Privacy Policy and Personal Data Collection and Usage Statement
Benemir d.o.o. is the publisher of the website and web applications, hereinafter referred to as the Publisher.
The privacy of our visitors and users is extremely important to us. All personal data you provide on our site is securely stored, and we only collect data allowed by the law on personal data protection and the law on electronic communications.
The Publisher is committed to protecting users’ personal data by collecting only necessary basic information about users needed to fulfill our obligations. We inform users about the way collected data is used, regularly provide them with choices about the use of their data, including the option to decide whether or not they want their name removed from the lists used for marketing campaigns. All user data is strictly kept and accessible only to employees who need it to perform their tasks. All employees of the Publisher and business partners are responsible for respecting privacy principles.
Types of Personal Data We Collect via the Website
The Publisher may collect the following personal data of website users via appropriate forms: name, email address, postal address, phone number, date of birth, and gender, when the user visits the website, registers, contacts support, or participates in promotions or surveys. These data will not be collected through channels not listed above, even when available on the internet (email, chat, Facebook, etc.). If data is received through one of the aforementioned channels, the Publisher will not use it for any purpose listed in the next section. The Publisher is not responsible for the security of the above information nor can it guarantee its confidentiality.
In all cases, data collected via the website is necessary to provide optimal customer service. If the user does not provide the requested data, Publisher cannot guarantee that the provided information and services will fully meet the user’s needs.
How We Use Users’ Personal Data
The Publisher processes users’ data for the following purposes:
- Sending commercial notifications via email to inform users about new products, special offers, and news related to the website and the Publisher’s activities.
- These notifications refer to products and services offered by the Publisher as well as any collaborators or partners with whom an agreement has been made to promote to users. Under no circumstances will partners or collaborators have access to users’ personal data. All notifications will be sent exclusively by the Publisher.
Users can cancel the receipt of subscribed services by clicking on the “Subscriptions” section.
Security of Personal Data
The website uses security technologies such as firewalls, access control procedures, and cryptographic mechanisms to prevent unauthorized access to data and guarantee confidentiality. To achieve this, users agree that the Publisher may collect information for access control verification purposes.
The Publisher states that it has taken all necessary technical and organizational measures to ensure the security and integrity of personal data and to prevent its loss, alteration, and/or unauthorized access by third parties.
Does the Publisher Share My Personal Data?
The Publisher explicitly informs and guarantees users that their personal data will not be forwarded to third parties under any circumstances, and that explicit, informed, and clear consent from the user will be required for this.
User Rights Regarding Personal Data Management
The Publisher guarantees users the right to access, correct, delete, or object to the processing of their personal data in accordance with applicable laws. Website users can exercise these rights by submitting a written request along with a copy of their ID to the email address: prodaja@benemir.com.
Privacy Notice for Telephone Callers to Benemir
This notice explains how personal data is processed when you contact a business that uses the tAInica AI voice assistant by telephone. The common text is the same for all tAInica clients. The identity of the controller, the active scope of the service and the contact details for exercising your rights are set out in the Controller Information Card.
1. Controller Information Card
Controller: BENEMIR d. o. o. za proizvodnju, trgovinu i usluge
Trading name: BENEMIR
Registered office and personal identification number (OIB): Ivana Rabljanina 6, 51280 Rab, Croatia, OIB 30551645134
Contact for privacy matters and exercising your rights: Cvetka Erce, info@benemir.com
Human assistance or alternative contact: +385 51 550 183, +385 99 8244 254 or info@benemir.com
Active functions and purposes: Responding to approved business and administrative enquiries, providing information about available products and services, recording messages, receiving order requests, producing call transcripts and summaries, and providing operational notifications in the application or by email. SMS notifications and calendar functions are not included in this service package.
Special categories of personal data: The processing of special categories of personal data is not included in the agreed service, and such data is not deliberately collected. Sensitive content disclosed incidentally is not explored further or included in the structured output, except where necessary to forward the enquiry to an authorised person of the Client.
Applicable condition under Article 9 GDPR, if required: Not applicable.
Additional legal basis for an action requested by you, where Article 6(1)(b) does not apply: For routine business enquiries, messages and the receipt of order requests where Article 6(1)(b) GDPR does not apply: Article 6(1)(f) GDPR, namely the legitimate interest in handling incoming enquiries in an accessible, efficient and reliable manner, supported by a legitimate interests assessment. The AI does not conclude contracts or give final confirmation of orders.
