Privacy policy

General information

This Privacy Policy of Benefit Systems d.o.o. (hereinafter: Benefit Systems) applies to MultiSport Card users, Clients, business partners and other natural persons (hereinafter: data subjects) whose personal data is processed by Benefit Systems, in relation to whom the company is considered the controller of personal data. This Privacy Policy applies from 1 December 2025 and was last updated: 15 July 2026.

Since you entrust us with your personal data, this Privacy Policy describes what personal data we collect, how we collect and process it as a controller, for what purposes we collect and process it, the data retention period, data transfers, how you can monitor the processing activities of your personal data, as well as your rights related to your data.

We approach the processing of your personal data responsibly and seriously and in full accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: the General Data Protection Regulation), the Act on the Implementation of the General Data Protection Regulation and other regulations of the European Union and/or the Republic of Croatia governing the protection and security of personal data.

Who is the Controller of your personal data and what does that mean?

The data controller responsible for the processing of personal data is:

Benefit Systems d.o.o., Vjekoslava Heinzela Street 44, Zagreb, OIB: 57845277445.

This means that Benefit Systems makes decisions about the purposes and methods of processing your personal data, i.e. how it will be used.

Our Clients (employers) and Partners act as independent data controllers and Benefit Systems has no influence on their personal data processing practices.

How to contact us

You can contact us regarding all questions related to the processing of your personal data:

to the email address which is also the address of the data protection officer:

dpo@benefitsystems.hr ,

to the address of the headquarters of Beneﬁt Systems d.o.o., Ulica Vjekoslava Heinzela 44, 10000 Zagreb with a note on the envelope “Personal data”.

In the event that we are not responsible for a particular processing activity, we will instruct you as the data subject on how and where you can exercise your rights.

Types of personal data we collect and process, purposes and legal bases of processing, retention period and data transfer

To be able to carry out our services, we must process personal data. Personal data is all information related to an identified or recognizable natural person (e.g. first and last name, e-mail address, MultiSport Card number, IP address).

The types of personal data we process depend on your relationship with us (whether you are a Client, Website User, MultiSport Card User or Partner).

When you use our websites or applications, we process the data you provide in the registration form and in your account, data about your activity on the website or application (e.g. interaction with content, etc.) and data about your device (e.g. IP address, data collected through cookies or other similar technologies, browser data, IDs). For more information about cookies, please visit our “Cookie Policy”.

When you join the MultiSport Program or the MultiSport Lite Program or the MultiSport Kids Program, we process your data, such as identification data, contact data and data relating to your use of our services (including the services of our affiliated entities and providers of additional services offered in connection with the MultiSport Program). We receive the data directly from you or the Employer, e.g. via a registration form. We may also receive your data from the entity that enabled you to use the MultiSport Program and from providers of additional services and benefits.

When we have an established business relationship with you, we process your data, such as your identification data, contact data, data relating to your function, data on services provided, orders and billing. If you are a party to a contract with us, we have received the data directly from you or from the contracting party that has concluded the contract on your behalf. If you are a representative or contact person of an entity that is a party to a contract signed with Benefit Systems, we have received the data from the entity that is a party to the contract. We may also receive data from an intermediary who has helped us establish cooperation with you or the entity for which you are a representative or contact person.

MultiSport Card and Card for the Trial Period

Plastic MultiSport Card

If you use the Plastic MultiSport Card as an Employee, we always collect and process the following personal data:

name and surname, Plastic MultiSport Card number, card type and validity date (which becomes your personal data after the card is issued in your name), place and time of MultiSport card use and type of service you used.

If you use the Plastic MultiSport Card as an Accompanying Person, we always collect and process only the following personal data:

first and last name, MultiSport card number, card type and validity date (which becomes your personal data after the MultiSport card is issued in your name), the place and time of using the MultiSport card and the type of service you used.

In addition to the above, we may collect and process the following personal data:

the identification number of the MultiSport card user (if required for card user registration) with the Employer and contact details (e-mail address and mobile phone number), if we also need these data to achieve the purpose of processing personal data.

