Information on data protection on social networks

I. Data Controller

We, Poliklinika Sinteza d.o.o., Folnegovićeva 1C, 10000 Zagreb (hereinafter “Poliklinika”), have corporate profiles on social media platforms such as YouTube, Instagram, and Facebook (hereinafter “social media pages”; if the references differ or deviate, they refer to “YouTube accounts” or “Instagram pages”). Through these social media pages, we engage with social media users and regularly share content. The provider of these social media pages, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter “Google”), and Facebook Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland (hereinafter “Facebook”), may store your user behavior using cookies and similar technologies. If you use social media (through profiles on our corporate page, in groups, etc.), the type, scope, and purposes of data processing on social media will primarily be defined by the social media providers. In this regard – if you visit our social media pages – we may have access to general statistics about interests and demographic characteristics.

We would like to draw your attention to the important legal aspects of data protection when using our social media pages. You use our social media pages at your own risk. If you do not wish for the mentioned data processing within Instagram or Facebook, please contact us via our website www.sinteza.hr.

II. Processing of Personal Data via Facebook, Instagram, and Google

According to our knowledge, Facebook and Google process user data primarily for providing services, advertising (analytics, measurement, personalized advertising), market research, improving security, integrity, and communication, for communication with you, for research and innovation for social purposes, as well as for personalizing and improving products.

More information about data processing via Facebook can be found in the individual data usage rules available for Facebook pages here, for Instagram pages here, and for the YouTube channel here.

For storing and further processing this information, Google and Facebook use so-called cookies. These are text files that are stored on the end user’s devices. When a user has a profile on a social network and is logged in, cookies can be stored and analyzed on all devices. More information about Facebook’s use of cookies and how to disable them can be found in the relevant cookie guidelines available for Facebook pages here, for Instagram pages here, and for the YouTube channel here.

III. Page Statistics

Facebook and Google, as the providers of their respective social networks, make page statistics (page visits) available to us, i.e. statistical data on the usage of our YouTube channel as well as our pages on Facebook and Instagram. These are summarized statistics. They are generated using specific events that are logged by Google and Facebook servers when people interact with pages and content related to the pages. Google and Facebook provide information about specific categories (followers or fans, reach of people visiting the page, etc.) and periods.

1. Facebook Pages

On Facebook pages, we receive aggregate statistical data about:

The number of people, grouped by age and gender, who have seen one of our posts at least once.
The origin of our fans based on country, city, and language.
“Likes” – mentions of other pages that our fans most frequently click on.
Interactions with our posts, events, or video content.
Relationship status.
Family status (e.g., parent).
Level of education.
Job titles.
Interests.
User behavior.
Significant life events (e.g., marriage, engagement, childbirth, birthdays, moving).
Device usage.
Frequency of activity.

2. Instagram Pages

On our Instagram pages, we receive aggregated statistical data about:

Gender
Age group
Favorite locations
The number of “Likes” on our photos and video content
The number of comments on our photos and video content
The number of people who have seen a photo or video content
The frequency of sharing a particular photo or video content
Visits to the profile, clicks on the website, and initiated conversations, as well as how many people view content on our Instagram page
Visits to our posts, stories (subscriptions, invites, replies, emails, SMS notifications, shared content, impressions, clicks on links, opening pages from stories, leaving/following the story, clicks on the website on links to other websites available through the content)
Route planning to locations through links
Route planning to locations through links
Information about subscriptions and target groups, including the growth of the number of subscribers during defined periods
Information about when our subscribers are online.

3. YouTube Channel

Through the YouTube channel, we receive aggregated statistical data about:

Data you voluntarily entered, such as your name and username, email address, phone number
Content you create, upload, or receive from others while using the services, such as photos and video content you store, documents and spreadsheets you create, and your comments on YouTube videos
Content you later share about the topics that interest you
Storing and processing confidential messages that you directly send to other users
Your location based on GPS data
Information about wireless networks or your IP address
Login data, including IP address, browser type, operating system, information about previously visited websites, your location, your mobile service provider, the device you use (including device ID and app ID), search terms you used, and cookie information.

Page analytics for these social media pages are created and provided by Google and Facebook, i.e., as the provider of these pages, we have no influence over their creation and display. We receive the data in an aggregated form and use analytics to shape the posts and activities on our social media pages in a way that makes them more interesting for users. Since analytics are displayed only after a certain number of people, the data cannot be linked to individuals.

More information about page analytics can be found in the Page Analytics Information available for Facebook here, and for Google here. Additionally, you will find the Joint Controller Agreement we have signed with Facebook here.

Polyclinic processes the mentioned data based on Article 6, 6. Paragraph 1, (f) of the General Data Protection Regulation (GDPR). The processing allows us to optimize the functionality of our social media pages and improve our offerings. These purposes are also based on our legitimate interest in processing data according to Article 6 6. Paragraph 1, (f) of the General Data Protection Regulation (GDPR).

IV. Processing of Other Personal Data by the Polyclinic

We may identify users of our social media pages and, in accordance with visibility settings, gain insight into their profiles and shared information, for example, when they post on our social media pages or add links to posts. As part of this, we process data (e.g., usernames) to provide the fan page on social media.

