LEGAL INFORMATION

Privacy and Personal Data Protection Policy

June 2026
Revision History:
Version:

Date:  

Author of Change:

Summary of Change:
           

Purpose:
The purpose of this document is to determine organisational responsibilities and the protection of personal data. This document addresses the provisions of Chapter II of the General Data Protection Regulation and Chapter IV – controller and processor, Articles 24 to 31 of the General Data Protection Regulation.
Contents

1 Introduction
2 Privacy and Personal Data Protection Policy
2.1 General Data Protection Regulation
2.2 Definitions
2.3 Principles of Personal Data Processing
2.4 Rights of Individuals
2.5 Lawfulness of Data Processing
2.5.1 Consent
2.5.2 Performance of a Contract
2.5.3 Compliance with Legal Obligations
2.5.4 Vital Interests of the Data Subject
2.5.5 Processing Necessary for the Performance of a Task Carried Out in the Public Interest
2.5.6 Legitimate Interests
2.6 Privacy by Design
2.7 Contracts Involving the Processing of Personal Data
2.8 Cross-Border Transfer of Personal Data
2.9 Data Protection Officer (DPO)
2.10 Personal Data Breach Notification
2.11 Compliance with the General Data Protection Regulation
List of Tables

Table 1 – Deadlines for Complying with the Rights of the Data Subject

1 Introduction
In its day-to-day business operations, ZENITH, sole proprietorship for real estate brokerage, owner Zvonimir Rakić, Vodice, Ante Starčevića 25, Personal Identification Number (OIB): 96044650550 (hereinafter: the Company) uses various personal data of individuals on the basis of which their identity may be established, including data concerning:
-    current, former and future employees and other persons engaged to work;
-    clients, principals, buyers, sellers, tenants, landlords, lessees and lessors;
-    suppliers, business partners, external associates and service providers;
-    owners, co-owners, authorised representatives and other persons connected with the properties that are the subject of brokerage;
-    persons participating in viewings, negotiations, the conclusion or performance of legal transactions relating to real estate;
-    the sole trader, i.e. the owner of the Company;
-    persons who enter the Company's business premises or otherwise communicate with the Company;
-    contractors, subcontractors, designers, supervising engineers and other persons involved in the arrangement, maintenance, adaptation or construction of properties connected with the Company's business.
In collecting and using the aforementioned data, the Company acts in accordance with the applicable regulations that determine the manner in which such activities are carried out and that determine the protective measures that must be ensured for the protection of such activities.
The purpose of this policy is to set out the applicable regulations and to describe the steps taken by the Company to ensure that such conduct is in accordance with the applicable regulations.
This control applies to all systems, individuals and processes forming an integral part of the organisation's information system, including employees, suppliers and other third parties who have access to the Company's information system.

2 Privacy and Personal Data Protection Policy
2.1 General Data Protection Regulation
The General Data Protection Regulation 2016 (hereinafter: the GDPR) is one of the most significant regulations determining the manner in which the Company carries out its activities relating to the processing of personal data. High fines are prescribed for conduct contrary to the GDPR, which have been set in order to protect the personal data of citizens of the European Union. Through its policy, the Company ensures compliance with the GDPR and other applicable regulations in a clear manner that can be demonstrated at any time.

2.2 Definitions
The GDPR sets out 26 definitions, and it is not necessary to list all of them in this document. However, the following definitions are highlighted as fundamental to this Policy:
"Personal data" means:
any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
"Processing" means:
any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
"Controller" means:
the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

2.3 Principles of Personal Data Processing
There are several basic principles on which the GDPR is founded.
These principles are as follows:
1. Personal data must be:
(a) processed lawfully, fairly and in a transparent manner in relation to the data subject ("lawfulness, fairness and transparency");
(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Art. 89(1), not be considered to be incompatible with the initial purposes ("purpose limitation");
(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ("data minimisation");
(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay ("accuracy");
(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1), subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject ("storage limitation");
(f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures ("integrity and confidentiality");
2. The controller shall be responsible for, and be able to demonstrate, compliance with paragraph 1 ("accountability").
The Company ensures conduct in accordance with the aforementioned principles both in the personal data processing currently carried out and when introducing new methods of personal data processing, such as new IT systems.

