ALPHA LUXE GROUP personal data protection policy

Effective date: April 15, 2019

ALPHA LUXE GROUP d.o.o. (hereinafter referred to as "ALPHA LUXE"), represented by Robert Budimir, Director, is committed to protecting the privacy and personal data of individuals by Regulation (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of individuals about the processing of personal data and the free movement of such data and the repeal of Directive 95/46 / EC (hereinafter referred to as "the Regulation").

POLICY ON THE PERSONAL DATA MANAGEMENT SYSTEM AND INDIVIDUAL PRIVACY

I. INTRODUCTORY PROVISIONS

All content, structure, texts, photos, and videos on our websites are protected by copyright. Any reproduction of information or data, including the use of texts or parts of text, images, and videos or any other exploitation or sharing, requires the prior written consent of ALPHA LUXE. Any unauthorized use will be considered a violation of copyright or intellectual property rights and is subject to legal action.

II. DEFINITIONS

Personal data: Any information relating to a natural person (individual) whose identity has been established or can be established, including an identifiable individual's identification number, name, location data, network identifier, or one or more characteristics specific to their physical, physiological, mental, economic, cultural, or social identity.

The data subject (respondent): A natural person (individual) whose identity can be established directly or indirectly, primarily based on name, identification number, location data, network identifier, or with the help of one or more characteristics specific to their physical, physiological, mental, economic, cultural, or social identity.

Processing of personal data: Any procedure or set of operations performed on personal data or stages of personal data, whether automated or non-automated means, such as collection, recording, organization, structuring, storage, adaptation, modification, retrieval, inspection, use, detection by transfer, dissemination, or otherwise making available, harmonization, combination, restriction, deletion, or destruction.

Data controller: A natural or legal person who, alone or together with others, determines the purposes and means of personal data processing.

Information system: The comprehensiveness of technological infrastructure, organization, people, and procedures for collecting, processing, generating, storing, transmitting, displaying, distributing, and disposing of information. An information system can also be defined as the interaction of information technology, data processing procedures, and the people who collect and use the data.

Supervisory body: An independent public authority established by the Republic of Croatia to control and ensure the implementation of the Regulation.

Confidentiality: The property of information (data) unavailable or disclosed to unauthorized entities.

Consent: Any voluntary, informed, unambiguous expression of the respondent's wishes by which he gives his approval or explicit affirmative action to consent to the processing of personal data relating to him.

Profile creation: Any automated processing of personal data that consists of using personal data to assess certain unique aspects related to the individual, especially for analyzing desires and needs in the sale of real estate.

Third parties: Any natural or legal person, public authority, ALPHA LUXE, or other body other than the respondent, controller, processor, or persons authorized to process personal data under the direct authority of the controller or processor.
"Distribution channels" refer to the means and methods through which clients can access, contract, and use ALPHA LUXE products and services and receive commercial information and offers related to ALPHA LUXE. These channels include the company's headquarters, website, and others. Information regarding ALPHA LUXE's distribution channels is available to clients anytime via telephone.

For personal data processing, the respondent must provide their "consent" in a voluntary, specific, informed, and unambiguous manner. This can be expressed through a statement or explicit affirmative action.

Protecting personal data involves safeguarding against security breaches that result in accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access to personal data during transmission, storage, or other processing.

III. SCOPE AND OBJECTIVE

The personal data protection policy establishes a framework for personal data protection by the General Data Protection Regulation. The policy sets rules related to the security of individuals about collecting and processing personal data and practices associated with the free movement of personal data.
The policy applies to all processing of personal data, except in cases where the processing is such a nature that it is a statistical analysis from which it is impossible to identify an individual.

IV. PRINCIPLES OF DATA PROCESSING

The policy applies to all processing of personal data, except in cases where the processing is such a nature that it is a statistical analysis from which it is impossible to identify an individual.

