This Privacy Policy refers to the data of contractual partners, job candidates, business partners or other persons (hereinafter: “data subjects”) with whom we have business cooperation and whose personal data we process in our business operations.
This Privacy Policy does not regulate the processing of personal data arising from the employment relationship, since such data is regulated by internal rules.
We believe that responsible handling of personal data supports business growth, builds trust and strong relationships. We are committed to respecting and protecting the privacy of all individuals whose personal data we process.
In this Privacy Policy we will use the term “personal data processing” when we talk about any activity related to personal data, such as the collection of personal data, their storage, sharing, destruction or even mere access to data without taking any other actions.
Transparency regarding your personal data we process is very important to us including: the reason, method and duration of processing, data protection and your rights. This Privacy Policy refers exactly to that. The Policy is divided into several parts for easier navigation. In addition to this Privacy Policy, we will also sometimes provide you with additional timely privacy information where appropriate. The Policy also provides the contact details of the Data Protection Officer, a person you can contact in order to exercise your rights.
We process personal data as part of our business activities. Personal data include any information that can identify you, such as your name, phone number, IP address, information you provided while participating in one of our events, or a resume that you submitted with a job application.
When handling personal data, we act either as a Data Controller or as a Processor, depending on the situation. This distinction is crucial since it establishes the level of responsibility of the company, what the company should do in terms of data protection, and how it ensures that you exercise your right to privacy. The simplest explanation is that the Data Controller is the one who decides how and for what purpose your personal data will be used and he is ultimately responsible for handling them, while the Processor follows the instructions of the Data Controller on how to handle such data.
Our contractual partners are mainly companies that use services from our portfolio for various needs in their business. When providing services, we act as a Processor on behalf of the contractual partner and we process relevant data exclusively for the purpose of providing our services to contractual partners. We do this within the defined limits, according to the instructions of the contractual partner and in accordance with the terms of use of the services, service agreement, data processing agreement or similar agreement concluded with the contractual partner.
This Privacy Policy describes the activities we undertake in the role of the Data Controller, not in the role of the Processor. We act as a Data Controller when we process personal data for our own needs and do not act on behalf of others.
The entity responsible for the processing of personal data as described in this Privacy Policy - the Data Controller - is Bonsai Ltd., Croatia, Zagreb, Koturaška cesta 47, company identification number (OIB): 81255473305, https://bonsai.tech/.
Bonsai Ltd. is part of the Span group. For the processing of personal data within the Span group, each company is responsible for the part of the data it processes. Depending on the specific relationship that applies to you, another Span Group company may be the Data Controller of your personal data. Each company of the Span Group is authorized to define its own policies and rules for the protection of personal data in accordance with the applicable regulations. You can find a list of all Span Group companies here.
If you have any questions regarding this Privacy Policy, you can contact our Data Protection Officer at dpo@span.eu or by mail to the address Bonsai Ltd., Koturaška cesta 47, 10000 Zagreb, with the indication “Data Protection Officer”.
Most of the personal data we process is provided to us directly by you, for example when you:
We also receive your personal information from other sources, such as in the following situations:
What personal data do we process?
Bonsai processes data necessary for concluding contracts and successfully maintaining business relations with contractual partners, which includes:
How do we collect personal data?
Why do we process personal data, on what legal basis and how do we use them?
We process such data in order to:
We process your data because it is necessary to perform a contract with you or your company or to take actions before entering into a contract.
How long do we keep personal data?
If required by applicable national regulations, when requested by competent authorities, or if we need to retain them to defend our legal interests, we may be required to keep these data for a period that differs from the above.
What personal data do we process?
How do we collect personal data?
Why do we process personal data, on what legal basis and how do we use them?
We process such data in order to:
Such activities represent our legitimate interest in conducting our business. If you personally, as our potential contractual partner, are interested in concluding a contract with us, we process your data since this is necessary for the execution of the contract concluded with you or in order to take actions before concluding the contract.
How long do we keep personal data?
Personal data collected for the stated purposes are kept until you request deletion, unless we conclude a contract with you or your company (in which case the retention periods from the previous point apply).
What personal data do we process?
How do we collect personal data?
Why do we process personal data, on what legal basis and how do we use them?
The purpose of processing these data is:
If you subscribe to our marketing communications via e-mail, we rely on your consent. For business-to-business (B2B) marketing, we rely on our legitimate interest in maintaining and improving business relationships and informing our existing business partners about our products and services, news, webinars and upcoming events via e-mail or other forms of communication.
