Privacy Policy

Overseas Trade Co LTD d.o.o.

Effective from: May 2018

Last updated: 7 July 2026

1. Introduction

Through this Privacy Policy, https://overseas.hr/en/legal/privacy-policy, we explain how Overseas Trade Co LTD d.o.o. collects, uses, stores and protects the personal data of users of its services, website visitors and persons who communicate with us.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679, the Act on the Implementation of the General Data Protection Regulation, regulations governing postal and delivery services, electronic communications regulations and other regulations applicable to our business.

This Policy is primarily intended for natural persons: senders, recipients of shipments, persons authorised to collect shipments, users of parcel lockers and OEX parcel shops, website visitors, customer service users, persons participating in surveys, promotions or prize activities, and business contacts of our clients and partners.

The processing of personal data of employees, job applicants, regular external associates, couriers, owners of partner sales locations and other specific categories of persons may be governed by separate privacy notices.

More information about the processing of personal data of job applicants is available in the Privacy Notice on the Processing of Personal Data of Job Applicants.

2. Data Controller and Contact Details

Where we determine the purposes and means of processing personal data, we act as the data controller. Where we process personal data exclusively or partly in accordance with the documented instructions of our business customer, we may act as joint controllers or as a data processor. These roles are explained in more detail in Section 7 of this Policy.

Data controller	Overseas Trade Co LTD d.o.o., Hrvatski Leskovac, Zastavnice 38 a, Personal Identification Number (OIB): 19407280555
Telephone and fax	Telephone: +385 1 3454 555; fax: +385 1 6175 410
Privacy e-mail	privacy@overseas.hr
Data Protection Officer	Telephone: +385 1 7898 936; e-mail: povjerenik@overseas.hr

3. How We Collect Personal Data

We collect personal data in several ways, depending on the service you use and the capacity in which you act.

• Directly from you, for example when you order a service, hand over a shipment, request redirection, collect a shipment, pay for a service, contact customer service, complete a form, submit a complaint or subscribe to a newsletter.
• From the sender, a business customer or another person who provides us with the recipient's data for the purpose of delivering a shipment.
• From our delivery, logistics, payment, IT and business partners, where this is necessary for the provision of a service, handling of complaints, payment collection, security or compliance with legal obligations.
• Automatically, when you use our websites, applications, Track&Trace functionality, cookie settings and other digital channels.
• Through telephone conversations where calls are recorded, subject to prior notice, and through video surveillance in areas clearly marked as being under video surveillance.

If we receive the recipient's data from the sender or a business customer, we use such data for the receipt, sorting, transport, tracking and delivery of the shipment, proof of delivery, handling complaints and fulfilling other obligations related to the shipment. In such cases, the recipient may be informed about the processing through a delivery notice, SMS, e-mail, website notice, this Policy or another appropriate channel.

4. What Personal Data We Process

We process only the data necessary for a specific purpose. Depending on the circumstances, we may process the following categories of data:

• identification and contact data: first and last name, address, telephone number, e-mail address, name of a trade or business entity where it relates to a natural person, business function and business contact details;
• data required for specific identification: Personal Identification Number (OIB), identity card or passport number, only where necessary for a specific service, legal obligation, identity verification, delivery exclusively to a specified person, payment collection, fraud prevention or compliance with the instructions of a business customer;
• shipment and delivery data: shipment number, barcode, collection and delivery address, selected service, delivery instructions, shipment status, tracking history, delivery attempts, time and place of delivery, signature or other proof of receipt, parcel locker or OEX parcel shop data;
• data concerning the physical characteristics of a shipment: weight, dimensions, volume, packaging, labels and photographs of the shipment where necessary to prove its condition, resolve a complaint or ensure security;
• financial and payment data: service price, cash-on-delivery amount, IBAN or account number for cash-on-delivery payments, account and invoice details, payment status, transaction reference, masked card number or token where provided by a payment service provider;
• data for international delivery and customs clearance: description of contents where required, value of goods, destination country, customs documentation and data required by customs, security or other competent authorities;
• communication data: content of enquiries, objections or complaints, e-mail correspondence, contact forms, customer service notes, call records and voice recordings where calls are recorded;
• web and technical data: IP address, device and browser identifiers, browser type, operating system, pages visited, time of visit, referring URL, cookie settings and similar identifiers;
• social media data: username or profile, publicly available information, comments, messages, reactions and data made available through your interaction with our profiles;
• video surveillance recordings: recordings of persons entering areas under video surveillance, with such areas being clearly marked.