The principles of data processing are the basic rules that ALPHA LUXE follows when processing the personal data of respondents. The processing that is carried out by the following regulations is considered legal.

legality, fairness, and transparency - personal data are legally, somewhat, and transparently processed about the respondent; In certain situations, ALPHA LUXE will have to ask respondents for some personal ones that are not needed to perform specific service services but are required by law to collect (e.g., g. the Law on the Prevention of Money Laundering and Terrorist Financing). ALPHA LUXE transparently informs respondents about managing their data, their use or processing, and how much this personal data will be processed. The respondent will be informed promptly, i.e., before the data collection, with all relevant information. Also, ALPHA LUXE ensures transparency of personal data processing by providing respondents with all necessary information and, upon request, providing respondents with insight into their data, explanations of processing, basics, laws of processing, etc.
Purpose limitation - personal data must be collected for explicit and lawful purposes. They may only be further processed in a manner consistent with those purposes if other processing is required by law or necessary for the quality delivery of the service itself.
Reduction of the amount of data - the collection and processing of personal data is appropriate, relevant, and limited to what is necessary about the purposes for which they are processed
Accuracy - personal data are accurate and up-to-date if necessary; ALPHA LUXE will take all reasonable steps to ensure that personal data that are inaccurate, taking into account the purposes for which they are processed, are deleted or corrected without delay; ALPHA LUXE provides the application of this principle through communication with respondents through which a correction of data may be requested if the respondent notices that some of their data have not been provided correctly.
Integrity and confidentiality - personal data are processed in a way that ensures adequate security of personal data, including protection against unauthorized or unlawful processing and accidental loss, destruction, or damage through the application of appropriate technical or organizational measures.
storage restriction - personal data are kept in a form that allows the identification of respondents only for as long as necessary for the purposes for which personal data are processed; personal data may be stored for more extended periods if the personal data will be processed exclusively for statistical purposes, subject to the implementation of appropriate technical and organizational measures or if there is a legitimate interest (e.g., in the event of litigation)

V. OBLIGATION TO KEEP CONFIDENTIALITY

All ALPHA LUXE employees must adhere to the measures defined in this Policy. ALPHA LUXE will ensure that third parties who, in their cooperation with ALPHA LUXE, gain access to personal data are acquainted with the measures defined in this Policy to comply with them.

All persons under an employment contract or any employment contract who may directly or indirectly access personal data are obliged to respect confidentiality and protect the individual's privacy, including preventing unauthorized access to personal data and equipment used in processing data or their unauthorized use.

ALPHA LUXE will forward the respondents' data to state institutions if there is a legal basis for this (for example, forms for the Law on the Prevention of Money Laundering and Financing of Terrorism).

VI. LEGALITY OF PERSONAL DATA PROCESSING

At ALPHA LUXE, we acknowledge that the personal data of our respondents belong to them, and we handle it accordingly. However, we need to process a minimum data set to provide quality service in compliance with the law. Therefore, if the respondent declines to provide the necessary data, we won't be able to offer our assistance.

We process the personal data of the respondent when we meet one of the following conditions:

Processing is necessary to fulfill the contract to which the respondent is a party or to take action upon the respondent's request before the conclusion of the contract.
Processing is necessary to comply with legal obligations. Whenever the law authorizes or obliges ALPHA LUXE to process specific data, we will do so based on that law.
Processing is necessary for the legitimate interests of ALPHA LUXE, except when those interests outweigh the interests or fundamental rights and freedoms of the respondent, mainly if the respondent is a child. Our legitimate interest includes processing that helps us improve processes, develop products, enhance our services, offer specific products and services, resolve legal disputes, and protect persons and property.
The respondent has given consent to process their data, which must be provable, voluntary, written in easy-to-understand language, and can be withdrawn at any time. The real estate offers that ALPHA LUXE communicates through available distribution channels are considered part of the service. The respondent's consent is optional as long as the processing complies with the processing principles set out in point IV.
Processing is necessary to protect the vital interests of the respondents."

