Privacy policy
Personal Data Controller:
Croatian Insurance Bureau
Martićeva 71, 10000 Zagreb
dpo@huo.hr
The Croatian Insurance Bureau (hereinafter referred to as "HUO" or "Bureau") is the national insurance office in the Republic of Croatia, a non-profit legal entity representing insurance companies in legal transactions with third parties.
HUO is a legal entity with public authority as defined by the General Data Protection Regulation (GDPR) and the Act on the Implementation of the General Data Protection Regulation (Official Gazette 42/18).
The Bureau's activities are determined by the Insurance Act (Official Gazette 30/15, 112/18, 63/20, 133/20, 151/22), the Compulsory Traffic Insurance Act (Official Gazette 151/05, 36/09, 75/09, 76/13, 152/14, 155/23), and other regulations.
The duties of HUO as a public authority include:
Duties prescribed by Article 353, Paragraph 1 of the Insurance Act:
- Duties as the national insurance office and other duties set out in international agreements regarding vehicle owners' liability insurance for damages caused to third parties;
- Management of the Guarantee Fund;
- Operations of the Compensation Bureau;
- Operations of the Information Center;
- Insurance statistics;
- Handling complaints from policyholders or injured parties;
- Out-of-court resolution of disputes between policyholders or insurance contract holders, or consumers and insurance companies or insurance service providers, involving decisions on the rights and obligations of legal and natural persons.
Duties prescribed by Article 52 of the Compulsory Traffic Insurance Act:
- Managing the Information Center, including maintaining a prescribed register containing data on: i) License plates; (ii) Types, brands, models, and chassis numbers of vehicles registered in the Republic of Croatia; (iii) Insurance policy numbers for these vehicles; (iv) Other prescribed data.
In exercising its public authority and performing the above-mentioned duties, HUO collects and processes personal data.
1. PURPOSE OF PROCESSING PERSONAL DATA
Below are the personal data processing activities carried out by HUO based on Article 6(1)(e) of the GDPR (processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller). These processing activities fall under HUO’s public authority.
1.1. Information Center Operations
The Information Center operated by HUO is established under the Compulsory Traffic Insurance Act to enable injured parties to claim compensation for damages resulting from traffic accidents involving vehicles.
The Information Center collects and maintains a register containing the following personal data:
- Vehicle registration number, type, brand, model, chassis number, and owner;
- Motor vehicle liability insurance policy number;
- Name, surname, date of birth, personal identification number (OIB), residence, and domicile of the insured, beneficiaries, and policyholders;
- Date of insurance coverage termination or expiry.
This data is regularly provided to the Bureau by insurance companies and the Ministry of the Interior, based on obligations under the Compulsory Traffic Insurance Act.
Data from the Information Center's register is stored for at least 7 years from the vehicle deregistration or policy expiration date. In certain justified cases, data is retained for a longer period to address specific business needs, such as the reactivation of claims or legal cases, which may require information on insurance coverage years later. Considering the interests of injured parties, HUO retains this data permanently.
1.2. Handling of Compensation Claims
To assist in resolving compensation claims filed with HUO and its members (insurance companies), HUO collects information on the claims submitted. These processing activities fall under HUO’s public authority.
HUO also receives information on traffic accidents from the Ministry of the Interior under the Compulsory Traffic Insurance Act.
Documentation collected and processed for these purposes may include, in addition to the data listed in Section 1.1, the following personal data:
- Information on injured parties, participants, and witnesses in traffic accidents;
- Descriptions of damages, injuries, and health conditions;
- Medical records, expert reports, and other health-related data used to assess the severity of the incident's consequences;
- Information on birth, death, marital status, and property ownership;
- Bank account details for compensation payments;
- Identification card or passport number, Green Card number, email address, or phone number of the insured or injured person.
Data for compensation claims is stored for 5 years from the claim resolution date, or 15 years if the case involved legal proceedings.
1.3. Border Motor Vehicle Liability Insurance
In cooperation with its members (insurance companies), HUO arranges mandatory motor vehicle liability insurance policies at road and maritime border crossings into Croatia.
For these purposes, HUO maintains records of issued insurance policies containing the following personal data:
- Vehicle insurance policy number;
- Name, surname, date of birth, personal identification number (OIB), and residence or domicile of the insured or policyholder, if different from the insured.
The record of the issuance of compulsory motor vehicle liability insurance policies at border crossing points shall be kept for 5 years from the expiry of the insurance contract. The processing operations fall within the public authority of the HUO.