The Controller identified in this Card is responsible for decisions concerning purposes, legal bases, permitted information, active functions, the calendar, recipients and the handling of data subject requests.
2. AI voice assistant and transcription
At the beginning of the call, we will inform you that you are speaking with an AI system and that the conversation is being transcribed for the purpose of handling the call. The AI voice assistant may act only within the scope approved by the Controller.
The transient audio stream is processed in real time to conduct the conversation and generate text. No separate audio recording of the call is stored. The text transcript and a data-minimised call summary are stored for up to 60 days, unless a shorter period, earlier redaction or deletion is required.
The AI is not an emergency service and does not replace professional or human judgement. You may end the call and use the human assistance or alternative contact listed in the Card. If an enquiry is specific to an individual, sensitive, urgent, complex, unclear or outside the approved scope, the AI should not resolve it independently but should refer it to the Controller’s human support channel.
3. Who processes the data
The business identified in the Card is the controller for the content of callers’ communications. It determines why data is processed, which functions are active and which legal basis applies.
ATOM SOLUTIONS, a sole proprietorship providing IT services and consultancy, owned by Toma Šimunić, Ulica Ljudevita Gaja 6, Zaprešić, OIB 57808613233, provides the tAInica service and acts as a processor for call content in accordance with the Controller’s instructions and the Data Processing Agreement (DPA). The tAInica contact for privacy matters is privacy@tainica.hr. To exercise your rights, please first contact the Controller using the details in the Card.
tAInica may act as an independent controller only for its own clearly separate business and administrative records, such as contractual communications, billing, user account security, abuse prevention, support, evidence of service delivery and compliance with legal obligations. This role does not include independently determining the purposes for which the content of your call is processed.
4. What data we may process
Depending on the content of the call and the active functions, the following may be processed:
- Telephone number, date, time and duration of the call, and necessary telecommunications and technical data;
- Your name, contact details and other information you provide;
- The content of your enquiry or message and approved business information related to the enquiry;
- The text transcript and a data-minimised call summary;
- Data concerning the service, appointment, location, selected person or other agreed action;
- Data needed to send an operational SMS or email notification;
- Data relating to service execution, errors, security and reliability;
- Special categories of personal data only if expressly specified in the Card and the DPA, and where an applicable legal basis and a condition under Article 9 GDPR exist.
The AI should not deliberately request data that is unnecessary for the active scope. Unnecessary or sensitive content disclosed incidentally is not explored further or included in the structured output, except to the minimum extent necessary for safe referral to an authorised person of the Controller.
5. Purposes and legal bases
Purpose: Receiving incoming enquiries, providing approved information, recording messages and producing summaries
Typical data: Telephone number, name if provided, time and duration, enquiry content, transcript and summary
Legal basis: Article 6(1)(f) GDPR, namely the Controller’s legitimate interest in receiving and handling enquiries in an accessible, efficient and verifiable manner
Purpose: Booking, changing or cancelling an appointment and performing another action at your request
Typical data: Identity and contact details, selected service, appointment, location and data needed for the action
Legal basis: Article 6(1)(b) GDPR where processing is necessary for a contract with you or for steps taken at your request before entering into a contract; in other cases, the additional legal basis stated in the Card
Purpose: Sending an operational confirmation or notification by SMS or email
Typical data: Contact details, confirmation content and delivery data
Legal basis: The same legal basis as for the enquiry or action that prompted the message
Purpose: Security, abuse prevention, troubleshooting and providing evidence of service operation
Typical data: Technical, security, telecommunications and audit data
Legal basis: Article 6(1)(f) GDPR, namely the legitimate interest in the secure, reliable and verifiable operation of the service
Purpose: Compliance with legal obligations and responding to requests from competent authorities
Typical data: Data necessary for the specific obligation
Legal basis: Article 6(1)(c) GDPR
Purpose: Handling requests, objections and legal claims
Typical data: Identification data, communications and necessary evidence
Legal basis: Article 6(1)(c) or (f) GDPR, depending on the circumstances
If the Controller relies on consent for an additional purpose, this must be clearly and specifically stated when the data is collected. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before its withdrawal.
6. Legitimate interests, anonymisation and anonymous results
The Controller’s legitimate interests include the accessible and efficient receipt of enquiries, business continuity, orderly message management, accuracy checks, security, abuse prevention, resolving technical difficulties and reasonably documenting how enquiries have been handled.
