Privacy Policy

TomTon, a service business, with its registered office in Zagreb, Pile III. 11, MBS: 99029472 (hereinafter referred to as: the Business) is determined and committed to protecting your privacy and personal data when processing them. This Privacy Policy explains how we collect and use your personal data for the purpose of fulfilling our legal obligations, establishing and exercising rights and obligations under the contractual relationship, and your rights and options in this regard.

The Business is responsible for the security of the collected personal data.

Your data will be processed by the Business as the data controller, and Tomislav Tonšić as the person responsible for the GDPR. In order to protect personal data, enable their processing and exercise your rights as a data subject whose personal data is processed, personal data may be transferred to natural and legal persons with whom we cooperate based on our contractual or legal obligations (e.g. tax advisors, accounting services, law firms, competent public authorities).

• data for establishing and maintaining contact such as name and surname, residential address, place of residence, personal identification number, occupation-business function, postal address, business address, landline number, fax number, mobile phone number, electronic mail (e-mail);

• data relating to the issuance of invoices and payment processing and the implementation of legal obligations in relation to the prevention of money laundering and terrorist financing such as bank account numbers and other related information;

• further business information that is strictly necessary for the purpose of establishing a contractual relationship or that is voluntarily provided to us such as instructions, specific requests and/or orders;

• previously published information that we collect through publicly available registers, records and registers;

• details of mutual communication (written correspondence, etc.) as well as conversations conducted to the extent necessary for the exercise of rights and obligations under the contractual relationship;

We collect and process your personal data depending on the circumstances, including:

• when and if the collection of personal data is necessary for the purpose of establishing a contractual relationship and exercising rights and obligations under it;

• when you contact us directly or via electronic communications and/or our employees with the aim of establishing a business relationship or expressing an interest in establishing a business relationship;

• when our employees contact you or a legal entity in which you are a shareholder, business shareholder, direct or indirect economic interest or perform a relevant function, including employment, with the aim of establishing a business relationship or expressing an interest in establishing a business relationship;

• for the purpose of distributing promotional material and advertising our products and services;

• in certain circumstances we collect and process your personal data through third parties. For example, we may collect personal data from a legal entity with which you are doing business, other legal entities with which your legal entity is doing business, other publicly available registers, records and registers.

In principle, you provide us with all personal data voluntarily; as a rule, there are no negative or harmful consequences if you decide not to provide us with your personal data. However, there are circumstances when the Business cannot undertake business activities, including legal actions, without your personal data, for example when personal data is necessary to process your orders, instructions, requests and applications, for the purpose of establishing a legally binding relationship. In all such cases, the collection and processing of your personal data is a condition for the provision of our services unless there is another legal basis for their collection, such as a statutory or contractual basis.

We process personal data exclusively for the following purposes (hereinafter: Permitted Purposes):

• for the purpose of establishing and exercising rights and fulfilling obligations arising from employment;

• for the purpose of exercising the rights of workers prescribed by special laws;

• for the purpose of exercising the rights of the Business as an employer arising from employment and in connection with employment;

• for the purpose of protecting the safety and health of workers;

• for the purpose of creating and delivering promotional material;

• for the purpose of establishing a contractual relationship and exercising rights and obligations arising from it;

• for the purpose of managing and administering business processes related to the fulfillment of the contract and exercising rights and obligations arising from it, including payment processing, accounting purposes, auditing, debt collection and support services in connection with the above;

• for the purpose of harmonizing and fulfilling our legal obligations as well as obligations that may arise from European Union law and the laws of third countries to the extent applicable and to the extent and content in which the aforementioned rights do not contradict the law of the Republic of Croatia;

• for the purpose of analyzing and improving our services and communicating with you;

• for the purpose of protecting security and managing access to our business premises, IT and communication systems, online platforms, websites;

• for the purpose of identifying the person authorized to represent our contractual partners, sign orders and accept offers and conclude a contractual relationship with us;

• for the purpose of complying with court decisions and decisions of public law bodies and legal entities with public authority and exercising our rights and legally based interests;

• for the purpose of keeping records of statistics related to our business;

• for the purpose of marketing, promotion and advertising;

• for any purpose that is considered strictly necessary in connection with the achievement of any of the above-mentioned purposes.

For the purpose of communicating in connection with marketing services, provided that such an obligation is prescribed by law, we will only send you information in relation to which you have given consent and only for as long as you do not withdraw your consent. We will not use your personal data to take any other actions or create profiles except in the cases specified here.

Depending on the Permitted Purpose for which we process your personal data, we may process your personal data on the following legal grounds:

• if you have given consent to the processing of your personal data for one or more Permitted Purposes;

• the processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract;

• the processing is necessary for compliance with our legal obligations;

• the processing is necessary to protect your vital interests;

• the processing is necessary for the purposes of our legitimate interests in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: GDPR).

We may share your personal data in the following circumstances:

If you are our business partner, we may share your personal data with external collaborators such as law firms, accounting services, tax advisors, credit bureaus and financial institutions, business entities with which cooperation is necessary to exercise rights and obligations under a mutual contractual relationship (for example, printing houses), debt collection agencies, public law bodies and bodies with public authority, when this is necessary for the purpose of protecting contractual rights and/or claims, or when this is in the public interest or when this represents a legal obligation.

