Privacy policy

Verzija na hrvatskom jeziku: Politika privatnosti

DATA CONTROLLER: BiLog d.o.o., Strojarska cesta 20, Zagreb, e-mail:
bilog@bilog.hr
More detailed information can be found at: Home – BiLog IT Solutions

Data Protection Officer, DPO, e-mail: gdpr@bilog.hr, dpo@bilog.hr

BiLog d.o.o. (hereinafter: the “Company”) is committed to protecting the privacy and
security of personal data and processes personal data in accordance with the
General Data Protection Regulation (EU 2016/679) (GDPR), the Croatian Act on the
Implementation of the General Data Protection Regulation, and other applicable laws
and regulations.

This Policy explains:
– which personal data we process,
– for what purposes we process them,
– on which legal bases we process them,
– how long we retain them,
– with whom we share them,
– what rights data subjects have,
– which security measures we apply.

For the purposes of this Policy:
Personal data means any information relating to an identified or identifiable natural
person.

Data subject is a natural person whose personal data are being processed.

Processing represents any operation or set of operations performed on personal
data, such as collection, recording, organization, structuring, storage, adaptation or
alteration, retrieval, consultation, use, disclosure by transmission, dissemination or
otherwise making available, alignment or combination, restriction, erasure, or
destruction.

Data controller is the legal entity which determines the purposes and means of the
processing of personal data.
Data processor is a natural or legal person that processes personal data on behalf
of the data controller.

Consent is any freely given, specific, informed, and unambiguous indication of the
data subject’s wishes by which they signify agreement to the processing of personal
data relating to them.

The Company primarily provides services to business clients (B2B).

Personal data may be processed during:
– implementation of HRMS systems,
– development of business software applications according to client
requirements,
– development of reporting and analytics systems,
– recruitment procedures and employment relationship establishment,
– business communication with clients, partners, and suppliers,
– inquiries submitted via the website contact form.

Depending on the purpose of processing, processed data may include:
– first and last name,
– business e-mail address,
– business telephone number,
– employment-related information,
– data contained within clients’ business applications,
– other data necessary for the performance of the agreed service.
The Company does not use the personal data of end users for its own marketing or
commercial purposes.

We process personal data solely when an appropriate legal basis exists.

Performance of a Contract
Data are processed to provide agreed services to business clients and fulfill
contractual obligations.
Legal basis: Article 6(1)(b) of the GDPR.

Compliance with Legal Obligations
Certain data are processed to fulfill legal and regulatory obligations of the Company.
Legal basis: Article 6(1)(c) of the GDPR.

Legitimate Interests
Certain data may be processed for the purposes of:
– protecting information systems and network security,
– preventing unauthorized access to systems,
– ensuring business continuity,
– conducting business communication,
– responding to inquiries submitted via the website,
– establishing, exercising, or defending legal claims.

Prior to relying on legitimate interest, the Company conducts a balancing test to
ensure that the interests, fundamental rights, and freedoms of data subjects do not
override the legitimate interests of the Company.
Legal basis: Article 6(1)(f) of the GDPR.

Consent
Where required, personal data are processed based on the prior consent of the data
subject.
Legal basis: Article 6(1)(a) of the GDPR.
The data subject may withdraw their consent at any time.

In certain cases, the Company does not collect personal data directly from data
subjects, but receives them from its business clients within the scope of providing
contracted services.

When the Company acts as a data processor, it processes personal data strictly
according to the documented instructions of the data controller and does not
determine the purposes or means of processing.

The Company processes personal data strictly to the extent necessary to achieve the
purpose of processing.

Within the scope of providing services to business clients, personal data are
processed primarily on the client’s systems and are not used for the Company’s
own business purposes.

The Company takes appropriate technical and organizational measures to ensure the
confidentiality, integrity, and availability of personal data.

Where the Company acts as a data processor, personal data are processed strictly in
accordance with documented instructions from the data controller.

Personal data may be accessible to:
– authorized employees of the Company,
– contractual partners providing support services, which may include: cloud
service providers, hosting partners, backup service providers, security service
providers, accounting, and auditing partners,
– competent public and government authorities when required by law.

The Company does not sell or rent personal data to third parties.

The Company generally does not transfer personal data outside the European
Economic Area (EEA).

