Data Protection – Blink d.o.o.

Introduction

Blink d.o.o. places particular importance on the protection of personal data and the privacy of its clients, business partners, website visitors, and other individuals whose personal data it processes.

This Data Protection Policy explains how Blink d.o.o. collects, uses, stores, and protects personal data and what rights individuals whose data is processed have.

Processing is carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “General Data Protection Regulation” or “GDPR”), the Act on the Implementation of the General Data Protection Regulation (Official Gazette No. 42/2018), and other applicable legislation.

1. Controller of Personal Data

The controller of personal data is:

Blink d.o.o.
Kustošijski venec 8, 10000 Zagreb
OIB: 31697199035
E-mail: blink@blink.hr
Telefon: +385 1 3750 477

For any questions regarding the processing of personal data and the exercise of your rights, you may contact us at the email address provided above.

2. Principles of Personal Data Processing

Blink d.o.o. processes personal data lawfully, fairly, and transparently and collects it only for specified, explicit, and legitimate purposes.

Data is processed only to the extent that it is adequate, relevant, and necessary for the purpose of processing. We endeavor to ensure that it is accurate and up to date and retain it only for as long as necessary for the purpose of processing or as required by law.

When processing personal data, we implement appropriate technical and organizational measures to protect it against unauthorized or unlawful processing and against accidental loss, destruction, or damage.

3. Categories of Individuals Whose Data We Process

Depending on the relationship with Blink d.o.o. and the purpose of processing, personal data may relate to:

website visitors,
individuals who submit an inquiry via the website or email,
potential clients and their contact persons,
existing clients and their contact persons,
employees and users of the IT systems of clients to whom Blink d.o.o. provides IT services,
business partners and their contact persons,
other individuals who enter into a business relationship with Blink d.o.o.

4. What Personal Data We Process

Depending on the relationship and purpose of processing, Blink d.o.o. may process the following data:

first and last name and position within the company,
company name, OIB (Croatian personal/company identification number), and registered office address,
business email address and telephone number,
data necessary for entering into and performing contracts and issuing invoices,
the content of business communications (emails, inquiries, support requests),
data necessary to provide IT services, such as usernames and information about users and devices in the systems we maintain,
other data provided voluntarily by the individual where necessary for a specific purpose.

The type and scope of data depend on the specific relationship, method of communication, and purpose of processing.

5. Data Collected Through the Website

Website visitors may contact Blink d.o.o. via the contact form. The following data is collected through the form:

first and last name,
email address,
telephone number,
company name,
the content of the message and other data provided by the user.

Data submitted through the form is stored in the website database and delivered to the official email address of Blink d.o.o. It is used exclusively to respond to the inquiry, for further communication, and, where applicable, to prepare an offer or contract.

6. Purposes of Processing Personal Data

We process personal data for the following purposes:

responding to inquiries,
establishing and maintaining business communications,
preparing offers and entering into and performing contracts,
providing contracted IT services and technical support,
issuing and processing invoices,
complying with legal obligations,
presenting our services to business entities (Article 21),
protecting information systems and websites,
analyzing website usage, subject to the user’s consent.

7. Legal Bases for Processing

Depending on the purpose, we process personal data on the basis of one of the legal bases set out in Article 6 of the GDPR:

Izvršavanje ugovora – kada je obrada potrebna za sklapanje ili performance of a contract ili za steps taken at the request of the individual prior to entering into a contract (e.g. responding to an inquiry or preparing an offer).
Compliance with Legal Obligations – where processing is required by law (npr. accounting and tax regulations).
Legitimate Interest – where processing is necessary for the legitimate interests of Blink d.o.o., such as business communications, presenting services to business entities, and protecting information systems, provided that those interests are not overridden by the individual’s rights and freedoms.
Consent – for analytical cookies and other processing for which consent is required.

Consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

8. Business Relationships and Clients

In the course of our business activities, we process the personal data of contact persons of clients and business partners where necessary for the business relationship, including for preparing and performing contracts, providing services, business communications, issuing invoices, complying with legal obligations, and handling complaints and disputes.

Blink d.o.o. as a Processor

When, in the course of providing IT services (system maintenance, technical support, backups, user account management), we access data in clients’ systems, the client is the controller of that data. In such cases, Blink d.o.o. acts as a processor, solely in accordance with the client’s instructions and the data processing agreement concluded with the client.

9. Recipients of Personal Data and Processors

Personal data is made available only to recipients who need it for a specific business or legal purpose. These may include:

website and email hosting service provider: TOTOHOST d.o.o., Republic of Croatia,
authorized persons within Blink d.o.o. involved in accounting, bookkeeping, administrative, and financial activities,
providers of business software and cloud services that we use in our operations,
Google Ireland Limited, for Google Analytics (Article 10), only with the user’s consent,
public authorities, where disclosure is required by law.

If Blink d.o.o. engages an external accounting or bookkeeping service provider, personal data may be made available to such provider to the extent necessary for issuing invoices, maintaining accounting records, and fulfilling accounting and tax obligations. In such cases, the relationship with the external provider is governed by an appropriate agreement in accordance with Article 28 of the GDPR, where applicable.