2.4 Rights of Individuals
The data subject has certain rights in accordance with the GDPR. The rights of the data subject consist of the following rights:
1.    the right to be informed;
2.    the right of access;
3.    the right to rectification;
4.    the right to erasure;
5.    the right to restriction of processing;
6.    the right to data portability;
7.    the right to object;
8.    rights in relation to automated decision-making and profiling.
Each of the aforementioned rights is guaranteed through the Company's corresponding internal rules, which enable the necessary actions to be taken within the deadlines set in accordance with the GDPR.
Deadlines for complying with the aforementioned rights of the data subject are set out and shown in Table 1.
Data subject's request    Deadline
Right to be informed    During the collection of data (if the data is collected from the data subject) or within one month (if the data was obtained from another source)
Right of access    One month from receipt of the request
Right to rectification    One month from receipt of the request
Right to erasure    Without undue delay
Right to restriction of processing    Without undue delay
Right to data portability    One month from receipt of the request
Right to object    At the time the objection is received
Right in relation to automated decision-making and profiling    Not specified
Table 1 – Deadlines for Complying with the Rights of the Data Subject

2.5 Lawfulness of Data Processing
There are six alternative means by which the lawfulness of the processing of personal data is achieved in each individual case, in accordance with the GDPR. It is the Company's task to identify and document, through its policy, the basis for the processing of personal data, in accordance with the GDPR.
Legal bases for the processing of personal data:
-    performance of a contract / pre-contractual actions: brokerage agreements, communication with the Client, buyer, seller, landlord, tenant;
-    legal obligation: accounting, taxes, anti-money laundering (AML/KYC), obligations arising from the regulations on real estate brokerage;
-    legitimate interest: protection of legal claims, evidencing viewings, communication with business partners, security of the premises, potential debt collection;
-    consent: newsletters, promotional messages, publication of photographs of individuals, use of special marketing tools not necessary for the basic service.
These options are briefly described in the sections below.

2.5.1 Consent
The Company obtains the data subject's consent only in cases where consent is the appropriate and required legal basis for the processing of personal data, in particular for certain marketing activities, the sending of newsletters, the publication of photographs of individuals, the use of certain cookies or other tools that are not necessary for the performance of a contract, compliance with a legal obligation, or the pursuit of the Company's legitimate interest.
Where processing is based on consent, the Company ensures that consent is given freely, for the specific purpose, in an informed manner and unambiguously. The data subject has the right to withdraw their consent at any time, whereby the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
The Company does not use consent as the legal basis for processing where another appropriate legal basis exists, for example the performance of a contract, taking steps prior to concluding a contract, compliance with a legal obligation, or the pursuit of a legitimate interest.

2.5.2 Performance of a Contract
The data subject's explicit consent is not required where the collection and processing of personal data is necessary for the performance of a contract to which the data subject is a party. This will often be the case where the contract cannot be performed without the collection and processing of personal data, e.g. delivery cannot be carried out without the delivery address.

2.5.3 Compliance with Legal Obligations
The data subject's explicit consent is not required where personal data is collected and processed in order to comply with legal obligations. This may be the case with certain data relating to employment and taxation, as well as in cases relating to the field of activity of the public sector.

2.5.4 Vital Interests of the Data Subject
Where personal data is necessary in order to protect the vital interests of the data subject or of another natural person, this constitutes a lawful basis for the processing of personal data. In cases where this ground is used as the lawful basis for collecting personal data, the Company shall act reasonably in assessing the existence of the lawful basis and shall document evidence confirming the existence of such a lawful basis for collecting personal data. This basis may, for example, be used in aspects of social welfare, particularly in the public sector.

2.5.5 Processing Necessary for the Performance of a Task Carried Out in the Public Interest
Where the Company needs to carry out a task that it believes to be in the public interest, or that is necessary for the exercise of official authority, the data subject's explicit consent is not required. The assessment of the public interest or official authority shall be documented and made available as evidence where necessary.