If the transfer of personal data outside the EEA is necessary for the provision of a
specific service, the Company will ensure appropriate safeguards pursuant to the
GDPR, including the application of Standard Contractual Clauses (SCC) approved by
the European Commission or another appropriate transfer mechanism.

Through the use of website analytics tools (Google Analytics 4), certain online
identifiers and browsing data may be transferred to the service provider Google
Ireland Limited. This transfer is based on the European Commission’s Adequacy
Decision under the EU-U.S. Data Privacy Framework (DPF) and Standard
Contractual Clauses (SCC).

Personal data are retained only for as long as necessary to achieve the purpose for
which they were collected or as required by applicable statutory regulations.
Upon expiration of the retention period, data are erased or securely anonymized.
5/1
Data of job applicants are retained until the completion of the recruitment process, or
for up to 6 months with the data subject’s explicit consent.

The Company does not carry out automated decision-making or profiling within the
meaning of Article 22 of the GDPR that would produce legal effects concerning data
subjects or similarly significantly affect them.

Every data subject has the right:
– to access their personal data,
– to rectification of inaccurate personal data,
– to erasure (“right to be forgotten”),
– to restriction of processing,
– to data portability,
– to object to processing,
– to withdraw consent at any time where processing is based on consent.

Requests may be submitted:
by e-mail: gdpr@bilog.hr, dpo@bilog.hr
or by postal mail to the Company’s registered address.

We will respond to requests without undue delay and at the latest within one month
of receipt. In exceptional cases, where the request is particularly complex, this
deadline may be extended by up to two additional months, with prior notification
provided to the data subject.
Requests are processed free of charge, unless they are manifestly unfounded or
excessive.

If we process personal data on the basis of our legitimate interest (Article 6(1)(f) of
the GDPR), you have the right to object to such processing at any time on grounds
relating to your particular situation. In the event of an objection, we will cease
processing your data unless we demonstrate compelling legitimate grounds for the
processing which override your interests, rights, and freedoms, or for the
establishment, exercise, or defense of legal claims.
You may submit your objection request to: gdpr@bilog.hr or dpo@bilog.hr.

If you consider that the processing of your personal data infringes data protection
regulations, you have the right to lodge a complaint with the supervisory authority:
Agencija za zaštitu osobnih podataka (AZOP)
Selska cesta 136, 10 000 Zagreb, Croatia
Website: www.azop.hr | E-mail: azop@azop.hr

Without prejudice to the right to lodge a complaint with the supervisory authority, data
subjects have the right to an effective judicial remedy and to enforce their rights
before the competent court in accordance with applicable statutory law.

The Company’s website uses cookies to ensure functionality and improve user
experience.
The legal basis for using strictly necessary cookies is our legitimate interest (Article
6(1)(f) of the GDPR), while analytical cookies are used exclusively based on user
consent (Article 6(1)(a) of the GDPR).

We use:
Necessary Cookies
Essential for website operation and cannot be switched off.

Analytical Cookies
Used to analyze website usage and improve site functionality.
Analytical cookies are placed exclusively after the user provides consent via the
cookie management system.
Users may modify or withdraw their consent for analytical cookies at any time via the
cookie settings available on the website.
More information is available in our separate Cookie Policy.

The Company implements appropriate technical, organizational, and physical
security measures to protect personal data against:
– unauthorized access,
– unauthorized disclosure,
– alteration of data,
– loss of data,
– destruction of data,
– other security incidents.

The Company manages information security through an established and certified
Information Security Management System compliant with the ISO/IEC 27001
standard and applies corresponding security policies and operational procedures.

Personal data may be disclosed to competent state and judicial authorities when
such disclosure is required by law or based on a valid and legally binding request
issued by a competent authority.

For all questions regarding personal data protection, you may contact us:
E-mail: gdpr@bilog.hr, dpo@bilog.hr
By post: BiLog d.o.o., Strojarska cesta 20, 10 000 Zagreb, Croatia
Marked: “For Personal Data Protection”

We regularly update this Privacy Policy to ensure it remains accurate and current,
and we reserve the right to amend its content if deemed necessary. You will be duly
informed of all changes and amendments via our website in accordance with the
principle of transparency.

Last updated: September 11, 2026