PRIVACY POLICY STATEMENT
Primary School Prizma and Kindergarten Maleni talenti respect your privacy and base their websites on technologies that provide a better and safer online experience. This Privacy Policy Statement applies to the collection and processing of your personal data on the website www.prizmazagreb.com (hereinafter: the Website). By using this Website, you agree to the collection and processing of data as described in this Statement.
Collection and Processing of Personal Data
In order to maintain the functionality of the Website and to provide the services requested by users, Primary School Prizma and Kindergarten Maleni talenti may collect and use users’ personal data on this Website. Depending on the purpose, the website www.prizmazagreb.com
may collect your personal data such as: name and surname, email address, home or business address, telephone number, and similar data.
By entering personal data into the designated fields, you give your consent for such data to be used for the purpose for which they were provided.
Primary School Prizma and Kindergarten Maleni talenti collect information about your computer. This information may include your IP address, browser type, access time, and referring website addresses. Primary School Prizma and Kindergarten Maleni talenti also collect user data outside this Website, based on questionnaire forms, with the user’s consent and for the purposes stated in those forms.
Collected data, as well as data obtained through the provision of services to users, are processed for the purpose for which they were provided, i.e., for using the Website and providing the requested services, and in order to provide you with information about products and services you may use.
Primary School Prizma and Kindergarten Maleni talenti may also use the above data to provide more efficient customer service, to facilitate the use of the Website by eliminating the need for repeated entry of the same data, or to tailor the Website to your personal preferences and interests.
Primary School Prizma and Kindergarten Maleni talenti do not sell, rent, or lend the list of their website users to third parties. Subject to confidentiality obligations, Primary School Prizma and Kindergarten Maleni talenti may share data with data processors for specific purposes such as: preparing statistical analyses, providing customer support, organizing delivery, or similar needs.
Primary School Prizma and Kindergarten Maleni talenti hereby inform you that you have the right to access all personal data you have provided, the right to have them rectified, the right to subsequently withdraw previously given consent (in whole or in part), as well as the right to object to the processing of personal data for the purpose of providing information about products or services—both with Primary School Prizma and Kindergarten Maleni talenti as the data controller and with any data processors.
Use of Cookies
The website www.prizmazagreb.com
uses so-called cookies—text files placed on the user’s computer by the web server used. Cookies are created when the user’s browser loads a visited website, which then sends data to the browser and creates a text file (cookie). The browser retrieves and sends the cookie back to the website server upon the user’s return to it.
Cookies are used to enable the functioning of all features of the Website and to improve the user experience. They may be temporary (stored only during the visit) or persistent (remaining stored on the user’s device even after the visit).
The websites of Primary School Prizma and Kindergarten Maleni talenti do not contain cookies that enable programs to run or viruses to be installed on your computer.
The website www.prizmazagreb.com
uses Google Analytics statistics; the rules on third-party cookies can be found in Google Analytics’ policies. From time to time, we may also collect information about how users use our Website by using other tools similar to Google Analytics.
Disabling Cookies
If you do not agree with the use of cookies, you can easily delete (or disable) them on your computer or mobile device through the settings of the browser you use. More information about managing cookies can be found on the pages of the browser you use or at www.allaboutcookies.org
.
Since the purpose of cookies is to improve and enable the use of our Website and its processes, please note that disabling or deleting cookies may prevent certain features from functioning or may cause them to work and appear differently in your browser.
Security of Your Personal Data
The website www.prizmazagreb.com
protects your personal data from unauthorized access, use, or disclosure. Data stored on computer servers are kept in a controlled, secure environment, protected from unauthorized access, use, or disclosure.
Terms and Amendments
The terms of this Privacy Policy govern the use of all data collected during the application of this Policy. Primary School Prizma and Kindergarten Maleni talenti reserve the right to amend this Policy at any time in order to provide important new information and to ensure that you are informed about how your data are protected on their websites. We therefore recommend that you periodically check this page for updates.
Contact Information
Primary School Prizma and Kindergarten Maleni talenti will gladly receive your comments and suggestions regarding this Policy, as well as any other remarks. You may contact us by phone at +385 99 466 9999.
