Privacy Policy

Privacy Policy

Effective Date: May 2018.

Last Modified: July 2020.

This Privacy Policy is addressed to you, the users of our services and visitors to our website and social media profiles, and aims to provide information about the processing of your personal data and your rights. Please study it in detail.

We, Overseas Express, a trademark of the company Overseas Trade Co LTD d. o. o., Hrvatski Leskovac, Zastavnice 38 a, take care to process your data exclusively within the framework prescribed by the General Data Protection Regulation ${}^1$ (hereinafter: Regulation), the Act on the Implementation of the General Data Protection Regulation, and other regulations that we apply in our business.

Data Controller

The Data Controller, i.e., the entity that determines the purpose and means of the processing of your personal data, is responsible for the processing of your personal data.

When we act as Data Controllers under this Policy, you can contact us or our Data Protection Officer at:

Overseas Trade Co LTD d. o. o.,

Hrvatski Leskovac, Zastavnice 38 a, OIB: 19407280555

Phone: +385 1 3454 555

Fax: +385 1 6175 410

e-mail: privacy@overseas.hr

Data Protection Officer:

Phone: +385 1 7898 936

e-mail: povjerenik@overseas.hr

How We Collect Your Data

We collect your personal data that you provide when contracting services in our branches and on our websites including, but not limited to: www.overseas.hr, shipping.overseas.hr, oexreport.overseas.hr, webapi.overseas.hr, and/or any other websites or applications available over the internet that are in the sub-domain of the overseas.hr or oex.hr domain by using a web browser, data transfer, or email communication from or to the overseas.hr domain.

We also collect your personal data during the recording of telephone conversations, with prior notification, and through the video surveillance system in our business premises. Also, through survey forms, competitions, and promotional offers.

We may also collect your personal data from third parties – senders who send you shipments using our services.

${}^1$ Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC

PRIVACY POLICY Page 2 of 4

In some situations, we act as a Data Processor who processes your data on behalf of our clients. In these cases, our clients are obliged to inform you about the processing of your personal data.

What Data We Collect and Why

The types of personal data we collect include:

• Your name, surname, email address, telephone number, and home address, personal identification number, identification number of your ID card or passport, which are necessary for us to hand over or deliver a shipment, regardless of whether we have a contract with you or a third party. We also use your telephone number to ask you about the quality of the service provided and to give us an online rating in order to further improve our services, and you decide whether to take the time to answer our questions.

• Bank account number may be collected for the purpose of transferring money when paying by cash on delivery.

• Information about your employer may be collected if you choose to have your shipment delivered to your workplace.

• Household data, including data on household members based on special user requests related to deliveries to private addresses (including handing over shipments to household members if permitted).

• Voice recordings may be collected during telephone contact with any of our customer services. If voice recordings are collected, we will always inform you. Voice recordings are collected for the purpose of ensuring the quality of our service, which is our legitimate interest.

• Credit card details (card type, credit card number, name on the card, expiration date, and security code) if credit card payment is offered for a particular service in accordance with the rules on credit cards and credit card processors.

• Data you provide to us regarding your marketing preferences or during participation in surveys, competitions, or promotional offers.

• Your video recordings if you have been on our premises which are protected by a video surveillance system for the purpose of protecting persons and property, which is our legitimate interest.

• Personal data via cookies on our websites, about which we have a separate notice.

If you do not provide us with the data necessary for a particular purpose (e.g., data necessary for the delivery of a shipment), this may affect some of your transactions with us or the services may be refused to you.

If a signature on a contract you have with our client is required as part of the delivery, we download data from your identification document using special software, which we do on behalf of such a client. In these situations, photos from ID cards are not collected, and Overseas Express does not save your data but automatically delivers it to the sender. The sender is responsible for the processing of your data and must inform you about the details of the same.

