We care about the protection of your personal data!
This notice serves to inform data subjects – natural persons whose personal data is processed by the Data Controller, with the aim of providing them with information and explaining how, why and when personal data is processed.
The Data Controller of your personal data is H-ABDUCO d.o.o., Radnička cesta 41, Zagreb (Grad Zagreb), OIB: 13667298928 (hereinafter referred to as: „H-ABDUCO“ or „Data Controller“), and this notice contains information about the processing of your personal data and your rights in relation to its processing.
Please read the Notice carefully to understand why we collect your personal data and how it will be used.
2 Contact details of the Data Protection Officer and the Data Controller
4 How do we use your personal data?
5 With whom does H-ABDUCO process your personal data as a joint controller?
6 Sources of your personal data
7 Who are the recipients of your personal data?
8 How long do we keep your personal data?
9 What are your rights regarding the processing of your personal data?
10 Changes to the Personal Data Processing Notice
Data Controller means a natural or legal person, public authority, agency or other body which alone or jointly with others determines the purposes and means of the processing of personal data.
A data subject is a person whose personal data are processed by a Data Controller. For example, debtors or other natural persons (e.g. co-debtors, guarantors, pledgors, etc.), third parties who settle debts on behalf of and for the account of the debtor.
Data subjects can ne:
Personal data means any information relating to an identified or identifiable natural person (for example: name, surname, OIB, address, contact information, age, gender, place of residence, account information, debt information, picture, voice, etc.).
The General Data Protection Regulation refers to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
The Act on the Manner, Conditions and Procedure of Servicing and Purchase and Sale of Receivables means the Act on the Manner, Conditions and Procedure of Servicing and Purchase and Sale of Receivables, NN 155/23, which has been in force in the Republic of Croatia from 30 December 2023.
The Data Protection Officer is a person appointed to ensure the Data Controller’s compliance with personal data protection regulations, acts as a contact point for data subjects and provides support in exercising their rights.
The processing of your personal data is lawful only if it is based on one of the following legal grounds:
If you have any questions regarding the processing of your personal data or would like to exercise any of your rights, please feel free to contact our Data Protection Officer at the following e-mail address: zastita-osobnih-podataka@habduco.hr or at our address Radnička cesta 41, Zagreb (City of Zagreb).
Regarding complaints or other questions not related to the protection of personal data, you can contact H-abduco at the e-mail address: centar@habduco.hr or at Radnička cesta 41, Zagreb (City of Zagreb).
H-abduco processes your personal data when it is necessary for the performance of services, business needs or when it is necessary for the realization of your rights and requests.
When you visit the website https://habduco.hr/ H-abduco will process your IP address, which is considered personal data. You can read more about the processing of your personal data in relation to your visit to this website and cookies by clicking on Cookie Policy.
When you send us a request or wish to exercise one of your rights, we will process your name and surname, the contact information through which the request was made (for example, e-mail address, telephone number, your address of residence/domicile), the content of your request and the necessary data to identify you as the applicant of the request or inquiry or other type of complaint. H-ABDUCO will process the aforementioned personal data in order to be able to respond to your request and to prove that it has been answered. The processing of the aforementioned categories of data is based on H-ABDUCO’s legal obligation to respond to such a request, while the storage of the request may be based, in addition to the legal obligation, on the established legitimate interest of H-ABDUCO.
When we collect your data from other sources, we collect it from sources that are publicly available or provided by third parties, and in such cases we also take into account your rights. Here are some of these situations:
H-ABDUCO bases the aforementioned processing of personal data on established legitimate interest.
When we use publications and databases that are publicly available or based on a contractual relationship (external sources) to ensure that the data we process about you is constantly updated or to assess your ability to repay. By external sources we mean: public institutions and government bodies, public registers, electronic databases (e.g. FINA), information available on social media and on the Internet. H-ABDUCO bases the aforementioned processing of personal data on applicable regulations or on established legitimate interests.
