Law Office Emir Mulalić with its registered office at Ulica Pavla Šubića 9/IV, 10 000 Zagreb (hereinafter: the Law Office) and Registry Office at Lađarska 17, 44000 Sisak, pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter: the General Data Protection Regulation), and the Act on the Implementation of the General Data Protection Regulation (Official Gazette NN 42/2018), in its capacity as a data controller, hereby wishes to inform you through this privacy policy about the manner in which your personal data is processed.

Processing of Personal Data

As part of its activities, the Law Office collects and processes the personal data of our clients and website visitors lawfully, fairly, and transparently, ensuring that the data is processed exclusively in a manner that guarantees appropriate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, by applying appropriate technical and organizational measures.

The Law Office collects and processes the following types of personal data:

• personal data of current and former employees in accordance with the Employment Agreement and the legislative framework;

• personal data of clients in accordance with issued powers of attorney, orders, representation agreements, and the legitimate interest in performing legal services;

• personal data of customers of the Law Office's products (e.g., digital programs) in accordance with the legislative framework;

• personal data of potential clients (customers) as well as potential employees who contact us via the contact form or email.

When providing certain services or selling certain products, the Law Office will request the following personal data: first and last name, address, email, mobile phone number, and job position (the company of employment and the specific role). The client/customer/potential client confirms their agreement to the processing of personal data by clicking the submission button.

The Law Office processes personal data only if one of the following conditions is met:

• the data subject has given consent to the processing of their personal data for one or more specific purposes; or

• processing is necessary for the performance of a contract to which the data subject is a party; or

• processing is necessary for compliance with a legal obligation of the Law Office; or

• processing is necessary to protect the vital interests of the data subject or of another natural person.

Regarding website visitors, the Law Office notes that "cookies" (small data files) are used to ensure the proper functioning of the site. These are stored on your computer or mobile device when you visit the website to save your preferred display settings. Please see our Cookie Policy here.

Data Recipients

Access to your personal data is granted to lawyers, trainee lawyers, as well as other employees of the Law Office responsible for, for example, accounting, administration, IT, and mail dispatch.

Access to your personal data may also be granted to external recipients (competent state authorities and courts, notaries public, FINA, etc.) if it is necessary for the performance of legal services or if it arises from a mandatory legal regulation.

Data Retention Periods

For certain personal data, in accordance with the Attorney Act, lawyers are obliged to retain personal data contained in a case file for 10 years from the final conclusion of the proceedings. Regarding data we retain based on consent, we keep this data as long as the purpose for which it was provided exists, or until the consent for processing is withdrawn by the data subject.

Upon the cessation of the purpose, withdrawal of consent, or expiration of the retention period, we permanently delete the personal data or anonymize it so that it can no longer be associated with a specific data subject.

Rights of the Data Subject

The rights to which data subjects are entitled under the General Data Protection Regulation are as follows:

• Right of access – the right to obtain information about the purpose of the processing of the data subject's personal data, the categories of personal data being processed, the recipients or categories of recipients to whom the personal data has been or will be disclosed, the envisaged period for which the personal data will be stored, and, where the personal data is not collected from the data subject, any available information as to their source. It also includes the right of the data subject to be provided with a copy of the personal data contained in the storage system that relates to them.

• Right to rectification – the right of the data subject to obtain without undue delay the rectification of inaccurate data or the completion of incomplete data concerning them.

• Right to erasure – the right to request the erasure of personal data concerning the data subject, provided that the personal data is no longer necessary in relation to the purposes for which it was collected or for legal purposes, and if the data subject withdraws the consent on which the processing is based.

• Right to restriction of processing – the right to obtain a restriction of processing if the conditions defined by the General Data Protection Regulation are met.

• Right to data portability – the right to request the provision of personal data concerning the data subject in a structured, commonly used, and machine-readable format and the right to transmit that data to another controller, if the processing is based on consent or a contract and is carried out by automated means.

• Right to object – the right of the data subject to object, on grounds relating to their particular situation, to the processing of personal data concerning them. An objection can be submitted to the Law Office via email: odvjetnik.emirmulalic@gmail.com or by post to the registered address indicated in the introduction. The Law Office will provide you with the requested information and a notice of the actions taken no later than one month from the date of receiving your request. If the processing of the request is complex or if there is a large number of requests, the one-month period may be extended by another two months, in which case we will inform you of the reasons for any such extension.

Furthermore, in the event of rejecting a data subject's request, the Law Office will inform the data subject of the reasons for the rejection without delay, and at the latest within one month of receiving the request.

Please note that in the case of receiving requests that are manifestly unfounded or excessive, particularly because of their repetitive character, the Law Office, in accordance with the provisions of the Regulation, may charge a reasonable fee based on administrative costs or refuse to act on the request.

If you have any additional questions or comments regarding the Law Office's Privacy Policy or wish to exercise any of your aforementioned rights, please contact us via email at odvjetnik.emirmulalic@gmail.com or by phone at +385 99 850 7514.