Personal Data Protection Policy

1. INTRODUCTION

The company Arhigon technologies d.o.o., headquartered in Croatia, Sveti Ivan Zelina, Ulica Mate Žigrovića 2, OIB: 67326599617 (hereinafter referred to as Arhigon or the Company or We) respects the privacy of its users, business partners, clients and associates and bases its business on mutual trust and transparency.

The 2016 Data Protection Regulation ( hereinafter referred to as the Regulation ) replaces the 1995 Data Protection Directive 95/46/EC and replaces the laws of individual Member States that were created in accordance with the aforementioned Directive. The main purpose of the Regulation is to protect the rights and freedoms of natural persons and to restrict the processing of personal data of individuals without their knowledge. It describes the ways in which organizations, including the Company, must collect, process and store personal data. The rules defined by the Regulation must apply regardless of whether the data is collected and stored in electronic form, on paper or on other media. In order to comply with the Law, the Company must collect and use data fairly, store it securely and not disclose it unlawfully.

The Regulation applies to all, partially or fully automated, personal data processing procedures, as well as to the processing of other personal data ( e.g. in paper form ) that are an integral part of the organization.

In territorial terms, the Regulation applies to all controllers and processors operating in the European Union (EU) who process personal data for the purposes of the controller and/or processor. In addition, the Regulation also applies to all controllers outside the EU whose processing of personal data enables the offering of goods and services and/or the monitoring of the behaviour of personal data subjects within the EU.

This Policy regulates the principles and rules that the Company and all associates, contractual partners and other natural and legal persons working on behalf of the Company adhere to when collecting, processing and storing all groups of personal data, in order to meet high standards in line with existing legal provisions.

We process technical data of each visitor to our website ( www.arhigon.com ) such as information about the device you use to access our website (type, OS, etc.), your IP address and cookies. Unless you also register or log in to the Application, we cannot identify you, i.e. you remain anonymous to us. For the Cookie Policy, see here .

1.1. Reasons for the existence of this Policy

• Adherence to the standards defined in this Policy ensures compliance of the collection, processing and storage of personal data with applicable law and the Regulation.
• The rights of employees, service users and other partners of the Company are protected.
• Methods of storing, processing and preserving individual data are transparently defined
• The policy protects against the risk of illegal distribution of confidential data

1.2. Key terms

Headquarters – The main headquarters of a controller in the EU is the place where the controller makes key decisions about the purposes and means of processing personal data. The main headquarters of a processor in the EU is its administrative headquarters. If the controller is registered outside the EU, it will need to appoint a representative within the EU. Its powers and responsibilities must allow it to act on behalf of the controller, including all types of communication with supervisory authorities.

Personal data – All data relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Special category of personal data – Those personal data that reveal racial or ethical origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data collected for the purpose of unique identification of a natural person, health data or data related to a natural person's sex life or sexual orientation.

Controller – A natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of the processing are determined by EU law or by the law of a Member State, the criteria for the appointment of a controller may be specifically defined by EU law or by the law of a Member State.

Processor – A natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Data Subject – Any living individual whose data held by an organization is subject to some type of processing.

Processing – Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, disclosure by transmission or otherwise making available, erasure, destruction, etc.

Profiling – any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to an individual, in particular to analyse or predict aspects concerning that individual's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

Personal data breach – a breach of security that leads to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted, stored, or otherwise processed.

Child – The Regulation defines a Child as any person under the age of 16. Depending on the laws of individual Member States, the age limit that ensures the status of a child may be at least 16 years. The processing of personal data of a child is only permitted if the consent of the parent or guardian has been obtained. The controller must make reasonable efforts to verify that the consent is given by the holder of parental responsibility over the child.

Third party – A natural or legal person, public authority, agency or other body other than the data subject, the controller, the processor or persons authorised to process personal data under the direct authority of the controller or processor.

Storage system – Any structured set of personal data that is accessible according to certain criteria, regardless of whether it is centralized, decentralized, or dispersed on a functional or geographical basis.