We may share your personal data on a confidential basis with third parties for the purpose of obtaining your opinion regarding the quality of our products and services in order to help us improve the quality of our products and services.

We may share your personal data with third parties to whom we have transferred or assigned rights under a contractual relationship with you.

We are also authorized to instruct third parties to process your personal data on our behalf and for our account and in accordance with our instructions as the data controller, in which case we assume responsibility for the confidentiality and security of your personal data. In such a case, the Business remains fully responsible to you for the security and confidentiality of your personal data and will use all necessary measures required by applicable regulations to ensure the integrity and security of your personal data.

We may also use your personal data for statistical purposes to monitor visits to and use of our websites with the aim of developing our business and improving the quality of the websites.

Otherwise, we may disclose your personal data to a third party only if you give us your consent to do so, regardless of whether the consent is contained in a separate document or represents a separate clause of the contract, if it is a legal obligation or an obligation to act in accordance with an order of a court or other public law body or body with public authority.

If you provide us with personal data of other individuals (for example, one of your employees, directors or persons with whom you have a specific business relationship), you must ensure and warrant that you are authorized to disclose the personal data to us, that we may process it, and that we may obtain, use and transfer it without obligation to take further action in accordance with the terms set out in the Privacy Policy. In particular, you must ensure that the other individual is aware of the disclosure of their personal data to us, that they have consented to such disclosure, use and transfer of personal data, and that they are fully aware of the content of the Privacy Policy, including but not limited to our identity, contact details, purposes of processing personal data, rights in relation to access to personal data, amendment of personal data, insight into collected personal data, deletion of personal data, transfer of personal data, right to lodge complaints in relation to the processing of personal data, as well as the consequences in the event of a breach of our obligations in relation to the above.

We will protect your personal data by implementing appropriate technical and organizational security measures in accordance with internal regulations and procedures regarding the storage, access, disclosure and access to personal data. Personal data may be kept in paper form and stored in special electronic personal data protection systems.

If the Business needs to transfer personal data to a third country or an international organization, we will take all necessary measures to ensure that the level of protection of your personal data meets the requirements of the Regulation and other applicable regulations of the Republic of Croatia. We ensure this, among other things, by applying standard contractual clauses issued by the European Commission (Commission Decision of 15 June 2001 on standard contractual clauses for the transfer of personal data to third countries, in accordance with Directive 95/46/EC and Commission Decision of 27 December 2004 amending Decision 2001/497/EC as regards the introduction of an alternative set of standard contractual clauses for the transfer of personal data to third countries). In the event of such a transfer, the recipient of personal data in a third country or international organization shall ensure the level of protection required by the Regulation. In the event of the transfer of personal data to third parties, the Business will ensure that the said persons provide the same level of protection as the Business.

If any of the personal data you have provided to us changes (e.g. your e-mail, residential address, etc.) or if you become aware that we have inaccurate personal data, please inform us by sending an e-mail to the following e-mail address: tomton.hr@gmail.com

The Business is not liable for any losses arising from inaccurate, untrue, incomplete or incomplete personal data provided to us.

Your personal data will be deleted when there is no reasonable need to keep it for the Permitted Purposes or, to the extent applicable, when you withdraw your consent, provided that we are not required to keep your personal data based on legal obligations. In any case, we will keep your personal data for as long as there is a need to keep it for the purpose of exercising our rights and obligations under a contract or business relationship, including the need to enforce a claim.

Subject to the conditions prescribed by the Regulation or regulations of the Republic of Croatia, you have the right to withdraw consent (if the processing of personal data is based on consent and there is no other legal basis for it), the right to access the collected personal data, the right to request a copy of the personal data we hold, the right to request the amendment of the collected personal data, the right to delete personal data, the right to transfer the collected personal data, the right to object to the processing of personal data. If you decide to do any of the above, please contact us by sending an email to the following email address: tomton.hr@gmail.com. When sending, we may ask you to prove your identity by submitting a valid copy of a personal document from which your identity can be established in order to comply with applicable regulations and prevent unauthorized disclosure of personal data. We reserve the right to charge you additional fees if you abuse your right to access personal data, for example in the case of repeated requests or requesting additional copies of documents without reasonable grounds. We will consider all your requests and complaints that we receive and respond to them in a timely manner. If you are not satisfied with our response, you can send your complaint to the body responsible for personal data protection – the Personal Data Protection Agency.

Contact details of the Personal Data Protection Agency:

Martićeva ulica 14

HR – 10000 ZAGREB

Tel. 00385 (0)1 4609-000

Fax. 00385 (0)1 4609-099

E-mail: azop@azop.hr

Web: www.azop.hr

This Privacy Policy is effective as of 15.11.2025. We reserve the right to change it from time to time to reflect changed procedures and methods of processing personal data or changed legal circumstances. Changes will be effective on the date of publication.

We care about your opinion about our Privacy Policy. You can contact us by sending an e-mail to the e-mail address: tomton.hr@gmail.com or in writing by sending a letter to the following business address within the headquarters of the Business: Zagreb, Pile III. 11.