We do not request special categories of personal data, such as health data, biometric data used for unique identification, political opinions, religious beliefs or trade union membership, unless this is necessary due to a legal obligation, a legal claim or circumstances you choose to disclose in your communication with us.

5. Purposes of Processing and Legal Bases

We process personal data only where an appropriate legal basis exists. The most common legal bases are performance of a contract or steps taken prior to entering into a contract, compliance with a legal obligation, legitimate interests, consent and the establishment, exercise or defence of legal claims. Where we rely on legitimate interests, we ensure that the processing is proportionate and that your rights and freedoms do not override those interests.

5.1. Receipt, Transport, Tracking and Delivery of Shipments

We process data relating to senders, recipients and persons authorised to collect shipments for the purposes of receipt, sorting, routing, transport, tracking and delivery of shipments. This includes preparing and processing delivery documentation, managing shipment status, providing delivery notifications, proving delivery and resolving routine issues related to delivery.

The legal basis is performance of a contract where you are the sender or direct user of the service. Where we receive the recipient's data from the sender or a business customer, the processing is generally based on the legitimate interests of Overseas, the sender and the recipient in ensuring that the shipment is properly delivered, that delivery can be tracked and proven, and that complaints or objections can be resolved. Where specific legislation requires the processing of certain data, the legal basis is compliance with a legal obligation.

5.2. Parcel Lockers and OEX Parcel Shops

When you use a parcel locker, OEX parcel shop or another alternative collection or drop-off location, we process the data required to select the location, send collection instructions or a collection code, record the placement and collection of the shipment, and prove delivery. Such data is processed on the basis of a contract, legitimate interests in proper and secure delivery and, where applicable, compliance with a legal obligation.

5.3. Track&Trace and Shipment Status Notifications

We process shipment number, status, time and location of delivery events, contact details and technical data to enable shipment tracking, send notifications by SMS, e-mail or another channel, reduce unsuccessful deliveries and provide customer support. The legal basis is performance of a contract where tracking forms part of the service, and legitimate interests in transparency, delivery efficiency and customer support.

5.4. Payments, Cash on Delivery and Card Transactions

We process data required for charging for services, paying out cash-on-delivery amounts, issuing invoices, recording payments and preventing misuse on the basis of a contract, legal obligations and legitimate interests in proper payment collection and fraud prevention.

Where payment is made by card or another digital payment method, payment processing may be carried out by authorised payment service providers, banks, card schemes and anti-fraud systems. In accordance with card payment security rules, the card security code (CVV/CVC) must not be stored after the transaction has been authorised. Overseas may receive or retain only the data necessary to confirm the transaction, maintain accounting records, handle complaints and prove payment, such as the amount, transaction status, transaction reference, payment date and masked card number or token.

5.5. Customer Service, Enquiries, Objections and Complaints

When you contact us, we process the data you provide and the data necessary to verify the shipment, the identity of an authorised person, the delivery status, a complaint, damage, or a lost or damaged shipment. The legal basis may be performance of a contract, legitimate interests in providing support, establishing facts and protecting legal claims, compliance with a legal obligation, or consent where required for a specific form of communication.

Telephone conversations may be recorded for quality control, evidence of communication, training and dispute resolution purposes, subject to prior notice. If you do not wish to communicate through a recorded channel, you may use another available communication channel, such as e-mail, a written request or a web form, where applicable.

5.6. Satisfaction Surveys and Service Improvement

We may use contact details and data relating to the service used to ask for your opinion on service quality, request a delivery rating or invite suggestions for improvement. The processing is based on our legitimate interest in improving our services, unless consent is required in the circumstances. You may object to such processing at any time.