When H-ABDUCO carries out its activities in the status of a buyer of receivables/buyer of non-performing loans. In the aforementioned case, H-ABDUCO will process your name and surname, date of birth, citizenship, personal identification number (OIB), place of birth, place of residence, domicile, contact information such as: postal address, telephone number, e-mail, information about your financial and/or professional status such as: employment/profession, nature of sole proprietorship (e.g. tradeship), name of employer, income, type of income, sources of income, bank account, information about real estate and other assets of yours, information about existing debt (e.g. type of debt, amount of debt, interest, currency, costs), information related to the collection of receivables (e.g. repayment plan, costs, debt balance), signature, information about other participants in the legal transaction (e.g. guarantors/heirs/spouses) on the basis of which there is a creditor’s claim, information about administrative or judicial proceedings in which you are a party to the extent that they are related to the receivables in the portfolio and/or may affect the collection of receivables (e.g. foreclosure proceedings, personal bankruptcy proceedings of consumers and other court proceedings initiated to protect legal claims/interests of creditors in court, etc.); information that is considered evidence of any interaction between you and H-ABDUCO through written and/or oral communication. In addition to the above, we also process internal identification data related to case management and the status of claims (Client ID, Group ID, Collateral ID, REO ID) and audio recordings of telephone communication of the call center (customer support) to the extent regulated by applicable regulations (if we have contacted you and/or you as the data subject have contacted us). When the conversation is recorded, we will always inform you as the data subject about the above.
H-ABDUCO bases the aforementioned processing of personal data on a contractual relationship (e.g., pursuant to a contract after H-ABDUCO became the new creditor through the cession), a legal obligation or an established legitimate interest, i.e. the processing of personal data is based on legal regulations that oblige the controller to process personal data (for example; regulations governing the storage of accounting data; data processing as part of the execution of obligations under regulations adopted to prevent money laundering and terrorist financing; tax or accounting legislation, instructions from regulatory authorities or other state and public bodies).
When, in accordance with the Act on the Manner, Conditions and Procedure of Servicing and Purchase and Sale of Receivables, H-ABDUCO carries out its receivables collection activity (purchaser of non-performing loans) and contracts service with a receivables/loan servicing service provider forwards your data to the servicing service provider who, within the scope of its activities, in its own name or on behalf of and for the account of H-ABDUCO, exercises the rights and performs the obligations that belong to H-ABDUCO as a creditor (purchaser of non-performing receivables) on the basis of special so-called non-performing loan agreements under which it provides one or more loan servicing services. The aforementioned processing of personal data is based on legal regulations that oblige H-ABDUCO and the other contracting party to process personal data, and the data is processed as in the previous point
When H-ABDUCO fulfills its legal obligations in accordance with legal regulations on the prevention of money laundering and financing of terrorism, data such as your name and surname, place of residence, date of birth, OIB and identification document number, citizenship and other data that must be collected in accordance with the aforementioned legal regulations will be processed. H-ABDUCO bases the aforementioned processing of personal data on a legal obligation, i.e. the processing of personal data is based on legal regulations that oblige the controller to process personal data. In relation to this processing, tools are also used that facilitate the prescribed obligations, and in relation to which legitimate interest is applied as a legal basis, and they are used for the purpose of more efficient business operations and enabling more accurate or precise assessments.
When, in accordance with internal procedures, H-ABDUCO, together with its affiliated companies, and for the purpose of facilitating assessment and decision-making regarding you as a data subject or debtor, processes your debt data, including name, surname, type of debtor, industry in which the debtor operates, legal status of the debtor, data about real estate (address, photos, etc.). Personal data may also be processed by exchanging reports containing data on payments and collateral, all for the purpose of controlling business processes, financial analysis, reporting and monitoring business efficiency. H-ABDUCO bases the aforementioned processing of personal data on the established legitimate interest.
In addition to all of the above, it is important to note that special categories of data are processed as an exception. Namely, in practice it may happen that the debtor voluntarily submits data that are considered special categories in order to “justify” the requested settlement or “discount”. Such documentation is not stored in the system, it is destroyed. Along with the destruction, the person who submitted the data is informed not to do so again.
