INTRODUCTION
BELJE plus, a limited liability company, Svetog Ivana Krstitelja 1a, 31 326 Darda, OIB 35385249539 (“Belje”), gives particular attention to protecting the personal data and privacy (“privacy protection”) of website visitors, business partners, job applicants, employees, former employees and other individuals (“Users”). We act in accordance with the General Data Protection Regulation (EU 2016/679) (“Regulation” or “GDPR”), applicable laws, best practice and internationally accepted standards, taking account of business and security requirements.
Confidential, responsible processing of personal data is central to the corporate culture of Belje plus d.o.o., Darda (“BELJE”). This applies particularly to data about employees, business partners, applicants, visitors and similar individuals (“Data”).
This Privacy Policy describes the rules we follow when processing personal data, data linking, consent, safeguards, processing locations, disclosure to third parties, your rights and who to contact about privacy protection.
About the Personal Data Protection Policy
This Policy provides clear, transparent information in one place about processing and protecting Users’ data, allowing straightforward oversight and management of data and consent.
It does not diminish Users’ rights or create obligations beyond applicable law and any contractual data protection provisions.
The Policy is a unilateral, legally binding instrument describing the purposes and objectives of collecting, processing and managing personal data, based on leading international practice. It ensures appropriate protection under the GDPR and other applicable data protection laws.
It applies to all Belje websites and domains and all services and products involving personal data processing. It primarily concerns individuals requesting or using services or otherwise contacting Belje. Respecting the legitimate interests of legal entities, it also applies to them as appropriate under applicable law.
Its objective is to establish appropriate processes to protect and manage data about website visitors, business partners, job applicants, employees and other data subjects.
By supplying your data, you agree to contact with us and authorise processing for the stated purpose. Protection of your privacy is ongoing.
Published as an official document, the Policy applies from 1 April 2019.
Please check it periodically for changes published on Belje’s websites.
Definitions Used in This Policy
Personal data means information relating to an identified or identifiable individual. Identification may be direct or indirect, particularly through a name, identification number, location data, online identifier, or factors specific to physical, physiological, genetic, mental, economic, cultural or social identity. Examples include names, addresses, email, IP and MAC addresses, GPS location, RFID tags, website cookies, phone numbers, photographs, videos, OIB, fingerprints, iris scans, genetic data, education and qualifications, salary, credit debt, bank accounts, health, sexual orientation, voice and any other information capable of identifying the individual directly or indirectly.
Processing means any operation or set of operations on personal data, automated or otherwise, including collection, recording, organisation, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment, combination, restriction, erasure or destruction.
Controller means an individual, legal entity, public authority, agency or other body determining the purposes and means of processing, alone or jointly.
Processor means an individual, legal entity, public authority, agency or other body processing personal data on a controller’s behalf.
Recipient means an individual, legal entity, public authority, agency or other body receiving personal data, whether or not a third party.
Third party means a body or person other than the data subject, controller, processor or persons authorised to process data under the controller’s or processor’s direct authority.
Consent: see section 8 of this Policy.
Filing system means a structured set of personal data accessible under specific criteria, whether centralised, decentralised or dispersed functionally or geographically.
Personal data breach means a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, transmitted, stored or otherwise processed personal data.
Identifiable person means someone identifiable directly or indirectly, particularly through an identification number or characteristics of physical, psychological, mental, economic, cultural or social identity.
Special category personal data relates to racial or ethnic origin, political opinions, religious or other beliefs, trade union membership, health or sex life, and criminal or misdemeanour proceedings.
Scope
The Policy applies to all personal data about Users and Prospective Users.
Personal data means information relating to a directly or indirectly identified or identifiable individual (“data” or “personal data”). Processing includes any action on those data, such as collection, recording, storage, use, transfer or consultation.
The Policy does not apply to anonymous data: information altered so it cannot be linked to an individual, or only through disproportionate effort, and therefore not considered personal data under applicable law.
It applies to all Belje services and products involving personal data. A User’s latest statement regarding processing applies to all other services they use.
Belje generally acts as controller for Users’ personal data under applicable law.
Principles of Personal Data Processing
Trust
We aim to be a reliable partner in protecting privacy and to honour Users’ trust through transparent, clear processing.
