For the purposes of this Notice, the Data Controller of your Personal Data is Telemach Croatia Ltd. for Telecommunication Services ( “Telemach Croatia”, “we, us”, or “our”) a private limited liability company duly organized and validly existing under the laws of the Republic of Croatia, with registered office at Ulica Josipa Marohnića 1, 10000 Zagreb, Croatia with company ID number 70133616033

You can find further contact details under the “How to contact us” section below.

This Privacy Policy (“Notice”) applies to a prepaid eSIM product eNet2Go („eSIM product“) its related service, website(s) as well as any Mobile Apps, online forms and subscriptions controlled by Telemach Croatia where a link to this Notice is provided (the “Platform” and together, the “Platforms”).

Why is this Notice important?

Telemach Croatia is committed to protecting your Personal Data in accordance with our internal policies and applicable privacy and data protection legislation.

This Notice informs you of our practices with respect to the collection, processing, use and sharing of Personal Data which you provide to us. It also describes your data protection rights.

More information about your rights, and how to exercise them, is set out in the “Your Rights” section below.

What personal data we may collect?

Categories of data	List of data
Customer data	Email address
Contact history	Notes or recordings of your interactions with our contact centers, including calls, live chats, emails, letters, or any other communication records.
Financial data	Financial details required for payment processing and billing
Account information	Phone number (MSISDN), IMSI
Traffic data	Information related to your connectivity, such as data usage etc.
Technical information	Location information, the Internet Protocol (IP) address and MAC address used to connect your computer and/or mobile device to the Internet, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform.
Online browsing behaviour	Please look at our Cookie policy
Credential information	Authentication details used to access traffic information
Preferences	Your consent to data processing if necessary, or any objections to processing
Level of service	Information about the level of service you receive and details of your specific service or product usage

How we may collect your Personal Data and why?

We may collect your Personal Data in the following circumstances:

Legal basis	Nature and purpose of the processing	Categories of personal data
To perform our contractual obligation with you	- under our terms and conditions and terms of use for purchase and use of eSIM product - to provide customer service - to calculate and issue charges for product purchased	Customer data, Account information, Financial data, Traffic data, Technical information, Level of service
For compliance, legal or regulatory purposes	- for prospective responses to the requests of regulatory authorities - in order to comply with legal obligations in accordance with the relevant regulations, including special regulations in the field of electronic communications, among others the retention of data for the purpose of enabling the investigation, detection and prosecution of criminal offenses, in accordance with the law in the field of criminal procedure, and for the purpose of protecting the defense and national security, in accordance with the laws in the field of defense and national security - for the purpose of solving and responding to Customer complaints and requests - for the purpose of communicating relevant information to Customer when it is the legal obligation of Telemach Croatia - to report to the competent authorities an activity that we suspect violates relevant laws or regulations	Customer data, Account information, Financial data, Traffic data, Technical information, Level of service
For our legitimate interests	- to prevent fraud and ensure security of our network	Customer data, Technical information
Based on your consent	- to tailor direct marketing in relation to our products and services, if you consent to such processing	Customer data

Transfer of Personal Data

A. Third Parties

We might transfer your Personal Data where we use service providers to help us process Personal Data for the purposes described in this Notice as data processors. We also might transfer your personal data to regulatory authorities if prescribed by law.

B. Data Controller Intragroup Transfer

Telemach Croatia sits amongst a group of businesses which are governed by a lead entity, United Group BV, with its registered address at Spicalaan 41, 2132 JG Hoofddorp.

From time to time, we may need to share Personal Data collected by United Group amongst the Group together with their Data Processors. Any such transfers of Personal Data will be done in accordance with applicable EU data protection and privacy legislation.

C. Transfers outside the European Economic Area

Non-EEA countries may have Privacy and Data Protection laws that are less protective regarding the processing of your Personal Data than the legislation applicable to your jurisdiction. Where this is the case, our transfers of Personal Data will be regulated by the EU Commission's Standard Contractual Clauses relating to the transfer of Personal Data outside of the European Economic Area (or outside of jurisdictions deemed to provide “adequate” protection for Personal Data to the standards of the European Union.) The jurisdictions to which Personal Data are transferred may be conditional on your nationality or location.

Retention of Personal Data

The Personal Data you have provided us with will be retained for the duration of your relationship with us and, to the extent permitted, after the end of that relationship for as long as necessary to perform compliance, legal or regulatory purposes set out in this policy.

This includes, for example the length of time required to satisfy any legal, regulatory, accounting and reporting requirements, and to process personal information on you in order to establish, exercise or defend legal claims.

Where we process Personal Data in connection with performing a contract, we will store personal information for the periods needed for the purposes for which the information was collected or for which it is to be further processed. And sometimes we will keep it for longer if we are required to do so by law. Otherwise, we delete it.