We collect and process the above data for the purpose of:

creating a Plastic MultiSport Card that allows you to access the services included in our MultiSport Program,
informing about the eventual impossibility of using the services included in our MultiSport Program,
making calculations based on which your Employer or the Employer of an Employee of whom you are an Accompanying Person pays a fee for the use of the Plastic MultiSport Card for you or on your behalf,
delivery of Plastic MultiSport Cards,
improving the security and functionality of the server we use to provide electronic services,
checking whether the Plastic MultiSport Card is used in accordance with the Terms of Use and checking for possible misuse of the Plastic MultiSport Card,
responses to inquiries made through contact forms and other communication channels,
reporting on the use of services covered by the MultiSport Program.

The legal basis for collecting and processing the above personal data is our legal obligation related to the implementation of accounting and tax regulations; legitimate interest related to the exchange of data with recipients of your personal data, which is necessary for the performance of services and business efficiency, control of card usage in accordance with the terms of the MultiSport Program and/or analytics of service usage and/or contacting you about changes in terms, news and similar notifications that you expect from us; all in order to enable you to use the benefits of our MultiSport Program.

Virtual MultiSport Card and Virtual Card for the Trial Period

If you use a Virtual MultiSport Card, we always collect and process the following personal data:

first and last name,
email address,
mobile phone number,
your photo (stored exclusively on your mobile device and not uploaded to external storage).

We also process data related to your device on which you use our My MultiSport Platform or Application, namely the following data:

IP address, data stored in cookies or other similar technologies (see Cookie Policy at https://benefitsystems.hr/en/cookie-policy/), data related to your activities on our website or in the app, such as information about your desired activities or locations of activities, the content of HTTP requests sent to our server from your device (URL address, IP address, browser details, date and time of request, HTTP response status code, error information, cookie identifier, website resources viewed). The data collected in this way is stored in server logs.

We process your data for the purpose of:

creating a Virtual MultiSport card that allows you to access the services included in our MultiSport Program,
access our website or MyMultiSport mobile app,
solving technical and other problems related to the use of the Virtual MultiSport Card, which you report to us via e-mail, help desk, etc.,
server administration and security, which includes improving the functionality of the services we provide electronically,
providing analysis and statistics for product development as well as monitoring activity in the app to improve the operation of the Virtual MultiSport Card,
conducting analyses and statistics for market research in order to make decisions on commercial policy and surveys on satisfaction with the services of the Virtual MultiSport Card via telephone number if it is selected as a communication channel, all for the purpose of improving customer service and developing the products and services we offer,
informing users about the duration or status of the service,
making a calculation based on which your employer or the employer of the Employee of which you are an Accompanying Person pays for you or on your behalf the fee for using the Virtual MultiSport card,
checking whether the Virtual MultiSport Card is used in accordance with the Terms of Use and checking for possible misuse of the Virtual MultiSport Card,
responses to inquiries made through contact forms and other communication channels,
reporting on the use of services covered by the MultiSport Program.

The legal basis for collecting and processing personal data for the above purposes is our legal obligation related to the implementation of accounting and tax regulations; legitimate interest related to the exchange of data with recipients of your personal data, which is necessary for the performance of services and business efficiency, control of card usage in accordance with the terms of the MultiSport Program and/or analytics of service usage and/or contacting you about changes to terms, news, benefits and promotions of our other services for existing users and similar notifications that you expect from us; all in order to enable you to use the benefits of our MultiSport Program. In case you have given your consent within the pop-up window, the data is processed based on consent.

With your agreement, we may also process data related to your geolocation in order to show you the centers and amenities closest to your location. In this case, the legal basis for processing is your consent. Detailed information on the processing of personal data based on consent can be found in the Consent section.

MultiSport Kids Card

In relation to the MultiSport Kids Card, we always collect and process the following personal data:

the child’s first and last name, the child’s month and year of birth, the MultiSport Card number, the card type and expiration date (which become the child’s personal data after the card is issued in the child’s name), the place and time of use of the card and the type of service the child used;
information about the child’s parent/guardian, or information about the person whose Child is an Accompanying Person.

We collect and process the above data for the purpose of:

creating a MultiSport Kids Card that allows children to access services included in our MultiSport Program,
informing the Child or the parent/guardian about the possible inability to use the services included in our MultiSport Program,
delivery of MultiSport Kids Cards,
performing the calculation based on which the Employer of the parent/guardian of the Child or on behalf of the Child pays the fee for the use of the MultiSport Card,
improving the security and functionality of the server we use to provide electronic services,
checking whether the MultiSport Kids Card is used in accordance with the Terms of Use and checking for possible misuse of the MultiSport Kids Card.
responses to inquiries made through contact forms and other communication channels.