During an active contractual relationship, personal data may also be processed for the purpose of carrying out genuine anonymisation procedures, in accordance with the Contract, the DPA and the approved legitimate interests assessment. Until documented technical checks confirm that identification is no longer reasonably possible, the result remains personal data, and tAInica processes it solely as a processor acting on the Controller’s instructions.
Independent use is permitted only after anonymisation has actually been carried out and verified. Removing names or telephone numbers, replacing identifiers, hashing and pseudonymisation do not, by themselves, constitute anonymisation. Personal and pseudonymised data is neither sold nor used for tAInica’s own training, further training or improvement of AI or ML models. Genuinely anonymous results may be used for statistics, analytics, benchmarking, research, and the development and improvement of the service and other products, only for as long as they remain anonymous.
You may object to processing based on legitimate interests by contacting the Controller using the details in the Card.
7. Recipients, subprocessors and international transfers
Data may be accessed by authorised personnel of the Controller and by providers necessary for the operation of the service: tAInica as processor, and providers of application hosting, databases and authentication, AI processing, transcription, telephone and SMS services, calendars, email, and network and application security.
The current List of Subprocessors and Recipients specifies the legal entities, roles, purposes, data categories, processing locations, function status and applicable transfer mechanisms. Not all optional providers are active for every Controller.
Certain providers may process data outside the European Economic Area. Depending on the specific data flow, an adequacy decision, the EU–US Data Privacy Framework where applicable, standard contractual clauses and supplementary safeguards may apply. You may request information on the applicable mechanism and how to obtain a copy of the safeguards by contacting the Controller.
8. Retention periods
Category: Separate audio recording of the call
Standard period or criterion: Not stored; audio is processed transiently in real time
Category: Text transcript
Standard period or criterion: Up to 60 days, with earlier redaction or deletion where necessary
Category: Data-minimised call summary
Standard period or criterion: Up to 60 days
Category: Content of operational SMS and email notifications in the tAInica system
Standard period or criterion: Up to 60 days; individual delivery providers may apply their own shorter operational retention periods, as stated in the List of Subprocessors
Category: Appointment data in a connected calendar
Standard period or criterion: In accordance with the Controller’s and the connected calendar’s rules, for as long as needed for the appointment, the related service or statutory records
Category: Basic telecommunications, security and technical logs
Standard period or criterion: For as long as necessary for service provision, security, billing, abuse prevention and incident resolution, subject to providers’ retention periods and applicable legal obligations
Category: Evidence relating to a request, objection or legal claim
Standard period or criterion: Until the proceedings have concluded and the applicable limitation or statutory periods have expired
Data may be retained separately for longer only where necessary for compliance with a legal obligation, a security incident, or the establishment, exercise or defence of legal claims.
9. Automated decisions
The standard service is not intended to make automated decisions that produce legal or similarly significant effects concerning an individual. Routine bookings or other administrative actions are carried out according to rules set by the Controller and are considered completed only once the connected system confirms the action.
If the Controller intends to introduce profiling or an automated decision with significant effects, it must carry out a separate legal and risk review and update this notice accordingly before activation.
10. Your rights
Depending on the circumstances and the legal basis, you may request access to your data, rectification, erasure, restriction of processing and data portability, object to processing based on legitimate interests, and withdraw consent where processing is based on consent.
Send your request to the Controller using the contact details in the Card. To protect personal data, the Controller may request reasonable verification of your identity. You have the right to lodge a complaint with the Croatian Personal Data Protection Agency.
11. Whether you must provide data
Making a call is voluntary. Some data, such as your telephone number, the time and duration of the call, and necessary telecommunications and technical data, is generated or transmitted automatically during the call. You provide other data during the conversation.
Without the data needed to handle your enquiry or perform the requested action, we may be unable to answer the enquiry, pass on a message or carry out the action. If you do not wish to use the AI assistant, you may end the call and use the human assistance or alternative contact listed in the Card.
12. Changes to this notice
The Controller must keep the Card accurate and publicly available. tAInica maintains the common text and publishes a new version whenever standard functions, data categories, recipients, transfers, retention periods or other material processing rules change.
A material change relating solely to a particular Controller must be included in its Card or, if the Card cannot accurately cover it, in a separate supplementary notice before the change is activated.