Your GDPR Rights
A plain-language explanation of your data protection rights and how to exercise them.
- Version:
- 1.0
- Effective from:
- 2026-09-08
- Last updated:
- 2026-09-08
These documents are prepared for the EPIL ZAGREB business model. Parts marked for legal review need confirmation by a Croatian lawyer or data-protection professional.
Overview
Under the General Data Protection Regulation (GDPR) and Croatian data protection law, you have a number of rights in relation to the personal data we hold about you. These are summarised below.
Right of access
You may ask us to confirm whether we process your personal data, and to receive a copy of it together with information about the processing.
Right to rectification
You may ask us to correct inaccurate personal data, or complete incomplete data.
Right to erasure
You may ask us to delete your personal data where, for example, it is no longer necessary for the purpose it was collected for, or you withdraw consent and no other legal basis applies. This right is not absolute: we may need to retain certain data (for example accounting records, or documentation photographs where a legitimate retention or evidentiary ground applies) even after an erasure request.
Right to restriction of processing
You may ask us to limit how we use your data in certain situations, for example while a dispute about its accuracy is being resolved.
Right to data portability
Where processing is based on consent or a contract and is carried out by automated means, you may ask to receive your data in a structured, commonly used, machine-readable format, or ask us to transmit it to another controller where technically feasible.
Right to object
You may object to processing based on our legitimate interest, and to any use of your data for direct marketing at any time, without needing to give a reason.
Right to withdraw consent
Where processing is based on your consent (for example health questionnaire data, documentation or marketing photographs, or marketing communications), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and does not affect data processed under a different legal basis.
Right to information
You have the right to be informed, in a clear and accessible way, about how and why your data is processed — which this policy and our other legal documents aim to provide.
Right to lodge a complaint
You may lodge a complaint with Agencija za zaštitu osobnih podataka (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr at any time if you believe your data protection rights have been infringed.
How to exercise your rights
You can submit a request from the Privacy / GDPR requests section of your client account, or by emailing epilzagreb@gmail.com. To protect your data, we may need to verify your identity before acting on a request.
Response time
We respond to requests without undue delay and in any case within one month of receipt. This period may be extended by a further two months for complex or numerous requests, in which case we will inform you of the extension and the reasons for it.
Fees
Exercising your rights is free of charge. We may charge a reasonable administrative fee, or decline to act, only where a request is manifestly unfounded or excessive, in particular because of its repetitive character.
Limits
Some rights may be limited where the law requires us to retain data (for example for tax or accounting purposes) or where retention is necessary to establish, exercise or defend legal claims.