Our Legal Basis

We process your personal data based on one or more of the following legal bases:

a) based on Article 6, paragraph 1, point (b) of the Regulation, if necessary for the performance of a contract between us and you or in order to take pre-contractual steps at your request (e.g., when you are the sender),

b) based on Article 6, paragraph 1, point (f) of the Regulation, when the processing is necessary for the purposes of our legitimate interests (e.g., in the case of voice or video recording and in the processing of recipient data) or the legitimate interests of a third party,

PRIVACY POLICY Page 3 of 4

c) based on Article 6, paragraph 1, point (a) of the Regulation if you have given us your consent,

d) based on Article 6, paragraph 1, point (c) of the Regulation, if it is our legal (statutory) obligation (e.g., in the case of data archiving according to accounting regulations).

Data Sharing

If necessary for international delivery services, we provide your personal data to the companies Eurodis GmbH and Österreichische Post AG.

We also share your data with transport service providers only for the purpose of processing the shipment from acceptance to delivery and all accompanying activities that accompany the execution of our service.

Also, in our business and with our partners who provide us with marketing, website and social media management, and video surveillance services.

We take care to choose partners who respect the highest data protection standards.

If necessary, we disclose personal data to law enforcement and other authorities if required by law or strictly necessary to prevent, detect, or prosecute criminal offenses and fraud.

We do not sell or rent your data.

International Data Transfers

Transfers outside the European Economic Area are possible under special restrictions to protect your personal data.

We may transfer your data to any country if it is necessary for the execution of the contracted service.

Security

We take adequate organizational and technical measures to protect your personal data. All our business and internet applications and partners apply reasonable measures to prevent unauthorized access and misuse of information, including personal data. We use appropriate business systems and procedures for the protection and storage of information and personal data. We also use security procedures and technical and physical restrictions on access to and use of personal data on our servers. Access to personal data is permitted exclusively to authorized personnel for business purposes.

Data Retention

We process and retain your personal data until the purpose of processing for which the personal data was provided is fulfilled. After the purpose for which they were collected ceases, we no longer use your personal data, and they remain in our storage system and are kept as long as required by legal regulations.

Your delivery data from our basic logistics computer system are deleted after 18 months counting from the month after the service was provided.

Delivery data from our notification systems that may send you delivery information are deleted after 60 days.

PRIVACY POLICY Page 4 of 4

Voice and video surveillance recordings are automatically deleted within 60 days counting from the date of their collection.

We keep all emails for 11 years when they contain information related to the provision of services that are important for proving compliance with tax and accounting regulations.

Your Options and Rights

To exercise your rights, you can contact us in writing or by e-mail at: privacy@overseas.hr. or povjerenik@overseas.hr; Phone: +385 1 3454 555; Fax: +385 1 6175 410

You have the right:

• Right to withdraw consent

  If the processing is based on consent, you can always withdraw your consent without negative consequences and without affecting the lawfulness of the processing carried out so far.

• Right of access to your personal data

  You have the right to access the personal data we process about you and can request detailed information about their processing and a copy of the same in accordance with Article 15 of the Regulation.

• Right to rectification of personal data

  You have the right to request the rectification or completion of personal data if your data are not accurate, complete, and up-to-date in accordance with Article 16 of the Regulation.

• Right to erasure

  You have the right to request the erasure of your personal data in accordance with Article 17 of the Regulation.

• Right to restriction of processing of personal data

  You have the right to restriction of processing in accordance with Article 18 of the Regulation.

• Right to data portability

  You have the right to portability of your personal data if we process them by automated means based on consent or a contract with you, in accordance with Article 20 of the Regulation.

• Right to object to the processing of personal data

  You have the right to object to the processing in accordance with Article 21 of the Regulation.

Questions or Complaints

If you have questions or complaints regarding our processing of your personal data or wish to exercise any of the rights you have under this notice, feel free to contact us at privacy@overseas.hr. or povjerenik@overseas.hr

In case of questions or complaints, you can also contact the supervisory authority for data protection:

Agencija za zaštitu osobnih podataka

(Personal Data Protection Agency)

Selska cesta 136

10 000 Zagreb

Tel. 00385 (0)1 4609-000

Fax. 00385 (0)1 4609-099

E-mail: azop@azop.hr

Web: www.azop.hr