Politike privatnosti i kolačića

Data Controller: DRINK MY SOUL, obrt za marketing, vl. Dorijan Skoblar
Registered Address: Kampor 228, 51280 Rab, Croatia
Data Protection Contact: dorijan@drinkmysoul.com, +385 99 755 2732
Last Updated: 15 March 2026

DRINK MY SOUL has adopted this Privacy Policy to protect the privacy of its users and ensure compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 concerning the protection of natural persons with regard to the processing of personal data and the free movement of such data, repealing Directive 95/46/EC (the “General Data Protection Regulation” or “GDPR”), the Croatian Act on the Implementation of the General Data Protection Regulation, Directive 2002/58/EC and other applicable legislation.

We process personal data in accordance with the principles of lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. Where possible, personal data is anonymised.

This Privacy Policy applies to all services provided by DRINK MY SOUL and explains how we collect, use, store and protect personal data, as well as the rights available to individuals whose personal data we process.

Personal Data

Personal data means any information relating to an identified or identifiable natural person.

Processing

Processing means any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means. This includes the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making data available, alignment or combination, restriction, erasure or destruction of personal data.

We process personal data only where at least one of the following conditions applies:

• you have given your consent to the processing of your personal data for one or more specific purposes;

• processing is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into a contract;

• processing is necessary for compliance with a legal obligation to which we are subject;

• processing is necessary to protect your vital interests or those of another natural person;

• processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller; or

• processing is necessary for the purposes of our legitimate interests or those of a third party, unless those interests are overridden by your interests or fundamental rights and freedoms requiring the protection of personal data.

Personal Data We Collect

We collect and process the following categories of personal data:

a) Employee data

We process employees’ personal data in accordance with applicable laws and regulations.

Purpose of processing: To exercise the rights and fulfil the obligations arising from the employment relationship. Providing this information is a statutory and contractual requirement and a condition for entering into and maintaining an employment relationship.

b) Job applicant data

We process the personal data of individuals participating in recruitment or other employment-related procedures, including unsolicited applications. This may include their full name, residential or temporary address, Croatian Personal Identification Number (OIB), date of birth and any other information submitted as part of the recruitment or application process.

Purpose of processing: To recruit new employees. Providing this information is necessary for an applicant to be considered for potential employment.

c) Client and other individual data

We may process the full name, residential or temporary address, Croatian Personal Identification Number (OIB) and contact details of clients and other individuals.

Purpose of processing: To carry out business and legal transactions and prepare quotations or proposals.

d) Business partner and supplier data

We process personal data relating to individuals with whom we cooperate in the course of our business activities. This may include their full name, Croatian Personal Identification Number (OIB), residential address, bank account details and other information required to fulfil contractual obligations and related legal requirements.

Purpose of processing: To purchase goods and services and exercise the rights and fulfil the obligations arising from the relevant business relationship. Providing this information may be a statutory or contractual requirement and may be necessary to enter into a contract.

e) Marketing data

We may process contact information, such as an email address or telephone number, as well as information about user behaviour collected through cookies.

If you provide personal data through registration, live chat, a contact form, survey, competition or similar interaction, we may use that information for the stated purpose, customer relationship management, marketing management, business analysis and profitability analysis.

Purpose of processing: Marketing communications, newsletters, personalised offers and market analysis.

We may use your contact details to send promotional communications about our products and services only where you have consented to such processing.

We process personal data solely for the purposes described above and will not use or otherwise process it for incompatible purposes.

Under the GDPR, the legal bases applicable to the above categories of personal data, either individually or in combination, are as follows:

• Data referred to under point a): Processing is necessary for the performance of a contract to which the data subject is a party and/or for compliance with our legal obligations, including obligations under employment, health insurance, pension and tax legislation.

• Data referred to under point b): Processing is necessary to take steps at the data subject’s request before entering into a contract.

