1. INTRODUCTORY PROVISIONS

Tonkin Svijet, trade for information services, owner Damir Stojanovski, Rijeka, Kumičićeva 3a, Trade Registration Number 98977814, as the data controller, is committed to protecting privacy and personal data in its business operations in accordance with the provisions of the General Data Protection Regulation (EU) 2016/679 – GDPR and other regulations governing the protection of personal data.

This Privacy Policy applies to any person whose personal data is processed while using the Site or purchasing products and services through the Site. The provisions on the use of the Site can be found in our General Terms of Use. Abbreviations used in this Privacy Policy have the same meaning as in the General Terms of Use.

With this Privacy Policy, we provide clear information about the processing and protection of personal data and enable simple monitoring and management of personal data. The subject of this Privacy Policy is the handling of Users' personal data during visits to and use of the website www.tonkinsvijet.com.

We reserve the right to unilaterally amend this Privacy Policy at any time. The valid version of this Privacy Policy is always available on the Site. By using the Site or accepting the General Terms of Use, you agree to this Privacy Policy.

2. LEGAL BASIS AND PURPOSE OF PROCESSING

The Company processes the personal data of Users as the other contracting party or as a visitor to the Site in the following cases:

• Contact by the User via the emails found on the Site. In this case, we use the User's email, first name, and last name for the purpose of informing the User about the products and services on the Site and creating a suitable offer. The basis for processing personal data is taking action at the request of the User before concluding a contract. We do not process other personal data that the User voluntarily provides in this way if it is not necessary for this purpose;

• Subscription by the User to our newsletter. In this case, we use the User's email to periodically send notifications about special offers and news about the products and services on the Site. The basis on which personal data is collected is the consent given by checking a box.

• Interaction by the User on social networks (Facebook, Instagram, LinkedIn, etc.). In this case, we may have access to data such as the User's first and last name and personal data provided in reactions, comments, messages, and the like. We use social networks to respond to User inquiries and to inform Users about news in our work. Depending on the purpose of the processing, the basis for processing personal data is taking action at the request of the User before concluding a contract or the User's consent.

• Online ordering of services is detailed in the General Terms of Use. After confirming the cart, the User enters the personal data necessary for concluding the contract, namely first and last name, address, and email. Further processing of personal data depends on the payment method the User chooses. If the User chooses online card payment, the User enters the card number, expiration date, CCV code, first and last name, email, and other required data necessary for online card payment via the Stripe system, details of which are available at https://stripe.com/en-hr/privacy. The basis for processing personal data is the performance of a contract to which the User is a party.

• Data on the use of educational materials, such as which chapter has been viewed and/or completed. The basis for processing personal data is regulated by the General Terms. This enables us to provide quality support, advice, and solve User problems in an effective manner. We also use data on the use of educational materials to improve chapters and future educational materials.

The Company will remove the processed personal data upon the termination of the basis for its processing.

3. DATA SHARING AND STORAGE PERIOD

The Company fulfills its obligations from the contract concluded with the User personally. In the case of choosing online card payment as the payment method, we use an external service provider in accordance with the General Terms of Use.

We share personal data with third parties only when it is necessary for the performance of the concluded contract or if it pertains to the legal obligations of the Company. The Company may share the User's personal data with third parties in accordance with contractual obligations towards the Company's contractors if there is a legitimate interest of the Company, for example, concerning professional advisors, accounting, IT service providers, lawyers, and courier services.

The Company may also share personal data with supervisory authorities, courts, or government agencies when such data sharing is required by law. If permitted, the Company will then make all reasonable efforts to provide the User with prior notice of such sharing of personal data.

Collected personal data will not be made available to third parties for the purpose of offering third-party products and services, unless the User gives consent for that purpose.

We store the collected personal data as long as there is a basis for processing a certain category of personal data, for example, until the withdrawal of consent. We completely delete personal data from all storage systems no later than 30 days from the day the basis for processing and storage ceases, or later if special regulations specify an obligation to store said data.

4. COOKIES

Cookies are small text files that the Site stores on the User's computer. The general purposes of storage are the functionality of the Site, traffic measurement, analysis of User interests, and marketing. Cookies can be persistent or session cookies. A persistent cookie consists of a text file sent by a web server to a web browser, which will be stored by the browser and will remain valid until its set expiry date, unless the User deletes it beforehand. A session cookie expires at the end of the user session when the web browser is closed. The Company uses the following types of cookies:

• Browsing/session cookies: these are necessary for the proper functioning of the Site and are used regardless of the User's settings. They can be deleted within the User's browser at any time.

• Analytics cookies: these are used for the purpose of collecting data on the use of the Site. They do not store personal data but aggregate anonymous data, e.g., about the type of browser you use or the subpage you visit most often. This allows us to adapt the Site and provide you with the best user experience.

• Third-party cookies: these are used when you share certain content via social networks using the icons at the bottom of the Site or when you decide to contact us directly through the Site. Such integrations may use your personal data if you share it with them, but they will not use it unless you enter it independently and voluntarily. Third-party cookies may be changed at any time and without prior notice from the third party, as it is also the service provider.

When cookies do not collect personal data that can unequivocally establish the User's identity, we will not ask for your consent to store cookies. For more information on managing cookies, please refer to the pages of the browser you use.

5. USER RIGHTS

The Company enables Users easy and transparent management of personal data through the following rights:

• The right to withdraw given consent at any time by sending an email with the subject "Withdrawal of consent" and specifying which consent is being withdrawn. Consent for sending the newsletter can also be withdrawn by unsubscribing from the newsletter at the bottom of each newsletter.

• The right to obtain confirmation of which User personal data we process and access to the personal data we process by sending an email with the subject "Data Access."

• The right to request that we correct or supplement personal data if it is inaccurate or incomplete.

• The right to request the deletion of personal data if it is no longer necessary for the purposes for which we process it.

• The right to request access to your personal data in a structured, commonly used, and machine-readable format and the right to request the direct transmission of this data to another data controller, if applicable and technically feasible.

• The right to request the restriction of further processing, if applicable.

• The right to object to the processing of personal data, if applicable, and the right to lodge a complaint with the supervisory authority, the Personal Data Protection Agency. We ask all Users to first contact us before potentially addressing the Agency, as we wish to resolve any possible situation related to the protection of personal data directly and in good faith, while fully respecting the rights of the User.

You can exercise your rights by sending an email to podrska@tonkinsvijet.com or by sending mail to the address Tonkin Svijet, obrt za informacijske usluge, vl. Damir Stojanovski, Rijeka, Kumičićeva 3a, indicating the right you are exercising.