Your experience is important to us, but also the security of your data.

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 / EC (Official Journal of the European Union L 119 , 4.5.2016, page 1, hereinafter: General Regulation on Data Protection), which is in full application from 25 May 2018 in the Republic of Croatia and all EU Member States, as well as the Law on Implementation General Regulation on Data Protection (Official Gazette No. 42/18, hereinafter: the Act) or in accordance with the legal framework for personal data protection in the Republic of Croatia and the European Union and European best practice, Geldbaum Limited Liability Company for Services and Tourist Agency, based in The Republic of Croatia, Zagreb, Vrhovec 231B, PIN: 03530187806 (hereinafter: “GELDBAUM”), as the Data Controller of users of its services and customers, has developed the Privacy Notice.

This Privacy Notice (hereinafter: “Notice”) explains how GELDBAUM collects, uses and manages your personal data that is located on the web site gr8coffeefestival.com.
This Privacy Notice applies to all services offered by GELDBAUM, with the aim of the rules in a clear and transparent way to acquaint our visitors, partners and users of our services (hereinafter: “data subjects”) with the processing of their personal data and their rights.

GELDBAUM is dedicated to respecting and protection of your privacy. In regard to the data we collect, GELDBAUM is a Data Controller, that is, the one that determines the purposes, needs and means for which personal data is processed.
GELDBAUM as a website service provider is committed to protecting the privacy of personal information.

If you wish to contact us regarding this Notice or regarding your personal data, please use the following contact information:

Geldbaum d.o.o.
Vrhovec 231B
10000 Zagreb
Croatia
E-mail: [email protected]

For data protection you can contact: [email protected].

And now we will talk “a little” more about the rights, obligations and other issues that are relevant to the protection of your privacy and personal data! The text that follows is important and by no means boring and dry.

We collect your personal information when necessary to meet your needs and requirements, perform services or for the purposes of our business and the organisation of the GR8 Coffee Festival and Workshops:

1. for the sale of tickets GELDBAUM uses the services of its partner Entrio tehnologija d.o.o., Radnička cesta 54, 10000 Zagreb, PIN: 30513194761 (hereinafter: “Entrio”), which enables and conducts sales as an intermediary in the name and on behalf of GELDBAUM via the website https://www.entrio.hr and related pages. To buy a ticket, you need to open a user profile (registration) on the website https://www.entrio.hr and agree to the Terms of Sale and General Terms of Service of Entrio. When purchasing a ticket, the Entrio system will ask for certain information (personal data) such as name, surname and e-mail address. In the case of ticket purchase, a contractual relationship is concluded, which is the basis for the processing of your personal data due to the necessity of executing the contract in which you, as a customer, our visitor, are a party. We also process your data in order to take actions at your request, before concluding a contract. Entrio will forward the buyers’s first and last name to us for the purpose of entrance control and visitor records. Entrio will forward the buyer’s e-mail address to us if there is a need to send important information to the buyer related to purchased tickets, such as cancellation or change of event date, location change, program change, etc.
2. at the moment when you access the gr8coffeefestival.com we will collect your IP address, which is also considered to be personal data,
3. when registering a person as a user or recipient of a newsletter or other information about our products and promotions. As a Data Controller, we will ask you to enter information about yourself (personal data) such as e-mail address. The legal basis for the processing of your data is consent. Therefore, the user who signs up to receive notifications about our products and promotions by entering their data on the web page gr8coffeefestival.com gives consent to the processing of their personal data. The user may withdraw the consent at any time by notifying the e-mail address [email protected],
4. situations in which we collect other types of information such as the date and time of access to the site, information about the hardware, software or Internet browser you use as well as about your computer’s operating system and application version and language settings. We may collect information about clicks and your access to the gr8coffeefestival.com page displayed to you,
5. when you contact our office and ask us for help or ask a question in order to exercise any of your rights guaranteed by applicable regulations, we collect data that you had made available to us,
6. when you contact our office as partners/sponsors or as participants in connection with the Barista Challenge or workshops, we collect your name, surname, e-mail and telephone number,
7. when you contact us through social networks, we collect data that you had made available to us when making inquiries or requests,
8. when you want to unilaterally terminate the contract, we collect your name, surname, personal identification number, address, account information and purchase amount, all depending on the chosen method of payment,
9. when you participate in our giveaways, we will process the data depending on the type of gifts, and we will additionally inform you about this in the rules of the giveaway. Data that can be processed are, for example, name, surname, address for sending the gift,
10. when you send us any inquiry related to our offer, we will process your contacts and / or other information that you provide to us when sending the inquiry,
11. if you want to send an open job application, we will process information such as your name, surname, age, occupation, occupation, work experience, contact phone number and other information contained in your open job application,
12. for the purposes of web analytics via Google Analytics, we use the application “_gat._anonymize” through which the IP address of the data subject is shortened by Google and anonymized when the GR8 Coffee Festival website is accessed by a data subject from an EU Member State or another country under the European Economic Area,
13. when photographing and audio and video recordings of the Festival, workshops and/or short videos or the atmosphere, we will process your photo, movement, voice, hair colour, etc., all based on legitimate interest,
14. when you have bought the ticket or you are on the list of our visitors or you are a lecturer at the GR8 Coffee Festival or if you participate in the workshops or in the Barista Challenge, we will inform you about the program, news, exhibitors and other important issues that we consider important and part of the organisational process. During the above activities, we will process your e-mail or other contact based on a legitimate interest or in order to fulfil the contractual obligations we have towards you in accordance with the concluded contract.
15. when we conclude a business cooperation agreement with you as an exhibitor, we collect the name and surname of the persons you have authorized to work at the stand, as well as the license plates of delivery vehicles, all for the purpose of issuing accreditations.