5.7. Marketing, Newsletters and Promotional Activities

We process data for direct marketing, newsletters, promotional messages, prize activities, surveys with a marketing purpose and personalised advertising activities only where an appropriate legal basis exists. As a rule, we rely on your consent, unless direct marketing is permitted under applicable legislation and our legitimate interests, subject to a clear right to object and unsubscribe.

You may withdraw your consent at any time through an unsubscribe link, profile settings where available, or by sending a request to privacy@overseas.hr or povjerenik@overseas.hr. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

5.8. Websites, Applications and Cookies

When you use websites and digital services on the overseas.hr domain, we may process technical data about your device, browser, visits, actions on the website, cookie settings and other online identifiers. We use this data to operate the website, ensure security, store your settings, measure traffic, perform analytics, advertise and improve digital services, depending on the category of cookie and your settings.

Strictly necessary cookies are used without consent because they are required for the operation of the website or the service you requested. Analytics, marketing and social media cookies, pixels and similar technologies are used only with your consent, unless applicable law expressly permits otherwise for a particular technology. You may change your preferences at any time through the cookie settings available on the website.

5.9. Social Media

If you communicate with us through our social media profiles, we process the data you make available to us, such as your username, messages, comments, reactions and other data visible through the platform. Social media platforms may independently process your data in accordance with their own privacy policies.

5.10. Video Surveillance

We use video surveillance in clearly marked areas to protect persons and property, ensure the security of business premises, prevent and investigate incidents, and protect legal claims. The legal basis is legitimate interests, while where recordings are used or retained pursuant to a specific request from a competent authority or under legislation, the legal basis may also be compliance with a legal obligation.

Only authorised persons have access to recordings. Recordings may be disclosed to competent authorities, courts, insurers, lawyers or other persons only where an appropriate legal basis exists. Areas under video surveillance are marked at the entrance to the monitored perimeter.

5.11. Business Customers, Partners and Suppliers

We process the data of contact persons of business customers, partners, suppliers, service providers and other business associates for the purposes of entering into and performing contracts, communication, ordering and providing services, managing business relationships, invoicing, payment collection and compliance with legal obligations. The legal basis is most commonly our legitimate interest in business communication and performance of a contract with a legal entity, and in certain cases a contract, legal obligation or consent.

5.12. Legal Obligations, Security and Protection of Legal Claims

We also process personal data where necessary to comply with accounting, tax, postal, customs, security and other legal obligations, respond to requests from competent authorities, maintain records, conduct audits and internal controls, prevent fraud, protect information systems, demonstrate compliance and establish, exercise or defend legal claims.

6. Recipients of Personal Data

We do not sell or rent personal data. We share data only where necessary for a specific purpose and where an appropriate legal basis exists.

Depending on the service, personal data may be made available to the following categories of recipients: authorised employees and couriers; senders, recipients and business customers where necessary for shipment status and proof of delivery; delivery subcontractors, OEX parcel shops and parcel locker operators; international delivery networks and partners, including Eurodis GmbH, Österreichische Post AG and other partners in the destination country; IT, hosting and customer support providers; payment service providers, banks and card schemes; analytics, marketing and advertising service providers where you have given consent; video surveillance and security service providers; accounting providers, auditors, lawyers and insurers; courts, tax, customs, police, postal, regulatory and other competent authorities where required or necessary.

We enter into contracts with processors governing confidentiality, security, permitted processing activities, assistance in exercising data subject rights and other obligations prescribed by the GDPR.

7. When We Act as Controller, Separate/Independent Controller or Processor

Where we determine how delivery, shipment tracking, proof of delivery, notifications, security, complaints, payment collection, video surveillance and the protection of legal claims are organised, we generally act as an independent controller.