1.3. Risks

This Policy helps protect against real security risks related to the protection of personal data, including:

1. Breach of confidentiality (data is processed inappropriately)
2. Inability to choose how data is processed (all individuals should be free to choose how the Company uses data relating to them)
3. Damage to the company's reputation (loss of reputation in case of a successful hacker attack)

2. POLICY STATEMENT

2.1. Scope of the Policy

The rules described in this Policy apply to

1. Society
2. All employees of the Company
3. All associates, clients, contractual partners and other natural and legal persons working on behalf of the Company

The rules apply to all information that the Company holds regarding identifiable individuals. This may include:

• Names of individuals
• Addresses
• Email addresses
• Phone numbers
• Videos
• Audio recordings
• and all other data relating to the individual.

The company primarily processes the data you give us when creating your account, as well as any subsequent changes to that data. Please note that some of this data is public (visible) in our Application. This includes information such as your first and last name, your and , your profile picture. To make it easier for your contacts and other people to find you and recognize who you are, you can (but don't have to) add your profile picture.

We also process data about your:

1. your user account. This includes data such as your subscription, your contacts in the Application and similar information,
2. the use of the Application such as the date and time when you used the Application and the actions you performed on the Application, but also other technical data such as information about the devices you use to access our Application (type, OS, etc.), your IP address and cookies;
3. documents transferred or created through the Application, but also any comments or messages you have published in the Application

2.2. Statement

The Company, all employees of the Company and natural and legal persons working for and on behalf of the Company, are obliged to comply with all relevant EU and Member State laws relating to personal data and the rights and freedoms of individuals arising from the aforementioned laws, whose information is collected and processed in accordance with the General Data Protection Regulation. Compliance with the Regulation is described in this Policy and possible other sources applied by the Company.

The Regulation and this Policy apply to all activities that involve the processing of personal data, including data about users of the Company's services, clients, employees, suppliers and other partners, as well as all other personal data that the Company processes from any source.

The rules described in this Policy apply to all employees of the Company and third parties, natural or legal persons working for or on behalf of the Company, such as external collaborators, contractual partners, etc.

The company, in the role of processor, will process data at the request of the controller or client exclusively in accordance with the rules defined by the Regulation, the law of an individual member country and this Policy.

3. RESPONSIBILITIES AND ROLES IN ACCORDANCE WITH THE REGULATION

3.1. Controller and processor

The Company's main activity is the digitalization of business in the field of construction, architecture, mechanical engineering, electrical engineering, geodesy, and other professions that deal with the preparation of cost estimates or similar activities . If the Company finds itself in the role of a data processor in relation to a business partner, the Company assumes all obligations and responsibilities of the data processor towards the business partner (data controller), defined by the Regulation on Personal Data Protection, the law of the member state and the obligations defined by this Policy, and undertakes to carry out any processing related to the business partner's business exclusively on his order, as defined in the relevant contract.

In addition to the function of data processor, the Company is also the controller of personal data as defined by the Regulation. All those assigned a management or supervisory function in the Company are responsible for developing and promoting good information management practices in the Company.

3.2. Data Protection Officer

In order to further strengthen the security of the personal data it processes, the Company may appoint a personal data protection officer (hereinafter referred to as the Officer) in accordance with the requirements defined by the Regulation.

In the event of the appointment of an Officer, he should be responsible to the Company's management for ensuring compliance with applicable regulations on the protection of personal data.

An officer who may be appointed by the Company's management will assume responsibility for the Company's day-to-day compliance with this Policy, and in particular with the Regulation, in the segment of personal data processing carried out within the Company.

The Officer will have specific responsibilities related to certain procedures and will also be required to provide all relevant information and answers to questions from Company employees related to this Policy and Regulation.

Compliance with personal data protection regulations is the responsibility of all employees of the Company and natural and legal persons working for and on behalf of the Company, who process personal data.

Company employees are responsible for ensuring accurate and up-to-date information about themselves and are required to report any changes to ensure that employee information is accurate and up-to-date.

4. COMPANY DATA PROTECTION PRINCIPLES

Any processing of personal data must be carried out in accordance with the principles of data protection as a minimum as set out in Article 5 of the Regulation. The rules and procedures defining the processing of personal data in the Company have been created to ensure compliance with the principles of the Regulation and this Policy.

4.1. The Company as the processor of personal data

The Company, in accordance with the contractual obligations assumed with the business partner, assumes the role of processor. The processor and any person acting under the direction of the processor and having access to personal data, will not process such data unless requested to do so by the business partner, unless required by Union law or the law of a Member State. By concluding an appropriate contract, the Company will assume the obligations as processor, namely:

4.1.1. With this policy and other related policies, the company guarantees the implementation of appropriate technical and organizational measures in such a way that the processing of entrusted data is in accordance with the requirements of the Regulation and that it ensures the protection of the rights of the data subjects.