GELDBAUM recommends all ticket buyers and users of the Entrio site to take care of their login password for registration. We recommend combining uppercase and lowercase letters and numbers when choosing a password character combination. Use a password of at least six characters. We recommend changing the password periodically (at least once a year).

We collect the above mentioned specific categories of your personal data either on the basis of the consent shown to you when you arrive at  gr8coffeefestival.com via a pop-up window, or on the basis of a legitimate interest (for example in cases of cookies that are necessary for functioning gr8coffeefestival.com or when we are already sending you some interesting information and / or offers of shares as our weekender) or in order to fulfill our obligations arising from the applicable regulations of the Republic of Croatia.

If the processing is based on your consent, you have the right to withdraw your consent at any time. The withdrawal of consent must be notified to the head of processing by e-mail: [email protected] or to the address Vrhovec 231B, 10 000 Zagreb, with the indication “for data protection˝. Such withdrawal shall not affect the lawfulness of processing based on consent prior to its withdrawal.

Please pay attention to the mandatory volume of data we ask you to provide, because in case the customer or user does not provide the required information which are specified as mandatory in order to perform an activity requested or expected by them, unfortunately they will not be allowed to enter into it, without the required data that activity will not be technically possible to carry out.

Processing of personal data in payment processing

For the sale of tickets GELDBAUM uses the services of its partner Entrio tehnologija d.o.o., Radnička cesta 54, 10000 Zagreb, PIN: 30513194761 (hereinafter: “Entrio”), which enables and conducts sales as an intermediary in the name and on behalf of GELDBAUM via the website https://www.entrio.hr and related pages. To buy a ticket, you need to open a user profile (registration) on the website https://www.entrio.hr and agree to the Terms of Sale and General Terms of Service of Entrio. When purchasing a ticket, the Entrio system will ask for certain information (personal data) such as name, surname and e-mail address. In the case of ticket purchase, a contractual relationship is concluded, which is the basis for the processing of your personal data due to the necessity of executing the contract in which you, as a customer, our visitor, are a party. Entrio processes and forwards data about the bank card and the cardholder to their partner payment processor – the WSPay system, via a secure SSL connection for the purpose of charging the order and issuing tickets.
Data processing during payment is necessary in order to perform all actions that precede the purchase or conclusion of a contract with the Data Controller. When we talk about the legal basis of data processing related to certain types of payments or legal entities that provide these services, payment data such as name, surname, code, amount, account number or other transaction codes are shared with the card company or bank or third party through which payment is made, all at the request of the data subject who independently chooses the method of payment. Geldbaum warns customers or visitors to take care of the information stated on the card so that this information would not be available to third parties and so that it would not be misused.

