PRIVACY POLICY

  1. INTRODUCTION

At Ricardo d.o.o. (hereinafter: Ricardo), we are committed to protecting the privacy and personal data of all individuals with whom we conduct business or make contact, including the users of our website. This Privacy Policy explains what personal data we collect, for what purposes we process it, on which legal bases, how long we retain it, with whom we share it, and what rights you have regarding the processing of your personal data.

When processing personal data, Ricardo acts in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR), the Croatian Act on the Implementation of the General Data Protection Regulation, and other applicable regulations of the Republic of Croatia.

  1. DATA CONTROLLER AND CONTACTS

RICARDO d.o.o.
Kudeljara 1a, 31326 Darda, Croatia
OIB (PIN): 83535297393
Phone: +385 31 562 255
E-mail: [email protected]
[email protected]

For all questions regarding the protection of your personal data, you may contact our Data Protection Officer directly via e-mail or post:

  • E-mail: [email protected]
  • Address: Kudeljara 1a, 31326 Darda (marked: “Za službenika za zaštitu osobnih podataka” / “Attn: Data Protection Officer”)
  1. PRINCIPLES OF PERSONAL DATA PROCESSING

We process personal data lawfully, fairly, and transparently, and exclusively for the purposes for which they were collected. We collect only those personal data that are necessary to achieve a specific purpose of processing and do not process them in a manner incompatible with that purpose.

Ricardo applies appropriate technical and organizational measures to protect personal data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

If we engage data processors (for example, IT or hosting service providers) for specific activities, we enter into appropriate agreements with them to ensure that they process personal data exclusively in accordance with our instructions and under appropriate security measures.

  1. WHAT PERSONAL DATA WE PROCESS

Depending on your relationship with Ricardo, we may process the following categories of personal data:

  • Identification data (first and last name)
  • Contact details (e-mail address, phone number)
  • Company information or information about the organization you represent
  • Content of your inquiry or other information you voluntarily provide to us
  • Data required for registration and participation in events or training sessions
  • Photos, videos, or statements that you voluntarily provide to us or make available through official communication channels for publication on our website or official social media profiles
  • Technical data generated during the use of the website, such as IP address, date and time of access, and other data necessary for the security and proper functioning of the website.

We primarily collect personal data directly from you when you contact us or voluntarily provide it to us through our communication channels. In certain circumstances, we may also obtain personal data from our business partners, subcontractors, transport service customers, or other contractual partners where this is necessary for the organisation and provision of transport services, communication, transport coordination, and the maintenance of our business relationships. Such personal data may include your name, telephone number, email address, job title or position, and other contact details necessary for the performance of the relevant business relationship. In such cases, Ricardo processes only the personal data that are necessary for the specific purpose of the processing.

 

  1. PURPOSE OF PROCESSING AND LEGAL BASES

Ricardo processes personal data exclusively for specified, explicit, and legitimate purposes and on an appropriate legal basis.

Purpose of Processing Personal Data Legal Basis
Responding to inquiries received via contact forms or other communication channels First and last name, e-mail address, phone number, company name (if applicable), message content, and other data voluntarily provided Legitimate interest in communicating and responding to received inquiries, or taking steps at the request of the data subject prior to entering into a contract
Organization and execution of events, training sessions, and other activities First and last name, e-mail address, phone number, company or organization name Taking steps at the request of the data subject prior to entering into a contract, or the performance of a contract
Maintaining security and proper functioning of the website Technical data automatically processed when accessing the website (e.g., IP address, date and time of access, technical data required for system security) Legitimate interest in ensuring the security, availability, and proper operation of the website
Publishing photos, videos, and statements of employees, associates, or other persons on the website and official social media profiles of the company Photo, video, first and last name, job title, statement, or other content associated with the person Consent of the data subject, except in cases where, after assessing all circumstances of the processing, another appropriate legal basis may apply, while respecting the rights and interests of the data subject
Communication via official profiles of the company on social networks Data published or submitted by users themselves via social networks (e.g., profile name, comments, messages) Legitimate interest in communicating with users and presenting the company’s business
Fulfillment of legal obligations (e.g., accounting, tax, or other legal obligations) Data necessary for the fulfillment of legal obligations Compliance with a legal obligation to which the controller is subject
  1. PHOTOS, VIDEOS, AND STATEMENTS OF EMPLOYEES, ASSOCIATES, OR OTHER PERSONS

Ricardo may publish photos, videos, interviews, or statements of employees, drivers, associates, or other persons to present its business, activities, projects, working environment, and corporate communications.

The publication of such content is carried out only when there is an appropriate legal basis, for example:

  • The prior consent of the person depicted or whose statement is being published;
  • Another appropriate legal basis when applicable, following a prior assessment of the justification of such processing.

An individual may withdraw their consent for future publications at any time if the processing is based on consent. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

When publishing, we strive to limit the amount of personal data to what is necessary for the purpose of the publication.

