Privacy Policy
I INTRODUCTION
The purpose of adopting the Privacy Policy?
The purpose of the Privacy Policy of the Public Enterprise Railways of the Federation of Bosnia and Herzegovina, a limited liability company Sarajevo (hereinafter referred to as: JP ŽFBiH d.o.o. Sarajevo) is to, in accordance with Article 14 of the Law on the Protection of Personal Data (“Official Gazette of BiH” No. 12/25) (hereinafter referred to as: the Law), provide individuals whose personal data it processes with basic information about such processing, respecting the principle of transparency, based on which principle JP ŽFBiH d.o.o. Sarajevo is obliged to inform data subjects (natural persons whose personal data it processes) about the most important elements of the processing.
These Privacy Policy represent a way of providing information to natural persons about such processing.
2. Principles of personal data processing
JP ŽFBiH d.o.o. Sarajevo processes personal data in compliance with the following principles:
– lawfulness, fairness and transparency in relation to the data subject,
– purpose limitation,
– data minimization,
– accuracy,
– storage limitation,
– integrity and confidentiality,
– reliability principle.
II PRIVACY RULES
3. Data controller information (JP ŽFBiH d.o.o. Sarajevo)
Name of data controller: Public Railway Company of the Federation of Bosnia and Herzegovina, limited liability company Sarajevo
Head office/address of data controller: Musala no. 2, 71000 Sarajevo
Contact details: 033/657-313 (Switchboard), 033/251-120 (Office of the President of the Board-General Manager)
Contact details of the Personal Data Protection Officer: contact phone: 033/477480; 033/477515; e-mail: [email protected].
4. Purpose and legal basis for processing personal data
Personal data is processed by JP ŽFBiH d.o.o. Sarajevo in accordance with Article 8, paragraph (1), items b), c), d), e) and f) of the Law, and on the basis of a legal basis based on positive legal and by-laws, which JP ŽFBiH d.o.o. Sarajevo must comply with in carrying out its core business and other activities, taking into account the public interest, all with the aim of implementing the lawful and fair processing of personal data.
Personal data is processed for the purpose of performing the core business and responsibilities prescribed by legal and by-laws, in particular the Law on Railways of the Federation of Bosnia and Herzegovina, the Law on Safety and Security in Railway Transport, the Law on Labor of the Federation of Bosnia and Herzegovina, the Law on Pension and Disability Insurance of the Federation of Bosnia and Herzegovina, the Law on Financial Operations of the Federation of Bosnia and Herzegovina, the Law on Accounting and Auditing of the Federation of Bosnia and Herzegovina, the Law on Obligations, the Company Statute, the Company’s Rules of Procedure and other applicable regulations.
Personal data is processed by JP ŽFBiH d.o.o. Sarajevo for the following purposes:
employment and exercising rights arising from employment (name and surname, residential address, occupation, personal identification number, bank account information, etc.), which are kept for the duration of the employment relationship, after which they are archived, in accordance with the Company’s internal documents
conclusion of contracts with natural persons – service contracts, lease contracts, etc. (name and surname, name of the legal entity, residential address/headquarters, bank account details if necessary for the purpose of contract implementation, etc.), which are kept for the duration of the contractual relationship, after which they are archived, in accordance with the Company’s internal acts
conclusion of public procurement contracts (name of the legal entity, ID number, VAT number, registered office, name and surname of the responsible person, bank details of the legal entity for the purpose of contract execution and payment to the supplier-legal entity), which are kept for the duration of the public procurement contract, after which they are archived, in accordance with the Company’s internal acts
keeping records of employees for the purpose of acting in accordance with the applicable regulations governing the field of labor relations (name and surname, personal identification number, occupation data, residential address, bank details, etc.), which are kept for the duration of the employment relationship, after which they are archived, in accordance with the Company’s internal acts
for the purpose of protecting persons and property, video surveillance is performed in certain parts of the Company based on the legitimate interest of JP ŽFBiH d.o.o. Sarajevo and based on the Law on Agencies and Internal Services for the Protection of People and Property, and the data is deleted automatically after a certain period (30 days), in accordance with the Company’s internal acts
for the purpose of calculating union membership fees, data on employee membership in unions (employee’s name and surname, place of work, name of union, etc.) is collected, and which is kept while the employee is a member of the union organization, in accordance with the Company’s internal acts and is collected exclusively for the purpose of deducting union membership fees,
other purposes that have a legal basis in legal and by-laws or are related to the fulfillment of obligations in accordance with concluded contracts or the performance of a registered activity, and the data collected for the aforementioned purposes are kept as long as there is a legitimate need for them in order to exercise rights and obligations and as long as it is in the public interest.
