Identity and contact details

GNK Dinamo Zagreb

Maksimirska 128, 10 000 Zagreb, Croatia

Tax ID: 93376857458

Data protection contact

Address: GNK Dinamo Zagreb, Maksimirska 128, 10 000 Zagreb, Croatia (marked "data protection")

Email: [email protected]

Data Protection Officer

Contact: [email protected]

The Officer appointed pursuant to Article 37 of the General Regulation is responsible for monitoring the legality of processing and enabling the exercise of data subject rights.

Types of data processed

We process the following types of personal data:

• Name, surname, gender, date of birth
• Tax ID, email address, home address
• Mobile phone number
• Photographs, videos, audio recordings
• Usernames

Legal bases for processing

We process personal data based on the following legal bases:

• Legal obligation - when regulations require processing
• Contract performance - conclusion and fulfillment of contractual relationship
• Data subject consent - voluntarily given consent
• Legitimate interest - improving products and services, protecting property and persons, preventing fraud, ensuring device and website security

Club membership

Data required for membership registration (name, surname, tax ID, date of birth) are processed in accordance with the Associations Act. Additional data (phone number, email) are collected for communication. Photo for membership card requires your consent.

Ticket purchase and payments

Data is processed for the fulfillment of ticket purchase contracts, with legal basis in contract performance.

Employment

Data on qualifications, work experience and special skills are collected. Legal basis is legitimate interest for evaluating candidates and, possibly, your consent.

Players and coaches

Processed data includes: citizenship, place of birth, photographs, documents (passport/ID card), validity date, qualifications, health status.

Processing purposes include:

• Registration and status of players/coaches
• Regulating legal residence
• Obtaining work permits
• Tournament registrations
• Organization of accommodation and travel
• Insurance

Journalism and accreditation

For security and notification obligation purposes, we request from journalists and representatives of other services: company name, vehicle registration plate, and possibly a photo for accreditation.

Marketing and communication

Email addresses collected via website or surveys may be used to send activity notifications and improve services. Legal basis is legitimate interest. You can unsubscribe by clicking the unsubscribe link. Your address remains on record to prove compliance with your decision.

Prize games

Data is processed for conducting the game and delivering prizes. Legal basis is your consent given upon registration.

Video surveillance

The premises are recorded to prevent disorder at sports events (legal obligation) and to protect property and persons. Legal basis is legitimate interest.

Visitor records

Data from the front of identification documents (name, surname, document number) and time of arrival and person visited are collected electronically or manually. Purpose is record keeping and identification. Legal basis is legitimate interest and legal obligation under the Act on Prevention of Disorder at Sports Events.

Minors

For minors, additional data about the legal representative (name, surname, tax ID, document copy, address, account number) is collected for valid representation.

Data is not disclosed to third parties unless you have authorized us or we must do so to fulfill contractual or legal obligations.

Data recipients may include:

• Tax Administration, Ministry of Finance, banks - for compliance with accounting and tax obligations
• HNS and county association - for registration and status of players/coaches
• FIFA, UEFA, club coaches - for registration and obligations from competition system
• Third parties engaged by GNK Dinamo - suppliers, associates, students, contractors, volunteers
• Logistics companies - for product delivery
• Travel agencies - for ticket issuance
• Insurance agencies - for insurance services
• Tournament/camp organizers - for registrations
• Advertising and marketing agencies - for campaigns and effectiveness analysis
• Technical support - platform providers, servers, database, software
• Legal advisors, auditors, security services - in limited scope
• Competent institutions - only for fulfillment of legal obligations

Data is collected through:

• Telephone
• Website
• Forms and requests
• Applications
• Devices
• Surveillance cameras in business premises
• Directly at headquarters
• From club trustees
• From third parties to whom you have provided data

We retain personal data only as long as necessary for stated purposes:

• Member records - permanently (legally prescribed); others - during membership
• Ticket buyers and payments - 11 years (Accounting Act)
• Visitor records - 90 days
• Contracts - up to 5 years after termination
• Promotional offers, prize games, surveys - during duration
• Data subject requests - during processing + up to 1 year
• Direct marketing (consent) - until consent withdrawal or inactivity
• User inquiries - during processing + up to 3 years
• User accounts - until deletion request

After expiration, data is deleted by removal from storage media or anonymization.

Contact for exercising rights: [email protected]

As a data subject, you have the following rights:

Right of access

You may access your personal data pursuant to the General Regulation. Requests may be refused if manifestly unfounded, excessive or frequent, with possibility of charging reasonable fees.

Right to rectification

You may request correction or supplementation of incorrect or incomplete data.

Right to erasure (right to be forgotten)

You may request erasure when:

• Data is no longer needed for the purpose
• Processing was based on consent which you withdrew
• There is no legal basis for processing
• Processing constitutes disproportionate interference
• Data was unlawfully processed

Right to restriction of processing

Data may be stored but must not be processed or further used. This right exists when:

• You contest the accuracy of data
• Processing is unlawful
• No longer needed but you need them for legal rights
• You objected to processing

Right to data portability

You may request transfer or copying of data to another database. This applies to structured data you provided, based on contract or consent, and processing is carried out by automated means.

Right to withdraw consent

Consent may be withdrawn when processing is based on it, by clear and unambiguous indication. Withdrawal does not affect the lawfulness of processing before withdrawal.

Right to lodge a complaint with supervisory authority

If you believe your data protection right has been violated, you may lodge a complaint with the Personal Data Protection Agency, Martićeva ulica 14, 10 000 Zagreb, www.azop.hr, [email protected]

For contractual obligations

Data necessary for contract performance constitutes a contractual obligation necessary for contract conclusion. If you do not provide data, the contract cannot be concluded.

For marketing activities

Data is provided voluntarily based on consent (newsletter, user account, loyalty program). Lack of consent does not prevent contract conclusion, but benefits related to products/services/promotions are not received.

All technical, personnel and organizational protection measures are taken. Third parties processing data are contractually obligated to comply with regulations.

Security measures include application of most advanced security technology, prevention of unauthorized access and strict compliance with regulations.

Note: It is not possible to completely and absolutely ensure secure data transmission over the Internet. Any transmission is at your own risk.

The General Information is periodically updated. Updates are published on the website, at headquarters and FAN shops. Checking before providing data is recommended.