So, to summarise all the above, we generally collect your personal information directly from you either to enter a contract with us, to perform an action at your request, when you hire us to perform certain services provided by us or our contractual partners or fill out a specific form or when you want to receive our newsletter.

If you would like us to send you details about our products, the organisation of our events, services, offers and promotions, please subscribe to it by giving us consent when subscribing to the newsletter.

We treat your personal information as confidential information and they are properly protected by GELDBAUM and / or our trusted partners.

Typical categories of information we collect from users are the following: name, surname, e-mail, telephone number and other information you provide when filling out forms on websites or when communicating with us by phone, e-mail or via social networks.

We collect your personal data for:

• performance of a service, fulfillment of a contract or other way of ensuring provision of a requested service
• the use of all services on the webpage gr8coffeefestival.com
• the most efficient response to your inquiry and processing of your requests
• statistical data processing
• sending materials, offers and contacting
• improving the quality of content, functionality, and services

Please note that you have the right to request the following from GELDBAUM at any time:

To exercise any of the above rights, please use the contact information provided at the beginning of the Privacy Notice.

If you believe that your rights are not being respected, you have the right to file a complaint with the Personal Data Protection Agency.

We store the personal information we collect about you in a secure environment. Your personal information is protected from unauthorised access, disclosure, use, alteration, or destruction by any organisation or individual.

The processed data is stored in our premises and secure IT systems, but sometimes we store the data on the servers of our trusted service providers located in the EU.

GELDBAUM will ensure that personal data is kept in a secure location (which includes reasonable administrative, technical, and physical protection to prevent unauthorised use, access, disclosure, copying or alteration of personal data), which can only be accessed by authorised persons. All authorised persons sign a statement of confidentiality.

The data collected for the purposes specified in this policy will be retained only for as long as is necessary to fulfil the stated purposes. Your personal information will not be stored in a form that allows you to be identified for longer than GELDBAUM reasonably deems necessary to accomplish the purpose for which it was collected or processed. GELDBAUM will keep certain personal data for a period of time prescribed by law or a regulation that obliges GELDBAUM to retain data (see “How long will GELDBAUM keep your personal data?”).

If you have given us consent (for example, you have subscribed to our newsletter, selected a certain category of cookies to use), we will process your personal data until the consent is withdrawn. If you make a well-founded objection to the processing of personal data based on a legitimate interest, we will not process your personal data in the future.

In addition to all of the above, it is important to point out the following: if judicial, administrative, or extrajudicial proceedings are instituted, personal data may be retained until the end of such proceedings, including a possible period for declaring legal remedies.

GELDBAUM will not retain your personal data for longer than the period required to fulfill the purpose of their use, and for a maximum period of 3 years, except in exceptional cases where the law prescribes a longer retention period (for example, data related to unilaterally terminated contracts and complaints will be kept for 1 year, data related to exercising of your privacy rights will be kept permanently, data related to prize contests will be kept for 5 years, data on lecturers for 5 years, photos and recordings from lectures and other organized events at the GR8 Coffee Festival 5 years or until the acceptance of your objection to processing, e-mail addresses for the purpose of sending the newsletter until the withdrawal of consent, while we will keep account data for 11 years).

You can find out more about data retention periods by contacting us at our aforementioned address or by e-mail [email protected].

We may use your personal information in several different ways, mainly to meet our legal and other obligations toward you, but sometimes to improve your experience of using the website, and for security reasons.