REGULATION ON THE PROCESSING AND PROTECTION OF PERSONAL DATA
Based on Article 3(1) of the General Data Protection Regulation (EU) 2016/679 and Article [•] of the Statute of the School of Nature, Science and Mathematics Prizma, Ksaver, adopted at the session held on 01/05/2025, and the Statute of the Kindergarten Maleni talenti, adopted by the Governing Board at the session held on 01/05/2025, the following is adopted:
REGULATION ON THE PROCESSING AND PROTECTION OF PERSONAL DATA
I. GENERAL PROVISIONS
Article 1
In the processing of personal data and the protection of individuals with regard to the processing of personal data and rules relating to the free movement of personal data, the School of Nature, Science and Mathematics Prizma, Ksaver (hereinafter: the School) and the Kindergarten Maleni talenti (hereinafter: the Kindergarten) are subject to the application of the General Data Protection Regulation (EU) 2016/679.
Article 2
Pursuant to Article 4 of the General Data Protection Regulation, the School and the Kindergarten act as the controller of personal data processing, independently or jointly with others, determining the purposes and means of processing in accordance with national legislation or EU law.
Article 3
In accordance with the General Data Protection Regulation, the following terms used in this Regulation have the meanings set out below:
“personal data” means any information relating to an identified or identifiable individual (“data subject”); an identifiable individual is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that individual;
“processing” means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction;
“filing system” means any structured set of personal data which are accessible according to specific criteria, whether centralized, decentralized, or dispersed on a functional or geographical basis;
“controller” means a natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of processing personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;
“recipient” means a natural or legal person, public authority, agency, or another body to which personal data are disclosed, whether a third party or not;
“third party” means a natural or legal person, public authority, agency, or body other than the data subject, controller, processor, and persons who, under the direct authority of the controller or processor, are authorized to process personal data;
“consent” of the data subject means any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
“personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed;
“pseudonymisation” means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable individual.
Article 4
The School and the Kindergarten process personal data lawfully, fairly, and transparently.
They process only adequate and relevant personal data, exclusively for specific, explicit, and legitimate purposes, and do not further process such data in a manner incompatible with those purposes.
Personal data processed by the School and the Kindergarten are accurate and, where necessary, kept up to date. Inaccurate data are erased or rectified without delay.
Personal data are kept in a form permitting identification of data subjects for no longer than is necessary for the purposes for which the data are processed. Exceptionally, personal data may be stored for longer periods only if processed solely for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes.
Personal data are processed in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, through appropriate technical and organizational measures.
II. DATA PROTECTION OFFICER
Article 5
The School and the Kindergarten appoint a Data Protection Officer. The Data Protection Officer is appointed from among the staff of the School and the Kindergarten. The School and the Kindergarten publish the contact details of the Data Protection Officer on their websites and notify the supervisory authority of the appointed person.
The Data Protection Officer informs and advises the responsible persons of the School and the Kindergarten and their employees who directly carry out personal data processing regarding their obligations under the Regulation, monitors compliance with the Regulation and other Union or Member State data protection provisions, ensures data subject rights, and cooperates with the supervisory authority.
The Data Protection Officer must keep confidential all information obtained in the performance of their duties.
III. PROCESSING OF PERSONAL DATA
Article 6
The School and the Kindergarten process personal data only to the extent that at least one of the following conditions is met:
the data subject has given consent to the processing of their personal data for one or more specific purposes;
processing is necessary for the performance of a contract to which the data subject is a party;
processing is necessary for compliance with a legal obligation of the School and the Kindergarten;
processing is necessary to protect the vital interests of the data subject or another natural person;
processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the School and the Kindergarten;
processing is necessary for the purposes of the legitimate interests pursued by the School and the Kindergarten or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, in particular where the data subject is a child.
Article 7
Consent by which the data subject gives the School and the Kindergarten permission to process personal data relating to them must be freely given, provided in writing, in easily understandable, clear, and simple language, with the purpose clearly indicated, and without unfair conditions.
Where the processing concerns the personal data of a child below the age of 16, consent as described in paragraph 1 of this Article is given by the holder of parental responsibility (a parent or the child’s legal guardian).
Article 8
In the processing of personal data, the School and the Kindergarten provide the data subject with all relevant information (in writing or directly orally), in particular regarding: the purpose of processing, the legal basis, legitimate interests, the intention to transfer personal data to third parties, the period for which personal data will be stored, the existence of the right of access, rectification, erasure, restriction of processing, the right to object, and other rights.
IV. DATA SUBJECT RIGHTS
Article 9
The data subject has the right to access personal data contained in the filing system of the School and the Kindergarten relating to them.
The data subject has the right to obtain a copy/printout of personal data contained in the filing system relating to them.
