1.         Definitions

2.         Introductory provisions

2.1.       These General Terms and Conditions shall apply to all Services contractually agreed upon after the above-indicated data and provided to Orvas by Processors. These General Terms and Conditions shall apply in addition to other commercial terms of cooperation between Orvas and Processors.

2.2.       By relying on these General Terms and Conditions, Orvas and the Processor accept the said Terms and Conditions and undertake to act pursuant to them. These General Terms and Conditions shall be applicable unless otherwise agreed by Orvas and the Processor in writing or unless Orvas and the Processor have agreed in writing upon the applicability of other terms and instructions in connection with Services.

3.         Personal data

Processors as providers of Services process personal data of third parties in the name and for the benefit of Orvas as the user of their Services. Personal data that represent the subject-matter of these General Terms and Conditions are therefore personal data of tourists and other users of accommodation and vessel charter services managed by Orvas.

4.         Instructions of the Controller

4.1.       The processor communicates independently and directly with (potential) tourists as well as other users of accommodation and vessel charter services managed by Orvas. In order to meet the requirements of Orvas, the Processor undertakes to do the following:

4.1.1.    immediately before collection of personal data or their first usage for the purposes of Orvas, notify the concerned tourists and other users in an appropriate manner about the purpose for which their personal data are being processed; let them know that these activities are performed on behalf of Orvas as Controller; and inform them that all information regarding processing of their personal data on the part of Orvis can be found in the General Communication on Personal Data Processing by Orvas, available at […];

4.1.2.    for the purposes of Orvas, collect only the personal data ordered by Orvas; as for all other collected data, the Processor shall be independently liable;

4.1.3.    further process exclusively for the purposes of Orvas personal data of tourists and other users collected for the purposes of Orvas;

4.1.4.    forward the collected personal data to Orvas at least once on a quarterly basis and after Orvas confirms due to receipt of data, delete or anonymize the said personal data permanently;

4.2.       In case that Orvas has given no instruction with respect to a certain processing task or in case its instruction is unclear, the Processor shall stop the processing and request instruction or an explanation from Orvas.

5.         Processor’s duties

5.1.       When processing personal data, the processor shall assume the following obligations toward Orvas:

5.1.1.    The processor shall implement its internal organization and undertake technical and organizational measures, taking due account of the requirements referred to in Article 32 of the Regulation. The processor shall notify Orvas about the measures it has undertaken and Orvas shall approve them or if needed, request implementation of additional measures;

5.1.2.    The processor shall permanently keep the confidentiality of personal data in question. These personal data shall not be made public by the Processor. When being stored, personal data shall always be duly protected. The processor shall independently propose to Orvas appropriate protection measures to control access, whereas Orvas shall either approve them or, if needed, request additional measures;

5.1.3. The processor shall ensure that all persons that fall under the scope of its liability and that process or have access to the personal data in question have undertaken to permanently maintain confidentiality thereof;

5.1.4.    The processor shall not engage another subcontractor that would have access or exercise more rights with respect to the personal data in question without obtaining prior written consent from Orvas;

5.1.5.    The processor shall not transfer the personal data in question outside of the jurisdiction where the place of its registered office is located, apart from Croatia as the location where Orvas is seated;

5.1.6.    The processor shall notify Orvas in case it becomes subject to control, measures or investigation of a supervisory authority for personal data protection;

5.1.7.    The processor shall notify Orvas immediately and no later than 24 hours after learning about such event, in case of a breach of the applicable data protection regulations or provisions of these General Terms and Conditions either on the part of the Processor, its employees or subcontractors as well as in case of a suspected personal data breach or irregularities in the processing of personal data.

5.2.       Notwithstanding the measures that the Processor proposes and that Orvas approves provided that the measures are adequate, the Processor hereby undertakes to at least abide by the following minimum requirements:

5.2.1.          All personal data, as well as their source, shall be stored exclusively in electronic form;

5.2.2.          Access to data in question must be protected by a security password;

5.2.3.          If personal documents are scanned or photographed, the scan or photograph shall include only the necessary data, whereas all other data shall be illegible;

5.2.4.          At the first request of Orvas, delete or modify personal data that represent the subject-matter of these General Terms and Conditions.

6. Right to supervision

6.1.       Orvas shall have the right to directly supervise technical and organizational measures undertaken by the Processor in line with the assumed obligations. Orvas shall announce supervision at least 15 (fifteen) days before its intended start. The processor hereby undertakes to provide Orvas access to all requested relevant documentation as well as, if needed, insight into the manner in which the Processor implements its technical and other security measures.

6.2.       The processor shall ensure that its subcontractors that play a major role in the processing of personal data in question, give their consent and participate in this procedure.

7.         Liability

Orvas shall be entitled to appoint a third impartial party to conduct the prescribed supervision, whereas the Processor undertakes to allow any such supervision and provide any requested information

7.1.       The Processor that determines purposes or means for processing that are contrary to the provisions of the Regulation and thus breaches the instructions provided by Orvas, shall become the person liable for such processing. In this case, the Processor shall compensate any damage incurred by Orvas due to omission on the part of the Processor.

7.2.       If the Processor collects and processes personal data of persons in question for other purposes as well, liability for any such actions shall be borne exclusively by the Processor.

8.         Cooperation

8.1.       In case of any request or complaint filed by a data subject in connection with his or her personal data, which are the subject-matter of these General Terms and Conditions, the Processor shall immediately notify Orvas thereupon, but no later than 24 hours from the receipt of such a request.

8.2.       The Processor shall provide Orvas with adequate support, so that the latter may duly respond to or meet the subject data’s request.

9.         Final provisions

9.1.       These General Terms and Conditions shall be governed by the substantive law of the Republic of Croatia. In case of any dispute arising from these General Terms and Conditions, as well as in case of the question of the validity of these General Terms and Conditions, the relevant court shall be the competent court in Split, Croatia.

9.2.       Orvas shall have the right to unilaterally amend these General Terms and Conditions. In such a case, Orvas shall notify all Processors in an adequate manner about amendments at least 7 (seven) days before their entry into force. Any Processor that finds the adopted amendments to be unacceptable shall be entitled to unilaterally terminate its agreement on services concluded with Orvas, within 3 (three) days from the date of receipt of the notification on amendments to the General Terms and Conditions.

9.3.       Upon termination of the commercial relationship between Orvas and the Processor, these General Terms and Conditions shall cease to be applicable to the Processor in question. Notwithstanding, the Processor shall hand over to Orvas all personal data that represent the subject-matter of these General Terms and Conditions and, after Orvas confirms due receipt thereof, permanently delete or anonymize the said personal data.

*******

ORVAS d.o.o.