The purposes for which we use your data are described in these rules, and if your data is processed for other purposes, you will be notified before such (new) processing is carried out.

Newsletter

GELDBAUM wants to send you information about our activities and news that you might be interested in. Please note that you may opt out of receiving them at any time by exercising your rights set forth in this Policy. To subscribe to the newsletter, GELDBAUM collects and processes: e-mail addresses.

The newsletter contains the so-called tracking pixels. A tracking pixel is a miniature graphic element embedded in an e-mail that is sent in HTML format to allow saving and analysis via log files. This allows statistical analysis of the success of marketing campaigns. Through tracking pixels GELDBAUM can see when and if an e-mail was opened by you as a data subject and which links you followed. Personal data collected through tracking pixels in the newsletter is stored and analysed by GELDBAUM as the Data Controller in order to optimize the process of sending the newsletter, as well as adjust the content of future newsletters to the interests of data subjects.

Video surveillance, photo, audio and video recording

Numerous television crews, media companies and photographers will be filming at the GR8 Coffee Festival location. At the entrance to the venue where the GR8 Coffee Festival is held, there will be a special notice about audio and video recording and taking of photos, as well as extended notice with specified rights and information about video surveillance. By entering, you agree that you may be filmed and photographed. You also agree that all material from the GR8 Coffee Festival may be used globally for promotional purposes of the GR8 Coffee Festival. The legal basis of processing in relation to visitors is legitimate interest.

When taking photos and recording, data such as your physionomy, movement, hair colour, eye colour are processed. The video surveillance system is also used to protect property and for security. Please note that the area where the GR8 Coffee Festival is held is under video surveillance installed by Zagrebački velesajam d.o.o., Avenija Dubrovnik 15, 10020 Zagreb, Croatia, PIN: 95660678441, which is the independent Data Controller for personal data processing in the part related to video surveillance and for more information you can contact them at the aforementioned address or by e-mail [email protected].

To maintain the website and ensure that its functionality is at the expected level GELDBAUM uses a technology known as “cookies”.

Cookies are small files that we send to your computer that can be accessed later. They can be temporary or permanent. Thanks to cookies, you can easily search our pages. Cookies show us what interests you and other visitors to our website, which helps us improve it.

Read more about cookies in the Cookies Policy.

Privacy protection is important to us, so we will never share your personal information with third parties except for the purposes described in this Policy. We will always inform you when sharing and transferring data.

GELDBAUM cooperates with other companies. This means that we sometimes share your personal information, using secure IT systems. When we do so, the data is transferred to servers located in the EU or in a country that provides an adequate level of protection in accordance with EU legislation.

In some cases, our partners providing services on behalf of or for GELDBAUM may process your data outside the European Union. However, the contracts we conclude with such entities oblige them to treat your data using special security measures in accordance with the regulations in force in the Member States of the European Union.

On 10 July 2023, the European Commission adopted a new adequacy decision under which personal data can be freely transferred from the European Union to companies in the US participating in the Data Privacy Framework.

The adequacy decision is based on Article 45 of the General Data Protection Regulation. The General Data Protection Regulation (GDPR) and is a mechanism that ensures the secure and lawful transfer of data to third countries. Companies in the U.S. that wish to participate in the Data Protection Framework must undergo a self-certification process and enrol in the list of companies that have accessed the Data Privacy Framework.

Also, if our contract partner is based in the US, we will review existing contracts and check the security standards that our partner guarantees to ensure the protection of all our data subjects with the latest standards approved and suggested by the relevant institutions.

The purposes for which we share data with our trusted partners are, for example, marketing needs, maintenance of the gr8coffeefestival.com website, advertising, payment processing, delivery, and other services in and outside GELDBAUM. These service providers are obliged, according to the relevant contracts, to use the data entrusted to them only in accordance with our guidelines and exclusively for the purpose we have strictly determined. We also oblige them to adequately protect your data and to consider it a business secret.