4.1.2. The company will not engage another processor without the prior special or general written approval of the client. In the case of general written approval, the organization will inform the business partner of all planned changes in connection with the addition or replacement of other processors in order to enable the business partner to object to such changes.

4.1.3. The processing carried out by the Company is governed by a contract or other legal act in accordance with the law of the Union or the law of a member state.

4.1.4. If the Company hires another processor to carry out special processing activities on behalf of the business partner, the same obligations for data protection as those specified in the contract or other legal act between the Company and the business partner from the previous point, are imposed on that other processor by contract or other legal act in accordance with the law of the Union or the law of a member state.

4.1.5. The contract or other legal act referred to in points 3 and 4 of this paragraph may be in written or oral form, including electronic form.

4.1.6. The Company maintains records of all categories of processing activities performed for the controller, which include:

1. the name and contact details of one or more processors and each controller on whose behalf the processor acts and, if applicable, the representative of the controller or processor and the Officer if appointed;
2. the categories of processing carried out on behalf of each controller;
3. if applicable, the transfer of personal data to a third country or an international organisation, including the identification of that third country or international organisation and, in the case of a transfer referred to in Article 49(1)(h), documentation of the appropriate safeguards; if possible, a general description of the technical and organisational security measures referred to in Article 32(1) of the Regulation.

4.1.7. The Company will not review and determine the lawfulness of the processing of personal data ordered by a business partner or other data controller. It will not restrict such processing, but it will inform the business partner or other data controller on whose orders it is acting of any irregularities it observes. Nevertheless, if the Company assesses that the requested processing could in any way negatively affect its integrity and publicity and, ultimately, the financial stability of the Company, it will object to the requested processing. It will inform the business partner or other data controller of the possible negative consequences for the organization and for the business partner or other data controller.

4.2. The Company as the controller of personal data processing

4.2.1. Personal data may only be collected when the purpose of collection is specific, explicit and legitimate. Data obtained only for a specific purpose may not be used for any other purpose. 4.2.2. Personal data must be:

1. processed lawfully, fairly and transparently in relation to the data subject (“lawfulness, fairness and transparency”);
2. collected for specified, explicit and legitimate purposes and shall not be further processed in a manner incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, in accordance with Article 89(1) of the Regulation, shall not be considered incompatible with the initial purposes ("purpose limitation");
3. adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”);
4. accurate and as necessary up-to-date; every reasonable measure must be taken to ensure that personal data that is inaccurate, taking into account the purposes for which it is processed, is deleted or corrected without delay ("accuracy").

4.2.3. Processing in accordance with applicable law implies identifying a legal basis before processing personal data. Processing is lawful only if and to the extent that at least one of the following is met:

1. the data subject has given consent to the processing of their personal data for one or more specific purposes;
2. the processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the data subject's request prior to entering into a contract;
3. processing is necessary for compliance with the legal obligations of the controller;
4. processing is necessary to protect the vital interests of the data subject or another natural person;
5. processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
6. processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

4.2.4. Fair processing implies that the controller has ensured that the data subject has access to all necessary information. This applies in particular to situations where data is collected directly from the data subject.

4.2.5. Transparent processing means providing all relevant information to the subject as described in Articles 12, 13 and 14 of the Regulation. Information must be provided in an understandable form, using clear and understandable text.

4.2.6. All data processed by the Company is handled in accordance with valid positive regulations and internal rules of the Company

4.2.7. The minimum amount of information that must be provided to the data subject, which is defined in Annex 1 of this Data Protection Policy, is as follows:

1. Identity and contact details of the personal data controller
2. Contact details of the Officer ( if appointed )
3. Processing purposes for which personal data are used as well as the legal basis for processing
4. The period for which the personal data will be stored or, if this is not possible, the criteria for determining that period
5. The existence of the Data Subject's right to request from the controller access to personal data and rectification or erasure of personal data or restriction of processing relating to the Data Subject or the right to object to the processing of such data and the right to data portability
6. The existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before it was withdrawn
7. Right to lodge a complaint with the supervisory authority
8. Information on whether the provision of personal data is a legal or contractual obligation or a necessary condition for concluding a contract, and whether the data subject is obliged to provide personal data and what the possible consequences are if such data is not provided.
9. Information about the existence of automated data processing, which includes profiling and, at least in these cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.