If you no longer wish for your data to be processed in this way or if you want to limit this data processing, you can delete your posts or disconnect your Facebook profile from our page using the “I no longer like this page” function.

If you provide us with your personal data directly through our social media pages, we will use it exclusively as a response to your posts or notifications via Instagram, e.g., to answer questions or conduct contests. to answer questions or conduct contests.

The legal basis for processing data related to this is Article 6. Paragraph 1, b) General Regulation, if it concerns inquiries related to contracts, and in other cases, Article 6, 6. Paragraph 1, f) based on our interest to process inquiries and posts in accordance with the needs of the users and, if necessary, document the results of the processing in case of further inquiries.

V. Prize Contests

From time to time, we offer prize contests via our social media pages. In general, we will send the prizes directly ourselves. If, in certain cases, this is not possible due to the nature of the prize—
for example, because direct contact must be established with our partner in the prize contest, or because additional transport routes could endanger the package—
we will transfer your data to our partner in the respective prize contest. For each prize contest, the partner to whom the data is transferred will be specified.

The data provided for participation in the prize contest will be used solely for the purpose of managing the prize contest. The legal basis for processing data for participation in the prize contest is
Article 6, 6. Paragraph 1, (b) of the General Data Protection Regulation (GDPR). Address data collected for the purpose of sending the prize will be deleted no later than 6 months after the drawing, unless the rules of the prize contest specify a longer retention period. The legal basis for the transfer of data to a specific business partner is Article 6, 6. Paragraph 1, (b) of the General Data Protection Regulation (GDPR).

VI. Retention Period

Data is stored in accordance with the cookie retention periods. Stored personal data will be deleted if your request for deletion is granted, if the data is no longer needed for its intended purpose, or if its storage is not permitted for other legal reasons.

Please note that Google and Facebook collect and store your data when you visit our pages on social media platforms. This also applies to cookies used by Google and Facebook to provide functionality. We have no influence over this. In this regard, please refer to the information provided by Google and Facebook.

VII. Categories of Recipients, Transfer to Third Countries

As a rule, we do not transfer your data to third parties unless we are legally obliged to do so (e.g. in the case of a request from law enforcement authorities) or if such transfer is necessary for the execution of business processes, or if the data is used within the framework of a data processing agreement. This applies, for example, to service providers for delivery, payment processing, logistics, order processing, web hosting, communication agencies, external call centers, or IT service providers. In all cases, we strictly comply with legal requirements.

In this context, data may also be transferred to other countries where the above-mentioned contractual partners are based or process data. These are primarily countries within the European Economic Area (EEA), and in individual cases, countries outside the EEA whose data protection regulations may differ or offer less protection than those of the EU. As a result, for example, your data may be processed by authorities in those countries for control and monitoring purposes, potentially without the possibility of legal recourse. If personal data is processed outside the European Union and the European Commission has not issued a decision on adequate data protection, we apply appropriate safeguards, including the conclusion of EU Standard Contractual Clauses. The text of the contract with the EU Standard Contractual Clauses can be found on the website of the European Commission, available here.

More information on data protection in the case of transfers to third countries can be found for Facebook here, and for Google here.

VIII. Data Subject Rights

1. General

You have the right to information regarding the processing of your personal data, the right to data portability, and – where applicable – the rights to erasure, rectification, restriction of processing, and/or objection to processing, as well as the right to lodge a complaint with a supervisory authority.

Contact details of the competent supervisory authority in Croatia:

Croatian Personal Data Protection Agency
Selska cesta 136
10000 Zagreb
Phone: 00385 (0)1 4609-000
e-mail: azop@azop.hr

For more information, you can contact our Data Protection Officer, whose contact details are provided below.

With regard to the processing of data about your visits to our pages, we have agreed with Google and Facebook that it is primarily Facebook’s responsibility to provide you with information about your page visits and to enable you, as a data subject, to exercise your rights under the General Data Protection Regulation (e.g., the right to object). You can find more information on this for Facebook here, and for Google here.

Therefore, we generally recommend that you contact Google or Facebook directly to exercise your rights. If you need assistance with this or have any questions, feel free to contact us using the contact information provided below. We will be happy to forward your request to Google or Facebook.

2. Specific Information About the Right to Object Under Article 21 of the 21. GDPR

Based on your particular situation, you have the right, pursuant to Article 21, 6. Paragraph 1, of the General Data Protection Regulation (GDPR), to object at any time to the processing of your personal data which is carried out based on Article 6(1)(f) of the GDPR (data processing for the purposes of legitimate interest). This also applies to profiling based on that legal basis (as defined in Article 4(4) of the GDPR).

If you object, we will no longer process your personal data, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims. If your objection is directed at the processing of your data for advertising purposes based on Article 6, 6. Paragraph 1, f), we will immediately cease the processing without any further evaluation. This also applies to any profiling that occurs in connection with such advertising.

3. Data Protection Officer

For any questions related to data protection or your personal data at the Polyclinic, you can contact our Data Protection Officer

through e-maila: dpo@bmg.hr

or by post at the address:

Poliklinika Sinteza

Data Protection Officer
Folnegovića 1C/2

100100 Zagreb

Last updated: December 2022