Processes personal data, in Croatia

Regulation (EU) 2016/679, Arts. 12-21; Zakon o provedbi Opće uredbe o zaštiti podataka (NN 42/2018) · Read the law's page

• Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Croatia within one month of receipt.

Regulation (EU) 2016/679, Arts. 33-34 · Read the law's page

• Notify AZOP without undue delay and, where feasible, within 72 hours of becoming aware of a personal-data breach affecting a person in Croatia, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them.
• If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).

Regulation (EU) 2016/679, Arts. 44-49 · Read the law's page

• Rely on an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Croatia outside the EEA.

Regulation (EU) 2016/679, Arts. 82-83 · Read the law's page

• Compensate any person who suffered material or non-material damage from your infringement, as controller or processor, under GDPR Article 82.

Zakon o provedbi Opce uredbe o zastiti podataka, Arts. 21-23 · Read the law's page

• Obtain the data subject's explicit GDPR-compliant consent before processing biometric data of a person in Croatia for the individual, secure identification of a service user, per Act Article 22(2).
• Offer a non-biometric alternative and obtain explicit consent, or rely on a legal prescription, before deploying employee biometric time-and-attendance or access-control processing in Croatia, per Act Article 23.

Zakon o provedbi Opce uredbe o zastiti podataka, Narodne novine (Official Gazette) br. 42/18 · Read the law's page

• Establish a GDPR Article 6 lawful basis before processing personal data of a person in Croatia, following the Act's institutional and procedural rules.

Zakon o izmjenama i dopunama Zakona o obveznim odnosima · Read the law's page

• These rules are enacted but do not apply yet: they do not apply to products placed on the market or put into service before 9 December 2026, and Articles 1073 to 1080 now in force keep governing those products (Arts. 21(2) and 22 of the amending Act).
• If you develop or make a product, software included, or present yourself as its manufacturer by your name, trade mark or other distinguishing feature, you answer for damage a defect in it causes (Arts. 1072.a points 1 and 11, 1073(1) and 1076(1)).
• Keep supplying the software updates and upgrades needed to keep the product safe while it is within your control: a defect caused by software, by an update or upgrade, or by a missing update needed to maintain safety is not excused because it arose after you placed the product on the market (Arts. 1072.a point 5 and 1078(2)).
• Treat safety-relevant cybersecurity requirements and any recall as part of what decides whether your product is defective (Art. 1075(2) points 6 and 7).
• Allow for what the product learns or acquires after it is placed on the market, because the effect of that ability is weighed in deciding whether it is defective (Art. 1075(2) point 3).
• Keep evidence you could produce if a court orders you to disclose it: failing to disclose presumes the product defective (Arts. 1074(2) point 1 and 1074.a(1)).
• If you are outside the EU, the importer, your authorized representative or, failing both, the fulfilment service provider answers for the product in your place (Art. 1076(1) point 3).
• If you distribute a product, or run an online platform that lets consumers contract with traders, name the liable operator established in the EU or your own supplier within one month of the injured person's request, or you answer for the damage (Art. 1076(4) and (5)).
• If you substantially modify a product outside the manufacturer's control and then make it available on the market or put it into service, you answer as its manufacturer (Art. 1076(3)).
• If you build a software component into a product, you have no recourse against the maker of a defective software component that was a micro or small enterprise, or where you waived recourse by contract (Art. 1077.a).
• Do not rely on a contract term to limit or exclude liability to the injured person in advance; such a term is void (Art. 1079).
• Free and open-source software developed or supplied outside a business activity is outside these rules (Art. 1073(5)).
• A claim is time-barred three years after the injured person learned, or should have learned, of the damage, the defect and the identity of the economic operator, and the right to compensation is extinguished ten years after the product was placed on the market or put into service, or 25 years for a latent bodily injury (Art. 1080).