2.5.6 Legitimate Interests
Where the processing of specific data is necessary for the protection of the Company's legitimate interests, and it is considered that such processing does not significantly affect the rights and freedoms of the data subject, this may constitute a lawful ground for the processing of personal data. The justification for the existence of this ground must be documented.
Advertising of Properties and Photographs
In the course of carrying out the activity of real estate brokerage, the Company may process personal data associated with the properties that are the subject of brokerage, including photographs, recordings, descriptions, documentation and other data required for the advertising, presentation and brokerage of the sale, purchase, letting or leasing of properties.
When photographing, filming and advertising properties, the Company shall ensure that personal data of data subjects that is not necessary for advertising the property is not published, including photographs of individuals, personal documents, family photographs, private correspondence, invoices, vehicle registration plates, medical records, financial documentation and other items or data from which the identity of a particular individual could be directly or indirectly established.
Where applicable and reasonably possible, the Company shall, prior to publishing photographs or recordings of the property, remove or obscure personal data and other identifying marks that are not necessary for advertising the property.
The publication of information about the property and photographs of the property is carried out for the purpose of performing the brokerage agreement, undertaking pre-contractual actions, advertising the property and pursuing the legitimate interest of the Company and the Client in finding interested buyers, tenants, lessees or other contracting parties.
Recipients of Personal Data
The Company processes personal data solely to the extent necessary for carrying out its registered activity, performing contractual and legal obligations, and protecting its rights and legitimate interests.
Depending on the purpose of the processing, personal data may be disclosed to the following categories of recipients:
a)    buyers, sellers, landlords, tenants, lessors, lessees, principals and other persons participating in the legal transaction relating to the property;
b)    authorised representatives, lawyers, notaries public, banks, credit institutions, valuers, surveyors, energy certificate issuers and other professionals involved in the preparation, conclusion or performance of the legal transaction;
c)    accounting service providers, tax advisers and other external service providers performing administrative, bookkeeping, tax, IT or other business services for the Company;
d)    providers of IT, communication, hosting, e-mail, CRM, marketing and similar services;
e)    real estate advertising portals and platforms, where necessary for advertising the property;
f)    competent authorities, including the Tax Administration, the Anti-Money Laundering Office, courts, notaries public, competent ministries and other public-law bodies, where there is a legal obligation or other lawful basis for this.
Where necessary, the Company enters into appropriate agreements or other legal instruments with external processors, regulating the protection of personal data and the obligation to act solely in accordance with the Company's instructions.
Website, Cookies and Online Communication
Where the Company uses a website, contact forms, electronic mail, social networks, analytical tools, marketing tools or other forms of online communication, the personal data of data subjects may also be processed through these means.
Through the website or online communication channels, the Company may process personal data such as first and last name, contact details, the content of enquiries, information about the property in which the data subject expresses interest, IP address, technical data about the device and browser, and other data that the data subject themselves provides to the Company.
Where the Company uses cookies or similar technologies, it shall provide data subjects with clear and accessible notice of the types of cookies, their purpose, duration and the option to manage cookie settings.
Cookies that are not necessary for the functioning of the website, in particular analytical and marketing cookies, shall be used only where an appropriate legal basis exists, including the data subject's consent where required.
The Company may use social networks and internet platforms to advertise properties, communicate with clients and interested parties, and promote its services. In such cases, the processing of personal data through such platforms is also subject to the privacy rules of the respective platform provider.

2.6 Privacy by Design
The Company has adopted the principle of privacy by design and shall ensure that the definition and planning of any new or significant changes to systems that collect or process personal data are subject to privacy protection rules, including the carrying out of one or more data protection impact assessments.
A data protection impact assessment includes:
-    consideration of the manner in which personal data will be processed and for what purposes
-    assessment of whether the proposed processing of personal data is necessary and proportionate to the purpose(s)
-    assessment of the risks to individuals in the processing of personal data
-    what controls are necessary to address the identified risks and to demonstrate compliance with the regulations.
The use of techniques such as personal data minimisation and pseudonymisation shall be taken into account where applicable and appropriate.

2.7 Contracts Involving the Processing of Personal Data
The Company shall ensure that all relationships it enters into that involve the processing of personal data are subject to a written agreement, which includes the specific information and conditions prescribed by the GDPR.

2.8 Cross-Border Transfer of Personal Data
As a rule, the Company does not transfer personal data to third countries outside the European Economic Area.
Should such a transfer occur due to the use of IT, communication, hosting, cloud, marketing, analytical or other tools whose service providers may process personal data outside the European Economic Area, the Company shall ensure that the transfer is carried out only where an appropriate legal basis exists and where the appropriate safeguards prescribed by the GDPR have been ensured.
Such safeguards may include an adequacy decision of the European Commission, standard contractual clauses, additional technical and organisational protective measures, or other mechanisms permitted by the GDPR.
Records of Processing Activities
The Company maintains records of personal data processing activities in accordance with the GDPR, to the extent applicable given the nature, scope, context and purposes of the processing of personal data.
The records of processing activities may in particular cover the following activities:
g)    brokerage in the sale, purchase, letting and leasing of properties;
h)    conclusion and performance of brokerage agreements;
i)    communication with principals, buyers, sellers, tenants, landlords, lessees, lessors and other interested parties;
j)    advertising of properties;
k)    organisation and recording of property viewings;
l)    processing of ownership, land registry, construction, use, energy and other documentation related to properties;
m)    implementation of measures to prevent money laundering and terrorist financing, where applicable;
n)    accounting, invoicing and fulfilment of tax obligations;
o)    processing of data of employees, job candidates and other persons engaged to work;
p)    communication with business partners, suppliers and external associates;
q)    marketing, newsletters and other promotional activities, if carried out;
r)    processing of data via the website, cookies, social networks and online tools, if used;
s)    video surveillance, if carried out.
The records of processing activities contain, in particular, the name and contact details of the Company, the purposes of processing, a description of the categories of data subjects and categories of personal data, the categories of recipients of personal data, information on transfers to third countries, if any, the envisaged retention periods, and a general description of the technical and organisational protective measures.
Data Processing under the Anti-Money Laundering and Counter-Terrorist Financing Act
The Company processes personal data of parties and other relevant persons for the purpose of implementing measures to prevent money laundering and terrorist financing, including the identification and verification of the identity of the party, the establishment of the beneficial owner, the verification of the purpose and nature of the business relationship, and other measures prescribed by special regulations.
The processing of personal data may cover: first and last name, OIB (personal identification number), address, date of birth, nationality, a copy of the identity card/passport, information on the beneficial owner, information on politically exposed persons, and information on the transaction and purchase price.
Retention period of personal data:
Category of documentation    Retention period
Brokerage agreements, viewing confirmations, business-related communication    at least until the expiry of the limitation periods for claims
Invoices and accounting documents    at least 11 years
AML/KYC documentation    10 years
Documentation of job candidates who were not employed    e.g. 6 months, unless the candidate agrees to longer retention
Marketing consents    until consent is withdrawn
Enquiries from interested buyers/tenants    reasonably limited, e.g. 12–24 months, depending on the business purpose