5. Storage limitation
JP ŽFBiH d.o.o. Sarajevo processes personal data for the period of time necessary to fulfill the purpose of their processing. After the purpose for which they were collected ceases, personal data is no longer used, but is kept in the archive for the period prescribed by the Law and internal regulations of the company, after which it is deleted or destroyed.
6. Technical and organizational measures for the protection of personal data
JP ŽFBiH d.o.o. Sarajevo processes personal data in a manner that ensures their security, while fulfilling the principles set out in point 1 of these Privacy Rules, while taking certain organizational and technical measures prescribed by the Security Plan of JP ŽFBiH d.o.o. Sarajevo.
All employees of JP ŽFBiH d.o.o. Sarajevo, who process personal data in their work and use and access them for the purpose of achieving lawful purposes, have signed statements on the confidentiality of the personal data they access.
JP ŽFBiH d.o.o. Sarajevo has a legal obligation to, in the event of a personal data breach, notify the Personal Data Protection Agency of BiH without delay, and no later than 72 hours after becoming aware of the breach, in the manner prescribed by Article 35 of the Law.
JP ŽFBiH d.o.o. Sarajevo has a legal obligation to, in the event of a personal data breach, notify the data subject without delay in the manner prescribed by Article 36 of the Law.
JP ŽFBiH d.o.o. Sarajevo takes technical measures to protect electronic databases and prevent unauthorized access to the Company’s servers, including passwords for accessing computers and programs on which employee records are kept, as well as antivirus programs.
The equipment on which personal data is stored is located in a secure environment with limited physical access, and the places where personal data is physically stored are secured with special locked cabinets that only authorized employees have access to (archives, personnel files).
Employees of JP ŽFBiH d.o.o. Sarajevo, according to job needs and job descriptions and tasks, are continuously educated in the field of personal data protection.
7. Rights of data subjects
Right to object – The data subject has the right to object to JP ŽFBiH d.o.o. Sarajevo or the Personal Data Protection Agency in Bosnia and Herzegovina regarding the processing of his/her personal data, in accordance with Article 8, paragraph (1), item e) or f) of the Law.
In the event of an objection, the data controller may not further process the personal data, unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
Right to access personal data – The data subject may request detailed information, in particular information on the purpose of the processing, the type/categories of personal data processed, including access to their personal data, the recipients or categories of recipients, and the envisaged period for which the personal data will be stored. Access to personal data may be restricted only where a special law provides for a restriction due to respect for the rights and freedoms of others)
Right to rectification/amendment of personal data – The data subject has the right to request the rectification or amendment of personal data if their personal data are inaccurate, incomplete or out of date.
The request for rectification of personal data must specify which data are inaccurate, incomplete or out of date and which correction is requested.
Right to erasure – The data subject has the right to have their personal data erased: if their personal data are not necessary in relation to the purposes for which they were collected or processed; if the data subject has withdrawn the consent on which the processing is based (Article 8, paragraph (1) and Article 9 of the Law), and there is no other legal basis for the processing of his/her personal data; if the data subject has objected to the processing of his/her personal data in accordance with Article 23, paragraph (1) of the Law, and there are no other legal grounds for the processing; if the personal data have been unlawfully processed.
Exceptions to the exercise of the right to erasure:
The right to erasure shall not be exercised to the extent that the processing is necessary: for the exercise of the right to freedom of expression and information; for compliance with a legal obligation or for the performance of tasks in the public interest or in the performance of official duties of JP ŽFBiH d.o.o. Sarajevo; for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes, in accordance with Article 56, paragraph (1) of the Law, to the extent that the right to erasure is unlikely to render impossible or seriously jeopardise the achievement of the objectives of that processing; or for the establishment, exercise or defence of legal claims.
Right to restriction of processing – The data subject has the right to restrict the processing of his or her personal data if one of the conditions set out in Article 20, paragraph (1) of the Law is met.
Right to data portability – The data subject has the right to receive the personal data concerning him or her, which he or she has provided to the data controller, in a structured, commonly used and machine-readable format, and has the right to transmit that data to another data controller, without hindrance from the data controller to whom the personal data were provided, under the conditions set out in this Article.