4.2.8. Personal data must be adequate for the purpose, relevant and limited to what is necessary for the processing.

1. According to the defined obligations, the responsibility of the Officer is to ensure that the Company does not collect data that is not necessary to fulfill the purpose for which it was collected.
2. All forms collecting personal data ( electronic or paper ) must include a fair processing statement or a link to an approved privacy statement.
3. To ensure adequacy, relevance and avoid excessive data collection, the Officer, if appointed, reviews all methods of collecting personal data on an annual basis.

4.2.9. Personal data must be accurate and up-to-date, and inaccurate data must be deleted without delay.

1. The data stored by the controller must be regularly updated. They must not be stored if they are not accurate and up-to-date
2. If appointed, the Officer must provide training to the Company's employees so that they are properly trained and understand the importance of collecting and maintaining only accurate data.
3. It is the responsibility of the data subject to provide the Company with accurate and up-to-date data. If a formal data recording form is used in the process of collecting personal data, it will include a statement that the data provided therein is accurate as of the date the form was completed.
4. Company employees should notify the responsible persons of any changes in circumstances to enable personal data to be updated. It is the Company's responsibility to record any notification of a change in circumstances that has an impact on accurate and up-to-date records.
5. If appointed, it is the responsibility of the Officer to ensure that appropriate procedures and policies are in place to ensure the accuracy and up-to-dateness of personal data, taking into account the amount of data collected, the speed at which the amount of data may change and other relevant factors.
6. If appointed, the Officer is responsible for responding to the Data subject's requests within a period not exceeding 30 days. The period may be extended for a further two months for complex requests. If the Company's responsible persons decide not to respond to the Data subject's request, the Officer, if appointed, must provide the Data subject with an explanation for the failure to act and inform him/her of his/her right to appeal to the supervisory authority and the possibility of seeking legal remedy.

4.2.10. Personal data must be kept in a form that can identify the data subject only for as long as is necessary to carry out the necessary processing, i.e. to achieve the purpose for which the personal data were collected.

1. When personal data is stored longer than the period required for its processing, i.e. after the purpose has been fulfilled, such data will be stored in a form in which it is not possible to easily link it to the owner of the data.
2. Personal data is stored in an appropriate and secure manner.
3. Any retention of personal data for longer than permitted must be justified and based on positive regulations and the Company's internal rules.
4. Personal data must be processed securely.

4.2.11. If appointed, the Officer will conduct a risk assessment procedure taking into account all circumstances that have an impact on data processing and the security of data processing in the Company.

4.2.12. When determining the appropriateness of personal data processing, the Officer, if appointed, should take into account the extent of possible damages that could affect individuals in the event of a security breach, as a consequence of any security breach, with a direct or indirect impact on the reputation of the organization and the trust of users, suppliers and other interested groups.

4.2.13. When assessing appropriate technical measures, the Officer, if appointed, shall take into account the following:

1. Password protection policy
2. Automatic locking of equipment when idle
3. Restricting the use of USB and other media
4. Installed antivirus protection and firewall
5. Role-based access rights, including those granted to temporary staff and visitors
6. Encrypting devices that leave the organization's premises (laptops)
7. Network system security
8. Additional data protection options such as pseudonymization and anonymization if applicable
9. Improvement of safety standards in accordance with the development of technology.

5. RIGHTS OF THE DATA SUBJECT

5.1. Availability of information

Availability of information ensures that individuals become aware that their data is being processed and that they understand:

1. How the data is used
2. How can I exercise my rights?

5.2. The data subject has the following rights in relation to the processing of data relating to the data subject:

1. The data subject has the right to request access to the data processed about him/her from the data controller.
2. To object to the processing of personal data concerning him or her and to processing that may cause harm to the data subject
3. To prevent the processing of personal data relating to him/her for marketing purposes
4. Be informed about methods and algorithms when it comes to automatic data processing
5. Seek compensation for damages through the courts if they were caused by
6. Take actions that result in the correction, deletion or destruction of inaccurate personal data or data for which consent for processing has been denied where there is no other legal basis for the processing
7. Request an assessment from the supervisory authority of a violation of any of the provisions of the Regulation
8. Request data transfer to other data controllers
9. Stopping any automated profiling, unless consent has been given

5.3. For the purpose of exercising the rights of the data subject

1. The data subject may request access to personal data.
2. The data subject has the right to complain to the Company regarding the processing of his/her personal data and the management of the request for exercising his/her rights.

