Parks of Croatia About us Contacts News Sponsors and partners Park activities iTransparentnost

About us

The data controller responsible for the processing of personal data collected by the Brijuni National Park Public Institution is the legal person Brijuni National Park Public Institution, Brijuni, 52 100 Pula.

The Brijuni National Park Public Institution, Brijuni, collects and processes personal data of individuals (data subjects) for business purposes in accordance with applicable regulations governing the protection of personal data (General Data Protection Regulation (EU) 2016/679).

The function of the Data Protection Officer of the Brijuni National Park Public Institution is performed by:

Milena Kostović, dipl. iur.
Contact details:
e-mail: zop@np-brijuni.hr
address: Brionska 10, 52 212 Fažana
telephone number: +385 52 525 804

The Data Protection Officer monitors personal data protection and ensures the legality of personal data processing in terms of compliance with the provisions of the General Data Protection Regulation (GDPR) and other regulations governing personal data processing matters. The Data Protection Officer is obliged to safeguard the confidentiality of all information and data that they become aware of in the course of performance of their duties, and such obligation applies even after the performance of duties in their capacity as a Data Protection Officer.

The Brijuni National Park Public Institution collects the following categories of data:

data on employees and other persons at work;
data necessary for employment;
data on guests and visitors;
data on business partners;
data necessary for exercising the rights of access to and reuse of information;
data on visitors to premises;
video surveillance footage for the purpose of protecting property and safety of individuals.

You can contact the Data Protection Officer for all questions regarding the processing of your personal data and you have the right to:

obtain information regarding the processing of your personal data;
obtain access to your own personal data;
request rectification of inaccurate, imprecise or incomplete personal data;
request deletion of personal data when they are no longer necessary or if the processing is unlawful;
request restriction of processing of your personal data in specific cases;
object to processing of your personal data by lodging a complaint with the supervisory authority (Croatian Personal Data Protection Agency, AZOP).

“Personal data” means any information relating to a natural person who has been or can be identified based on such data. Personal data are all data relating to an individual whose identity has been or can be identified, directly or indirectly, in particular by reference to additional identifiers or by reference to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual.

Personal data can be collected and processed when you have been made aware of it and when there is a valid legal basis to do so.

A valid basis exists in the following cases:

processing is necessary for the performance of a contract to which you are party or in order to take steps at the request of the data subject prior to entering into a contract (e.g. data processing when applying for a job, submitting an application in order to exercise various rights, etc.);
processing is necessary for compliance with a legal obligation (e.g. transferring data on employees to the Croatian Health Insurance Fund (HZZO) or the Croatian Pension Insurance Institute (HZMO));
processing is necessary in order to protect your vital interests or the vital interests of another natural person (e.g. disclosure of employment data in order to exercise the right to child allowance);
processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (e.g. due to the official authority of the Croatian Bureau of Statistics, we are obliged to submit to the Bureau certain personal data);
processing is necessary for the purposes of the legitimate interests pursued by us as the controller, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data, in particular where the data subject is a child (e.g. the legitimate interest of a property owner to install a video surveillance system in order to prevent a real risk to their property);
you have given consent to the processing of personal data for one or more specific purposes (e.g. in order to subscribe to a loyalty programme).

The Brijuni National Park Public Institution has identified the following purposes of processing personal data:

complying with the requirements of acts and other applicable legal regulations governing labour relations, the hospitality industry, tourism, and taxes;
conclusion of contracts: processing for the purpose of concluding a contract relating to any area of activity of Brijuni National Park (e.g. participating in a public offer of employment, sending inquiries, sending special offers, requesting data about the signatories of a contract, participating in tenders of legal persons represented by data subjects, etc.);
performance of contracts: data processing is necessary for the purpose of performance of a contract, which includes the fulfilment of obligations, monitoring their fulfilment and ensuring that all relevant measures for their fulfilment are taken (e.g. agreement on the time and place of delivery of equipment under the contract, sending invoices, etc.);
providing information: collection and processing of data for the purpose of quality and timely provision of information;
protection of property and persons: includes monitoring entrances/exits from business premises and other property of the Brijuni National Park.

In addition to the stated purposes, personal data can be processed for other specific purposes as well, but always in line with the legal framework or if the processing is necessary to exercise rights and obligations arising from an employment relationship.

Legal framework

Act on the Implementation of the General Data Protection Regulation (Official Gazette No 42/18)