Privacy Policy
Based on Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
This Privacy Policy applies to all personal data of end customers that we collect and process, either directly or through our partners. Personal data is any information relating to an identified or identifiable natural person, directly or indirectly. Data processing includes any action performed on personal data, such as collection, storage, usage, inspection, and transfer of personal data.
- Data Controller
Gradska plinara Zagreb - Opskrba d.o.o.
Radnička cesta 1, 10000 Zagreb
OIB: 74364571096
email: opskrba@gpz-opskrba.hr
web: www.gpz-opskrba.hr
- Data Protection Officer
For questions about the processing of your personal data or to exercise your rights regarding data protection, you may contact our Data Protection Officer:
Contact:
Gradska plinara Zagreb - Opskrba d.o.o.
Data Protection Officer
Radnička cesta 1, 10000 Zagreb
gpzo.zastitaosobnihpodataka@gpz-opskrba.hr
- Purpose of Data Collection
We collect and process data for the following purposes: contracting gas supply and public gas supply service, identification of existing end customers (inquiries and complaints), fulfilling customer requests (installment payments, refunds/transfers, reactivation of gas supply), sending offers to former end customers, enabling access to the MojRačun application
- Lawfulness of Data Processing
Data is collected and processed based on Article 6(1)(a), (b), (c), and (f) of the General Data Protection Regulation (the “Regulation”).
Our operations are based on the Gas Market Act, Network Rules for the Gas Distribution System, General Conditions for Gas Supply, applicable bylaws, and other relevant legal frameworks regulating the gas supply business.
Regarding the purposes of processing related to sending offers to former customers in connection with interest in our more competitive prices and services, the legal basis is legitimate interest.
You can read the notice on the processing of personal data based on legitimate interest
here.[
- Data We Collect and Process
- For gas supply contracts: full name, personal ID number (OIB) of the end customer and/or authorized representatives, address and metering point number, gas meter serial number, email, phone/mobile number, additional billing address.
- Customer identification (inquiries/complaints): customer ID, metering point number, gas meter serial number, email.
- Customer requests (installments, refunds, reactivations): full name, OIB, phone/mobile, email, metering point details, IBAN (for refunds).
- Offers to former customers: full name, address, metering point number.
- MojRačun application: full name, OIB, address and metering point number, email, gas meter number.
- Retention Period
We retain your data during the contract duration and/or while legal effects of the contract last, and at the latest until expiry of all legal obligations unless debt collection or other legal procedures are initiated. If a complaint is submitted, data is kept until the procedure is complete. Data based on consent is stored until consent is withdrawn and deletion requested.
In the event of an objection to the processing of data based on legitimate interest, the data will be processed until the resolution of the submitted request or longer if legal proceedings have been initiated. It is possible that the objection will not be upheld, meaning that your request may be rejected, in which case we will in any event retain the request so that we can demonstrate to the supervisory authorities that we have informed you of all the circumstances of the case.
- Categories of Data Recipients
Your data may be shared with:
- Internal organizational units of the data controller
- Relevant distribution system operators
- Government agencies and Financial Agency (Fina) for SEPA direct debit services
- External service providers (delivery of invoices, notices, and reminders)
- Law firms and lawyers (in case of contractual breaches, in appropriate scope under the Regulation)
- Authorities if legally required or necessary to prevent, detect or prosecute crimes or fraud
- Security of Processing
We have implemented appropriate technical and organizational measures to ensure a level of security appropriate to the risks and nature of the personal data. After risk assessments, we took all necessary steps to protect data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, and any other form of unlawful processing.
Only authorized employees with signed confidentiality statements have access to data for business purposes.
- Data Subject Rights
Under the Regulation, you have the following rights:
Right of Access
You may request confirmation whether your personal data is being processed and obtain access to it along with information on processing purposes, categories, recipients, and retention periods. If data is not collected directly from you, you have the right to know its source.
Right to Rectification
Please notify us immediately of any changes or inaccuracies to keep records up-to-date.
Right to Erasure
You may request deletion of your personal data. If the request is justified and we are not legally required to retain the data, it will be deleted without undue delay.
Right to Restriction of Processing
You may request restriction if:
You contest the accuracy of data (pending verification)
Processing is unlawful and you oppose erasure
Data is no longer needed but required for legal claims
You objected to processing based on profiling
Right to Object
You may object to processing based on your specific situation. We will assess your objection and may request further information if needed.
Complaints are processed within 15 days. If a decision cannot be made within that time, we will notify you of the reason for delay and expected resolution time (max 30 days).
Right to Withdraw Consent
You may withdraw consent at any time. Processing prior to withdrawal remains lawful. Withdrawal is free and does not require justification.
- Consequences of Not Providing Personal Data
Your data is necessary for us to provide services. If you do not provide it, we may not be able to fulfill your requests or contractual obligations.
If, due to withheld data (as stated in pre-contractual forms), we cannot perform our service contract, we cannot be held responsible for such non-performance.
- Right to Lodge a Complaint with Supervisory Authority
If you believe your data is not being processed lawfully, you have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP) at www.azop.hr.
We encourage you to first contact our Data Protection Officer at:
gpzo.zastitaosobnihpodataka@gpz-opskrba.hr
