1. Data controllers
The Data Controller is the company Industrial Project d.o.o. (hereinafter also referred to as “Data Controller”), which can be contacted for matters relating to the protection of personal data at the email address email@example.com.
2. Categories of collected data
In order to make possible the use of the “BI4YOU” App the Data Controller will process data related to the users for the creation of the access profile (such as their personal details, email, user ID, password) and technical information on the devices used to access the service.
3. Purposes of the processing, legal basis and storage period
Personal data will be processed by Industrial Project d.o.o for the purposes and under the conditions indicated below.
Provision of services via App: for the booking and use of activities, events and services within the tourist facility. Registration credentials will be sent to users by email or given to them upon check-in.
Fulfilment of contractual obligations.
Data storage period
Until a request for cancellation of the account or termination of the service. However, the account and its data will be deleted after 5 years of non-use. If the customer does not activate the account after it has been created, the relevant data will be deleted within 30 days following the end of the stay at the facility.
4. Necessity of data processing
The processing of personal data for the purposes indicated above is necessary for the use of the service, as it is not possible to operate the App without them.
5. Processing methods
Industrial Project d.o.o. has adopted specific security measures to prevent unauthorised access, unlawful use or loss of personal data.
6. Categories of recipients of personal data
For the achievement of the purposes indicated in point 4 Industrial Project d.o.o. may communicate the data collected to the following categories of subjects: IT service providers; companies and other subjects providing assistance, consultancy and communication services. Where necessary, data recipients have been designated as data controllers as per the provisions of Article 28 GDPR.
7. Transfer of data to third countries
Personal data processed by the Data Controller may be transferred to other companies based in the United States of America solely for the purposes indicated above. This transfer will take place exclusively following the signing with the companies receiving the personal data of standard contractual clauses (S.C.C.) adopted by the Commission of the European Union (pursuant to Article 46, paragraph II, points C and D of the GDPR).
8. Rights of data subjects