The School and the Kindergarten shall, without undue delay, rectify inaccurate data relating to the data subject or complete them at the data subject’s request. The School and the Kindergarten shall, without undue delay, erase personal data relating to the data subject upon request, provided that the data are no longer necessary for the purposes for which they were collected, or if the data subject withdraws the consent on which the processing is based.
A data subject who believes that a right guaranteed by the General Data Protection Regulation has been infringed has the right to submit a request for the determination of an infringement to the competent authority.
Article 10
For the purpose of protecting personal data, the School and the Kindergarten apply pseudonymisation wherever possible, especially when publicly disclosing information in accordance with the Right of Access to Information Act.
V. FILING SYSTEM
Article 11
The School and the Kindergarten collect and process the following categories of personal data:
personal data of School and Kindergarten employees;
personal data of users of School and Kindergarten services;
personal data of parents/guardians of users of School and Kindergarten services;
personal data concerning the health status of users of School and Kindergarten services;
personal data of children with special needs who are users of School and Kindergarten services;
personal data of members of the School Board and the Kindergarten Governing Board;
personal data of candidates participating in recruitment procedures;
personal data of external associates.
Article 12
For the personal data referred to in Article 11, the School and the Kindergarten maintain a Record of Processing Activities included as an annex to this Regulation and forming an integral part thereof.
The Record of Processing Activities contains at least the following:
name and contact details of the School and the Kindergarten, their representatives, and the Data Protection Officer;
purposes of processing;
description of categories of data subjects and categories of personal data;
categories of recipients to whom personal data have been or will be disclosed;
envisaged time limits for erasure of different categories of data;
general description of technical and organizational security measures.
Article 13
The Principal of the School and the Kindergarten adopts a decision designating the persons responsible for processing and protecting personal data referred to in Article 11 of this Regulation.
VI. MEASURES FOR PERSONAL DATA PROTECTION
Article 14
To prevent unauthorized access to personal data, hard-copy data are kept in binders in locked cabinets, and data stored on computers are protected by user names and passwords known only to employees responsible for data processing, and for additional security and confidentiality are stored on portable storage media.
Article 15
Persons responsible for processing personal data are required to undertake technical, personnel, and organizational protection measures necessary to protect personal data from accidental loss or destruction, unauthorized access, unauthorized alteration, unauthorized disclosure, and any other misuse.
Article 16
This Regulation is published on the notice board and enters into force on 1 May 2025.
Acting Principal, PRIMARY SCHOOL PRIZMA
Tamara Skala
Principal, KINDERGARTEN MALENI TALENTI
Danijela Vujnović
RECORD OF PROCESSING ACTIVITIES TEMPLATE
Record of Processing Activities of Personal Data
Data Controller:
School of Nature, Science and Mathematics Prizma, Ksaver
Address: Jandrićeva 42, Zagreb
Phone: +385 99 466 9999
Email: skola@prizmazagreb.com
School Representative: Principal Tamara Skala
Data Protection Officer: Tamara Skala
Data Controller:
Kindergarten “Maleni talenti”
Address: Remetski kamenjak 10, Zagreb
Phone: +385 98 823 988
Email: malenitalenti@educarena.com
Kindergarten Representative: Principal Danijela Vujnović
Data Protection Officer: Danijela Vujnović
Purpose of processing (description): processing personal data of children attending the Kindergarten and the School.
Purpose of processing is determined by:
law,
for the purposes of performing the service contracts of the Kindergarten and the School,
by the controller based on the data subject’s consent.
Method of obtaining consent for collection and processing:
written consent given when submitting an application for a child’s enrollment in the School or the Kindergarten.
Category of data subjects and types of data: Children – users of School and Kindergarten services
Types of data:
name and surname
date and place of birth
residential address
nationality/ethnicity
citizenship
Personal Identification Number (OIB)
class/group attended
program attended
name and surname of parents
parents’ residential addresses
parents’ occupations
parents’ contact phone numbers and emails
Categories of recipients to whom personal data have been or will be disclosed:
Founder – natural person Tamara Skala
Envisaged time limits for erasure: 5 years from the date the child is withdrawn from the School or the Kindergarten.
General description of technical and organizational security measures:
Hard-copy data are stored in binders in locked cabinets, while computer data are protected by user names and passwords known to employees responsible for processing; for additional security and confidentiality, data are also stored on portable storage media.
This Decision enters into force on the date of adoption.
Acting Principal, PRIMARY SCHOOL PRIZMA
Tamara Skala
Principal, KINDERGARTEN MALENI TALENTI
Danijela Vujnović