1.4. Handling Policyholder Complaints
HUO manages complaints from policyholders and injured parties regarding the conduct of insurance companies.
It also resolves out-of-court disputes between policyholders/consumers and insurance companies, including arbitration, mediation, and insurance ombudsman services.
In such cases, the necessary personal data of policyholders/consumers is collected for handling complaints and disputes. This data is stored for 5 years from the receipt of the complaint.
…
In addition to the personal data processing conducted within the scope of its legal authority, the Office also engages in commercial activities and processes personal data for the following purposes:
1.5. Organization of Professional Conferences, Seminars, and Training
The Croatian Insurance Bureau (HUO) regularly organizes conferences, professional seminars, and training sessions in the field of insurance. For these purposes, data on participants (name, surname, contact details, payment information, certificates of participation) are collected. This data is gathered as part of pre-contractual activities or based on the contractual relationship between the Office and the training participants.
The data of participants who have attended and paid for the conference, seminar, or training are considered accounting documents and are retained for 11 years in accordance with the Accounting Act (NN 85/24).
Based on its legitimate interest, HUO also takes photographs and video recordings of certain events, and all participants are always informed in advance.
1.6. Notifications on News and Other Useful Information (Newsletter)
Participants of professional conferences, seminars, and training, as well as other individuals who have expressed interest in HUO’s activities, regularly receive updates on news and developments in the insurance sector, as well as announcements of future events organized by the Office. For these purposes, contact information, particularly email addresses, are used.
HUO carries out this data processing based on legitimate interest. The data is retained until unsubscribed, which can be done in each newsletter received.
1.7. Recruitment and Selection Process
For the purpose of conducting recruitment processes for vacant positions, HUO collects data on candidates (name and surname, contact information, place of residence, education details, previous work experience, and other information provided in the CV). In this case, the legal basis for processing personal data of candidates is the undertaking of pre-contractual activities (employment contract) at the request of the data subject.
The data collected for these purposes are retained until the recruitment process is concluded, but no longer than 3 months. Open applications received are kept by HUO for up to 12 months or until the candidate withdraws their consent.
2. RECIPIENTS OF PERSONAL DATA
In certain business processes, for example for IT support and accounting, HUO uses the services of reliable partners (processors). Processors, when necessary, process personal data, on behalf of and at the direction of the Office, while ensuring appropriate technical and organizational measures for the protection of personal data.
In the context of official investigations, supervisory procedures, regulatory reporting and other official powers and actions of public authorities, HUO provides personal data to the Ministry of the Interior and the Croatian Financial Supervisory Authority (HANFA), as well as to other authorised public authorities on the basis of an official request, i.e. a legal obligation.
The HUO, as a national insurance office, is a member of the 'Green Card System' of the 47 national offices of the members of the Council of Bureaux, with its seat in Brussels, whose purpose is to facilitate the international traffic of motor vehicles by providing insurance against liability for damage caused to third parties by their use under the conditions laid down in the country visited and guaranteeing to injured persons that they will be compensated in the event of an accident in accordance with the national law of that country.
The HUO shall, upon request, provide the national offices of the Member States of the European Union or of the third Member States of the Green Card System with information on the area of Croatia where the vehicle is normally based and its registration number, if any, and information on the insurance of the vehicle, if required by the Member State in whose territory the vehicle is normally based. The standard contractual clauses shall apply when data are transmitted for those purposes to third countries that are members of the Green Card Scheme. More information on the standard clauses is available at: SCC.
3. RIGHTS OF DATA SUBJECTS
Depending on the legal basis and the processing activities, data subjects may exercise the following rights:
- Right to information and access to their data;
- Right to correct inaccurate or incomplete data;
- Right to request the deletion of data (if no longer legally necessary for processing);
- Right to object to processing based on HUO's legitimate interest;
- Right to withdraw consent for data processing (where applicable).
4. RIGHT TO LODGE A COMPLAINT WITH THE SUPERVISORY AUTHORITY
Data subjects have the right to file a complaint with the supervisory authority:
Agency for the Protection of Personal Data
Selska cesta 136, 10000 Zagreb
azop@azop.hr
5. CONTACT DETAILS OF THE DATA PROTECTION OFFICER
HUO has appointed a Data Protection Officer. Data subjects can send any requests, inquiries, or complaints to the following contact details:
Croatian Insurance Bureau
Martićeva 71, 10000 Zagreb
This Privacy Policy was last updated on September 9, 2024.