The legal basis for the collection and processing of children’s personal data is the consent of the parent/guardian. Detailed information on the processing of personal data based on consent can be found under the Consent section.

We must certainly point out that the legal basis for collecting and processing personal data for the above purposes is our legal obligation in relation to the parent/guardian, which is related to the implementation of accounting and tax regulations; legitimate interest related to the exchange of data with recipients of personal data, which is necessary for the performance of services and business efficiency, control of card usage in accordance with the terms of the MultiSport Program and/or contacting you about changes to the terms, news and similar notifications; all in order to enable you to use the benefits of our MultiSport Program.

Common provisions for all MultiSport Cards

With your authorization, which you give to your Employer and he is responsible for it, we may forward data relating to the time and place of use of the service and the type of service used within the MultiSport Program to your Employer for the purpose of assessing the justification for the use of the MultiSport Program by your Employer, all related to participation in the MultiSport Program. In this case, the Employer is the controller of personal data for the above purposes and is responsible for the lawfulness of the processing in question, including ensuring that you as the data subject are informed, but also for ensuring authorization or ensuring an adequate legal basis for the processing and forwarding of your data. Detailed information on the processing of personal data for these purposes by your Employer can be obtained from the data protection officer appointed by the Employer as the controller.

Sports Facilities/Partners have the possibility to access the data of MultiSport Card Users when identifying MultiSport Card users specifically for identification purposes. Depending on the individual Facility/Partner, identification can also be done automatically by accessing the MultiSport database when you scan your card at the MultiSport terminal upon entry. In relation to other processing of your personal data, these Sports Facilities are considered independent data controllers, and you are welcome to contact them for details regarding their processing of your data.

We store the personal data of MultiSport Card users for 18 months from the moment of deactivation of the MultiSport Card, and if it is a MultiSport Card for a Trial Period, then for 6 months from the moment of deactivation of the MultiSport Card for the Trial Period. The specified period represents the time during which the MultiSport Card can be reactivated. If the card is not reactivated within the specified time, it is archived and the data is anonymized, meaning that it no longer exists in a form that allows the identification of the MultiSport Card user as an individual.

We store data about children as MultiSport Kids Card Users until the moment of withdrawal of consent by the parent/guardian and immediately delete it after withdrawal of consent. What we keep is proof of withdrawal and request, and for 5 years from the resolution of the same.

We store data on the time and place of use of the MultiSport Card, except for the MultiSport Card for the Trial Period, for the aforementioned period, provided that our bill for the services used has been settled during that period, and if the bill has not been settled, then we store it for a period of 3 years from the date the bill is due, and if we have initiated a forced collection procedure, then we store it until the final conclusion of the court proceedings, all for the purpose of defending our possible legal claims.

If you yourself pay the fee for using the MultiSport card through the My MultiSport Platform for individual payments, then your data required for making the payment is processed by our business partner through whom you make the payment and only provides us with information about the number of the order that has been paid.

In case you wish to use the MultiSport service with our partners outside Croatia, we forward your MultiSport Card data outside the Republic of Croatia to the companies Benefit Systems SA (Poland), MultiSport Benefit s.r.o. (Czech Republic), Benefit Systems Slovakia s.r.o. (Slovakia), Benefit Systems Bulgaria OOD (Bulgaria) and Benefit Systems Spor Hi̇zmetleri̇ Li̇mi̇ted Şi̇rketi (Turkey), in order to enable you to also use the benefits of the MultiSport Program (International Visits) in the above-mentioned countries. Detailed information about the identity of the company, as well as the processing of your personal data that will be carried out, is available here .

Business partners

If you are our business partner, then we collect and process the following data, some of which is personal data and some of which is business data:

name and surname or name of an associate or legal entity, name and surname of the responsible person in the legal entity, name and surname of the contact person in the legal entity, address, personal identification number and/or registration number of the legal entity, contact information (email address and telephone or mobile device number), website address, bank account number, credit/debit card number, information on the type and content of your contractual relationship with Benefit Systems, username and password if you are a Client or Partner who has access to the client/partner network zone, name and location of the Sports Facility and the type of services it provides if you are a Sports Facility as a Partner.