We regulate the data protection obligations of processors by contract in accordance with Article 28 of the GDPR.

10. Google Analytics

The website uses Google Analytics (Google Ireland Limited) for statistical analysis of website usage. Google Analytics processes technical data such as the type of device and browser, approximate location, and pages visited.

Google Analytics is activated only after the user gives consent through the cookie notice. Consent may be withdrawn at any time by changing the cookie settings.

11. Cookies

The website uses necessary cookies required for its operation and, subject to the user’s consent, analytical cookies. Detailed information about the types of cookies, their purposes, duration, and consent management is provided in a separate Cookie Policy document.

12. Transfers of Data Outside the EEA

As a general rule, we process personal data within the European Economic Area (EEA).

When using Google’s services, data may be transferred to the United States. Such transfers are based on the EU-U.S. Data Privacy Framework or the European Commission’s Standard Contractual Clauses. Any other transfer outside the EEA is carried out only where the requirements of Chapter V of the GDPR are met.

13. Data Retention Period

We retain personal data only for as long as necessary for the purpose of processing or as required by law:

Inquiries that do not result in a business relationship are retained for up to 12 months from the last communication.
Business correspondence with clients and partners is retained for the duration of the business relationship and for up to 5 years after its termination, in order to protect against potential legal claims.
Contracts are retained for the duration of the contract and until the expiry of applicable limitation periods and, where they constitute accounting records, for the periods prescribed for accounting documentation.
Invoices and accounting documentation are retained for at least 11 years, in accordance with the Accounting Act.
Data relating to contact persons used for presenting services (Article 21) is retained for up to 24 months from the last contact or until the individual objects, if they object earlier.
Google Analytics data is retained according to the service settings, for a maximum of 14 months.

After the applicable retention period expires, the data is deleted or anonymized.

14. Security of Personal Data

Blink d.o.o. implements appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures include access controls, encryption where appropriate, backups, and regular reviews of the effectiveness of the measures.

Access to personal data is limited to persons who need it to perform business or legal obligations.

15. Personal Data Breach

In the event of a personal data breach, Blink d.o.o. promptly takes measures to determine the scope of the breach, mitigate its consequences, and prevent recurrence.

Where required by the GDPR, we notify the Croatian Personal Data Protection Agency (AZOP) of a breach no later than 72 hours after becoming aware of it, and notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

16. Rights of Data Subjects

Depending on the circumstances and the legal basis for processing, you have the following rights:

right of access – to obtain confirmation as to whether your data is being processed and to access that data,
right to rectification – to request the rectification of inaccurate data or completion of incomplete data,
right to erasure – to request erasure of data where the conditions under the GDPR are met,
right to restriction of processing – in the cases provided for by the GDPR,
right to object – to object to processing based on legitimate interest; you may object to processing for direct marketing purposes at any time and without giving reasons,
right to data portability – to receive your data in a structured, commonly used, machine-readable format where the conditions under the GDPR are met,
right to withdraw consent – at any time, without affecting the lawfulness of processing carried out before the withdrawal.

17. How to Exercise Your Rights

You may submit a request:

by email to blink@blink.hr,
by post to Blink d.o.o., Kustošijski venec 8, 10000 Zagreb.

To protect your data, we may request additional information to verify your identity.

We respond to requests without undue delay and, in any event, no later than one month after receipt. In complex cases, the period may be extended by an additional two months, of which we will inform you in a timely manner. Exercising your rights is free of charge.

18. Provision of Personal Data

Providing personal data is not mandatory. However, certain data is necessary to respond to an inquiry, enter into and perform a contract, or comply with legal obligations. Without such data, Blink d.o.o. may not be able to provide the requested service.

19. Source of Personal Data

As a general rule, Blink d.o.o. collects personal data directly from the individual to whom it relates, for example through a contact form, email, telephone, or contract.

We may also collect data about business entities and their contact persons from publicly available sources, such as business registers and databases of business entities, publicly available advertisements, and company websites. In such cases, we inform the individual at the time of first contact about the source of the data and their rights.

20. Automated Decision-Making and Profiling

Blink d.o.o. does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect an individual.

We do not profile website visitors for remarketing or targeted advertising purposes.

21. Direct Marketing

Blink d.o.o. does not send newsletters.

Blink d.o.o. may contact business entities and their contact persons by email or telephone to present its services, based on legitimate interest. Only business contact data is processed for this purpose: first and last name, position, company name, business email address, and telephone number.

Each such communication contains information on how to opt out of further contact. The recipient may request at any time that they no longer be contacted by replying to the message or by contacting blink@blink.hr. After that, their data will no longer be used for this purpose.

22. Right to Lodge a Complaint

If you believe that your personal data is being processed in violation of applicable regulations, you have the right to lodge a complaint with the supervisory authority:

Croatian Personal Data Protection Agency (AZOP)
Ulica Metela Ožegovića 16, 10000 Zagreb
azop.hr

23. Changes to this Data Protection Policy

Blink d.o.o. may occasionally amend this Data Protection Policy to reflect changes in our business, technology, or applicable regulations. The current version is always available on this website.

Date of last update: [datum objave]

Privacy policy