Zaštita privatnosti

PRIVACY STATEMENT

This Privacy Statement sets out how we, AmRest Adria d.o.o., Trstenička 2, Zagreb, Croatia (hereinafter as “AmRest“), collect, use, process and store the personal data of its customers (i.e. visitors of AmRest’s restaurants) and users of AmRest’s website (“you“), and what are your rights regarding your personal data.

This Privacy Statement applies as of 25 May 2018 and is accessible on our website http://www.kfc.hr/.  Any future changes to the Privacy Statement will be posted there as well and applies from the date of publication.

  • Who is the controller of your personal data?

The data controller in respect of your personal data is AmRest.

For any questions or concerns regarding your personal data collected and processed by us, or if you wish to use any of your rights in relation to your personal data (we describe these in Section 7 of this Privacy Statement), you may contact us at info-HR@amrest.eu

Personal data we collect about you and how we obtain them

We obtain your personal data from you directly as further explained in this Section. We explain why we collect your personal data in Section 3 below.

  • Personal data you share with us

You may provide us with your personal data yourself when you visit our restaurants, our website (www.kfc.hr), placing order via telephone, as well as sending us queries, complaints and suggestions, namely when you contact us in any way, either by telephone, email or by regular mail, or fill in forms intended for us. While it will be up to you to decide which exact personal data to share in such case, these will typically include:

  • transaction information, such as product purchased, price, method of payment and payment details;
  • your contact information such as name, address, email, phone, and other contact details;
  • information about your device and use of our websites;
  • other personal data you choose to provide when interacting with us.
  • Why we collect and process your personal data and what is the legal basis for doing so

This table summarizes why we collect and process your personal data and what legal basis (reasons) we have to do so.

Purpose of collection (why we collect) Explanation Legal bases (our reasons)
Processing orders To process your order, we will process your personal data provided by you in the order. The legal basis for processing these data is the necessity to perform the order contract and to take actions at your request (art. 6 sec. 1 letter b) of GDPR)
Performing legal obligations In order to fulfill the obligations imposed on us by law, e.g. by the accounting act or tax regulations (e.g. invoicing and storage of invoices and accounting documents), we will process your personal data from the order. The legal basis for processing these data is the necessity to perform the order contract and to take actions at your request (art. 6 sec. 1 letter b) of GDPR)
Establishing, exercising or defending against legal claims In order to establish or exercise claims, as well as to defend against claims, we will process your order data as well as data related with the complaint. The legal basis for processing these data is the necessity to perform the order contract and to take actions at your request (art. 6 sec. 1 letter b) of GDPR)
Answering queries, complaints and suggestions In order to answer your queries, complaints and suggestions, we will process your data provided in the queries, complaints and suggestions. The legal basis for processing these data is the necessity to perform the contract (art. 6 sec. 1 letter b) of the GDPR) or our legitimate interest in giving response (art. 6 sec. 1 letter f).
Customer satisfaction survey and determination of the quality of our services In order to examine our Customers’ satisfaction and determine the quality of our services, we will process your data indicated in a survey which we can ask you to fill out. The legal basis for processing these data is our legitimate interest in obtaining relevant information to improve the quality of our products and services (art. 6 sec. 1 letter f).
  • Who we share your personal data with

Within AmRest, your personal data is processed mainly by our restaurant staff that you interact with when visiting our restaurants, our departments and employees responsible for managing contractual relationships and ensuring we comply with the law, for example accounting department, legal department, marketing department, customer care department and internal auditors.

When and only to the extent this is needed for purposes we described in Section 3 of this Privacy Statement, we share your personal data with third parties outside of AmRest, who act on our behalf. In any case, we only share personal data with companies or third parties based within the European Economic Area. Here, we list with whom we may share your personal data in this way:

  • IT solutions providers;
  • marketing agencies;
  • couriers;
  • entities providing accounting and administrative services;
  • entities conducting customer satisfaction surveys on our behalf;
  • courts, regulatory agencies and any other public authorities;
  • if assets of AmRest would be (partially) acquired by a third party, your personal data held by AmRest will transfer to the acquirer.
  • Where we store your personal data and where do we transfer it

We primarily store and process your personal data on locations inside the European Economic Area (“EEA”). We do not transfer personal data outside the EEA.

  • How long will we keep your personal data

We retain your personal data only for as long as is necessary for the purpose for which we obtained them. We will store your data:

  • For the purpose of processing your order – for the duration of the contract for this order or service provided, providing that we may extend this period for the period of limitation of your or our claims under applicable law, if the processing of this data will be necessary to establish or exercise claims and defend against claims.
  • For the purpose of complying with our legal obligations (e.g. from the accounting act or tax regulations) – for a period resulting from such provisions.
  • For the performance of our legitimate interests, i.e. establishment or exercising claims and defending against claims – for the period of limitation of your or our claims under applicable law (e.g. the general limitation period is 5 years, the above periods of personal data storage may change as applicable general legal regulations change).
  • For the performance of our legitimate interests, i.e. answering your queries, complaints and suggestions – for a period necessary to give such answer, no longer than 14 days, providing we may extend this period for the period of limitation of your or our claims under the law, if the processing of this data will be necessary to establish or exercise claims and defend against claims.
  • For the performance of our legitimate interests, i.e. our Customer satisfaction survey and determination of the quality of our services – for the duration of our legitimate interest, but no longer than 24 months.
  • Your rights

Below is the summary of rights that you have under law, and what AmRest does to protect those rights. You may contact us at info-HR@amrest.eu, if you wish to know more or to use any of these rights.