We process the above personal data for the purpose of concluding a contract, i.e. establishing a contractual relationship, executing the contract, i.e. exercising the rights and obligations arising from the concluded contract, e.g. issuing invoices for services performed in the case of Clients or settling invoices for services provided in the case of Sports Facilities as Partners, mutual use of logos, and the like.

Regarding the retention period of personal data, we emphasize that it depends on the type of personal data collected.

We keep the name and surname or business name, address and personal identification number and/or registration number of the legal entity that are on the invoice issued for our services and the invoice received for the services you provided to us for 11 years (counting from the last day of the year in which the invoice was issued) as this is the legal obligation to keep issued and received invoices. The above-mentioned data is also on the contract you concluded with Benefit Systems, as well as data on the content of the contractual relationship and data on the responsible person and contact person, and the same is kept for 3 years after the termination of the contractual relationship, as this is the longest limitation period for any claims arising from the contractual relationship.

We delete contact information immediately upon termination of the contractual relationship, i.e. the performance of the service, unless you have given us consent to store the said information for the purpose of sending notifications about news in our offer. If you have given the said consent, detailed information on the processing of personal data based on consent can be found in the Consent section.

Marketing

For marketing purposes, such as sending offers, newsletters and performing other marketing activities, we process the following personal data:

name and surname or name of the legal entity, e-mail address and mobile phone number

We process the aforementioned personal data for the purpose of sending offers and informing about our products and services.

If we process your personal data for the above purposes, and you are our business partner or an active user of the MultiSport Card (except for the MultiSport Children’s Card), then we process your data based on our legitimate interest, and in other cases based on your consent. Detailed information on consent can be found under the Consent section.

If we process data on the basis of consent, we use and store the data until the moment of withdrawal of consent, and if we process it on the basis of legitimate interest, then we use and store it for the time for which there is our legitimate interest in processing personal data for marketing purposes, i.e. until the successful resolution of your request in which you object to processing based on legitimate interest.

The way we process personal data for marketing purposes depends on the type of relationship between us (e.g. whether you have logged into our website or mobile application, whether you are our Client, Partner or other party) and the consents you have given us.

Our marketing activities may include displaying advertisements on websites or applications, displaying offers or advertisements via a communication channel such as email or telephone (if you have authorized us to deliver marketing content via a communication channel of your choice, e.g. email, push notifications), traditional marketing mailings, conducting analysis and statistics for marketing purposes, and conducting satisfaction surveys, including contacting you via a communication channel of your choice. We may also conduct profiling for marketing purposes.

Customized marketing

We may process your personal data for marketing purposes, including profiling, in the following cases:

If you consent to the storage of cookies or similar technologies on your device, we may use information collected by these technologies to provide you with advertisements or offers tailored to your potential interests identified based on the content you view and your activity. For example, if you browse pages related to MultiSport packages, we may show you an advertisement for MultiSport or our other services on other websites and in applications;

If you are a registered user of our website or app and log into your account, we will be able to link information from the content you have viewed with you and use it for profiling to better tailor our marketing communications and offers to you;

If you consent to the delivery of marketing content from us to you via the communication channel of your choice;

If we are bound by a contract or carry out professional collaboration;

If you consent to the use of location information from your device (e.g. smartphone) for marketing purposes, we will be able to show you ads or offers relevant to your location. For example, we’ll be able to show you an invitation to an event nearby;

to conduct analyses and statistics for our marketing needs and to test your satisfaction with the services we offer by contacting you through the communication channel of your choice.

We can also offer you non-profiled ads and offers.

What is profiling for marketing purposes?

Our processing of your personal data for direct marketing purposes includes profiling. Profiling is the use of automated processing of your data to draw conclusions about your potential interests and preferences. Profiling allows us to best match products, offers and advertisements to you. As part of profiling, we may also combine information that you leave with us when using our various products and services, such as information that you leave when visiting our website or application, using the MultiSport Program.

We use tools provided by specialized third parties for profiling. See our “Cookie Policy” for more information about our partners and the ability to adjust your advertising preferences. We strive to ensure that profiling brings clear benefits: offers, promotions and advertisements that may be of interest to you. In this way, we want to ensure that we do not present you with content that may be inappropriate or unattractive to you. Example: if we determine that you are a woman and as part of the MultiSport Program you regularly attend dance classes at a certain location, this will give us a signal that you may be interested in new dance classes at your favourite place, but you are probably not interested in martial arts courses in another, far-off city.