6. CONSENT

The Company considers that Consent represents any voluntarily given, specific, informative and unambiguous statement by which the data subject, the owner of the personal data, gives his/her consent to the processing of his/her personal data or the personal data of the persons he/she represents. Consent can be withdrawn at any time in approximately the same simple manner as it was given.

For the Company, giving Consent means that the data subject is fully informed about the intended processing of personal data. Any Consent obtained under duress or based on deception is invalid and cannot be the basis for processing the data subject's personal data.

Obtaining Consent from the data subject requires active communication between both parties (the controller and the data subject). Failure to respond to the request by the data subject will render Consent invalid, i.e. consent cannot be assumed. The controller must be able to prove that consent has been obtained for the processing of personal data.

In most cases, consent to the processing of personal and sensitive data is part of standard forms, i.e. written documents that are an integral part of the documentation and that the data subject (user, business partner) signs in accordance with defined internal procedures. The data subject has the right to withdraw consent to the processing of his or her personal data at any time.

7. DATA SECURITY

All employees of the Company and other persons working for and on behalf of the Company are responsible for the security of all personal data that the Company possesses and processes. The data should be kept in a secure place that does not allow the disclosure of personal data to a third party unless the third party is expressly permitted to receive the data under a previously concluded confidentiality agreement. In such a case, the third party accepts the terms of this Policy and confirms that it meets the security requirements described in the General Regulation.

All personal data is accessible only to those persons who need it to fulfill their business tasks. In the security segment, the Company treats personal data with the utmost care. For this reason, all personal data must be stored in an appropriate manner.

Processing personal data outside the Company poses a potentially higher risk of loss, theft or destruction of personal data. Company employees and other persons working for and on behalf of the Company must obtain specific authorization for such processing of personal data. All data processing activities are carried out in the EU. We do not transfer your data to any third country.

8. DISCLOSURE OF DATA

In certain circumstances, the Regulation allows for the disclosure of personal data to law enforcement agencies and government bodies without the consent of the data subject/data subject. In such circumstances, the Company will disclose the requested data. However, before disclosing the data, the Company's responsible person will ensure that the request is legitimate by seeking the assistance of legal advisors or supervisory authorities in the field of personal data protection.

The company must ensure that personal data is not disclosed to unauthorized third parties, including family members, friends, government agencies and, in certain circumstances, the police. All employees must be aware of the procedure to be followed if they are asked to disclose personal data to a third party.

9. DATA RETENTION AND DISPOSAL

The company may not store personal data that can identify an individual, longer than the time necessary to fulfill the purpose for which the data was collected.

The company may retain data for a longer period than required by law or accepted policy if the data are processed for purposes of public interest, scientific and historical research or statistical purposes. In such cases, it is necessary to implement appropriate technical and organizational measures to protect the rights and freedoms of the data subjects.

Personal data entrusted to the Company for processing is processed appropriately to remain secure, thereby protecting the rights and freedoms of the data subjects.

10. DATA TRANSFER TO THIRD COUNTRIES

Any transfer of data from the European Economic Area to third countries is unlawful if there is no adequate level of protection of the fundamental rights of the data subject.

1. The European Commission assesses third countries, territories and/or specific sectors within third countries to assess whether there is an adequate level of protection of the rights and freedoms of natural persons. In the case of transfers of personal data to countries that meet the security criteria, the authorisation of the supervisory authority is not required for the transfer of personal data to those countries/territories.
   A country that is a member of the European Economic Area, although not a country of the European Union, meets the required conditions.
2. The Company may adopt its own rules on the transfer of personal data to third countries. In such a case, the rules must be reported to the competent supervisory authority, which will issue an opinion approving or rejecting the rules.
3. If none of the above conditions are met, data transfer to third countries or international organizations may only be made under one of the following conditions:
   • The data subject has expressly consented to the proposed transfer, after being informed of the possible risks of such transfer.
   • The transfer is necessary for the performance of contractual obligations between the data subject and the controller/processor or for the implementation of pre-agreed measures taken at the request of the data subject
   • The transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller/processor and another natural or legal person.
   • The transfer is necessary in the public interest.
   • The transfer is necessary for the fulfillment of a legal purpose
   • The transfer is necessary to protect the vital interests of the data subject or of other persons, when the data subject is unable to give consent.