Where a business customer or another sender provides Overseas with the recipient's personal data for the purpose of dispatching and delivering a shipment, the sender and Overseas generally act as separate controllers for those processing activities for which each independently determines the purposes and essential means of processing. The sender is responsible for the lawful collection and disclosure of data to Overseas and for processing the data within its relationship with the recipient. Overseas is responsible for processing the data required for acceptance, sorting, transport, tracking, notifications, delivery, proof of delivery, complaint handling, payment collection, security and compliance with legal obligations related to the delivery service.

For certain specific services, Overseas Express may act as a processor where it processes personal data exclusively on behalf of and in accordance with the documented instructions of another controller. Such relationships are governed by a contract or another legal act in accordance with Article 28 of the GDPR.

In such cases, we do not collect more data than is necessary to carry out the instructions and do not use the data for our own purposes unless a separate legal basis exists.

8. Retention Periods

We retain personal data only for as long as necessary for the purpose for which it was collected, or for as long as required by legislation, contractual obligations, complaint procedures, limitation periods or the protection of legal claims. Once the applicable period expires, we delete, anonymise or archive the data in accordance with applicable rules.

9. Transfers of Personal Data Outside the European Economic Area

We may transfer personal data outside the European Economic Area where necessary for international delivery, customs clearance, security checks, the use of international delivery networks or the provision of IT, analytics, marketing and other services.

Where data is transferred to a third country or an international organisation, we apply one of the mechanisms provided for by the GDPR, such as an adequacy decision of the European Commission, standard contractual clauses, additional technical and organisational measures, the EU-U.S. Data Privacy Framework for certified U.S. organisations, or derogations for specific situations, for example where the transfer is necessary for the performance of an international delivery contract.

10. Security and Confidentiality

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, disclosure or destruction. These measures include role-based access restrictions, confidentiality obligations, physical protection of premises, system access controls, backups, access logs, protection of communication channels, supplier assessments and other measures appropriate to the risk of processing.

Access to personal data is limited to persons who require it for the performance of their work. Processors and business partners are required to maintain confidentiality and implement appropriate security measures.

11. Automated Decision-Making and Profiling

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

We may use automated logistics, security, analytics or marketing tools, for example for shipment routing, sending notifications, measuring website traffic or managing advertising campaigns, but such processing does not in itself constitute decision-making with legal or similarly significant effects on a data subject.

12. Your Rights

Under the GDPR, you have the following rights, depending on the legal basis and circumstances of the processing:

• the right of access to personal data and information about the processing;
• the right to rectification of inaccurate or completion of incomplete personal data;
• the right to erasure of personal data where the prescribed conditions are met;
• the right to restriction of processing;
• the right to data portability where processing is based on consent or a contract and is carried out by automated means;
• the right to object to processing based on legitimate interests, on grounds relating to your particular situation;
• the right to object to direct marketing at any time, after which we will no longer process your data for that purpose;
• the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;
• the right not to be subject to a decision based solely on automated processing where it produces legal or similarly significant effects, except in cases permitted by the GDPR.

To exercise your rights, you may contact us at privacy@overseas.hr or povjerenik@overseas.hr, by post at the controller's address, or through another available channel designated for personal data protection matters.

We will respond to your request without undue delay and no later than one month after receiving it. This period may be extended by a further two months where the request is complex or where we have received a large number of requests, in which case we will notify you. Where necessary, we may request additional information to verify the identity of the person making the request.

13. Complaints to the Supervisory Authority

If you believe that the processing of your personal data is not in accordance with applicable regulations, you may first contact us so that we can attempt to resolve your request or complaint. Independently of this, you have the right to lodge a complaint with the competent data protection supervisory authority.

Supervisory authority	Contact
Croatian Personal Data Protection Agency	Ulica Metela Ožegovića 16, 10000 Zagreb, Croatia; telephone: +385 (0)1 4609-000; fax: +385 (0)1 4609-099; e-mail: azop@azop.hr; website: www.azop.hr

15. Amendments to the Privacy Policy

We may amend this Policy from time to time to reflect changes in legislation, services, technology, business organisation or the manner in which personal data is processed. The current version is published on the website. In the event of significant amendments, we may also notify you through another appropriate channel, depending on the nature of the amendment and the contact details available to us.