Users may always request changes to their data or state the purposes for which they do or do not want processing.
Lawfulness and Best Practice
We comply with law and strive for higher standards and European best practice, guided by leading external consultants. Employees handling data sign confidentiality declarations and receive ongoing training.
Belje periodically audits implementation of all data protection policies to ensure legal compliance and improve protection within the company.
Purpose Limitation
We collect and process data only for specified lawful purposes. Further processing must remain compatible unless otherwise permitted by law or User consent.
Data Minimisation
We use only data adequate and necessary for the specific lawful purpose, and no more.
Processing Without Names
Where possible and justified, we use unnamed data, primarily anonymous information. To protect Users, we also pseudonymise data where appropriate, using substitution, hashing or similar techniques to mask them. Identification requires additional information, such as a key, stored separately and securely.
Integrity and Confidentiality
We process securely, protecting against unauthorised or unlawful processing and accidental loss, destruction or damage. Only authorised persons needing data for their work have access, rather than other employees.
Data Quality
Data must be accurate, complete and current to protect Users and prevent misuse. Users should notify us of changes immediately or as soon as possible.
Storage Limitation
We retain and process data only as long as necessary for a legitimate purpose, unless law requires a longer or shorter period or another expressly prescribed circumstance applies. Data are then permanently erased or anonymised.
Generally, retention follows regulatory requirements and best practice to support supply chain traceability, consumer safety, integrity and standards. Periods depend on the data’s nature and may change.
Employees access data according to their authority and duties. Other legal entities providing services receive data only where necessary to fulfil joint contractual obligations or based on a User’s express request or consent.
Belje also supplies data to businesses or state institutions where a legal basis exists.
How We Collect Personal Data
Belje collects Users’ personal data in several ways:
1. Primarily directly from Users or Prospective Users. Requests for services or products may require identification information and documents, such as name, address, document copies and OIB. We also collect data through phone, email, Human Resources, websites, contact forms, online portals, social media, complaints and applications. These data fulfil Users’ requests. Where lawful and possible, we inspect documents and make a record rather than retain copies, particularly for biometric or sensitive material.
2. Automatically when Users use or provide services or products.
3. From public sources, including registers, telephone directories, public or commercial services and publicly available numbering information.
4. Under agreements with business partners.
5. Under employment or service contracts and while work or services are performed.
6. Through CCTV and entry and exit records at company premises, and GPS in company vehicles and machinery. CCTV use is detailed in the publicly available CCTV Rules. Vehicle and machinery monitoring checks compliance with company vehicle rules and efficient machine operation. GPS data may include current location, speed and status; historical routes; daily, weekly and monthly reports; distance and driving time; stops and their timing; speeding; visits to points of interest and geofenced areas, including entry and exit; use during and outside working hours; operation, fuel consumption and proper use. These data are retained for five years.
Every collection requires an appropriate legal basis: law, legitimate interest or User consent.
Types of Personal Data We Collect
Depending on the service or product, consent and purpose, Belje may collect the categories below. We collect only what is necessary for a lawful purpose, legitimate business interest or public interest.
Belje does not process special categories or data concerning criminal convictions and offences, except a criminal record clearance certificate inspected when an employment contract is concluded and then returned to the employee.
Belje collects information on offences committed at or during work to meet statutory duties or prove compliance.
Contractual Data
This includes core information provided to conclude and perform agreements: name, birth date and place, postal and delivery addresses, telephone and email, OIB, JMBG, ownership, possession, lease, rental, concession, bank account, marital status, citizenship, nationality, medical fitness, disability, children, qualifications and similar data.
Communications with Belje
This includes written and electronic correspondence, social media communications, preferred channels, requests and job applications.
On our website and related websites, we may automatically collect device information: IP address, accessed filename, access date and time, data transferred, successful access notifications, browser, device type and unique identifiers. We may collect interactions, including pages viewed and links opened.
This helps us understand visitors, where they come from and their interests. Internal analysis improves website quality and tailors content to visitors.
Some information is collected through cookies or similar technologies. See the website cookie information and terms of use for details.