• Data referred to under point c): Processing is necessary for the performance of a contract to which the data subject is a party or to take steps at the data subject’s request before entering into a contract; for compliance with our legal obligations; for the purposes of our legitimate interests or those of a third party; and/or to protect the vital interests of the data subject or another natural person. Relevant legitimate interests may include maintaining system security, preventing misuse and conducting business communications.

• Data referred to under point d): Processing is necessary for the performance of a contract to which the data subject is a party; for compliance with our legal obligations, including those arising under accounting legislation; and/or for the purposes of our legitimate interests or those of a third party.

• Data referred to under point e): Processing is based on the user’s consent.

We collect personal data:

• directly from you, with your consent or where necessary to enter into and perform a contract; and

• automatically when you visit our website, through cookies and similar technologies.

Consent is not required for cookies that are strictly necessary for the website to function. These may include cookies used to retain information entered by users, authentication cookies, security cookies, multimedia session cookies, load-balancing cookies and cookies enabling logged-in users to share content through social media plug-ins.

All other cookies and similar technologies are used on the basis of your consent, which you may withdraw at any time.

We do not use the personal data we collect for automated decision-making.

We implement appropriate technical and organisational measures to protect personal data. Access is limited to authorised personnel and contracted data processors, such as hosting and IT service providers and legal advisers, to the extent necessary for them to perform their services and in accordance with applicable law.

We enter into appropriate written agreements with our processors, requiring them, among other things, to comply with all data protection standards prescribed by the GDPR.

Website Cookies

Our official website uses cookies. Cookies are small text files placed on a user’s device by a web server when the website is displayed through the user’s internet service provider.

Cookies are created when the browser on a user’s device loads a website. The website sends information to the browser, which then creates a text file. When the user returns to the website, the browser retrieves the cookie and sends it back to the website’s server.

Further information is available in our Cookie Policy.

We automatically collect certain information when you visit, use or browse our website. This information does not directly reveal your identity, such as your name or contact details, but may include device and usage information, including your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, approximate location, information about how and when you use our website, and other technical information.

This information is primarily required to maintain the security and operation of our website and for internal analytics and reporting purposes.

Data Retention and Security

We process your personal data for as long as necessary to fulfil the purpose for which it was collected.

Once that purpose no longer applies, we will cease using the data. However, it may remain stored in our systems for as long as required under applicable statutory record-retention and archiving obligations.

Personal data processed on the basis of consent is retained for up to five years, unless you withdraw your consent earlier. Data required for the performance of a contract is retained in accordance with applicable accounting regulations and statutory limitation periods.

Personal data is processed within the Republic of Croatia. We do not transfer personal data to third countries outside the European Union and the European Economic Area or to international organisations.

Personal data in physical form, including written documentation, is stored and otherwise processed at our business premises unless the purpose of processing or a legal obligation requires otherwise.

Personal data in electronic form is stored and otherwise processed within our IT infrastructure unless the purpose of processing or a legal obligation requires otherwise.

We apply strict procedures and security measures to protect personal data. However, no method of transmitting data over the internet can be guaranteed to be completely secure. By submitting data online, you acknowledge the risks inherent in internet-based data transmission.

DRINK MY SOUL does not knowingly collect personal data from persons under the age of 16, and no part of our website is designed or intended to attract children under the age of 16.

Where required by the purpose of processing or by law, we may disclose personal data to other natural or legal persons, public authorities, agencies or other bodies. In all other circumstances, we do not disclose personal data under our control to third parties.

Individuals responsible for processing personal data are required to protect it against accidental loss or destruction, unauthorised access, unlawful processing, unauthorised disclosure and any other form of misuse. Where appropriate, they are also required to sign confidentiality undertakings.

Access to personal data is granted only to individuals who have been specifically authorised or whose duties require them to process such data. Unauthorised access to personal data, as well as any attempt to transmit or alter it without authorisation, is strictly prohibited.

Technical security measures applied to personal data under our control include:

• securing business premises;

• locking cabinets containing physical records;

• limiting access to keys or other means of entry to authorised individuals;

• using antivirus protection;

• protecting computers and other devices with passwords; and

• applying any other technical measures appropriate to the current risks affecting the rights and freedoms of data subjects.