It is also possible that special categories of data are also contained in the court file, either because they were submitted by the debtor himself or through a lawyer. You should know that the data in the court file will only be deleted after finality (res judicata). During the proceedings, since it is a court file, documentation may not be destroyed. Exceptionally, the judgment is not deleted. Therefore, if it contains data that can be considered special categories (for example, it was stated by the judge in the reasoning), we will have to keep the judgment as a basis for record keeping, and for 11 years from the date of finality (res judicata).
The legal basis in relation to the processing of special categories of data is related to the fact that the processing is necessary for the establishment, exercise or defense of legal claims or whenever courts are acting in a judicial capacity.
Apart from the aforementioned cases, special categories of data can be processed in cases where the Act on Prevention of Money Laundering and Terrorist Financing is applied, which regulates the measures, actions and procedures that must be taken to prevent and detect money laundering and terrorist financing.
Please pay attention to the mandatory scope of data we are asking you for, because if you do not provide the requested information that is determined as mandatory in order to carry out the requested or expected activity for you, unfortunately, you will not be allowed to participate in it; without the requested data, the activity will not be technically feasible.
In the event that your personal data is processed for purposes not previously stated in this notice, you will be informed in a timely manner. In such situations, we will provide you with all relevant information about the new purposes of processing, the legal basis and your rights related to such processing.
Note regarding special categories of data:
We ask you once again to be careful when submitting medical documentation that you, as a data subject, submit to us through an attorney or otherwise attach to the court file yourself. We are not allowed to destroy such documentation if it is part of the court file and in that case one of the recipients is the court to which you submitted it.
Processing of personal data means any operation or set of operations performed on personal data or sets of personal data, including, for example, viewing, sharing, storage, analysis, modification and access.
We use tools that are not fully automated (human intervention is required) to determine/perform an evaluation/estimation of the collection of the claim, but also to collect the claim. Such evaluation is based on data provided to us directly by you or by a previous creditor, as well as on information obtained from public sources (Internet/public databases/publications and official (public) information issued by state bodies/official databases on entities and persons subject to international sanctions/public registers). Thanks to this data, we can conclude on the optimal method of repayment/settlement of the claim for both parties, in particular whether it is necessary to initiate enforcement proceedings, as well as to assess further collection proceedings.
If we are unable to contact you, in order to comply with the principle of data accuracy, we will do our best to update your personal data based on information obtained from official sources (e.g. court registers, press releases and official information issued by government authorities) or from public sources (Internet/social networks/public databases/public registers).
We use data about your assets securing claims, all for the purpose of collecting claims.
We also use your data to conduct internal statistical analysis and reporting in order to assess the efficiency and improve the methodology for collecting claims.
We process, analyze and respond to your complaints, requests to exercise your rights under the GDPR and all other requests you contact us with.
When you contact us as an interested party and leave your telephone number and/or email address, we use them to respond to your inquiry with the possibility for you to specify the desired method of communication.
We inform you about the status of your debt (while we process your personal data), the status of legal proceedings that are in progress and that are related to your debt, as well as all data and information that you are interested in regarding the debt collection process.
In addition to all of the above, in situations in which we are obliged to comply with the Act on Prevention of Money Laundering and Terrorist Financing, we also process data for the purpose of in-depth analysis and assessment through a system that allows us to conduct in-depth analysis, especially in the area of political or other public exposure.
Is your data protected?
H-ABDUCO believes that the security of your personal data is very important, and in this regard, we ensure and conduct checks on organizational and technical security measures designed to protect data from unauthorized access, modification, disclosure or destruction.
All service providers with whom H-ABDUCO has concluded contracts and who are considered data processors are subject to regular checks and audits.
In accordance with Article 26 of the General Data Protection Regulation, H-ABDUCO, in certain processing cases, together with another data controller, jointly determines the purposes and means of data processing and determines in a transparent manner its responsibilities and compliance with the obligations under the General Data Protection Regulation, in particular with regard to the exercise of your rights as a data subject and its obligations regarding the provision of information under Articles 13 and 14 of the General Data Protection Regulation.
