European Economic Area) or to international organisations.

Personal data in physical form (written documentation) is stored and otherwise processed in the Company’s premises, unless the purpose of processing or a legal obligation requires otherwise. Personal data in electronic form is stored and otherwise processed within the Company’s IT infrastructure, unless the purpose of processing or a legal obligation requires otherwise. We apply strict procedures and security measures; however, we cannot guarantee complete security of data transmission over the internet. By submitting data via the internet, you accept the risks associated with such transmission.

Velebit-Promet does not allow registration for persons under the age of 16. Accordingly, no part of the Company’s websites is designed to attract persons under 16 years of age.

If required by the purpose of processing or by a legal obligation, in certain cases the Company may disclose (transfer) personal data to other natural or legal persons, public authorities, agencies, or other bodies. In all other cases, the Company does not disclose personal data to third parties.

Individuals responsible for processing personal data are responsible for protecting personal data from accidental loss or destruction, unauthorised access or unlawful processing, unauthorised disclosure, and any other misuse, and they sign an appropriate confidentiality statement.

Access to personal data is granted only to persons specifically authorised to do so or where the performance of processing activities arises from the job position held. Unauthorised access to personal data and any attempt to export or alter data is strictly prohibited.

With respect to personal data stored under the Company’s control, technical security measures are implemented, including: locking business premises, locking cabinets containing paper files, restricting access to keys solely to authorised persons, antivirus protection, passwords for access to computers and other devices, and other technical measures appropriate to the current risks to the rights and freedoms of data subjects.

Data Subject Rights

We ensure the exercise of the following rights for individuals whose personal data we process:

1. Right of access: You have the right to access your personal data and to request detailed information, in particular on the purposes of processing, the categories of personal data processed (including access to your personal data), recipients or categories of recipients, and the envisaged storage period. Access may be restricted only in cases prescribed by EU or national law, where such restriction respects the essence of the fundamental rights and freedoms of others.
2. Right to rectification: You have the right to request correction or completion of personal data if your data is inaccurate, incomplete, or not up to date. To do so, submit your request to us as the controller in writing, including electronically.
3. Right to erasure (“right to be forgotten”): You have the right to request erasure of personal data relating to you if one of the following grounds applies: your personal data is no longer necessary for the purposes for which it was collected or otherwise processed; you withdraw consent and there is no other legal ground for processing; you object to processing under Article 21(1) GDPR and there are no overriding legitimate grounds; the personal data has been unlawfully processed; the personal data must be erased for compliance with a legal obligation; the personal data was collected in relation to the offer of information society services under Article 8(1) GDPR.
4. Right to restriction of processing: You have the right to obtain restriction of processing where: you contest the accuracy of the data; processing is unlawful and you oppose erasure; the controller no longer needs the personal data but you require it for the establishment, exercise, or defence of legal claims; you have objected to processing and verification is pending.
5. Right to data portability: You have the right to receive personal data concerning you, which you have provided to the Company, in a structured, commonly used, and machine-readable format and have the right to transmit those data to another controller, where processing is carried out by automated means and is based on consent or on a contract.
6. Right to object: Where you object, the Company shall no longer process your personal data unless it demonstrates compelling legitimate grounds which override your interests, rights and freedoms, or for the establishment, exercise, or defence of legal claims.

In addition to the above rights, you have the right to lodge a complaint with the competent supervisory authority. In the Republic of Croatia, the competent authority is the Croatian Personal Data Protection Agency (AZOP).

To exercise your rights, you may contact us at marketing@velebit-promet.hr. We will respond as soon as possible.

Rights Where Processing Is Based on Consent

Where we base the processing of personal data on consent, we ensure that you always provide consent in the form of a written statement, handwritten or electronically signed, and that the consent is freely given, specific, informed, and unambiguous.

The written statement by which you give consent for the processing of your personal data will be prepared for each specific purpose of processing, in an intelligible and easily accessible form, using clear and plain language.

You have the right to withdraw your consent at any time, and you will be informed of this right prior to giving consent. This right will be explicitly stated in the consent statement, including the method for withdrawing consent by signing a withdrawal form which we will prepare in a simple format.

Upon withdrawal of consent, we will immediately erase all your personal data, except for data that we are required to retain under the laws of the Republic of Croatia and the European Union.

Objections and Amendments

If you believe that your rights have been infringed, you may contact us at marketing@velebit-promet.hr. We reserve the right to amend and supplement this Privacy Policy and recommend that you periodically review its content.

Note that we reserve the right to amend and supplement this Privacy Policy at any time, without providing any specific notice to interested persons. For this reason, we recommend that all interested persons regularly check the Company’s website to stay informed of the current content of this Privacy Policy.

Controller Contact Details

Velebit-Promet d.o.o., Industrijska ul. 5, 10370 Dugo Selo, Croatia
Telephone: +385 (0)1 2755 558
Email: marketing@velebit-promet.hr