Your Rights

You have the following rights in relation to your personal data:

1. Right of access

You have the right to obtain confirmation as to whether we process your personal data and to access the personal data we hold about you.

You may also request further information, particularly regarding the purposes of processing, the categories of personal data concerned, the recipients or categories of recipients to whom the data has been or will be disclosed, and the envisaged period for which the data will be stored.

Access may be restricted only where permitted under European Union or Croatian law and where such a restriction respects the essence of the fundamental rights and freedoms of others.

2. Right to rectification

You have the right to request the correction or completion of your personal data if it is inaccurate, incomplete or out of date.

To exercise this right, please submit a written request to us as the data controller. Requests may also be submitted electronically.

3. Right to erasure (“right to be forgotten”)

You have the right to request the erasure of personal data relating to you where one of the following conditions applies:

• the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;

• you withdraw the consent on which the processing is based under Article 6(1)(a) or Article 9(2)(a) of the GDPR, and there is no other legal basis for the processing;

• you object to the processing under Article 21(1) of the GDPR, and there are no overriding legitimate grounds for continuing the processing;

• the personal data has been processed unlawfully;

• the personal data must be erased to comply with a legal obligation under European Union law or the law of an EU Member State to which the data controller is subject; or

• the personal data was collected in connection with the offer of information society services referred to in Article 8(1) of the GDPR.

4. Right to restriction of processing

You have the right to request the restriction of processing where:

• you dispute the accuracy of the personal data;

• the processing is unlawful, but you oppose the erasure of the data;

• we no longer require the personal data for the purposes of processing, but you require it to establish, exercise or defend legal claims; or

• you have objected to the processing of your personal data while it is being determined whether our legitimate grounds override your rights and interests.

5. Right to data portability

You have the right to receive personal data that you have provided to us in a structured, commonly used and machine-readable format.

You also have the right to transmit that data to another data controller, provided that the processing is carried out by automated means and is based on your consent or on a contract.

6. Right to object

You have the right to object to the processing of your personal data.

Following an objection, we will no longer process the relevant personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or unless the processing is necessary for the establishment, exercise or defence of legal claims.

In addition to the rights listed above, you have the right to lodge a complaint with the competent supervisory authority.

In Croatia, the competent authority is the Croatian Personal Data Protection Agency:

Croatian Personal Data Protection Agency (AZOP)
Selska cesta 136
10000 Zagreb, Croatia
Website: www.azop.hr

To exercise any of your rights, please contact us at dorijan@drinkmysoul.com. We will respond without undue delay and within the time limits prescribed by applicable law.

Processing Based on Consent

Where the processing of personal data is based on consent, we ensure that consent is freely given, specific, informed and unambiguous.

Where written consent is required, the consent statement will be prepared separately for each specific processing purpose and presented in a concise, transparent, intelligible and easily accessible form, using clear and plain language. Consent may be provided by hand or electronically, as applicable.

You have the right to withdraw your consent at any time. Before providing consent, you will be informed of this right. Withdrawing consent will be made as easy as giving it.

The withdrawal of consent does not affect the lawfulness of any processing carried out before the consent was withdrawn.

If you withdraw your consent, we will stop the relevant processing and erase your personal data unless we have another lawful basis for retaining it or are required to retain it under Croatian or European Union law.

Complaints and Changes to This Policy

If you believe that your rights have been infringed, please contact us at dorijan@drinkmysoul.com.

We reserve the right to amend or update this Privacy Policy at any time. Any changes will be published on our website. We therefore recommend reviewing this page periodically to ensure that you are familiar with the latest version of the Policy.

Contact Details of the Data Controller

DRINK MY SOUL, obrt za marketing, vl. Dorijan Skoblar
Kampor 228
51280 Rab, Croatia
Telephone: +385 99 755 2732
Email: dorijan@drinkmysoul.com