Once a year, we audit all our partners to make sure that the protection of your personal data is still at the required level and that it complies with applicable regulations.

Other websites that can be accessed through the website gr8coffeefestival.com have their own statements of confidentiality and data collection and the ways in which they are used and disclosed.

GELDBAUM is not responsible for the ways and conditions of work of third parties.

GELDBAUM collects and processes personal information through user interactions on social networks such as Facebook and Instagram. GELDBAUM or authorised persons appointed by GELDBAUM have access to messages and/or posts on the mentioned social networks, however personal data collected through them, especially those contained in messages, is not stored, and further processed by GELDBAUM except for the purposes specified in this Policy.

GELDBAUM uses a business profile within the services of Facebook and Instagram, and you can view their Privacy Policy or Privacy Statements as well as the way they use your personal data at:

FACEBOOK ONLINE
https://www.facebook.com/policy.php

INSTAGRAM ONLINE

https://help.instagram.com/519522125107875

In case you have questions regarding the collection and processing of data by Facebook and/or Instagram or you want to exercise any of your rights guaranteed by the General Data Protection Regulation, contact:

FOR FACEBOOK:
META PLATFORMS IRELAND Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

Contact of the Data Protection Officer:

https://hr-hr.facebook.com/policy.php
https://www.facebook.com/help/contact/540977946302970

If you are not satisfied with the way your personal data is collected and processed, you can contact the leading supervisory body of Facebook, the Irish Data Protection Commissioner or the Personal Data Protection Agency of the Republic of Croatia.

On gr8coffeefestival.com, GELDBAUM as the Data Controller has installed Facebook components. Facebook is a social network.

A social network is a place of social connection on the Internet, an online community that typically allows users to communicate with each other in a virtual space. A social network serves as a platform to share opinions and experiences, or to provide the Internet community with personal or business-related information. Facebook allows its users to create private profiles, upload images and connect through friend requests.

Facebook is owned by Meta Platforms Inc., 1 Hacker Way, Menlo Park, CA 94025, SAD. If the person using Facebook lives outside the United States or Canada, the Data Controller for processing is Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbor, Dublin 2, Ireland. Meta Platforms Inc., 1 Hacker Way, Menlo Park, CA 94025, USA, is a standalone Data Controller.

By opening gr8coffeefestival.com the data subject’s browser will display the corresponding Facebook component as a result of using the Facebook plugin. An overview of all Facebook plugins can be found at https://developers.facebook.com/docs/plugins/. During this technical procedure, Facebook is provided with information about a specific subpage visited by the data subject.

In case you are, as the data subject, logged in to Facebook, Facebook can additionally detect each of your visits to gr8coffeefestival.com. This information is collected through the Facebook component and remitted to the data subject’s Facebook account. If the data subject clicks on any Facebook button integrated on the gr8coffeefestival.com website, e.g., the “Like” button, or if the data subject sends a comment, Facebook can transfer the information to the data subject’s personal Facebook account and thus save personal data.

Each time a data subject is logged in to Facebook and at the same time visits the gr8coffeefestival.com website, Facebook will receive information about it via the Facebook component. This will happen regardless of whether the data subject clicks on the Facebook component or not. If the data subject does not want to transfer this type of information, he/she can prevent the same by logging out of the Facebook account before accessing the gr8coffeefestival.com website.

FOR INSTAGRAM:
META PLATFORMS Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland

Contact of the Data Protection Officer:

https://hr-hr.facebook.com/policy.php
https://www.facebook.com/help/contact/540977946302970

If you wish to raise a concern about Instagram use of your information (and without prejudice to any other rights you may have), you have the right to do so with your local supervisory authority or Instagram International Company’s lead supervisory authority, the Irish Data Protection Commission or the Personal Data Protection Agency of the Republic of Croatia.

This Notice shall enter into force upon publication on the website.

GELDBAUM reserves the right to amend and republish the Privacy Notice on the website.

Date of update and publication: 29.02.2024. godine