H-ABDUCO jointly processes your personal data with the following affiliated companies:
The exchange of data between the aforementioned companies is related to the purposes of controlling established business processes, business efficiency, financial evaluations of business decisions and processes, process analysis, and for reporting related to the billing procedure and other business processes.
In cases where, in accordance with the Act on the Manner, Conditions and Procedure of Servicing and Purchase and Sale of Receivables, H-ABDUCO carries out its receivables collection activity and contracts a service with a receivables/credit servicing service provider, H-ABDUCO processes your personal data in the role of a joint data controller with the company:
Read more about the processing of your data by VERALTIS ASSET MANAGEMENT d.o.o. here.
Each of the aforementioned Joint Controllers separately and independently implements all necessary organizational and technical measures, including information security and protection systems, to ensure the security of your personal data and their protection against any accidental or unlawful destruction, loss, alteration, unauthorized disclosure and any other form of unlawful processing. The measures thus implemented guarantee a level of security appropriate to the risks of the type and nature of the data processed, using appropriate technologies to enhance privacy and confidentiality, all in accordance with applicable regulations.
When purchasing receivables, H-ABDUCO receives your personal data from your previous creditor (e.g. a bank). You will be informed of this by means of a special notification within the period specified in accordance with applicable regulations.
The source of your personal data may also be public sources such as public institutions and state bodies, public registers, electronic databases (e.g. Fina) and information available on the Internet.
In the ordinary course of business, H-ABDUCO may transfer your information to other individuals or legal entities in order to achieve the purposes for which we process personal data that you have provided to us directly or that we have received from other sources. H-ABDUCO may also use or disclose personal data when there is a legal obligation to do so or when permitted by law.
Here are examples of persons with whom H-ABDUCO may share your personal data or to whom it may make it available under strictly controlled and prescribed conditions:
H-ABDUCO will process your personal data for the time necessary for the purposes of the processing, which may vary depending on the purpose of the data being processed. Therefore, H-ABDUCO will process your data during the collection/service of receivables and store them for a period of five years from the moment the debt is transferred and/or after the full settlement of the receivables, unless otherwise prescribed for by applicable law.
In the event of settlement of claims or after the completion of enforcement proceedings and/or any other court proceedings, personal data will be retained for at least 10 years unless otherwise prescribed by applicable law.
It is important to note that in the case of data processing for accounting purposes, your data will be stored for at least 11 years in accordance with the legal regulations on accounting. The above tasks are performed on behalf of H-ABDUCO by another legal entity with which the data is shared. The legal entity that provides accounting software services to H-ABDUCO or a company affiliated with it and that performs the above business activities is also considered to be the data processor and data recipient.
When data processing occurs for the purpose of implementing the Act on Prevention of Money Laundering and Terrorist Financing, personal data collected and otherwise processed during this process are kept for 10 years after the termination of the business relationship.
You can find out more information about data retention periods by contacting our Data Protection Officer at the e-mail address: zastita-osobnih-podataka@habduco.hr.
You can exercise the following rights at any time, within the limits provided for by applicable legislation regarding the protection of personal data:
Right of access to personal data – you may request access to your personal data at any time to be informed whether H-ABDUCO is processing personal data relating to you. If such personal data is being processed, you may request the following: access to information on the categories of personal data concerned, the purpose of the processing, the envisaged period for which the personal data will be stored if possible or the criteria used to determine that period, if the personal data are not collected from you, information on their source, and information on the existence of automated decision-making. H-ABDUCO may provide you with a copy of the personal data being processed. For any additional copies you request, H-ABDUCO may charge a reasonable fee based on administrative costs.
Right to rectification – you can ask us to correct your personal data at any time so that your data is up-to-date and accurate at all times.
