Data protection
Last updated: 9 September 2026
The General Data Protection Regulation (GDPR) and the Croatian act implementing it give you control over your personal data. This page summarises the rights you have towards us and how to exercise them. What we actually collect is described in the Privacy notice.
1. Your rights
| Right | What it means |
|---|---|
| Access | Confirmation of whether we process your data, and a copy of it. |
| Rectification | Correction of inaccurate data or completion of incomplete data, without delay. |
| Erasure | Deletion once the basis for processing ends or you withdraw consent. |
| Restriction | A temporary halt to processing while an objection or dispute is resolved. |
| Objection | Objection to processing based on legitimate interest. |
| Portability | Your data in a structured, machine-readable format, for transfer to another controller. |
| Withdrawal of consent | At any time, without affecting the lawfulness of processing before withdrawal. |
| Complaint to the supervisory authority | To the Personal Data Protection Agency, if you believe we infringe your rights. |
2. How to exercise them
Send your request to info@energoloyalty.hr or by post to Appliment d.o.o., Utinjska ulica 19, 10000 Zagreb, Croatia. To make sure we give data to the right person, we may ask you to verify your identity.
We reply within 30 days at the latest. If a request is complex or there are several, we may extend that by up to two months and will tell you within the first 30 days. Exercising your rights is free unless requests are manifestly unfounded or excessive.
3. EnergoLoyalty as a processor
This website collects data only through the contact form, and for that we are the controller. The platform at charger.energoloyalty.hr, which venues use to run chargers and their guests' cards, is a different relationship: the venue using the platform is the controller and EnergoLoyalty is the processor. If you are a guest of such a venue, address your request to the venue first — we help it respond.
As a processor we undertake to:
- process data only on the controller's documented instructions
- keep the data confidential
- apply appropriate technical and organisational security measures
- engage sub-processors only under the conditions the GDPR sets
- assist the controller with data-subject requests and breach notifications
- delete or return the data at the end of the contract, as the controller chooses
The data processing agreement for platform customers is available on request.
4. Security measures
The site is served exclusively over an encrypted connection (HTTPS). It keeps no database of visitors — the contents of the contact form are delivered by email and not stored on the site. Access to email and systems is limited to the people who need it for their work.
5. Personal data breaches
If a breach occurs that could put your rights and freedoms at risk, we notify the supervisory authority within 72 hours of becoming aware of it, and you without undue delay where the risk is high. If you suspect a breach, write to info@energoloyalty.hr.
6. Supervisory authority
Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, Croatia, azop.hr.