Privacy policy

The Law Firm Hanžeković & Partners Ltd, Zagreb, Radnička cesta 22, Personal Identification No. (OIB): 85127306373 (hereinafter: H&P), in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: the General Data Protection Regulation) and the Act on the Implementation of the General Data Protection Regulation (Official Gazette 42/2018), as the controller wishes to inform you with this privacy policy of the manner in which your personal data are being processed.

Processing of personal data

H&P processes personal data lawfully, fairly and in a transparent manner in relation to the data subject, taking account of that the data are processed exclusively in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

Categories and purpose of personal data processing

H&P collects and processes the following types of personal data:

• personal data of employees and former employees in accordance with their Employment Contracts and the regulations in force;
• personal data of employees and former employees in accordance with their Employment Contracts and the regulations in force;
• personal data of clients in accordance with the granted powers of attorney, instructions, representation contracts, in the provision of legal services in accordance with the Act on the Legal Profession;
• personal data of business partners and associates in accordance with concluded Contracts;− personal data of potential clients as well as potential employees who contact us through the contact form or by email.

We process the personal data collected through the contact form (when you send your queries, job applications etc.) exclusively for the purpose of contacting you.

H&P processes personal data only if, and to the extent that, one of the following conditions has been met:

• the data subject has given consent to the processing of his or her personal data for one or more specific purposes; or
• the data subject has given consent to the processing of his or her personal data for one or more specific purposes; or
• processing is necessary for the performance of a contract to which the data subject is party; or
• processing is necessary for compliance with legal obligations of H&P; or
• processing is necessary in order to protect the vital interests of the data subject or of another natural person.

In reference to visitors of the website, H&P wishes to point out that, in order to ensure the correct operation of the website, cookies (small data files) are used that are stored on the computer or mobile device when visiting the website for the purpose of storing setting preferences in respect of the display of the website.

Recipients of data

Your personal data can be accessed by lawyers, trainee lawyers and other employees of H&P in charge of e.g. accounting, administration, IT or dispatch of post.

External recipients (competent state authorities and courts, notaries public, the Financial Agency, etc.) can have access to your personal data if it is necessary in order to provide legal services or it follows from mandatory legislation.

Data retention periods

The processing and retention periods for certain personal data are prescribed by the legislation in force in the Republic of Croatia. Thus, for example the Act on the Legal Profession prescribes the obligation of lawyers to retain personal data on file for 10 years as of the final completion of proceedings. In reference to data that we retain on the basis of consent, these data are retained while the purpose for which they were provided exists i.e. for which they are processed, i.e. until consent for the processing of such data is revoked by the data subject.

After the purpose ceases to exist i.e. the retention period expires, we permanently erase the data or anonymise them so that they can no longer be linked to a specific data subject.

Rights of data subjects

Rights the data subjects have in accordance with the General Data Protection Regulation:

• Right of access – the right to receive information on the purpose of processing of the personal data of the data subject, the categories of personal data being processed, on the recipients or categories of recipient to whom the personal data have been or will be disclosed, the envisaged period for which the personal data will be stored, and where the personal data are not collected from the data subject, any available information as to their source. It also includes the right of the data subject to receive a print-out of the personal data contained in the storage system referring to him or her.
• Right of rectification – the data subject has the right to obtain without undue delay the rectification of inaccurate personal data or to have incomplete personal data concerning him or her completed.
• Right to erasure – the right to obtain the erasure of personal data concerning him or her without undue delay provided that the personal data are no longer necessary in relation to the purposes for which they were collected or for legal purposes, and if the data subject revokes the consent on which the processing was based.
• Right to restriction of processing – the right to obtain the restriction of processing if the conditions defined in the General Data Protection Regulation have been met.
• Right to Data Portability – the right to receive the personal data concerning him or her, in a structured, commonly used and machine-readable format and the right to transmit those data to another controller if it concerns data which are processed based on a consent or contract, and if the processing is carried out by automated means.
• Right to object – the right of the data subject to object, on grounds relating to his or her particular situation, at any time to the processing of personal data concerning him or her. The objection is submitted to H&P to the contact addresses (by email, post).

H&P will, at the latest within one month as of the receipt of your request, provide you with the requested information and a notice on taken actions. If the processing of the request is complex or it concerns a larger number of requests, the one-month period can be extended by two more months, and in that event we will inform you of the reasons for the potential extension of the period.

Also, if the request of the data subject is rejected, H&P will without delay, and at the latest within one month of receipt of the request, inform the data subject of the reasons for the rejection of the request.

Please note that in the event of receiving requests that are obviously unfounded or excessive, in particular because of their repetitive character, in accordance with the provisions of the Regulation, H&P can charge a reasonable fee on account of administrative costs or refuse to act upon the request.

You can download the Request Form here. 

Additional information and comments

If you have any additional questions or comments concerning the H&P Privacy Policy or wish to exercise some of your abovementioned rights, in addition to submitting the request form, you can contact us through our online form, by e-mail dpo@hanzekovic.hr or by phone + 385 (0)1 61 84 611.