1. DATA CONTROLLER

The data controller is ING-GRAD Jsc., a company headquartered in Zagreb (City of Zagreb), Kalinovica 3/IV, OIB: 93245284305, telephone: +3851 3033000, email: dpo@ing-grad.hr.

2. USE OF COOKIES

The official website www.ing-grad.hr utilizes cookies—small text files stored on the user's device by an internet server through which the service provider accesses the Internet (ISP) and displays the website. Cookies are created when the user's browser loads a visited web destination, which then transmits data to the browser and generates a text file (cookie). Upon subsequent visits, the browser retrieves and sends the cookie back to the web server.

The legal basis for the use of cookies, Google Maps services, and data collection protocols is Article 6, Paragraph 1, Point f of the General Data Protection Regulation (GDPR), as data processing is necessary for the legitimate interests of the data controller or a third party. The purpose of this processing is the continuous improvement of the website and user experience. Data is deleted as soon as it is no longer required to fulfill the purpose for which it was collected.

Name	Domain	Storage Duration	Purpose	Type of Cookie
_ga	ing-grad.hr	80 days	Enables visitor recognition and Google services (Google Analytics)	Google Analytics
ga*	ing-grad.hr	80 days	Enables visitor recognition and operation of Google Analytics 360 service	Google Analytics
_gid	ing-grad.hr	1 day	Ensures proper functionality of Google Analytics services	Google Analytics
gat_gtag*	ing-grad.hr	1 minute	Ensures proper functionality of Google Analytics services	Google Analytics
cookiesck	ing-grad.hr	80 days	Records user preferences in the cookie usage tool	Essential Cookies
PH_HPXY_CHECK	ing-grad.hr	80 days	System cookie for platform operation	Essential Cookies

3. PROCESSING OF PERSONAL DATA THROUGH VIDEO SURVEILLANCE

The video surveillance system is implemented at the data controller’s headquarters and temporary construction sites. The primary purpose of video surveillance is the protection of persons and property.

The legal basis for the operation of the video surveillance system is the legitimate interest of the data controller. The system is secured against unauthorized access, and data access is limited to authorized personnel appointed by the data controller or processor. Competent state authorities, such as inspection services, the public prosecutor’s office, the police, and other entities authorized to oversee general security and workplace safety, may also access the data within the scope of their legal responsibilities.

Recordings obtained via video surveillance are stored for up to 30 days or longer if they are required as evidence in judicial, administrative, arbitration, or other legal proceedings. Such recordings may be provided to competent authorities (e.g., police, courts) upon request, in compliance with applicable legal provisions.

4. DATA SUBJECT RIGHTS REGARDING PERSONAL DATA PROCESSING

To exercise your rights, you may contact us in writing or via email at dpo@ing-grad.hr.

Your rights include:

• Right of access to personal data – You have the right to obtain confirmation from the data controller regarding whether your personal data is being processed. If so, you may request access to your personal data and relevant information in accordance with GDPR provisions.
• Right to rectification of personal data – You have the right to request the correction of inaccurate personal data without undue delay and to supplement incomplete data.
• Right to erasure of personal data (‘right to be forgotten’) – You have the right to request the deletion of your personal data without undue delay if one of the following conditions is met:
• The data is no longer necessary for the purposes for which it was collected or otherwise processed;
• You withdraw your consent, and no other legal basis exists for processing;
• You object to data processing based on the data controller’s or a third party’s legitimate interest, and no overriding legitimate grounds exist;
• Your personal data has been unlawfully processed;
• Deletion is required to comply with a legal obligation.
• Right to restriction of processing – You have the right to request a restriction on data processing under the following conditions:
• You contest the accuracy of personal data, for a period allowing verification;
• Processing is unlawful, and you oppose erasure, instead requesting restriction;
• The data controller no longer needs the personal data, but you require it to establish, exercise, or defend legal claims;
• You have objected to processing based on legitimate interests, pending verification of whether these interests override yours.
• Right to object – You have the right to object, based on your specific situation, at any time to the processing of your personal data. If an objection is made, the data controller must cease processing unless compelling legitimate grounds for processing exist, overriding your interests, rights, and freedoms, or if the data is required for legal claims.
• Right to withdraw consent – Where data processing is based on your consent, you may withdraw it at any time, in whole or in part, without affecting the lawfulness of processing conducted before withdrawal.

5. SECURITY OF PERSONAL DATA

Personal data is collected and processed in a manner ensuring appropriate security and confidentiality. Measures are implemented to guarantee effective data protection principles, minimize data collection, regulate processing scope, and ensure secure storage and access.

We take all appropriate technical and organizational measures to prevent accidental or unlawful destruction, loss, alteration, unauthorized use, disclosure, or access to data.

All employees of the data controller are bound by confidentiality agreements regarding personal data.

6. RETENTION PERIOD OF PERSONAL DATA

We process your personal data only as long as necessary to fulfill the intended purpose. Once the purpose is achieved, we no longer use your data, and it remains stored only for the period required by legal regulations on the retention of archival records.

7. CONTACT INFORMATION

If you have any questions regarding the processing of your personal data, please contact us via email: dpo@ing-grad.hr.

8. CHANGES TO THE PRIVACY POLICY

We regularly update this Privacy Policy to ensure accuracy and relevance. We reserve the right to amend its content as necessary. Any modifications will be communicated promptly through our website in accordance with the principle of transparency.