Right to erasure of personal data (“right to be forgotten”) – you may request the erasure of your personal data that we process and that we take all necessary steps to do so if: (i) the purpose for which they were collected no longer exists or has been fulfilled; (ii) you withdraw your consent, and the processing was carried out on the basis of that consent and there is no other legal basis for the continued processing; (iii) you have objected to the processing of the data and there are no other legitimate reasons for the further processing; (iv) your personal data was processed without a valid legal basis. We also inform you that the personal data for which you have exercised the right to erasure may be further processed in the following situations: (i) for compliance with legal obligations governing the processing; (ii) as well as for the exercise/defense of legal claims of H-ABDUCO in legal proceedings.
Right to restriction of processing – you have the right to request restriction of processing in the following situations: (i) you have contested the accuracy of your personal data that we process and, for the period necessary to verify their accuracy, your data will be restricted in processing; (ii) the processing of your personal data was not legitimate and you have opposed the erasure of the data and instead requested restricted processing of the data; (iii) you have opposed the processing of your personal data and, while verifying the validity of the legal basis, the processing of your data will be restricted; (iv) although the data retention period has expired, you have explicitly requested that we retain your data in order to exercise your rights in court. In the event of restricted processing, your personal data may be processed by storing. Other personal data processing activities will only be possible for: (i) exercising rights/defending legal claims of H-ABDUCO in court; (ii) protecting the rights of other natural or legal persons; (iii) based on your explicit consent or (iv) protecting the public interest. If your request for restriction of data processing is granted, we will inform you of this before lifting the restriction on the processing of personal data.
Right to data portability – in the case of your personal data that we process automatically, based on your explicit consent or based on the performance of a contract between you and H-ABDUCO, you can request that the data be structured in a machine-readable format that you can send to another data controller or you can ask us to send the data directly to that data controller (to the extent that this is technically possible for H-ABDUCO).
Right to object to the processing of personal data – for reasons relating to your particular situation, you may object to the processing of your personal data based on H-ABDUCO’s legitimate interest and/or data processing carried out in the public interest, including profiling based on these provisions.
Right to withdraw consent – in cases where processing is based on your consent, consent may be withdrawn at any time and the processing will cease. Withdrawal of your consent will only have effects for future processing. Processing carried out before the withdrawal of consent remains valid.
All of the above rights can be exercised by submitting a written request to the contact details below, and we will respond to you within one month or, if the request requires a more complex analysis, this deadline may be extended for a further 2 months, in which case we will inform you of the reasons for the extension.
If you submit your request electronically, we will also provide you with the information in electronic form, if possible, or through another format or channel requested by you.
H-ABDUCO may request additional information to verify your identity before we share information about your personal data with you or act in connection with the exercise of your rights listed above.
We perform identification by asking for your name, surname and OIB, all under the circumstances that your email address has been previously verified as correct (if you submit the request in this way) or another address if you have submitted the request in writing. In case of suspicion that the request is not submitted by the data subject, we may ask you for additional identifiers for security reasons. We want to prevent your data from being accessible to persons who are not authorized to access it.
We also inform you that in justified cases the law allows us to refuse to act on your requests or to charge a fee, for example where your requests are excessive by their repetitive or manifestly unfounded character. In such a case, we will provide you with a written explanation of such action.
If you believe that your personal data is being processed unfoundedly and that the processing of your personal data is not in accordance with legal regulations, you can also file a complaint directly with the supervisory authority, i.e. the Croatian Personal Data Protection Agency.
We regularly update the Personal Data Processing Notice so that it is accurate and up-to-date, and we reserve the right to change its content if we deem it necessary. You will be informed about all changes and additions in a timely manner through our website in accordance with the principle of transparency or in another way if, as the data controller, we estimate that notification through other channels is more transparent and accessible in relation to the data subjects.
Updated: 30.4.2025.
The latest valid and published version enters into force on 1.5.2025.
REQUEST FOR EXERCISING RIGHTS IN RELATION TO THE PROCESSING OF PERSONAL DATA (General Data Protection Regulation (EU) 2016/679)