We will review and may update this Privacy Policy from time to time. Any changes to this Privacy Policy will be effective when we post a revised version. Please check our Website for any updates or changes to our Privacy Policy, which we will summarize below.

Annex 1. Data protection policies

1. Identity and contact details of the personal data controller
   • Arhigon technologies d.o.o., headquartered in Croatia, Sveti Ivan Zelina, Ulica Mate Žigrovića 2, OIB: 67326599617, e-mail: privacy@arhigon.com
2. Contact details of the Officer ( if appointed )
   • On the date of adoption of this Data Protection Policy, a Data Officer has not been appointed.
3. Processing purposes for which personal data are used as well as the legal basis for processing
   • Registration on our Application : We process your personal data necessary to create and verify your user profile. In this case, we rely on our contract (General Terms of Use) as the legal basis for processing your personal data. In case you have added your profile picture, we rely on your separate consent to process your profile picture. In case the user invited you to the Application, we process your e-mail contact in order to send you this invitation.
   • Access to our App : We may process your personal data to provide you with access to the App, its content and to share any content you create in the App, and to enable us to further develop the App and provide you with an even better experience. In this case, we rely on our agreement (General Terms of Use) as the legal basis for processing your profile data.
   • Understanding how you use the Application : We may process your personal data so that we can further develop the Application and provide you with an even better experience.
   • Contacting you : We may process your personal data to inform you about news related to the Application or to hear what you think about the Application.
   • Submitting a request or otherwise contacting us : We may process your personal data to respond to your request or otherwise respond to your questions. In this case, we rely either on our legitimate interest to respond to your message or on our legal obligation to respond to your request.
   • Security incident or unauthorized use of the Application : We may process your personal information in order to detect, prevent or otherwise resolve any security incident or unauthorized use of the Application. In this case, we rely on our legitimate interest as the creator of the Application.
4. The period for which the personal data will be stored or, if this is not possible, the criteria for determining that period
   • Arhigon will not retain your personal data for longer than the period for which the data is necessary to fulfill the purpose of its use, except in exceptional cases when a specific data retention period is prescribed by law.
5. The existence of the Data Subject's right to request from the controller access to personal data and rectification or erasure of personal data or restriction of processing relating to the Data Subject or the right to object to the processing of such data and the right to data portability
   • You can ask Arhigon what personal data about you it uses, and you can also request access to that personal data. You have the right to know the purpose of the processing, what categories of your personal data we store, the bodies or categories of bodies with which we share your personal data, the period for which the data is retained, as well as the source of the data in cases where the data is collected indirectly.
6. The existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before it was withdrawn
   • If the processing is based on your consent, you have the right to withdraw your consent at any time. You must inform the data controller of the withdrawal of your consent by e-mail: privacy@arhigon.com  or by sending an email to Arhigon technologies d.o.o., Ulica Mate Žigrovića 2, 10380 Sveti Ivan Zelina. Such withdrawal will not affect the lawfulness of the processing based on your consent before its withdrawal.
7. Right to lodge a complaint with the supervisory authority
   • If you believe that your rights are not being respected, you have the right to file a complaint with the Personal Data Protection Agency, Selska cesta 136, HR – 10 000 Zagreb, e-mail: azop@azop.hr
8. Information on whether the provision of personal data is a legal or contractual obligation or a necessary condition for concluding a contract, and whether the data subject is obliged to provide personal data and what the possible consequences are if such data is not provided.
   • This is a necessary condition for concluding a contract and the obligor is obliged to provide personal data. If such data is not provided, the user cannot use the Company's services.
9. Information on the existence of automated data processing, which includes profiling, and, at least in these cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.
   • We only ask for a minimal set of personal data from you – we don’t need to know more about you than what is necessary to operate our Application. We do not perform any profiling based on your personal data or make any automated decisions that affect your rights or have a similar impact on you.