1. 1. General

The Controller is obliged to process and protect personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the "General Data Protection Regulation" or the "Regulation"), and other applicable data protection regulations in force in the country in which the company operates. In the Republic of Slovenia, the Personal Data Protection Act (Official Gazette of the Republic of Slovenia, No. 163/22, hereinafter referred to as ZVOP-2) applies.

The Controller will use personal data solely for the purposes for which it was provided within the scope of its legal powers.

2. Purposes of processing, types of data and retention period

2.1 Newsletter subscription

In order to subscribe to the newsletter, the controller processes personal data on the basis of consent, i.e.: e-mail address, first and last name. Consent may be withdrawn at any time.  obdeluje osebne podatke, to je: e-naslov, ime in priimek. Privolitev je mogoče kadarkoli preklicati.

The controller shall keep your data for as long as is necessary for the purposes for which the personal data are processed, but no longer than five years.

By entering your email address, you are signing up for the newsletter, which will inform you about initiatives and campaigns, share interesting facts and examples of good practice and inform you about current prize draws.

Personal data will only be used for the purposes for which the user has given consent and will only be accessible by authorised persons of the data controller, who are obliged to handle personal data carefully and in accordance with the applicable European legislation, using a username and password.

The data controller will not disclose user data to third parties without your prior consent.

3. Consent and revocation

The controller processes your personal data on the basis of your consent, until revocation.

The processing may be revoked at any time by the data subject by sending a message to [email protected].

4. Other data processed by the controller

The following data is automatically collected by the Controller when you visit the website:

- the number of page views,

- the number of unique visitors to the page (Users),

- the percentage of returning visitors to the page (Returning users),

- Average engagement time,

- the number of page views per visitor (Views per user),

- the number of document downloads,

- the date and time of each visit to the website,

- device type,

- operating system,

- operating system version,

- the manufacturer of your device,

- the model of your device

- the address(es) of any website(s) visited.

If you enter and confirm your personal data on our websites, i.e. name, surname, email address, etc., we will use your device's unique fingerprint to vaporize all your past events (listed above) and associate them with your personal data. From the moment you confirm the entry of your personal data, all previously collected anonymous data listed in the above list will also be considered personal data.

We use the data collected, which forms a unique device footprint, to improve your user experience and the overall quality of our services. This means that we can tailor the content and display of the website to you and the devices you use to access our services, so that we can make the most of the capabilities of different devices and tailor the services to your requirements and needs.

We will retain your data for the period necessary to fulfil our purposes, unless a longer retention period would be necessary or permitted by law.

5. The individual has the right to exercise the following rights:

The individual has the right to exercise the following rights:

• to request information from the controller as to which data concerning him or her are being processed and for what purpose;
• to obtain confirmation from the controller as to whether his or her personal data are being processed;
• to have inaccurate personal data concerning him or her rectified by the controller without undue delay;
• the erasure by the controller, without undue delay, of personal data concerning him or her, unless the basis is a law or a contract, until the expiry of the grounds for retention on that basis;
• request the controller to restrict the processing of personal data if: 
  • the data subject contests the accuracy of the data until the request is resolved,
  • the processing is unlawful and the data subject objects to erasure,
  • the controller no longer needs the data for its purposes but the data subject needs it for his or her legal claims,
  • the data subject raises an objection to the processing, pending its resolution;
• to have his or her personal data processed by the controller by automated means transmitted to the controller in a structured, commonly used and machine-readable format, and the right to request the company to transmit those data directly to another controller;
• the right to object at any time to processing of personal data concerning him or her, unless the grounds for objection are based on a contract, the expiry of the grounds for retention on that basis, the protection of the vital interests of the data subject or the law;
• to lodge a complaint with a supervisory authority.