Learn about the legality of personal data processing at ALPHA LUXE. We treat the personal data of our respondents as their property but need to process a minimum set of data to provide quality service while complying with the law. If the respondent declines to provide the necessary data, we won't be able to offer our assistance. We process personal data when one of the following conditions is met: fulfilling a contract, complying with legal obligations, pursuing legitimate interests, obtaining consent, or protecting vital interests.

ALPHA LUXE values your privacy and ensures that your consent is provable, voluntary, written in easy-to-understand language, and can be withdrawn at any time. Real estate offers communicated through available distribution channels are part of our service and do not require the respondent's consent if they comply with our processing principles. Contact us to learn more.

VII. RIGHTS OF RESPONDENTS

The respondent has various rights concerning their data, as follows:

Right of access - The respondent has the right to contact ALPHA LUXE at any time to confirm whether their data is being processed and, if so, request access to the data and related information, including the right to personal data protection. ALPHA LUXE must provide a copy of the personal data being processed, usually in electronic form if requested electronically, and may charge a reasonable fee for additional documents.
Right to correction - The respondent has the right to obtain from ALPHA LUXE the correction of inaccurate personal data without delay and to supplement incomplete data. ALPHA LUXE must communicate any modifications to the data's recipients and inform the respondent of those recipients if requested.
Right to erasure (right to forget) - The respondent has the right to request the erasure of their data, which must be met promptly if justified. If deletion is not possible or prudent, ALPHA LUXE must block the data against unauthorized processing and communicate any omissions to recipients of the data. If requested, inform the respondent of those recipients.
The right to restrict processing - The respondent has the right to obtain from ALPHA LUXE a restriction on processing in certain circumstances, including when contesting accuracy or illegality or processing is no longer needed or exceeds legitimate rights. However, ALPHA LUXE may still process personal data as applicable regulations permit.
Right to data portability - The respondent can receive personal data related to them in a structured, commonly used, and machine-readable format and transfer it to another controller if the processing is based on consent or contract and is carried out automatically.
Right to object - The respondent can object to processing their data if based on ALPHA LUXE's legitimate interests or direct marketing purposes. ALPHA LUXE may continue processing if it can demonstrate legitimate reasons for doing so or to set, exercise, or defend legal claims.
The right to withdraw consent - The respondent can withdraw their consent at any time, which should be as simple as giving it. Withdrawal does not affect the lawfulness of processing based on consent before the withdrawal.
Right to compensation and liability - The respondent has the right to compensation for property or non-property damage due to violations of the applicable legal provisions by the processing manager or processor.

The respondent can exercise their rights by contacting ALPHA LUXE through the contact information published on its website or in pre-negotiation information. If they believe there has been a violation of their data processing rights, the respondent may complain to the national supervisory authority. Additionally, the respondent has the right not to be subject to automated decisions that produce legal effects or similarly significant results unless necessary for a contract, permitted by law, or based on explicit consent.

VIII. INFORMING

ALPHA LUXE ensures that the respondent is provided with all information to be provided if personal data are collected from the respondent or if personal data are not obtained from the respondent, as well as that the respondent is informed of his rights under the previous article. ALPHA LUXE will publish information on personal data protection on the official website.

IX. RECORDS AND STORAGE

ALPHA LUXE has established and maintains records of personal data. The processing on them constantly ensures that only personal data are included in the processing, for the processing of which there is a legal basis.
Personal data is appropriate, relevant, and limited to what is necessary for the purposes for which the data are processed data processing purposes. It is therefore ensured that the period in which personal data is stored is limited to a strict minimum. Personal data are processed only if other means cannot justifiably achieve the purpose of the processing.
ALPHA LUXE continuously implements appropriate technical and organizational protection measures, taking into account the nature, scope, context, and purposes of the processing, as well as the risks of different levels of probability and severity for the rights and freedoms of respondents.
The legality of processing. ALPHA LUXE does not allow unauthorized collection, processing, or use of personal data. The rule of restricting access to data applies only to data necessary to perform specific business tasks. ALPHA LUXE employees are strictly prohibited from using respondents' data for any purpose that does not comply with the conditions defined in Chapter VI. Finally, by applicable laws (e.g., the Law on the Prevention of Money Laundering and Terrorist Financing), ALPHA LUXE has the right to inspect and process part of personal data, but only to the extent necessary to meet regulatory requirements or enforce the Agreement with the respondent.
Personal data is protected from unauthorized access, use, alteration, and loss. Protection mechanisms are applied to personal data within ALPHA LUXE, regardless of the form in which they are stored - paper or electronic.