  1. SOCIAL MEDIA

Ricardo may maintain official profiles on social media networks, including Facebook and other platforms, through which it communicates with users, presents its business, publishes information about its activities, and responds to user inquiries and comments.

If you communicate with us via social media, Ricardo may process personal data that you have made available through your profile or communication with us, such as your profile name, comment content, messages, photos, or other data you voluntarily publish or submit.

Ricardo may moderate content published on its official social media profiles to maintain appropriate and professional communication. This includes removing or restricting content that is unlawful, offensive, discriminatory, threatening, harassing, inappropriate, or unrelated to the topic of the post.

In cases where the content constitutes a violation of the social network’s terms of use, an infringement of the rights of others, or a potential violation of applicable regulations, Ricardo may report such content to the social network provider or competent authorities, where applicable.

Ricardo does not use the personal data of social media users for purposes unrelated to communication, responding to inquiries, or presenting the company’s business, nor does it sell or unauthorizedly share them with third parties.

The processing of personal data carried out independently by social media providers is subject to their own privacy policies and terms of use, over which Ricardo has no control.

  1. SHARING PERSONAL DATA WITH THIRD PARTIES

Ricardo does not sell, rent, or unauthorizedly share personal data with third parties.

We may share your personal data only when necessary to achieve a specific purpose of processing or to fulfill legal obligations, and only with trusted recipients who ensure an appropriate level of personal data protection.

Recipients of personal data may include:

  • IT, hosting, and website maintenance service providers processing data on behalf of Ricardo;
  • Providers of other services necessary for organizing business activities, events, or training sessions, when required for their execution;
  • Competent state authorities and institutions when we are obliged to do so under law or other regulations.

Ricardo enters into appropriate data processing agreements with its personal data processors, ensuring that personal data are processed exclusively according to our instructions and with the application of appropriate security measures.

As a rule, personal data are processed and stored within the European Union or the European Economic Area.

  1. RETENTION PERIODS FOR PERSONAL DATA

Ricardo retains personal data only as long as necessary to achieve the purpose for which they were collected, unless longer retention is required to fulfill legal obligations or protect the legal interests of the company.

The following indicative retention periods apply:

  • Data submitted via contact forms and other inquiries – until the communication is completed and the inquiry is resolved, and as a rule, for a maximum of 6 months after the end of the communication, unless there is another justified purpose for further retention;
  • Data related to registrations for events, training, and activities – until the end of the activity, or longer if necessary to fulfill legal obligations (e.g., accounting or tax obligations);
  • Photos, videos, and statements published to present the business – until consent is withdrawn, a request for removal is made, or the need for publication ceases, unless there is another appropriate legal basis for further retention;
  • Technical data related to website security and operation – for the periods necessary to maintain information system security and detect potential security incidents;
  • Data we are obliged to keep by law – during the periods prescribed by the applicable regulations of the Republic of Croatia.
  1. COOKIES

Our website uses exclusively necessary cookies that are required for its proper functioning, security, and to provide basic functionalities.

We do not use analytical, marketing, or other cookies used for tracking users or building user profiles.

Necessary cookies do not collect information that would be used to identify users for marketing purposes.

You can control cookie settings through your web browser. Disabling necessary cookies may affect the proper functioning of certain parts of the website.

  1. YOUR RIGHTS IN RELATION TO PERSONAL DATA PROCESSING

In accordance with the GDPR, you have the right to request the exercise of the following rights:

  • Right of access to personal data – you can request information on whether we process your personal data and access those data;
  • Right to rectification – you can request the correction of inaccurate or completion of incomplete personal data;
  • Right to erasure (“right to be forgotten”) – you can request the erasure of personal data when they are no longer necessary for the purpose for which they were collected or when there is no longer an appropriate legal basis for their processing;
  • Right to restriction of processing – you can request the restriction of processing in cases provided for by the GDPR;
  • Right to data portability – when the conditions of the GDPR are met, you have the right to receive your personal data in a structured, commonly used, and machine-readable format;
  • Right to object – you have the right to object to processing based on legitimate interest;
  • Right to withdraw consent – when processing is based on consent, you can withdraw it at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise your rights, you can contact Ricardo via:

Ricardo will respond to your request within the time limits prescribed by the GDPR.

If you believe that your personal data are being processed contrary to applicable regulations, you have the right to lodge a complaint with the competent supervisory authority:

Agencija za zaštitu osobnih podataka (AZOP)
Selska cesta 136
10000 Zagreb
Republic of Croatia

  1. LINKS TO OTHER WEBSITES

Our website may contain links to external third-party websites.

Ricardo is not responsible for the content, security, or privacy policies of those external websites. We recommend that you read their privacy policies before using such sites.

  1. CHANGES TO THE PRIVACY POLICY

This Privacy Policy shall enter into force on the day of its publication on Ricardo’s website.

Ricardo reserves the right to amend and update this Privacy Policy to align it with changes in regulations, business processes, or technical solutions.

The updated version of the Privacy Policy will always be available on this website, indicating the date of the last modification.

This Privacy Policy applies from July 6, 2026.