In any case, you may unsubscribe from communications or unsubscribe from our marketing communications at any time via the unsubscribe link provided in our marketing communications. When you unsubscribe from our marketing communications (that is, withdraw your consent or object to processing), we will stop sending you marketing material. However, we retain the so-called “unsubscribe list” containing your e-mail address to ensure that we do not contact you with unwanted content in the future. We store this information based on our legitimate interest in respecting the selection of recipients of our newsletter.
How long do we keep personal data?
What personal data do we process?
How do we collect personal data?
Why do we process personal data, on what legal basis and how do we use them?
If you register for one of our events, we process your data in order to:
We process your data because it is necessary to execute or conclude a contract with you or your organization or to take actions before entering into a contract.
The legal basis we rely on for the stated purposes is our legitimate interest in conducting our business. You can object to such processing and communications (in terms of invitations to future events as well as information about our products and services) at any time by using the unsubscribe link provided in all our communications, and we will stop sending them to you.
How long do we keep personal data?
What personal data do we process?
How do we collect personal data?
Why do we process personal data, on what legal basis and how do we use them?
We process data:
When inviting you to be part of our research, we send you an e-mail with a login link. For this activity, we rely on our legitimate interest in improving our products and services. We will only contact you in connection with research related to a product or service that you already use or have used.
How long do we keep personal data?
What personal data do we process?
When you visit our website, we may collect certain information through cookies, such as your browser type, the pages you visited and the order of visits, as well as information about whether you are a new or returning visitor.
How do we collect personal data?
Cookies are set either automatically (strictly necessary cookies) or only after you have agreed to them (functional, statistical and marketing cookies). Please review our Cookie Policy for more information.
Why do we process personal data, on what legal basis and how do we use them?
We process such data in order to:
In doing so, we rely either on our legitimate interest in ensuring the functioning of the website (for strictly necessary cookies) or upon your consent (for functional, statistical and marketing cookies). Please review our Cookie Policy for more information on how you can manage cookies.
How long do we keep personal data?
This depends on the types of cookies, which can be temporary (they are deleted after closing the browser or after the end of the session) or permanently (they remain on your device until you delete them or until your browser does so). Please review our Cookie Policy for more information on the retention periods of certain types of cookies.
What personal data do we process?
When you apply for a job for an advertised position or internship with us, we process the following data:
When you send us an open application (for a position that has not yet been published), we process the following data:
How do we collect such data?
Why do we process personal data, on what legal basis and how do we use them?
We process your personal data in order to:
In doing so, we rely on our legitimate interest in finding talented individuals.
In doing so, we rely on your consent to process your personal data.
If you are selected as the most suitable candidate for a position or internship, you will be provided with an offer. If you accept it, we will collect additional information so that we can conclude and execute a contract with you.
Further collection and processing of your personal data will be carried out in order to conclude a work or execute a contract with you or to take necessary actions that precede the conclusion of a contract.
We process your personal data through the employment platform of our processor, Talentlyft (AdoptoTech Ltd.). Your personal data will be collected and stored on servers maintained by Talentlyft in data centers located in the European Union, and they will be processed by authorized members of the Bonsai recruitment team. Please find more details on Talentft’s privacy practices here.
Furthermore, we perform psychological testing of candidates through our processor Selekcija Ltd., which collects and stores personal data of candidates in data centers located in the European Union. Please find more details on Selection's privacy policy here.
How long do we keep personal data?
If requested by competent authorities or if necessary to defend our legal interests, we may be required to retain this data for a period that differs from the above.
You have the right to withdraw your consent at any time. If you want to withdraw your consent or edit your profile, you can do so directly by accessing your profile or by contacting our Data Protection Officer at dpo@span.eu or by mail to the address Bonsai Ltd., Koturaška cesta 47, 10000 Zagreb, with the indication “Data Protection Officer”.
Please find more information about your rights in section 9 below.
What personal data do we process?
How do we collect them?
Why do we process personal data, on what legal basis and how do we use them?
We process your personal data in order to:
The processing of CCTV surveillance data, as well as processing related to access control, is carried out on the basis of our legitimate interest in the protection of our employees, visitors and property.
How long do we keep personal data?
However, we may be required to retain this information for different periods of time in certain circumstances, if required by applicable regulations, if requested by competent authorities or if necessary to defend our legal interests.
We will keep the personal data for which you have given us your consent until you withdraw your consent, and at the latest until the deadline specified in the consent. If you want to withdraw your consent and delete your data, you can do so at any time by sending an e-mail to dpo@span.eu or by mail to the address Bonsai Ltd., Koturaška cesta 47, 10000 Zagreb, with the indication “Data Protection Officer”. Please note that withdrawal of consent does not affect the legality of processing based on consent before its withdrawal.
As for your personal data which we process on a basis other than consent, we will keep them as long as necessary to fulfil the purposes for which they were collected before we anonymize it so that we can no longer identify you, or we delete them.
Specific storage periods are specified in section 5 of this Privacy Policy. The specified storage periods are standard periods. In some cases, in order to comply with legal regulations or for the purpose of defending our legal interests, we may keep these data for longer than the periods specified in section 5 (e.g. in case of legal proceedings or at the request of a competent authority).
As a rule, we do not share personal data with third parties except when this is absolutely necessary and only to the extent necessary, such as in the following cases:
When transferring your personal data, we strictly comply with the principle of processing restrictions with the transfer of the minimum amount of data necessary to fulfil the purpose, and by complying with all other relevant data protection principles.
We try to primarily process personal data within the EU/EEA area.
If the above is not possible, we select companies in countries outside the EU/EEA for which the European Commission has made a decision confirming that they ensure an adequate level of personal data protection (the so-called Adequacy decision).
If our business operations require the transfer of personal data from the EU/EEA to the USA, we choose companies in the USA that are subject to the decision of the European Commission on the adequacy of the data protection framework between the EU and the USA (the so-called EU-US Data Privacy Framework).
If we have to transfer your personal data to third countries for which an adequacy decision has not been made, in such situations we always apply the appropriate protection measures and try to achieve the level of personal data protection guaranteed by the GDPR (e.g. by applying the so-called Standard Contractual Clauses).
Exceptionally, in special situations and if data transfers are not of a regular type, your personal data may be transferred to third countries for which a decision on adequacy or appropriate protection measures has not been made (for example with your consent after we have previously informed you of the risks of such transfer; or if the transfer is necessary for the conclusion or performance of a contract concluded with you or in your interest; or if the transfer is necessary for important reasons of public interest or legal requirements).
Regarding the processing of your personal data, we would like to draw your attention to the following rights you can exercise:
You also have the right to withdraw your consent at any time, in which case we will no longer use your personal data collected based on your consent. Please note that withdrawal of consent does not affect the legality of processing based on consent before its withdrawal. You can withdraw your consent directly (e.g. by clicking on the “unsubscribe” link in our marketing communications, or on your profile on the platform of our processors Talentlyft or Selekcija) or by sending an e-mail to dpo@span.eu or by mail to the address Bonsai Ltd., Koturaška cesta 47, 10000 Zagreb, with the indication “Data Protection Officer”.
You have the right to request the fulfilment of the stated rights, and we shall respond to your request within one month. In justified situations, we can extend that deadline by an additional 2 months, of which we will inform you in due time.
All stated requests can be submitted free of charge, unless your request is clearly unfounded or excessive. In such situations, we reserve the right to charge a reasonable fee or refuse to comply with the request. You will be informed in a timely and clear manner about all relevant information related to your requests.
If you have questions about how we use your personal data or if you want to exercise a certain right or file a complaint regarding the processing of your personal data, you can contact our Data Protection Officer by sending an e-mail to or by mail to the address Bonsai Ltd., Koturaška cesta 47, 10000 Zagreb, with the indication “Data Protection Officer”.
You can also send your complaint to the supervisory authority of the EU member state where you have your usual residence, place of work or at the place of the alleged violation. If you wish to make a complaint or contact the relevant data protection authority for any other reason, you can find the contact details of the EEA data protection authorities at https://edpb.europa.eu/about-edpb/board/members_en.
Contact details of the competent supervisory body in the Republic of Croatia are: Croatian Personal Data Protection Agency (“AZOP”), Selska cesta 136, HR - 10000 Zagreb, phone: +385 (0)1 4609-000, e-mail: azop@azop.hr, website: http://www.azop.hr.
In order to protect the personal data that we process, we implement appropriate physical, technical and organizational protection measures, taking into account the nature, scope, context and purposes of processing, as well as risks of different levels of probability and severity for the rights and freedoms of data subjects.
We update and test our security technologies on an ongoing basis and continuously improve them. We use advanced tools to protect and prevent data leakage, permanently monitor critical systems, encrypt certain sensitive data and protect data from unauthorized access, modification, loss, theft or any other data breach and abuse.
Access to data is limited only to the data that are necessary for the performance of certain business tasks, and only to authorized persons who work directly on the provision or maintenance of the service as well as on improving the quality and billing of the service, in accordance with clearly defined roles and responsibilities. All employees are bound by data confidentiality agreements, and we hire only partners with whom we contract the appropriate protection measures.
We make sure that all our employees are educated in the field of privacy and security, starting from their first day.
We will not make any decisions based on the automated processing of data relating to you and we will not profile you.
This version of the Privacy Policy applies from February 21st, 2024.
A previous version of the Privacy Policy is available here.