General Privacy Policy
ENNA Group
Last updated: 14 May 2026
1.Introduction
This General Privacy Policy explains how companies within ENNA Group (the “Group”) process personal data in connection with their business activities, websites, social media pages, business premises and recruitment processes.
This Policy provides the information required under Article 13 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the General Data Protection Regulation or the “GDPR”) in a general form for the Group.
For certain processing activities, more detailed or specific privacy notices apply, as referenced below.
2.Controllers within the Group
The controller of your personal data is the relevant Group company with which you interact, in particular the company that:
- maintains a business relationship with you or your employer;
- operates the relevant website or social media page;
- operates the relevant business premises; or
- conducts the relevant recruitment process.
The companies covered by this Policy include, inter alia:
ENERGIA NATURALIS d.o.o., Gospodarska zona Vukovar 13, Vukovar, PIN: 65900776536;
ENNA Charge d.o.o., Gospodarska zona Vukovar 13, Vukovar, PIN: 97052395887
ENNA ESCO d.o.o., Gospodarska zona Vukovar 13, Vukovar, PIN: 77752255036
ENNA Fleet d.o.o., Gospodarska zona Vukovar 13, Vukovar, PIN:97506835174
ENNA GEO d.o.o., Gospodarska zona Vukovar 13, Vukovar, PIN: 93706478234
ENNA LOGIC d.o.o., Gospodarska zona Vukovar 13, Vukovar, PIN: 53488178655;
ENNA NEXT d.o.o., Gospodarska zona Vukovar 13, Vukovar, PIN: 61700516273
ENNA Power d.o.o., Gospodarska zona Vukovar 13, Vukovar, PIN: 76061669735
ENNA SOLAR d.o.o., Gospodarska zona Vukovar 13, Vukovar, PIN: 59149709878
ENNA TRANSPORT d.o.o., Gospodarska zona Vukovar 13, Vukovar, PIN: 87583888894
ENNA TRANSPORT HU Kft., 1037 Budapest, Montevideó utca 3/B, PIN: HU32776296
DESOL d.o.o., Gospodarska zona Vukovar 13, Vukovar, PIN: 63483307101
Eko Reciklažni Park d.o.o., Gospodarska zona Vukovar 13, Vukovar, PIN: 53782715851
GEO POWER BABINA GREDA d.o.o., Gospodarska zona Vukovar 13, Vukovar, PIN: 95533888135
GEO POWER ZAGOCHA d.o.o., Gospodarska zona Vukovar 13, Vukovar, PIN: 87576535731
LOGIC FINANCIAL d.o.o., Gospodarska zona Vukovar 13, Vukovar, PIN: 27354907951.
PVP CEPHEUS S.R.L., B-dul Barbu Văcărescu, No. 301-311, AFI LAKEVIEW OFFICES, Office 5.8, Block AFI Lakeview Offices, Floor 5, Bucharest Sector 2, Romania, registration number: J2020015654403.
Each listed company acts as an independent controller for the processing activities it carries out, unless expressly stated otherwise.
3.Data protection contacts
Certain Group companies have appointed a Data Protection Officer (DPO). Where a DPO has been appointed, you may contact the relevant DPO as follows:
ENERGIA NATURALIS d.o.o. – DPO contact: dpo@enna.hr
ENNA Next d.o.o. – DPO contact: dpo@enna-next.hr
For all other companies within the Group, privacy-related questions may be sent to:
General privacy contact: dpo@enna.hr
4.Business partners and their representatives / employees
This section applies to suppliers, customers, contractors and other business partners, as well as their representatives, employees, contact persons and other persons acting on their behalf.
We may process identification and business contact data, function/job title, contractual and transaction-related data, payment and invoicing data, correspondence, and data required for compliance and due diligence purposes.
We process such data:
- to take steps prior to entering into a contract and to perform a contract, including managing the business relationship, communication, administration of orders, services, deliveries, invoicing and payments;
- to comply with legal obligations, including accounting, tax, sanctions, compliance and record-keeping obligations; and
- for our legitimate interests, in particular to manage business relationships, perform internal administration, protect our rights, carry out compliance checks, prevent fraud, and ensure IT and business security.
5.Website visitors
This section applies to visitors of websites operated by the Group.
We may process technical and usage data (such as IP address, browser type, device information, access date and time, logs and pages visited), information submitted through website forms, and communication sent via the website.
We process such data:
- for our legitimate interests, in particular to operate, maintain, secure and improve the website, respond to enquiries and ensure proper website functionality;
on the basis of your consent, where required by law, in particular for non-essential cookies and similar technologies; and
- to comply with legal obligations, where applicable.
The exact purposes, processing activities and types of cookies used may depend on the individual website and may change from time to time. For more information on the use of cookies and similar technologies, please see our Cookie Policy: https://www.enna.hr/en/cookies/
6.Visitors of Facebook, LinkedIn and other social media pages
This section applies to visitors of our official pages, profiles and accounts on Facebook, LinkedIn and other social media platforms.
We may process public profile data, usernames, information contained in messages, comments and other interactions, and statistics or analytics made available to us by the relevant platform provider.
We process such data:
- for our legitimate interests, in particular to maintain our public presence, communicate with users, provide information about the Group and analyse the reach and engagement of our content;
- on the basis of your consent, where this is required by law or where you voluntarily provide information through the platform; and
- to comply with legal obligations, where applicable.
