Rules on the handling of personal data

Dentvitalis Fides d.o.o. (Ltd) with headquarters in Rijeka, Krešimirova 60, Croatia, OIB (PIN) 39977041464 (hereinafter: Processor), subject to application of

• Regulation (EU) 2016/679 of the European Parliament and of the European Council as of 27th April 2016 (hereinafter: General Regulation) and
• the provisions of all other applicable regulations governing the protection of personal data

under these Rules regulates the protection of the personal data of individuals (natural persons) to whom it provides information and/or services in the frame of its activity.

Introductory regulations

1. The Rules on the handling of personal data is a unilaterally binding legal act based on the basic principles of the General Regulation and all other regulations applicable to the protection of the personal data of natural persons.
2. A Data subject is a natural person whose data is collected in accordance with these Rules.
3. Personal data is any information relating to an individual whose identity is identified or identifiable.
4. The Processing of personal data is any procedure or set of procedures in which personal data is used.

Principles of collection, processing and storage of personal data

1. The data subject's personal data is processed lawfully, fairly and transparently. Only data relevant to the provision of information and services within the activities of the Processor is collected and processed.
2. If the Data subject agrees, the Processor is willing to collect other personal data that would be used solely for the purpose of the better future healthcare of the Data subject.
3. Personal data is collected and stored in such a way as to protect it from theft, unauthorised use, loss, destruction or damage.
4. Personal data is collected, processed and stored exclusively in accordance with:
   • regulations on records in the field of health and other applicable legal regulations relating to specific type of data, and
   • business-justified needs, that is, needs conditioned by the process of providing services from the activities of the Processor.
5. The data subject provides personal data solely on a voluntary basis. In doing so, the Processor reserves the right to refuse service to any Data subject who does not provide personal data that is necessary for the quality and safe provision of the service.

The purpose of collection and processing of personal data

The Data subject's personal data is only collected and processed if at least one of the following conditions is met:

1. if the processing of personal data is necessary for the provision of services within the activities of the Processor,
2. if there is a legal obligation to process it,
3. if there is a need to protect the key interests of the Data subject or other natural person,
4. if processing is necessary for the performance of a public interest task,
5. if processing is necessary for the protection of the legitimate interests of the Processor, except in cases where the protection of the Data subject, or his fundamental rights, should be given priority (eg. protection of the interests of the child).

Method of collecting Data subject's personal data

The Data subject's personal data is collected in the following ways:

1. Directly by the Data subject to whom the Processor provides services within his business activity. The Data subject may provide this information either orally, in writing, or through the Processor's website.
2. Through medical and other documentation of third parties made available by the Data subject to the Processor.
3. Through the medical and other documentation of the Data subject, which arises in the process of providing services from the activities of the Processor (e.g. diagnostic material, records of medical procedures, medications, processes, etc.).
4. Through the documentation from third parties involved in the process of providing services to the Data subject (e.g. laboratory test results, dental technician's dental scans, etc.).

Transfer of personal data

The Data subject's personal data is only transferred to third parties for the purpose of:

1. fulfilment of obligations provided by law
2. execution of certain tasks for which the Processor has hired a third party (e.g. dental laboratory, accounting office, etc.)

The duration and storage of personal data

The Processor will keep the Data subject's personal data in accordance with the time limits prescribed by the Law, and if this is not the case, then only until such time when their storage is commercially justified. Exceptionally, personal data will be retained for longer than the said period if its storage is a condition for the legitimate protection of the interests of the Processor. The personal data of the Data subject will be deleted after the expiry of the legal period obliging the Processor to keep certain personal data or cease the purpose of keeping them.

The rights of the Data subject

1. Right to access personal data

   The Processor is obliged, on the basis of a written request, to allow the Data subject access to any personal data, to inform him/her about the purpose of processing personal data, about the type of personal data being processed, about the recipients or categories of recipients to whom the personal data has been disclosed or will be disclosed, about the estimated timeframe for its storage, or about the criteria used to determine that period.

2. The right to correct inaccurate personal data

   The Processor is obliged to allow the Data subject to correct inaccurate or to supplement existing personal data.

3. The right to delete personal data

   The Processor will delete the Data subject's personal data in the following cases:

   • when the Data subject's personal data is no longer necessary for the fulfilment of the purpose of processing, that is, with the termination of the purpose of processing,
   • when the Data subject withdraws his/her consent as the legal basis for data processing, and there is no other legal basis for further processing of such data,
   • when the Data subject files a justified objection to data processing,
   • when personal data must be deleted in order to fulfil legal obligations.
4. The right to restrict data processing

   The Processor will restrict the processing of personal data if one of the following conditions is met:

   • Data subject disputes the accuracy of personal data,
   • the processing of personal data is illegal, but the Data subject does not seek deletion, only restriction of its processing,
   • The Processor no longer needs personal data, but the Data subject requests its partial processing to protect his/her interests.
5. The right to lodge a complaint

   The data subject has the right to lodge a complaint about the processing of his/her personal data. The Processor reserves the right to disregard such a complaint if there is a justified legitimate interest in processing the personal data of the Data subject.

6. The right to data portability

   The data subject has the right to request the transfer of personal data to another Processor in the following cases:

   • in the case of data obtained by the Processor on the basis of a revocable consent,
   • if so agreed,
   • if the data processing is carried out automatically.
7. The right to Request the determination of violation of rights

   The data subject has the right to file a Request for determination of violation of rights to the Personal Data Protection Agency.

8. Revocation of consent

   The Data subject may, at any time, withdraw his consent for the collection and processing of personal data not covered by this Rules.

Information and objections

For any questions or complaints with regard to the protection of personal data by the Processor, the Data subject may contact the Data Protection Officer in writing:

Data Protection Officer
Dentvitalis Fides d.o.o. (Ltd)
Krešimirova 60, Rijeka
dpo@dentvitalis.com

All inquiries and requests will be processed by the Processor without undue delay and in accordance with the statutory deadlines.

Amendments to the Rules on handling personal data

The Processor retains the right to amend these Rules at any time and without any prior notice.

Dentvitalis Fides d.o.o.
Rijeka, 25.05.2018.