Requests CVs and Job Applications
Our website allows submission of applications, CVs and supporting documents. Interviews and tests may provide further data.
We use these data in selection processes according to changing recruitment needs at Belje or subsidiaries.
For a specific vacancy, data are used solely for that selection. They are deleted or destroyed afterwards unless the applicant is employed or expressly consents in writing to retention in the candidate database for future recruitment.
Unsolicited applicants must sign consent permitting storage and use for future selection or job offers. Belje retains these data for five years from the latest consent. Postal applications without consent prompt a request for signed consent within eight days, unless this requires excessive effort. Without timely consent, data are destroyed. See section 7 for further information on consent.
Application, internship, test and interview data are accessible only to Human Resources employees. Where necessary, they may be shared with internal staff involved in selection who have signed confidentiality declarations.
Prospective User Data
This includes core and contact data, such as name and email, and interest in Belje products or services. We generally record information about people requesting information or offers. Data are deleted or anonymised after five years, or sooner on request, unless legal obligations require longer retention, for example in a dispute.
External Sources
We may occasionally receive data from external sources, including public registers, website publications and media.
Special Categories of Personal Data
Sensitive data reveal racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic information, biometric identification, health, sex life or sexual orientation.
Such data are generally processed on one of these bases:
- Your explicit consent, Article 9(2)(a) GDPR.
- Establishing, exercising or handling legal claims, Article 9(2)(f) GDPR.
- Exceptionally, protecting vital interests when you cannot consent, Article 9(2)(c) GDPR.
Belje generally does not collect sensitive data except religion and trade union membership, solely to fulfil legal obligations or employee rights and obligations under internal rules, including the Collective Agreement and Work Rules.
Purposes for Which We Use Personal Data
Providing a service requires a minimum set of data necessary for quality delivery under the conditions below. If a User refuses required information, Belje may be unable to provide the service or process the request.
Processing takes place when one of the following conditions is met.
Performance of a Contract
Belje primarily collects and uses data to conclude and perform agreements, including any clear expression of intent, and for employment and termination. This includes identity and ability to pay checks, service delivery, billing and collection, necessary contact, complaints, fault resolution, quality and safety monitoring, customer support, advice and assistance, and other lawful contractual actions.
The legal basis is necessity for contract performance or pre contractual steps requested by the User. Without required data, Belje may be unable to conclude or perform the agreement.
Data are also collected to fulfil employment contracts and rights under the Collective Agreement and Work Rules.
Legitimate Interest
Belje uses certain data only for internal records to protect Users’ legitimate interests, unless overridden by their interests or fundamental rights and freedoms. Examples include preventing, detecting and pursuing misuse affecting Users or the company; employee, User, product and service safety; developing suitable offers; marketing and promotion; high quality customer experiences; personalised support; and electronic communications network optimisation.
The basis is Belje’s legitimate interest unless overridden by User interests or fundamental rights and freedoms, and/or protection of the vital interests of a User or another individual. Cases described in section 7 where consent is the basis are exceptions.
Legal Obligations and Public Interest Tasks
On a written request grounded in applicable law, Belje must provide certain data or access to competent state authorities.
The basis is compliance with legal obligations and performance of public interest tasks.
We comply with Croatian and applicable European law, and relevant industry standards, including ISO, HACCP, GLOBAL GAP and OHSAS.
Personal Data Safeguards
The controller must restrict access to authorised persons who have signed confidentiality declarations and completed internal training.
It must protect networks and systems against:
- Fire
- Flood
- Power loss
- Unauthorised access
Protection also includes antivirus software, encryption, pseudonymisation where possible and other appropriate information security measures.
Written records are kept in files, locked cabinets or safes. Computer data are protected by usernames and passwords known to processing staff and, for additional security and confidentiality, stored on portable media and server backups.
Consent
Consent is a freely given, specific, informed and unambiguous indication of a User’s wishes, expressed by a statement or clear affirmative action agreeing to processing, or opt in. It may be written or given through another appropriate method. It can be given or withdrawn at any time free of charge. Not every processing activity requires consent.
Users may change or withdraw consent in writing by email or post, where identity can be established reliably, or by visiting a Belje office. Depending on the channel, the change or withdrawal is recorded within forty eight hours of receipt, provided identity is established beyond doubt.
Rights of Data Subjects and Users
Applicable law provides the following rights.
Right to Information
You may know which data are collected, from what sources and why. Contact us at any time to request this information.
Right to Rectification
You may request correction of inaccurate data. We work with you to maintain accuracy, but errors may occur. We undertake to comply with correction requests.
Right to Be Forgotten
You may request deletion from our servers. We comply unless law requires retention. Within technical capabilities, Belje deletes or anonymises data in all databases relating to consent based processing.
Right to Restrict Processing
GDPR permits restriction in certain circumstances. Our review of processing purposes and methods identified no case where this would apply. Requests under this right will be treated as withdrawal of consent, leaving only essential notifications.
Right to Data Portability
You may request personal data in a structured format. Belje responds within thirty days. We provide only data you supplied or that we collected from public sources or partners.
Right to Object
You may object to processing based on the company’s legitimate interest.
Automated Decision Making
Belje does not carry out automated decision making except personalised advertising after website visits, for which explicit consent is obtained. You may withdraw it at any time.
Requests to exercise GDPR rights must be in writing. Action cannot be taken before identity is established beyond doubt.
Request forms are available by emailing dpo@belje.hr.
International Data Transfers
Your data may be transferred to and processed in countries outside the EU where the European Commission has not established an adequate level of protection, and equivalent protection may not be available. Local laws may permit governmental access. We have appropriate safeguards to protect data under this notice. We seek consent where transfers are not governed by specific laws or other safeguards. Details of safeguards are available on request.
Our websites will expressly warn you of any transfer outside the EU.
Business partners providing system, equipment and application maintenance, physical or technical security, subcontracted services and similar support may access certain data. Belje will notify you and, where necessary, request consent. We require the highest data protection standards from partners.
Job and internship applications may be shared with internal staff involved in selection who have signed confidentiality declarations.
Processors
Under a written agreement, the controller may entrust processing tasks within its activities to another individual or legal entity acting as processor.
Only registered processors offering sufficient guarantees for appropriate safeguards may be appointed. For classified information, they must meet specific information security requirements.
How Long We Keep Your Data
During the business relationship, data are retained as long as necessary for their purpose or while contractual or statutory retention and documentation obligations apply, including tax rules, the Civil Obligations Act, Labour Act, limitation periods, education law obligations or legitimate interests.
Once no legitimate retention purpose remains, data are deleted or anonymised. If immediate deletion is impossible, for example in backups, data are kept securely and excluded from further processing until deletion is possible.
Detailed retention periods are set out in the Rules on Protection and Processing of Archival and Registry Material.
Data Protection Officer
The controller appoints a Data Protection Officer, or DPO.
The DPO reports directly to the controller’s responsible person, may not receive instructions from other employees, and maintains direct contact with the supervisory authority.
The DPO oversees lawful processing and data protection rights, particularly:
- Informing and advising controllers, processors and staff about GDPR and other EU or national obligations.
- Monitoring compliance with law and policies, including responsibilities, awareness, training and audits.
- Advising on data protection impact assessments when requested and monitoring implementation.
- Cooperating with and acting as contact for the supervisory authority, including prior consultation and other advice as needed.
The DPO considers processing risks, nature, scope, context and purposes.
Required expertise includes:
- National and European data protection law and practice, with deep GDPR understanding.
- Practical understanding of processing operations.
- Information technology and data security.
- The controller’s business and working organisation.
- Ability to promote a data protection culture.
The DPO must not be:
- The controller’s legal representative.
- A person collecting and processing personal data.
- The Human Resources director.
- The head of Information Technology.
- Another senior manager or person determining processing purposes and methods who has an actual or potential conflict of interest.
Who to Contact
Users may exercise rights by submitting an appropriate request to dpo@belje.hr or:
BELJE plus d.o.o.
Svetog Ivana Krstitelja 1a, 31 326 Darda
A personal data request form is also available on our website.
Final Provisions
This Policy takes effect on 1 August 2020.
Changes will be published on the company website with the version number and month of the latest update. BELJE plus d.o.o.