6. Exercising those rights and remedies

The individual shall exercise the aforementioned rights, with the exception of the right to lodge a complaint, free of charge with the controller. The controller may request data from the data subject in order to verify his or her identity. The controller shall decide on the individual's request without undue delay and at the latest within one month of receipt of the request. This time limit may be extended by up to two additional months if necessary, taking into account the complexity and number of requests. The controller must inform the individual of the extension and the individual may appeal against the extension. In the case of manifestly unfounded or excessive requests by the data subject, in particular where the requests are frequently repeated, the controller may refuse to act on the request, giving specific reasons.

The data subject may at any time request, in writing or by any other agreed means, the controller to permanently or temporarily cease using or otherwise processing his or her personal data for direct marketing purposes. In the case referred to in the preceding sentence, the controller shall, within 15 days at the latest, cease processing the personal data for the purpose of direct marketing and shall, within a further period of five days, inform the data subject who made the request in writing or by any other agreed means thereof.

If, after receipt of the controller's decision, the data subject considers that the personal data he or she has received are not the personal data he or she requested or that he or she has not received all the personal data requested, he or she may, before lodging a complaint with the Information Commissioner, lodge a reasoned objection with the controller within 15 days. The controller must decide on the objection as a new request within five working days. If the controller does not decide on the individual's request within the time limit, the individual may lodge a complaint for silence with the Information Commissioner.

The Information Commissioner shall decide on the appeal against the decision in accordance with the rules of general administrative procedure. In cases which cannot be resolved otherwise, the Information Commissioner shall decide on the appeal by means of a decision. The decision may not be appealed, but may be the subject of an administrative dispute.

Information Commissioner

Dunajska cesta 22

1000 Ljubljana, Slovenija

E-mail: [email protected]

7. Protection of personal data and liability

The controller is obliged to ensure appropriate technical and organisational measures for the protection of personal data and is responsible for the security of personal data.

When dealing with personal data, the controller shall respect the principle of protection of personal data by design and by default, by collecting and processing personal data only as and to the extent necessary for each legitimate purpose, by keeping them only for the period for which they are necessary for the purpose, by limiting access to them to persons who need them for the performance of their tasks, and by incorporating safeguards in the handling of the data in order to comply with the requirements of the Regulation and to protect the rights of the data subject.

Under no circumstances will the controller disclose personal data to unauthorised persons, nor will they be transferred to third countries outside the EEA or to international organisations without the consent of the data subject or an explicit legal obligation.

Personal data will only be disclosed to others at the request of an authorised authority or other person having a legitimate interest, on the basis of a demonstrated adequate legal basis.

8. Contractual processing of personal data

The controller may entrust the processing of personal data to a processor by means of a contract. The contract shall be in writing or in an equivalent electronic form and shall comply with the requirements of the General Data Protection Regulation (EU), the provisions of the law governing the protection of personal data and other regulations governing the protection of personal data and shall commit the data processor to the same standards of protection and compliance with the rules as the controller or the company.

9. Cookies

A "cookie" is information that our website sends to your browser, which then stores it on your system. A cookie allows our website to "remember" information about your preferences until you close the current browser window (if the cookie is temporary) or until you disable or delete the cookie. Many users prefer to use cookies to help them navigate websites more easily. Their storage is under the complete control of the browser used by the user. The latter can restrict or disable the storage of cookies if it wishes.

Cookies do not contain more data than you allow and cannot transmit personal or other information from your hard drive to the sender.

Why are cookies necessary?

Cookies are essential for providing user-friendly online services. The most common e-commerce functions would not be possible without cookies. Cookies make the interaction between the web user and the website faster and easier. They help the website to remember the individual's preferences and experience, saving time and making browsing more efficient and enjoyable.

Managing and deleting cookies

If you wish to change the way cookies are used in your browser, including blocking or deleting them, you can do so by changing your browser settings accordingly. To manage cookies, most browsers allow you to accept or reject all cookies, accept only a certain type of cookie, or warn you that a page wants to store a cookie. You can easily delete cookies that have been stored by your browser.

The procedure for managing and deleting cookies varies from browser to browser. You can find more detailed information on how to do this on your browser's website.

Which cookies does the website use?

Example: