Privacy Policy

Overseas Trade Co LTD d.o.o.,

Effective from: May 2018

Last modified: 07 July 2026.

1. Introduction

This Privacy Policy explains how Overseas Trade Co LTD d.o.o. collects, uses, stores and protects the personal data of users of its services, website visitors and persons who communicate with us.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679, the Act on the Implementation of the General Data Protection Regulation, regulations governing postal and delivery services, regulations on electronic communications and other regulations applicable to our business.

This Policy is primarily intended for natural persons: senders, recipients of shipments, persons authorized to collect shipments, users of parcel lockers and OEX parcel shops, website visitors, customer service users, persons participating in surveys, promotions or prize activities, and business contacts of our clients and partners.

The processing of personal data of employees, job candidates, permanent external associates, couriers, owners of partner retail locations and other special categories of persons may be governed by separate notices on the processing of personal data.

2. Controller and contact

When we determine the purposes and means of processing personal data ourselves, we act as the controller. When we process personal data exclusively or partly according to the documented instructions of our business user, we may act as joint controllers or processors. The roles are explained in more detail in point 7 of this Policy.

Controller	Overseas Trade Co LTD d.o.o., Hrvatski Leskovac, Zastavnice 38 a, OIB: 19407280555
Telephone and fax	Telephone: +385 1 3454 555; fax: +385 1 6175 410
Privacy e-mail	privacy@overseas.hr
Data Protection Officer	Telephone: +385 1 7898 936; e-mail: povjerenik@overseas.hr

3. How we collect personal data

We collect personal data in several ways, depending on which service you use and in what capacity you act.

• Directly from you, for example when you order a service, hand over a shipment, request redirection, collect a shipment, pay for a service, contact customer service, complete a form, submit a complaint or subscribe to the newsletter.

• From the sender, business user or another person who provides us with recipient data for the purpose of delivering a shipment.

• From our delivery, logistics, payment, IT and business partners, when this is necessary for performing the service, resolving a complaint, charging, security or fulfilling legal obligations.

• Automatically, when using our websites, applications, Track&Trace functionality, cookie settings and other digital channels.

• Through telephone conversations if the call is recorded, with prior notice, and through video surveillance in areas marked as being under video surveillance.

If we receive recipient data from the sender or a business user, we use such data for receiving, sorting, transport, tracking, delivery, proving delivery, resolving complaints and fulfilling other obligations related to the shipment. In such cases, the recipient may be informed about the data processing through a delivery notification, SMS, e-mail, a notice on the website, this Policy or another appropriate channel.

4. Which personal data we process

We process only the data that is necessary for a specific purpose. Depending on the circumstances, we may process the following categories of data:

• identification and contact data: first and last name, address, telephone number, e-mail address, name of a trade or business entity if it relates to a natural person, business function and contact data of a business person;

• data required for special identification: OIB, identity card or passport number, only when this is necessary for a special service, legal obligation, identity verification, delivery exclusively to a specific person, collection of payment, fraud prevention or acting on the instruction of a business user;

• shipment and delivery data: shipment number, barcode, pick-up and delivery address, selected service, delivery instructions, shipment status, tracking history, delivery attempts, time and place of delivery, signature or other proof of collection, data on a parcel locker or OEX parcel shop;

• data on the physical properties of the shipment: weight, dimensions, volume, packaging, labels, photographs of the shipment if necessary to prove the condition of the shipment, for a complaint or for security;

• financial and payment data: service price, cash-on-delivery amount, IBAN or account number for payment of cash-on-delivery amounts, invoice and billing data, payment status, transaction reference, masked card number or token if provided by the payment service provider;

• data for international delivery and customs clearance: description of contents when required, value of goods, destination country, customs documentation and data required by customs, security or other competent authorities;

• communication data: content of inquiries, objections or complaints, e-mail correspondence, contact forms, customer service notes, call records and voice recordings if calls are recorded;

• web and technical data: IP address, device and browser identifiers, browser type, operating system, pages visited, visit time, URL from which you arrive, cookie settings and similar identifiers;

• social network data: username or profile, publicly available information, comments, messages, reactions and data available through your interaction with our profiles;

• video surveillance recordings: recordings of persons entering areas under video surveillance, with clear marking of the areas under video surveillance.

We do not request special categories of personal data, such as health data, biometric data for unique identification, political opinions, religious beliefs or data on trade union membership, unless this would be necessary due to a legal obligation, legal claim or circumstances that you yourself present in communication with us.

5. Purposes of processing and legal bases

We process personal data only where there is an appropriate legal basis for doing so. The most common legal bases are the performance of a contract or taking steps prior to entering into a contract, compliance with a legal obligation, legitimate interest, consent and the protection of legal claims. When we rely on legitimate interest, we ensure that the processing is proportionate and that your rights and freedoms do not prevail.

5.1. Receipt, transport, tracking and delivery of shipments

We process data of senders, recipients and persons authorized to collect shipments for the purpose of receiving, sorting, routing, transporting, tracking and delivering shipments. This includes preparing and processing delivery documentation, managing shipment status, notifying about delivery, proving handover and resolving usual questions related to delivery.

The legal basis is the performance of a contract when you are the sender or direct user of the service. When we receive recipient data from the sender or a business user, the processing is generally based on the legitimate interest of Overseas, the sender and the recipient that the shipment is duly delivered, that delivery can be tracked and proven, and that complaints or objections can be resolved. If a special regulation requires the processing of certain data, the legal basis is a legal obligation.

5.2. Parcel lockers and OEX parcel shops

When you use a parcel locker, OEX parcel shop or another alternative location for collecting or handing over a shipment, we process the data required to select the location, send instructions or a collection code, record the deposit and collection of the shipment and prove delivery. Such data is processed on the basis of the contract, legitimate interest in orderly and secure delivery and, where applicable, a legal obligation.

5.3. Track&Trace and shipment status notifications

We process data on the shipment number, status, time and location of the delivery event, contact data and technical data for the purpose of enabling shipment tracking, sending notifications by SMS, e-mail or another channel, reducing failed deliveries and providing customer support. The legal basis is the performance of a contract when tracking is part of the service and legitimate interest in transparency, delivery efficiency and customer support.

5.4. Payments, cash on delivery and card transactions

We process data required for charging the service, paying cash-on-delivery amounts, issuing invoices, recording payments and preventing misuse on the basis of the contract, legal obligations and legitimate interest in proper charging and protection against fraud.

If payment is made by card or another digital payment method, payment processing may be carried out by authorized payment service providers, banks, card companies and anti-fraud systems. In accordance with card business security rules, the card security code (CVV/CVC) may not be stored after transaction authorization. Overseas may receive or store only the data necessary to confirm the transaction, for accounting, complaints and proof of payment, for example the amount, transaction status, transaction reference, payment date and masked card number or token.

5.5. Customer service, inquiries, objections and complaints

When you contact us, we process the data you provide to us and the data needed to check the shipment, the identity of the authorized person, delivery status, complaint, damage, lost or damaged shipment. The legal basis may be the performance of a contract, legitimate interest in providing support, establishing facts and protecting legal claims, a legal obligation or consent if necessary for a specific form of communication.

Telephone conversations may be recorded for quality control, proof of communication, training and dispute resolution, with prior notice. If you do not wish to communicate through a recorded channel, you may use another available communication channel, for example e-mail, a written request or a web form, where applicable.

5.6. Satisfaction surveys and service improvement

We may use contact data and data on the service used in order to ask you for your opinion on service quality, delivery rating or suggestions for improvement. Processing is based on legitimate interest in improving the service, unless consent is required according to the circumstances. You may object to such processing at any time.

5.7. Marketing, newsletter and promotional activities

We process data for direct marketing, newsletters, promotional messages, prize activities, surveys with a marketing purpose and personalized advertising activities only where there is an appropriate legal basis for doing so. As a rule, we rely on your consent, except where direct marketing is permitted on the basis of applicable regulations and our legitimate interest, with a clear right to object and unsubscribe.

You may withdraw consent at any time via the unsubscribe link, profile settings if they exist, or by sending a request to privacy@overseas.hr or povjerenik@overseas.hr. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

5.8. Websites, applications and cookies

When you use websites and digital services on the overseas.hr domain, we may process technical data about your device, browser, visits, actions on the website, cookie settings and other internet identifiers. We use this data for the operation of the website, security, storing your settings, measuring traffic, analytics, advertising and improving digital services, depending on the category of cookies and your settings.

Technically necessary cookies are used without consent because they are required for the operation of the website or the service you requested. Analytics, marketing and social network cookies, pixels and similar technologies are used only with your consent, unless an applicable regulation expressly permits otherwise for a specific technology. You can change your settings at any time through the cookie settings available on the website.

5.9. Social networks

If you communicate with us through our profiles on social networks, we process the data you make available to us, for example username, messages, comments, reactions and other data visible through the platform. Social network platforms may independently process your data according to their own privacy policies.

5.10. Video surveillance

We use video surveillance in marked areas for the protection of persons and property, security of business premises, prevention and clarification of incidents and protection of legal claims. The legal basis is legitimate interest, and when recordings are used or stored on the basis of a special request from a competent authority or regulation, the legal basis may also be a legal obligation.

Only authorized persons have access to recordings. Recordings may be provided to competent authorities, courts, insurers, lawyers or other persons only where there is an appropriate legal basis for doing so. Areas under video surveillance are marked at the entrance to the recording perimeter.

5.11. Business users, partners and suppliers

We process data of contact persons of business users, partners, suppliers, service providers and other business associates for the purpose of concluding and performing contracts, communication, ordering and providing services, managing relationships with business partners, invoicing, collection and fulfilling legal obligations. The legal basis is most often legitimate interest in business communication and performance of a contract with a legal person, and in certain cases a contract, legal obligation or consent.

5.12. Legal obligations, security and protection of legal claims

We also process personal data when this is necessary for fulfilling accounting, tax, postal, customs, security and other legal obligations, acting on requests from competent authorities, keeping records, audits, internal controls, preventing fraud, protecting information systems, proving compliance and establishing, exercising or defending legal claims.

6. Recipients of personal data

We do not sell or rent personal data. We share data only when this is necessary for a specific purpose and with an appropriate legal basis.

Depending on the service, personal data may be available to the following categories of recipients: authorized employees and couriers; senders, recipients and business users when necessary for delivery status and proof of delivery; delivery subcontractors, OEX parcel shops and parcel locker operators; international delivery networks and partners, including Eurodis GmbH, Österreichische Post AG and other partners in the destination country; providers of IT, hosting and customer support; payment service providers, banks and card companies; providers of analytics, marketing and advertising tools if you have given consent; providers of video surveillance and security services; accountants, auditors, lawyers, insurers; courts, tax, customs, police, postal, regulatory and other competent authorities when prescribed or necessary.

We conclude agreements with processors regulating confidentiality, security, permitted processing activities, assistance in exercising data subject rights and other obligations prescribed by the GDPR.

7. When we act as controller, separate/independent controller/processor

When we determine the manner of organizing delivery, shipment tracking, proof of delivery, notifications, security, complaints, charging, video surveillance and protection of legal claims, we generally act as an independent controller.

When a business user or another sender provides Overseas with recipients’ personal data for the purpose of sending and delivering a shipment, the sender and Overseas generally act as separate controllers for those processing activities for which each of them independently determines the purposes and essential means of processing. The sender is responsible for the lawfulness of collecting and providing data to Overseas and for processing data within its relationship with the recipient. Overseas is responsible for the processing of data necessary for acceptance, sorting, transport, tracking, notification, handover, proof of delivery, resolving complaints, charging, security and fulfilling legal obligations related to the delivery service.

In certain special services, Overseas Express may act as a processor when it processes personal data exclusively on behalf of and according to the documented instructions of another controller. Such relationships are regulated by a contract or another legal act in accordance with Article 28 of the GDPR.

In such cases, we do not collect more data than is necessary to carry out the instruction and we do not use it for our own purposes, unless there is a separate legal basis.

8. Retention periods

We retain personal data only for as long as necessary for the purpose for which it was collected, or for as long as required by regulations, contractual obligations, complaint procedures, limitation periods or the protection of legal claims. After the expiry of the period, we delete, anonymize or archive the data in accordance with applicable rules.

9. Transfers of personal data outside the European Economic Area

We may transfer personal data outside the European Economic Area when this is necessary for international delivery, customs clearance, security checks, use of international delivery networks or provision of IT, analytics, marketing and other services.

When data is transferred to a third country or an international organization, we apply one of the mechanisms provided for by the GDPR, for example a European Commission adequacy decision, standard contractual clauses, additional technical and organizational measures, the EU-US Data Privacy Framework for certified US organizations or derogations for specific situations, for example where the transfer is necessary for the performance of an international delivery contract.

10. Security and confidentiality

We apply appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration, disclosure or destruction. Measures include role-based access restrictions, confidentiality obligations, physical protection of premises, system access controls, backups, access logs, protection of communication channels, supplier checks and other measures appropriate to the processing risk.

Only persons who need access to personal data to perform their work have such access. Processors and business partners are obliged to maintain confidentiality and implement appropriate security measures.

11. Automated decision-making and profiling

We do not make decisions based solely on automated processing, including profiling, which would produce legal effects concerning you or similarly significantly affect you.

We may use automated logistics, security, analytics or marketing tools, for example for routing shipments, sending notifications, measuring website traffic or managing advertising campaigns, but such processing in itself does not constitute decisions with a legal or similarly significant effect on the data subject.

12. Your rights

In accordance with the GDPR, you have the following rights, depending on the legal basis and circumstances of the processing:

• the right of access to personal data and information on processing;

• the right to rectification of inaccurate or completion of incomplete personal data;

• the right to erasure of personal data where the prescribed conditions are met;

• the right to restriction of processing;

• the right to data portability where processing is based on consent or a contract and is carried out by automated means;

• the right to object to processing based on legitimate interest, on grounds relating to your particular situation;

• the right to object to direct marketing at any time, after which we will no longer process your data for that purpose;

• the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;

• the right not to be subject to a decision based solely on automated processing if it produces legal or similarly significant effects, except in cases permitted by the GDPR.

To exercise your rights, you may contact us at privacy@overseas.hr or povjerenik@overseas.hr, by post at the address of the controller or through another available channel indicated for personal data protection.

We will respond to your request without undue delay and no later than within one month of receiving the request. This period may be extended by an additional two months if the request is complex or if we have received a larger number of requests, of which we will inform you. If necessary, we may request additional information to confirm the identity of the requester.

13. Complaints to the supervisory authority

If you believe that the processing of your personal data is not in accordance with regulations, you may first contact us so that we can try to resolve your request or complaint. Regardless of this, you have the right to lodge a complaint with the supervisory authority for personal data protection.

Supervisory authority	Contact
Croatian Personal Data Protection Agency	Ul. Metela Ožegovića 16, 10000, Zagreb, 10 000 Zagreb; telephone: 00385 (0)1 4609-000; fax: 00385 (0)1 4609-099; e-mail: azop@azop.hr; web: www.azop.hr

15. Amendments to the Privacy Policy

We may amend this Policy from time to time in order to align it with changes in regulations, services, technology, business organization or the manner of processing personal data. The current version is published on the website. In the case of significant amendments, we may also notify you in another appropriate manner, depending on the nature of the amendment and the available contact data.