Personal data are processed for the following purposes:

replying to an enquiry, booking, enabling rendering, improvement and payment of services, and other purposes stipulated in adequate laws and regulations.

We shall store your personal data only as long as required to fulfil an obligation set by laws and regulations or a legitimate interest, except where personal data are processed under your consent, where at the moment of withdrawing the consent the data processing is terminated.

You may withdraw your consent at any moment by sending your request:

• to our e-mail address: info@villadiana.hr,
• by post to the address: Osmijeh d.o.o., Kuzmanića 3, Split.

Please note that your withdrawing the consent does not effect legality of the data processing under your consent before its withdrawal.

If your personal data are required for the above stated purposes no more, they will be destroyed, except where their further storing is required by applicable regulations.

Your personal data will remain confidential when our coffee bar and restaurant or the coffee bar and restaurant web page are visited. We are committing ourselves not to reveal your personal data to any third person, except in the cases provided for by the valid laws and regulations. Your personal data will not be revealed to any unauthorised third person without your explicit consent, as that would be contrary to our Privacy Policies, the above mentioned Ordinance and other national laws and regulations.

The personal data are processed by the video surveillance system only for the purpose of protection of properties of the coffee bar and restaurant, their visitors and staff, except where the personal data by video surveillance system is overruled by the subject’s interests.

The recordings obtained by the video surveillance are stored up to six months, except where other regulations demand a longer storing period or where they make evidences in a court, administrative, arbitration or other similar proceeding.

The video surveillance includes only the space where the purposes stated in the paragraph 1 are being achieved.

The sanitary facilities and dressing rooms are not and, pursuant to the law, may not be covered by the video surveillance.

Osmijeh d.o.o. do not process personal data of the persons under the age of 18 by means of which these persons may be contacted by internet without an explicit consent by their parents or statutory guardians.

Osmijeh d.o.o. guarantee protection of personal data of children as provided by the special laws stipulating this matter.

Processing special categories of personal data relates to processing of personal data that reveal racial or ethnic origin, political opinions, religious or philosophical believes or trade-union membership, as well as processing of genetic data, biometric data for identification purposes, data related to health or sexual life or sexual orientation of an individual. Osmijeh d.o.o. neither collect nor use sensitive data, except where these are provided voluntarily aimed to receiving a particular service and meeting of personal requirements (e.g., adapting offered menus for religious reasons, and like).

Osmijeh d.o.o. transfer your personal data only to the countries members of the European Union and in line with the valid laws and regulations. Osmijeh d.o.o. do not transfer your personal data to third countries. Where such a transfer is necessary, Osmijeh d.o.o. will advise you adequately and will transfer the data only in line with the valid regulations.

Depending on the legal grounds of processing, your rights may be as follows:

• requesting access to the personal data related to you, and receiving information on the scope of the collected data, their processing purpose, category of the personal data being processed, the persons who are submitted the data and the storing period of time;
• requesting correction of incorrect and completing of incomplete personal data, in which case we are to act in line with your request without any undue delay;
• objecting to the personal data processing in cases of their processing in line with legitimate interests of Osmijeh d.o.o. or processing for marketing purposes;
• demanding erasure of the personal data when the processing purpose has been fulfilled, when you withdraw your consent that makes the only base of processing, when your privacy protection interests overrule the legitimate interests of Osmijeh d.o.o., when you objected processing for direct marketing purposes, when this is required by Osmijeh d.o.o. in order to honour their statutory obligations, and in cases of any illegal processing. The right to erasing is not an absolute right and does not apply, for instance, in cases where processing is necessary to implement the right to freedom of information and expression, honouring the statutory obligations of Osmijeh d.o.o. aimed to claiming, implementation or defending legal demands and like;
• limiting data processing where, for instance, you contest data correctness, as long as until we verified their correctness;
• transferring the data to another data processor if the processing is based on a consent or implementation of a contract that you are a party of, that is, where the processing is performed in an automated way and where that is technically possible;
• submitting an objection to the national supervising authority, the Data Protection Agency (Agencija za zaštitu osobnih podataka – AZOP).

If you want to access your personal data or you deem there is any irregularity in the personal data processing, please contact us in writing to our e-mail address: info@villadiana.hr, or to our postal address: Osmijeh d.o.o., Kuzmanića 3, 21000 Split, Croatia.

If you deem Osmijeh d.o.o. to have no legal grounds for processing your personal data, you may object in writing to our e-mail address: info@villadiana.hr, or to our postal address: Osmijeh d.o.o., Kuzmanića, 21000 Split, Croatia.

We are using several technical and organisational safety measures aimed to protection of your personal data against any accidental or intended manipulation, loss, destruction or accessing the data by unauthorised persons.