Social networks

For the purposes of conducting and organizing events and webinars, we use Microsoft tools:

Microsoft Teams (for webinars) and Microsoft Forms (organization of events, applications) (Privacy statement: https://www.microsoft.com/en-gb/privacy/privacystatement )

You can also find us on social networks like Facebook, Instagram, LinkedIn, TikTok and YouTube among others. Each social network informs you about how it processes your data during registration, in accordance with their terms of use or privacy policies. We do not have access to all information about you to the same extent as the aforementioned platforms. However, if you have an account on a social network and view our profiles or interact with us (e.g. by leaving likes, hearts, comments or sending us messages directly via the communicator of a particular service), then we may see information about you that you have provided on a particular social network when contacting us, or that the platform provides to us, e.g. in connection with the display of advertisements or our profile (depending on your privacy settings on that platform).

Our social media pages

As already mentioned, the social network will be the main administrator of your personal data, which it processes in accordance with the information you provided during registration, for example on:

Google/YouTube ( https://www.youtube.com/howyoutubeworks/privacy/ )
LinkedIn (Privacy Policy: https://www.linkedin.com/legal/privacy-policy#others ; Page Insights Joint Controller Addendum: https://www.linkedin.com/legal/l/page-joint-controller-addendum )
Meta (Facebook; Instagram, Threads) (Facebook Privacy Center: www.facebook.com/about/privacy , Instagram Data Policy: https://help.instagram.com/155833707900388 ).
Tik Tok (Privacy Policy: https://www.tiktok.com/legal/page/eea/privacy-policy/hr )

Only when interacting with our profile in a specific service, we can process your data as its administrator, about which we inform you in the information clauses published on certain social networks. In addition, we may act as so-called co-hosts with certain social media platforms. For example, in relation to data processing for statistical purposes as part of our Facebook and Instagram pages, we and Meta Platforms Ireland Limited, Block J, Serpentine Avenue, Dublin 4, Ireland act as joint controllers of your data. When we use Meta products, we do so in accordance with their Terms of Use. More information about website statistics can be found at: www.facebook.com/legal/terms/information_about_page_insights_data .

If you would like detailed information about data processing on social networks, you can also contact us. You can find our contact details above in the How to contact us section.

Plugins and codes for social networks

Please note that if you log in using external authentication services offered by Facebook, Google, Apple or others, we will receive your personal data, in particular your first name, last name/username, profile photo, platform-specific authorization data. Depending on your privacy settings on the external platform, we may also receive other data. Please read the terms of use of the data on the external platform before using this service.

In addition, we place buttons and codes for social networks on our websites and applications. When someone redirects you to a specific social portal by clicking on one of these buttons, you can, for example, like or start following our website. Your activity and personal data are then also processed by the entity operating the portal and used for their own purposes, e.g. for marketing. Your activity on pages containing the codes and your personal data is collected by the entities operating the social network portals, in particular for statistical purposes and to check whether you are a logged-in user of this portal and to enable the provision of services (e.g. logging in via your social network account). The data is also further processed for other purposes specified by these institutions as independent controllers.

Detailed information on the processing of your personal data and how to exercise your rights related to data processing via social media portals is described in the privacy policies of the individual portals. Please read them.

Application via contact forms

By filling out our contact forms that appear in the form of surveys or questionnaires on the official Benefit Systems website, social networks (Facebook, Instagram, LinkedIn, TikTok, YouTube) or as Microsoft Forms, you also entrust us with your personal data.

If you are filling out the contact forms as an employer, then we collect the following data: the name and surname of the person contacting you on behalf of the employer, the name of the employer’s company or trade, the number of employees at the employer, the employer’s OIB (Personal Identification Number), the employer’s e-mail address and telephone number.

If you are filling out the contact forms as an employee, we collect the following personal data from you: first and last name, name of your employer’s company or trade, email address and telephone number.

If you are filling out the contact forms as the owner of a Sports Facility, then we collect the following data: first and last name of the person contacting you on behalf of the Sports Facility, name and address of the Sports Facility, type of service provided by the Sports Facility, website address, e-mail and telephone number.

