Personal data protection policy

Personal data protection

Our company is aware of its responsibility in handling the personal data of our customers, potential customers, visitors to our website and all individuals who disclose their personal data when contacting us (hereinafter: users). We guarantee and undertake to use the personal data of users exclusively for the purposes stated in this document (Privacy and Personal Data Protection Policy).

In this Privacy and Personal Data Protection Policy (hereinafter: the Policy), we define the methods of collecting users' personal data, the purposes for which we collect it, the security measures with which we protect it, the persons with whom we share it, and your rights in relation to the protection of personal data. The protection and handling of users' personal data is fully consistent with the provisions of the General Data Protection Regulation (Regulation (EU) 2016/679, hereinafter: GDPR), and other legal regulations governing the protection of personal data. Our activities are consistent with European legislation and the conventions of the Council of Europe (ETS No. 108, ETS No. 181, ETS No. 185, ETS No. 189) and with the legislation of the Republic of Slovenia (Personal Data Protection Act (ZVOP-1, Official Gazette of the Republic of Slovenia, No. 94/07) and the Electronic Commerce Act (ZEPT, Official Gazette of the Republic of Slovenia, No. 96/09 and 19/15)).

1. Personal data

Personal data is any information about the characteristics, state, conduct or relationship that relates to a specific or identifiable natural person, i.e. an individual, regardless of the form in which it is expressed. An identifiable natural person is one who can be identified directly or indirectly by means of their identification numbers (e.g. Social Security Number, tax number, health insurance number, telephone number, vehicle registration number), or by reference to factors specific to their physical, physiological, mental, economic, cultural or social identity (e.g. employment, address, function, position or status in a specific entity, etc.).

The website owner collects the following personal data in accordance with the purposes defined below in this privacy policy:

• basic user information (name and surname, address),
• contact information and data on the user's communication with the website owner (email address, telephone number, date, time and content of postal or e-mail communication),
• data about the user's use of the website owner's website (dates and times of website visits, pages visited or URLs),
• other information that the user voluntarily provides to the website owner upon request for certain services that require this information.

2. Purposes of processing and grounds for data processing

Processing of personal data means any operation or set of operations which is performed upon personal data which are processed by automated means or which, when processed manually, form part of a personal data file or are intended to be included in a personal data file, in particular collection, retrieval, recording, editing, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, communication, dissemination or otherwise making available, alignment or combination, blocking, anonymization, erasure or destruction; processing may be manual or automated.

The website owner collects and processes users' personal data on the following legal grounds:

• individual's consent (agreement),
• legal and contractual basis,
• interest habit.

The website owner does not collect or process personal data of users, except when the users enable it or consent to it:

• when you subscribe to receive e-newsletters,
• when you provide us with your information by email,
• when you provide us with your information in the form of business cards,
• when there is a legal basis for collecting personal data or the website owner has a legitimate interest in processing.

The period of time during which the website owner stores the collected data is defined in more detail in the section Retention of personal data.

2.1. Processing of personal data based on consent

In our company, we collect and process users' personal data for the following purposes:

• sending e-newsletters,
• informing you about your services, offers and business opportunities, and
• invitations to events.

2.2. Processing based on laws and contractual agreements

In the event that the provision of personal data is a contractual obligation, an obligation necessary for the conclusion and performance of a contract with the provider, or a legal obligation, we will have to ask you to provide your personal data; if you do not provide personal data, you will not be able to conclude a contract with the provider, nor will the provider be able to perform services or supply products to you under the contract.

3. Personal data controller and data protection officer

Our company is also a personal data controller. We process data in accordance with the General Data Protection Regulation.

The person authorized for personal data protection in our company can be reached via the umbrella email address.

4. Transfer of personal data to third parties or to third countries

Our company does not transfer the collected personal data of users to third parties or to third countries.

5. Retention of personal data

We store the personal data that you have entrusted to us with your personal and explicit consent when registering, subscribing to e-newsletters, downloading e-publications, or submitting an inquiry until you revoke it.

You may withdraw your consent to the collection and processing of your personal data at any time. Withdrawal of consent does not affect the lawfulness of the collection and processing of your data prior to withdrawal. All other personal data within the framework of contractual cooperation is stored in accordance with applicable law.

We take multi-layered measures to ensure the protection of personal data. We store personal data in digital form, and our computer systems are protected by technical and organizational measures that prevent accidental or unlawful destruction, loss, alteration, and unauthorized disclosure or access to your personal data.

The data we collect is stored on secure servers until you revoke it, but not longer than the maximum retention period. Business premises, equipment and system software, including input/output units, are also adequately protected.

6. Personal data retention period

An individual's personal data obtained on the basis of consent may be processed and stored as long as the purpose exists or until the individual's consent is revoked.

An individual's personal data processed on the basis of a contract may be processed and stored for a further 5 years after the contractual obligations of both parties have been fulfilled.

In accordance with the law governing the field of value added tax, invoices are kept for 10 years after the end of the year to which the invoice refers.

We may process an individual's personal data for our own needs until the consent is revoked with a request to remove personal data from the database, otherwise only for as long as is necessary to achieve the purpose for which the data was collected, i.e. 10 years for registered users and 5 years from the fulfillment of the contractual obligations of both parties or for all other users and until the subscriber unsubscribes from the e-newsletter or until the controller ceases its activity on the market.

During the management of personal data, the individual has the opportunity to view and update the data in the database upon request. In accordance with the Value Added Tax Act, the company keeps invoices for 10 years after the year of issue of the invoice.

7. Individual rights

In accordance with applicable law, an individual has the right to revoke the consent given at any time, request access, correction, restriction of processing or deletion of personal data.

You can withdraw your consent to the processing of your personal data at any time. To this end, you can send your request to our email address or by regular mail to the company's headquarters.

An individual can also submit a complaint regarding the processing of their personal data to our address.

An individual may also submit a complaint regarding the processing of their personal data directly to the competent supervisory authority, i.e. the Information Commissioner of the Republic of Slovenia.

8. Handling of violations

In the event of a personal data breach, our company will immediately implement all internal and external measures (technical, organizational) to protect the rights and interests of the individual. It will notify each of the affected parties of any potential breaches and will also inform the competent supervisory authority in the Republic of Slovenia.