Please note that, in relation to certain analytics or page insights functionalities, the relevant social media platform provider and the relevant Group company may act as joint controllers.
Your use of these platforms is also subject to the privacy policies and other information provided by the respective platform providers, including for example:
Meta Privacy Policy: https://www.facebook.com/privacy/policy/
Meta Page Insights / joint controller information: https://www.facebook.com/legal/terms/page_controller_addendum
LinkedIn Privacy Policy: https://www.linkedin.com/legal/privacy-policy
LinkedIn Page Insights / joint controller information: https://www.linkedin.com/legal/l/page-joint-controller-addendum
7.Visitors to business premises
This section applies to persons visiting our offices, branches, production sites, warehouses or other business premises.
We may process identification and contact data, visitor log data, access data, vehicle information where relevant, and—where applicable—video surveillance recordings.
We process such data:
- for our legitimate interests, in particular to manage access to premises and to ensure the safety and security of our employees, visitors, property, information and operations; and
- to comply with legal obligations, where applicable.
Some premises may be subject to video surveillance. Such premises are marked by an appropriate sign. More detailed information is available in our separate CCTV / Video Surveillance Privacy Notice provided at the relevant locations.
8.Job applicants
This section applies to candidates applying for positions within the Group.
We may process identification and contact data, CVs, cover letters, education and employment history, qualifications, interview notes, assessment results, references where permitted, and other data provided during the recruitment process.
We process such data:
- to take steps at your request prior to entering into an employment contract, including assessing your application and managing the recruitment process;
- to comply with legal obligations, where applicable; and
- for our legitimate interests, in particular to conduct an efficient recruitment process, evaluate candidates and protect our rights in relation to recruitment-related claims.
More detailed information is available in our separate Recruitment / Job Applicants Privacy Notice: https://www.enna.hr/media/documents/Privacy_notice_for_job_applicants.pdf
9.Recipients of personal data
Depending on the nature of the relationship and the purpose of processing, personal data may be disclosed to:
- other companies within the Group;
- IT, hosting, cloud, communication and website service providers;
- professional advisers such as lawyers, auditors, tax advisers and insurers;
- banks and payment service providers;
- building management and security service providers;
- competent authorities, regulators, courts, law enforcement bodies or other third parties where required by law or necessary to establish, exercise or defend legal claims;
- relevant social media platform providers, where you interact with us through social media.
10.International transfers
Where personal data is transferred to, or accessed from, countries outside the European Economic Area (EEA), such transfers are carried out only in accordance with applicable data protection law and subject to appropriate safeguards, such as an adequacy decision, standard contractual clauses adopted by the European Commission, or another lawful transfer mechanism.
The Group uses external service providers, including cloud‑based collaboration and communication tools such as Microsoft 365, in the course of its business activities. Under Microsoft’s EU Data Boundary, customer data is generally stored and processed within the European Union. However, in limited circumstances (such as security, troubleshooting or support), personal data may still be accessed from outside the EU.
In addition, where individuals interact with the Group through social media platforms (such as Facebook, LinkedIn or similar services), personal data may be processed by the relevant platform providers and may be transferred outside the EEA in accordance with their respective privacy policies and applicable safeguards.
Further information about international transfers and applicable safeguards may be requested using the contact details provided in this Policy.
11.Retention of personal data
Personal data is retained only for as long as necessary for the purposes for which it is processed, taking into account statutory, contractual and legitimate business requirements.
In particular, business and accounting documentation containing personal data is retained in accordance with the Croatian Accounting Act, which generally requires retention for at least 11 years, unless a longer period applies.
Personal data related to contractual relationships may also be retained after termination of the relationship in accordance with applicable statutory limitation periods, for the purpose of establishing, exercising or defending legal claims.
More detailed retention information may be provided in separate privacy notices where relevant.
12.Automated decision-making
Unless expressly stated otherwise in a separate privacy notice, we do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
13.Your rights
Subject to the conditions and limitations under applicable law, you may have the right to:
- request access to your personal data;
- request rectification of inaccurate or incomplete personal data;
- request erasure of your personal data;
- request restriction of processing;
- object to processing based on legitimate interests;
- request data portability, where applicable;
- withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
To exercise your rights, please contact the relevant DPO or the general privacy contact indicated above.
14.Right to lodge a complaint
If you consider that the processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with the competent supervisory authority.
In the Republic of Croatia, this is:
Croatian Personal Data Protection Agency | Agencija za zaštitu osobnih podataka (AZOP)
Ulica Metela Ožegovića 16
10000 Zagreb, Croatia
E-mail: azop@azop.hr
Website: https://azop.hr
You may also contact us directly, and we will endeavour to address your concerns.
15.Related privacy notices
For more specific information on certain processing activities, please consult:
Cookie Policy: https://www.enna.hr/en/cookies/
Recruitment / Job Applicants Privacy Notice: https://www.enna.hr/media/documents/Privacy_notice_for_job_applicants.pdf
This list is not exhaustive, and additional privacy notices may apply depending on the specific circumstances of the processing and applicable local law.
16.Security of personal data
Appropriate technical and organisational measures are implemented to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
17.Updates to this Policy
This General Privacy Policy may be updated from time to time.
This General Privacy Policy supplements and, where applicable, replaces the relevant provisions of the privacy policy (data protection policy) dated 30 September 2025.
The latest version will always be published on the relevant website and indicated by the “Last updated” date above.