If you fill out the contact forms as a user of the Sports Facility, then we collect the following personal data: your first and last name, the name of the Sports Facility, the address of the Sports Facility’s website, your e-mail and telephone number.

We collect and process the above data for the purpose of contacting you in order to establish cooperation and store your data in our database.

If we process your personal data for the above purposes, then we process your data based on your consent. You can find detailed information about consent under the Consent section.

We store the above data for 18 months from the moment you gave your consent to process your personal data, and in the event of withdrawal of consent, we delete it immediately after withdrawal of consent.

Candidates for employment

If you have applied for a job advertisement and submitted your job application and CV to us, we process the following data:

first and last name,
address of residence or temporary residence,
mobile phone number,
email address,
citizenship,
date of birth,
sex,
work experience,
education and training,
personal skills,
as well as all other information you entered in your resume.

We process the above data for the purpose of your participation in the job vacancy competition and the selection of candidates for employment.

The legal basis for processing the above personal data is to take legal action at your request to enter into an employment contract with Benefit Systems.

In the process of selecting candidates for employment, we conduct a psychological testing process that is conducted on our behalf by our business partner as a special external expert; in this case, we additionally process the results we receive after the psychological testing. In this case, the legal basis for processing your personal data is our legitimate interest in selecting the candidate who best meets the requirements of the individual job position and who will best fit into the work environment.

We retain the above-mentioned data until the moment of selecting a candidate with whom we have decided to establish an employment relationship, i.e. conclude an employment contract, and then we immediately delete it.

If you withdraw your application during the candidate selection process, we will delete all data immediately after you provide us with notice of withdrawal.

We provide your above-mentioned data to our business partner as an independent expert and data controller, who provides us with professional consulting services regarding the selection of candidates for employment and is bound by the professional and ethical standards of the psychology profession.

Video surveillance of business premises

Certain parts of the business premises of Benefit Systems are covered by a video surveillance system, and the video surveillance system processes the following data only when data subjects come within the perimeter of the surveillance cameras:

– recordings of data subjects (excluding sound).

The processing of the above personal data is carried out for the purpose of protecting the persons and property of Benefit Systems.

The aforementioned data, i.e. recordings, are submitted to the competent state authorities if any illegal conduct is recorded.

The legal basis for processing is Benefit Systems’ legitimate interest in protecting its assets.

The aforementioned data, i.e. recordings, are stored for a period of 1 (one) month after their creation. In the event that illegal conduct is recorded on the video recording, a longer storage period may be conditioned by the implementation of appropriate judicial, administrative, arbitration or other proceedings, of which Benefit Systems will promptly notify the data subjects.

Is providing data mandatory?

As a rule, providing personal data is not mandatory, but it may be necessary to use the services provided by Benefit Systems, e.g. to enter into a contract with us, participate in our competitions or to consider questions related to you. Therefore, your failure to provide data may in some cases make it impossible to provide services or take other actions. Our forms used to collect data clearly state which data we need (necessary) and which are optional.

To whom do we share personal data?

Your personal data may be transferred to the following entities: entities from the Benefit Systems Group of companies, providers of hosting and maintenance services for our websites and applications, providers of ICT and IT support and security services, providers of data storage and destruction services, providers of services that are in addition to the services we provide to you, our partners (sports and recreation, entertainment and cultural institutions, hotels, offices and travel agents), entities that have enabled you to use the MultiSport Program, or other services (usually your employer or the employer of the person who registered you for the MultiSport Program), card printers, social network operators, payment operators, companies that support us in debt collection, entities that provide services related to our clients’ services, and other stakeholders (e.g. couriers) and those entities that support our marketing activities, as well as legal advisors and auditors and providers of electronic signature services or AI services to assist in reviewing documents.

If you wish to use your MultiSport Virtual Card outside of Croatia, your personal data will be transferred to a company within the Benefit Systems group that provides services in the country where you use the card. Detailed information about the identity of the company, as well as the processing of your personal data that it will carry out, is available here .

Your data may also be transferred to public authorities in cases provided for by law.

Your personal data is securely stored on our or an external server of our choice and in our business premises, which sufficiently guarantee the implementation of appropriate technical and organizational measures in such a way that the processing complies with the requirements of the General Data Protection Regulation and ensures the protection of your rights.

