MBE Adriatic d.o.o. collects and processes personal data, giving special attention to ensuring its adequate protection. This Statement outlines which data we collect, how we process it, the purposes for which we use it, and your rights regarding your data.
a) The data controller is:
Data Controller: MBE Adriatic d.o.o.
Puževa 11
10 000 Zagreb
Tel: +385 (0)1 6471-862
Email contact: gdpr@mbe.hr
b) When we use external service providers to process your personal data, this is considered processing on our behalf. Even in such cases, we remain responsible for protecting your personal data.
We process the following personal data in relation to our employees, clients, suppliers, and franchisees.
For employees, we process personal data as required by the Labor Law, the Regulations on the Content and Maintenance of Employee and Working Time Records, and data necessary for executing employment contracts and complying with labor law regulations.
For our clients, we process the following personal data: first and last name, address, contact number, and email.
For suppliers and franchisees, we process the following personal data: first and last name, address, personal identification number (OIB), contact number, email, employment information, and bank account details of the supplier/franchisee if operating as a sole proprietor or self-employed. If the supplier or franchisee is a legal entity, we also process the first and last name, OIB, address, and employment information of authorized representatives, as well as the first and last name, contact number, email, and employment information of contact persons.
We also process data from video surveillance recordings.
The legal basis for processing employees’ personal data is the Labor Law, the Regulations on the Content and Maintenance of Employee Records, and the employment contract.
The legal basis for processing the personal data of clients, suppliers, and franchisees is the contract, with the purpose of fulfilling rights and obligations under the contractual relationship or to take steps prior to entering into a contract.
Legitimate interest serves as the legal basis for processing video surveillance recordings.
The data controller will transfer personal data to third parties only on the basis of a written request from the recipient, and only if it is assessed that the obligation to provide the data outweighs the duty to maintain the confidentiality of personal data. The written request must specify the purpose of processing, the legal basis for using the personal data, and a precise specification of the exact data being requested.
Your personal data is not transferred outside the European Union.
Personal data is retained for the periods prescribed by law, or, if no such period is specified, until all rights and obligations under the concluded contracts have been duly fulfilled. Personal data will not be deleted if enforcement proceedings for unpaid claims have been initiated and/or legal proceedings are ongoing, until the final conclusion of such proceedings in accordance with applicable regulations.
When entering into an employment contract, the Data Controller clearly informs employees which personal data is required for the purpose of concluding the contract, and which data they are not obliged to provide if the Data Controller also collects and processes data that is not necessary for the conclusion or execution of rights and obligations under the employment contract.
For clients, suppliers, and franchisees, the Data Controller clearly informs them that certain personal data must be provided for the purpose of concluding and performing contracts, either to identify them as contractual parties or to fulfill rights and obligations under the concluded contracts.
a) Right to Rectification: If we process your personal data that is incomplete or inaccurate, you may request at any time that we correct or complete it.
b) Right of Access: You have the right to obtain confirmation as to whether we process your personal data, and where applicable, to request access to such data under the conditions set out in Article 15 of the General Data Protection Regulation (GDPR).
c) Right to Erasure: You may request the deletion of your personal data if we have processed it unlawfully or if the processing constitutes a disproportionate infringement of your protected interests. Please note that there may be reasons preventing immediate deletion, such as legal retention obligations.
d) Right to Restrict Processing: You may request the restriction of processing of your data: if you contest the accuracy of the data while we verify it; if the processing is unlawful but you oppose deletion and prefer restriction instead; if the data is no longer needed for the intended purposes but is still required to establish, exercise, or defend legal claims; or if you have lodged an objection.
e) Right to Data Portability: You may request that we provide the data you have entrusted to us for archiving in a structured, commonly used, machine-readable format: if we process such data based on your consent (which you may withdraw) or to fulfill a contract, and if processing is carried out using automated means.
f) Right to Object: If we process your data for tasks in the public interest or in the exercise of official authority, or rely on our legitimate interests, you may object to such processing if there are grounds to protect your data.
g) Right to Lodge a Complaint: If you believe that we have violated Croatian or European data protection regulations in processing your data, please contact us to resolve any concerns. You also have the right to lodge a complaint with the competent supervisory authority.
h) Exercising Your Rights: To exercise any of the rights listed above, please contact us using the details provided in Article 1 of this Statement or via the “Data Subject Request” form available on our website at www.mbe.hr.
i) Identity Verification: In cases of doubt, we may request additional information to verify your identity. This is to protect your rights and privacy.
j) Abuse of Rights: If any of these rights are exercised excessively or with obvious intent to abuse, we may charge an administrative fee or refuse to process your request.
We do not carry out any automated decision-making processes with regard to your personal data.
We may update this Statement, and you will be notified in a timely manner, including, among other methods, by posting the updated version on our website www.mbe.hr.
Mail Boxes Etc./MBE centers operate through independent franchisees under the MBE brand. Through its franchise network, Mail Boxes Etc. provides support services for businesses and individuals. Logistics and shipping services are MBE’s core offerings—facilitated through agreements MBE makes for the benefit of its franchisees with major domestic and international express couriers—along with other graphic and printing services, provided either directly or through agreements with large printing centers. Promotion of services to business and private customers is carried out as part of the business activities of each MBE franchise partner, both inside and outside MBE centers ("farming"). Each franchise partner is contractually obligated to perform such activities. Mail Boxes Etc. and MBE are registered trademarks used with permission from Fortidia – a registered trademark of MBE Worldwide S.p.A – (All rights reserved). Services offered by individual MBE centers may vary by location. The materials available on this website, the information contained herein, and any other relevant data may not be copied, distributed, modified, republished, reproduced, downloaded, or forwarded to third parties in any way without the express prior written consent of Sistema Italia 93 S.r.l. We accept no responsibility for unauthorized use of the materials, information, and/or data available on this website.
MBE Adriatic d.o.o. • Puževa ulica 11, Zagreb • OIB:64386903048 • MB:0479781