Cross-Border Transfer of Personal Data
The transfer of personal data outside the European Union, i.e. the European Economic Area, is carefully verified prior to the transfer itself in order to ensure compliance with the framework imposed by the GDPR. Such a transfer partly depends on the assessment of the European Commission regarding the adequacy of the personal data protection measures applied in the recipient country, which may change over time.
The international transfer of personal data within a group is subject to legally binding agreements constituting binding corporate rules under Art. 47 of the GDPR, guaranteeing rights for data subjects, and in the absence thereof the Company shall use standard contractual clauses on data protection.

2.9 Data Protection Officer
The Company is not obliged to appoint a Data Protection Officer unless the conditions prescribed in Article 37 of the GDPR are met in its operations, in particular where the Company's core activities would involve regular and systematic monitoring of data subjects on a large scale or the large-scale processing of special categories of personal data.
Given the nature and scope of its business, the Company does not, as a rule, carry out personal data processing that would require the mandatory appointment of a Data Protection Officer.
Notwithstanding the above, the Company may voluntarily appoint a person responsible for data protection matters, or designate a contact person to whom data subjects may turn in relation to the exercise of their rights and matters concerning the processing of personal data.

2.10 Personal Data Breach Notification
The Company's policy must be fair and proportionate when considering the actions required to inform data subjects affected by a personal data breach. In accordance with the GDPR, in the event of a personal data breach, where it is likely to result in a risk to the rights and freedoms of an individual, the supervisory authority shall be notified within 72 hours. This is carried out in accordance with the rules of conduct for security incidents under the Company's procedure, which sets out the overall process for managing information security incidents.
In accordance with the GDPR, for breaches of its provisions, the competent data protection authority may impose fines of up to 4% of total worldwide annual turnover, or EUR 20 million.

2.11 Compliance with the General Data Protection Regulation
The following actions are taken to ensure that the Company complies at all times with the principles established by the GDPR:
-    the legal basis for the processing of personal data is clear and unambiguous;
-    a Data Protection Officer has been appointed with specific responsibility for data protection within the organisation (if required);
-    all employees involved in handling personal data understand their responsibilities in relation to good practice in personal data protection;
-    training in the field of personal data protection is provided to all employees;
-    consent rules are observed;
-    data subjects wishing to exercise their rights in relation to personal data are enabled to do so, and such requests are handled efficiently;
-    regular reviews of procedures involving personal data are carried out;
-    privacy by design has been adopted for all new or amended systems and procedures;
-    a processing record is prepared containing the following information:
-    the name of the organisation and relevant details;
-    the purpose of processing the personal data;
-    the categories of individuals and personal data processed;
-    the categories of recipients of the personal data;
-    agreements and mechanisms for the transfer of personal data to countries outside the European Union, including details of any existing checks;
-    the duration of storage of the personal data;
-    the relevant technical and organisational controls in place.
The aforementioned actions are regularly reviewed as part of the management process relating to personal data protection.
The following annexes and related documents may form an integral part of this Policy:
t)    Records of Processing Activities;
u)    Notice on the Processing of Personal Data for Clients, Principals and Interested Parties;
v)    Notice on the Processing of Personal Data for Employees and Other Persons Engaged to Work;
w)    Cookie Policy, if the Company uses a website and cookies;
x)    Internal Procedure for Handling Requests from Data Subjects;
y)    Internal Procedure for Handling Personal Data Breaches;
z)    List of Processors and Other Recipients of Personal Data.

The aforementioned documents are maintained and updated in accordance with the Company's business needs, changes in the manner of processing personal data, and applicable regulations.

ZENITH, sole proprietorship for real estate brokerage,
owner Zvonimir Rakić