If we need your data to exercise our rights and/or defend legal claims before competent state authorities and/or comply with legal obligations, then we provide your data to our legal representative who represents us in these proceedings (e.g. a lawyer) or to a partner who performs the aforementioned legal obligations on our behalf (e.g. an accounting office or tax advisor). In that case, your data, depending on the type of proceedings, may be made available to recipients of personal data, such as courts, notaries, the Financial Agency and other state authorities that are in any way connected with the proceedings in question.

In certain cases, we also forward your data to an accounting office that performs bookkeeping and accounting tasks on behalf of Benefit Systems, such as posting invoices, preparing financial statements for the purpose of calculating and paying taxes, and in order to fulfil other obligations that we, as a company, must fulfil based on accounting, bookkeeping and tax regulations. For the above purpose, we also forward some of your data to the Tax Administration as the recipient of your data.

We forward your personal data, namely your name and surname or title and address, to legal entities that perform postal delivery services, and who need to know the specified data in order to be able to perform the delivery service. This applies if deliveries are made via regular mail.

The bank with which our business account is kept, through which money transactions are carried out, also has the possibility of viewing some of your data.

We will limit the data that we forward and deliver to the smallest possible extent so that we will only forward to the specified legal or natural persons to whom we forward personal data the data they need for the purpose of processing determined by Benefit Systems.

All legal and natural persons to whom we forward your personal data have an obligation to maintain confidentiality within the framework of the contractual relationship and have also implemented organizational and technical protection measures.

Certain data may be forwarded to the authorities of the Republic of Croatia at their request, in order to comply with obligations prescribed by the law of the Republic of Croatia and/or the European Union.

Is your data transferred outside the European Economic Area?

As a rule, your personal data is not transferred outside the European Economic Area (EEA). Some of the recipients of the data (such as technology solution providers) may process it in third countries or be subject to the jurisdiction of the USA. We make every effort to ensure that the provision of data to these providers is lawful and that all relevant safeguards are in place. If the European Commission has not adopted a decision confirming that a particular third country ensures an adequate level of protection of personal data, we ensure that data transfers are carried out on the basis of other legal safeguards, e.g. on the basis of standard contractual clauses or codes of conduct. You can contact us to obtain copies of the implemented security measures. You can find our contact details above in the How to contact us section.

How long will your data be stored?

We store your data for the period necessary to achieve the processing purposes set out in the How we process your personal data section. We will delete the data when it is no longer necessary for the purposes set out above. We specifically store your data:

For the performance of contracts and provision of services until the contract is fulfilled or until the provision of services ceases, and afterwards for the period necessary for an effective investigation or defence of claims, which is usually 3 or 6 years, but may be shorter or longer in certain situations provided for by law, with the note that we only keep the data that was necessary for us to defend our legal claims in the proceedings;
When the law imposes certain obligations on us, in particular tax and accounting obligations, we process the data necessary to fulfil these obligations for the legally prescribed period (11 years);
When we process data based on your consent, we process it at the latest until you withdraw your consent;
When we process data based on legitimate interest, we process it for the longest time until the complaint is effectively submitted and until the final completion of the complaint procedure, unless the data is no longer necessary for the realization of our legitimate interests;
We keep requests related to the exercise of your rights as a data subject for 5 years from the resolution or completion of other legal proceedings related to the request in question.

Consent management

If we base the processing of your personal data on consent, then we ensure that you can always give your consent with full information, in advance and explicitly – by signature or clear action (including the opt-in option if consent is given via electronic media) and that the consent is voluntary, separate from other purposes, and unambiguous.

Information regarding consent to the processing of your personal data will be compiled for each individual processing purpose, in an understandable and easily accessible form using clear and plain language.

You have the right to withdraw your consent to the processing of personal data at any time, of which you will be additionally informed before giving consent and you will be informed of how you can withdraw your consent.

Please note that if consent is given for a one-time processing operation, and that processing has already been carried out, then the withdrawal of consent has no legal effect.

In the event of withdrawal of consent, we will immediately delete all your personal data unless there is another legal basis and purpose for their further processing.

We also note that the processing of personal data that was based on valid consent before its withdrawal is completely lawful.