Personal data collected and processed by ALPHA LUXE in its work are considered confidential and must be treated with special care and may only be used by the reason for which they were collected.
ALPHA LUXE will collect and store personal data only to the extent necessary to fulfill the purpose of processing. ALPHA LUXE processes only personal data that is relevant, relevant, moderate and limited to what is required about the purposes for which it is processed ("reduction of the amount of data"); ALPHA LUXE takes all necessary measures to ensure that your data is accurate, complete and, where necessary, up-to-date, and undertakes to collect respondents' consents whenever they are needed and to inform respondents about the processing of their data.
Personal data will be held in the least possible places where they must be adequately protected. Access to personal data may be provided solely based on business needs. It is forbidden to use personal data to develop or test IT systems. Personal data must be protected by encryption, pseudonymization, or anonymization wherever possible.

X. LEGALLY BASED PROCESSING AND RIGHT OF COMPLAINT

ALPHA LUXE will process respondents' data by favorable legal and other regulations governing the prevention of money laundering to monitor and prevent fraud, money laundering, etc., carried out by European Union rules, standards, and recommendations institutions or national supervisory authorities.
By the Regulation, ALPHA LUXE gives respondents the right to object to data processing for direct marketing, whether about initial or for about her processing, at any time and free of charge.

XI. TRANSFER OF PERSONAL DATA

The faster and better service. In the case of concluding a business cooperation agreement, ALPHA LUXE may transfer the personal data of the respondent to an external associate who respondent's data to an external associate with professional competencies and provides sufficient guarantees to ensure appropriate subjective individual data protection measures and with whom ALPHA LUXE has signed a cooperation agreement. The same applies to business cooperation agreements with other entities registered for real estate brokerage, law firms, architectural offices, surveying offices, etc.
ALPHA LUXE further, and in the provision of advertising services (Istraplakati), may provide access to your personal information to its partners, who act as executors of processing. These third-party service providers will only follow the instructions of ALPHA LUXE. They will only have access to your data to fulfill the purposes for which personal data is collected. They are subject to personal data protection and confidentiality regulations as ALPHA LUXE. ALPHA LUXE must obtain your consent before forwarding your data to partners for direct marketing.
Furthermore, your data may be forwarded based on the following:

in response to legal or administrative proceedings of any kind or enforcement action requested by the competent authorities;
by legal obligations, protect the rights and security of the individual, protect the rights and property of ALPHA LUXE, including the need to respect this Privacy Policy and to prevent any technical, security, or fraud issues.

XII. INCIDENT MANAGEMENT AND THE RIGHT TO COMPLAINT

ALPHA LUXE takes all measures possible to protect the personal data of the respondents. In addition, all employees must notify the responsible person in case of a personal data protection incident or a personal data breach. ALPHA LUXE must report the incident to the Personal Data Protection Agency within 72 hours of learning of the violation, if feasible.

Also, in the event of a personal data breach that is likely to pose a high risk to the rights and freedoms of individuals, ALPHA LUXE notifies the respondent of the personal data breach without undue delay. The respondent has the right to complain to the supervisory authority (Personal Data Protection Agency) in case of an incident concerning his data or if he considers that ALPHA LUXE violates his rights defined by the Regulation.

XIII. FINAL PROVISIONS

This Policy shall enter into force on the day of its adoption.
ALPHA LUXE GROUP d.o.o. Robert Budimir Director