  • The right to access your personal data

You have the right to:

  • obtain from AmRest confirmation as to whether or not personal data concerning you are being processed; and
  • access your personal data by receiving a copy thereof.

Please contact us at info-HR@amrest.eu, if you wish to access your personal data held by AmRest.

  • The right to correction (rectification)

If the personal data AmRest holds about you are inaccurate or not complete, you have the right to ask us to correct them. If that personal data has been passed to a third party, we will ask them to correct the data, unless this is impossible or requires disproportionate effort on our part. We will tell you to which third parties your personal data has been passed if you ask us to. We may need to verify the accuracy of the new data you provide to us. Please contact us at info-HR@amrest.eu, if you need us to correct your personal data.

  • The right to erasure

You can ask us to erase all your personal data held by us and we will do so in these cases:

  • your personal data are no longer necessary for the purposes we processed or collected them for;
  • if you withdraw your consent to process your personal data – but only in cases where we have no other legal basis to do so apart from your consent;
  • if you object to the processing of your personal data and there are no overriding legitimate grounds for the processing (see right to object in Section 7.6 of this Privacy Statement);
  • if it turns out your personal data have been unlawfully processed;
  • if your personal data must be erased because the law requires us to.

Note that we may not erase your personal data even if you request us to in some cases, in particular when their processing is necessary for us to comply with the law (e.g. where we are legally required to keep the data) and for establishment, exercise and defence of legal claims. Please contact us at info-HR@amrest.eu, if you wish to request the erasure of your personal data held by AmRest.

  • The right to restrict processing

You have the right to ask AmRest to restrict how we process your data. This means that we are permitted to store your personal data but not further process it. We will restrict processing of your personal data in the following cases:

  • if you want us to establish the data’s accuracy; we will restrict processing for the time needed to establish accuracy;
  • where our use of the data is unlawful but you do not want us to erase it;
  • where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
  • you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it (see Section 7.6 of this Privacy Statement on your right to object); we will restrict processing for the time needed for such verification;

When we restrict processing only temporarily (first and last case above), we will let you know when the restriction is lifted. Note that we are permitted to process your personal data in certain cases even if the processing is restricted, for example for establishment, exercise or defence of legal claims, protection of rights of other persons or for reasons of important public interest. If you want to request us to restrict processing of your personal data, please contact us at info-HR@amrest.eu.

  • The right to data portability

You can ask us to send you your personal data which you have provided to us yourself (see Section 2.1 of this Privacy Statement) in structured, commonly used and machine-readable format (this means that the data can be easily understood by a computer). You have the right to transfer such personal data to a different company (data controller), or ask us to do so directly. We will send you such personal data in case:

  • we have been processing your personal data because you gave us your consent to do so or to perform a contract you have with us; and
  • we process your personal data by automated means (this means for example that we cannot give you your personal data in this form if we only have it in paper files).

Please contact us at info-HR@amrest.eu, on more information on how to use this right.

  • The right to object

When the legal basis for us to process your personal data is our legitimate interest, and you feel that because of your particular situation you no longer wish us to do so, you can at any time object to further processing of your personal data, including to profiling. In this case, we will stop processing your personal data. Note however that we are still allowed to continue to process your personal data even if you object, if our legitimate interests in a particular case outweigh your interests, rights and freedoms (meaning that your rights are not affected disproportionally, while it is important to us if we can continue processing), as well as for the establishment, exercise or defence of legal claims. If you object to the processing of your personal data, please contact us at info-HR@amrest.eu.

  • The right to withdraw consent

If we process your personal data on the basis of your consent but you change your mind later, you have the right to withdraw your consent at any time, and AmRest will stop processing your personal data. If you withdraw your consent, our processing prior to your withdrawal will remain lawful. If you want to withdraw your consent, us at info-HR@amrest.eu.

  • The right to complain to a supervisory authority

You have the right to complain to a personal data protection supervisory authority if you believe our processing of your personal data may be against the law. You may complain either to a supervisory authority in the place of your habitual residence (where you live most of the time), in the place where you work or in the place where you believe infringement may have happened. We believe the following supervisory authority may be relevant to you if you wish to complain: the Information Commissioner of the Republic of Croatia; you can find their contact details at http://www.pristupinfo.hr/en/;

  • Do you have to provide us with your personal data?

Providing personal data by you in order to conclude and perform contract regarding meal ordering or using the contact form on our website is necessary. If you do not provide this data, we will not be able to process your order or answer your queries, complaints or suggestions from the contact form.

  • Automated decision making

We will not make decisions regarding your person that are based solely on the automated processing of your data and produce legal effects or similarly significantly affect you.

  • From when does this privacy statement apply?

This privacy policy applies from May 25, 2018.

Any change or modification of this Privacy Policy enters into force upon publishing thereof.