If you do not agree to give consent in cases of data processing based on consent, we are then unable to carry out the processing based on consent.

What are your rights?

Right of access

You can obtain from us confirmation as to whether your personal data are being processed and, if so, access to that data and the following information: information on the purpose of the processing, the categories of personal data concerned, the recipients or categories of recipients to whom the personal data have been or will be disclosed, the envisaged period for which the personal data will be stored and the existence of the data subject’s rights with regard to the processing of personal data (which rights are set out further in this Privacy Policy).

Right to correction

If your personal data that we process is incomplete or inaccurate, you can ask us to correct or supplement it at any time by providing an additional statement. We note that you are responsible for providing correct data, and you are also obliged to inform us of relevant changes to your personal data. Correction and updating of personal data may take up to 5 business days, which is related to the technical conditions of our systems.

Right to erasure

You have the right to request the erasure of your personal data if you have objected to the processing based on our legitimate interest or if you believe that your data has been processed unlawfully or if you believe that your data should be erased under European Union or Croatian law. We will erase your data immediately after you submit a request for erasure, except for data that we are required to keep in accordance with European Union and Croatian regulations.

Right to restriction of processing

You can request from us to restrict the processing of your data:

if you dispute the accuracy of the data, during a period that allows us to verify the accuracy of that data,
if the processing of the data was unlawful, but you refuse deletion and instead request restriction of data use,
if we no longer need the data for the intended purposes, but we still need it to comply with legal requirements.

If data processing is restricted, then such personal data may only be processed with your consent, except for the purpose of storing the data or for the establishment, exercise or defence of legal claims or the protection of the rights of another natural or legal person or for important public interest reasons. If you obtain a restriction of data processing, we will inform you before the restriction is lifted.

Right to object

Given that we rely on our legitimate interests when processing your personal data, you may object to such processing if there is an interest in protecting your data. If you have objected to such processing, we will no longer process your data unless we demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms or if it is necessary for the establishment, exercise or defence of our legal claims.

Right to appeal

If you believe that we have acted contrary to European Union or Croatian law when processing your personal data, please contact us so that we can clarify any questions you may have. You certainly have the right to file a request at any time for the determination of a violation of your rights regarding the processing of your personal data with the Personal Data Protection Agency, Ulica Metela Ožegovića 16, 10 000 Zagreb, and you can find the request form via the following link https://azop.hr/zahtjev-za-utvrdivanje-povrede-prava/ .

Exercising rights

If you wish to exercise any of the above rights, you can contact us via the following communication channels:

to the email address which is also the address of the data protection officer:

dpo@benefitsystems.hr ,

– to the address of the headquarters of Beneﬁt Systems d.o.o., Ulica Vjekoslava Heinzela 44, 10000 Zagreb with

with a note on the envelope “Personal data”.

Benefit Systems will respond to your requests for exercising your rights in accordance with the deadlines and authorizations prescribed by the General Data Protection Regulation (one month). When we need more time, we will inform you of the extended deadline for considering your request and the reasons for the delay (up to two more months). If your request is manifestly unjustified or excessive, we may refuse to take the requested measures, of which we will always inform you.

In any case, when exercising the above rights, please note that we must unequivocally establish your identity, which serves to protect your rights and privacy.

If you exercise any of the above rights excessively and with obvious intent to abuse them, we may charge you a reasonable fee considering the actual administrative costs of providing information or notification or processing your request, or we may refuse to process your request.

Personal data protection measures

Benefit Systems has implemented appropriate technical, organizational and personnel measures to enable the effective application of data protection principles, such as reducing the amount of data and incorporating protective measures into the processing, as well as measures necessary to protect personal data against accidental loss or destruction, against unauthorized access or unauthorized alteration, unauthorized disclosure and any other misuse, in relation to all data regardless of the place of storage or processing or the format in which it is located, all in order to meet the requirements of the General Data Protection Regulation and protect the rights of data subjects.

Benefit Systems has trained its employees who participate in the processing of personal data, and such employees are required to keep this data confidential by means of a special confidentiality statement.

Privacy Policy Changes

This Privacy Policy may change from time to time in accordance with legislation or industry developments and practices and any new measures we may take to improve the security of your personal data. You will be notified of any changes in a timely manner by posting the revised privacy policy on the Benefit Systems website.

Benefit Systems d.o.o.