Where we process Personal Data for marketing purposes, or with your consent, we process the Personal Data until you ask us to stop and for a short period after this (to allow us to implement your requests). We also keep a record of the fact that you have asked us not to send you direct marketing, or to process your data so that we can respect your request in future.

We will delete or dispose of your Personal Data at the end of the relevant retention periods mentioned above.

Your Rights

Under the GDPR and other applicable EU and Privacy and Data Protection legislation, you have rights over your Personal Data. You may for example, be entitled to ask us for a copy of your Personal Data, to correct it, erase or restrict its processing, or to ask us to transfer some of this information to other organisations. These rights may be limited in some situations, for example if fulfilling your request would reveal Personal Data about another person, or where we can demonstrate that we have a legal requirement to process your Personal Data.

To exercise any of these rights, to obtain other information, or if you require further information on your rights or our use of your Personal Data, please contact us at osobni.podaci@telemach.hr

If you have unresolved concerns, you have the right to complain to an EU data protection authority where you live, work or where you believe a breach may have occurred.

Your rights include (subject to legal and regulatory requirements):

A. Right to Access Personal Data

You have the right to request a copy of Personal Data that we hold about you. Before responding to your request, we may ask you to (i) verify your identity and (ii) provide further details so we can better respond to your request.

B. Right to Rectification of Personal Data

If you inform us that your Personal Data is no longer accurate, or it is incomplete, we will rectify or update it. If we’ve shared your Personal Data with others, where possible, we’ll let them know about the rectification or update.

C. Right to Erasure of Personal Data

We will delete your Personal Data in certain circumstances such as where:

- You withdraw your consent for processing the Personal Data (if we rely on your consent for the processing);
- You (exercise your right to) object to the processing of your Personal Data (if we rely on our legitimate interest for the processing);
- The Personal Data is no longer required for the purpose(s) for which it was collected;
- The Personal Data has to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;

We might refuse to satisfy your request for deleting your Personal Data where the processing is necessary to:

- Comply with a legal obligation to which United Group or any of its affiliates are subject, or to perform a task in the public interest or the exercise of official authority vested in United Group or in any of its affiliates as the Controller of the Personal Data;
- For archiving purposes in the public interest, for scientific, historical research purposes; or
- For the establishment, exercise, or defense of legal claims.

Telemach Croatia will inform you of relevant exemptions we rely upon when responding to any deletion request you make.

D. Right to Restriction of Processing of Personal Data

We will restrict the processing of your Personal Data in certain circumstances such as where:

- You have requested to check the accuracy of your Personal Data – for the time necessary to confirm the accuracy of your Personal Data.

- You (exercise your right to) object to the processing of your Personal Data (if we rely on our legitimate interest for the processing).

Where processing has been restricted, Telemach Croatia shall, with the exception of storage, only process such Personal Data on the basis of your consent, or for the establishment, exercise or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest.

E. Right to Withdraw Consent

You have an absolute right to opt-out of direct marketing at any time. If, at any time, you have provided consent to us for processing your Personal Data under the circumstances or purposes described in this policy, and you no longer wish to have your Personal Data processed in this way, you may withdraw your consent by emailing us at osobni.podaci@telemach.hr

F. Right to Portability

You can ask us to provide you with your Personal Data (that you provided to us, or that we collected through your activities on our Platforms) in a structured, commonly used, and machine-readable format to send it to another controller.

G. Right to Object

You can object to the processing of your Personal Data when we use the Data for direct marketing purposes, where Personal Data are processed for scientific or historical research purposes or statistical purposes.

HOW TO CONTACT US

Should you wish to make any comments, complaints, enquiries or if you have any questions relating to this Notice, your rights, our Platforms, our Marketing and Promotion materials or Products or Services we provide, you may contact United Group’s Privacy Office by emailing or writing to:

Postal address
Osobni podaci
Telemach Hrvatska d.o.o.
Josipa Marohnića 1, 10 000 Zagreb, Hrvatska

Email
Email: osobni.podaci@telemach.hr

You may also contact the Data Protection Authority where you live, work, or believe the breach has happened. A list of the European Supervisory Authorities can be found here. If you are in Croatia, the Data Protection Authority will likely be the Croatian Data Protection Agency. You may contact them here.

CHANGES TO THIS NOTICE

This Notice is subject to periodic review to ensure it is in line with applicable legislation. We retain all applicable ownership rights to information we collect. We reserve the right to change, modify, add, or remove provisions of this Notice. Any changes to this Notice will be posted here, and we encourage you to check back from time to time. If the changes are substantial, we will notify the changes to you.

Effective date: 23rd of May 2025