Privacy Policy

4.1 Introduction

At SVETKOM d.o.o., Litostrojska cesta 40, 1000 Ljubljana (hereinafter: “controller” or “SVETKOM”), we are aware of our responsibility in handling personal data of our customers, potential customers, visitors to the website www.svetkom.si (hereinafter: “website”) and all individuals who disclose personal data to us upon contact (hereinafter: “users”), therefore we adopt this Personal Data Protection and Privacy Policy (hereinafter: “Policy”), with which we inform our users in a transparent, understandable and simple way about the purposes, legal basis for processing their personal data and rights related to processing, as provided by the Personal Data Protection Act (ZVOP-1, Official Gazette of RS, No. 94/2007) and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: “General Data Protection Regulation”).

Terms such as “controller”, “processing”, “restriction of processing”, “processor”, “profiling”, “pseudonymization”, “third party” and “enterprise” used in this Policy have the meaning as defined by the General Data Protection Regulation.

The Policy, in accordance with the General Data Protection Regulation, regulates the following areas:

• contact information of the controller,
• purposes and legal bases for processing different types of users’ personal data,
• including profiling of users’ personal data,
• users of personal data, contractual processing and transfer of data to third countries,
• retention period for different types of personal data,
  care for personal data security,
• users’ rights regarding personal data processing,
• procedure for exercising users’ rights regarding personal data processing,
• right to file a complaint regarding personal data processing.

4.2 Controller Information

The controller of users’ personal data is SVETKOM d.o.o., Litostrojska cesta 40, 1000 Ljubljana, registration number: 3811352000. For questions regarding personal data protection and privacy, please write to info@svetkom.si.

4.3 Personal Data

Personal data is information that identifies you as a specific or identifiable individual. A user is identifiable when they can be directly or indirectly identified, particularly by reference to an identifier such as a name, identification number, location data, online identifier, or by reference to one or more factors specific to the user’s physical, physiological, genetic, mental, economic, cultural or social identity. The controller, in accordance with the purposes defined in the continuation of the Policy, collects the following personal data:

• basic user information (name and surname, title, position and other employer data),
• contact information and data about user’s communication with the controller (email address; phone number; date, time and content of postal or electronic communication; date, time and duration of phone calls),
• data about participation in events organized by SVETKOM (information about the event attended; place and date of event),
• channel and campaign – method of acquiring the user or source through which the user came into contact with the controller (website and advertising campaign or action),
• data about user’s use of the controller’s website (dates and times of website visits, visited pages or URLs, time spent on individual pages, number of visited pages, total time of website visit, settings made on the website) and data about the use of received messages (email, SMS) from the controller,
  data from forms voluntarily completed by the user, e.g., in the context of prize games or inquiries about controller’s services,
• other data that the user voluntarily provides to the controller when requesting certain services that require such data.

The controller does not collect or process user’s personal data except when the user enables this or consents to it, i.e., when ordering products or services, subscribing to e-news, participating in prize games, etc., when there is a legal basis for collecting personal data, processing is necessary for executing contractual obligations, or when processing is necessary due to legitimate interests pursued by the controller (hereinafter: “legitimate interest”).

4.4 Processing Bases and Purposes

SVETKOM will process your personal data for one of the purposes listed below on the following legal bases:

• your consent or permission,
• fulfillment of controller’s legal obligations,
  based on legitimate interest,
• fulfillment of contractual obligations.

SVETKOM will process your personal data only for the purposes for which it was obtained and will not process it for purposes that are incompatible with the purposes for which it was collected. The administrator collects from the user only those personal data that are strictly necessary to achieve each purpose.

Processing Based on Consent or Permission

SVETKOM will process your personal data based on your written consent for the following purposes:

• for sending email messages to inform about contract progress or updates, news, content, services and also events at the controller or third parties,
• for telephone contact to present service solutions to the user or employer (by prior arrangement also at their address),
• for publication in professional media and on websites with the basic purpose of promoting the user and their employer,
• for monitoring the reading of sent emails, specifically which email you opened or didn’t open, which links you opened or clicked (which content you read or viewed),
• how long you read or viewed individual content,
• for user segmentation based on facts from the previous bullet point and further sending of customized (individualized) emails, meaning that different users may receive emails with different content for better (more relevant) information and achieving higher response rates to sent emails,
• for analyzing user journey on the website: where the user came from (traffic source), monitoring time spent on the website, which web pages were visited, which content was downloaded or viewed,
• for user segmentation based on facts from the previous bullet point and further sending of customized (individualized) messages through multi-channel communication, meaning that different users may receive messages with different content for better (more relevant) information of individuals and achieving higher user engagement rates,
• for all other purposes for which you specifically agree when cooperating with the controller.

In all cases where you give consent for processing your personal data, you can revoke this consent at any time via email info@svetkom.si.

Processing Required for Fulfillment of SVETKOM’s Legal Obligations

We also process your personal data when required by law. An example of such processing purpose is processing your personal data for judicial or administrative proceedings.

Processing Based on Legitimate Interest Pursued by SVETKOM

The controller may also process data based on legitimate interest, except when such interests are overridden by the interests or fundamental rights and freedoms of the user requiring personal data protection. In case of using legitimate interest, the controller always performs an assessment in accordance with the General Data Protection Regulation.

In certain cases, SVETKOM may adopt certain safeguards for the further processing of your personal data based on legitimate interest, collected on one of the above-mentioned legal bases (consent, contract), such as pseudonymization, encryption, processing in aggregated form and/or deletion of certain types of personal data.

SVETKOM will process your personal data based on legitimate interest for the following purposes:

• Marketing, business and other technical analyses, such as analyzing and determining which organizations customers come from for our services, what functions they hold in these organizations, maintaining records related to signed contracts, account settlements, etc.
• Prevention of abuse, ensuring security, enforcement of claims or defense against claims in administrative and judicial proceedings. Thus, in case of suspected abuse, the controller may process your personal data in an appropriate and proportionate scope to identify and prevent potential fraud or abuse and may, if appropriate, forward this data to the police, state prosecutor’s office or other competent authorities.
• Direct marketing, including user profiling, based on previously legally obtained personal data. You may object to this processing at any time in accordance with the Right to Object chapter of this Policy.
• Processing for Fulfillment of Contractual Obligations

In certain cases, processing of personal data is necessary for fulfilling the controller’s contractual obligations. If the user does not provide the necessary data, the controller cannot enter into a contract with the user or perform the service.

The controller will process your personal data for fulfillment of contractual obligations for the following purposes:
​

• contractual arrangement of business cooperation,
  performing activities specified in the cooperation agreement,
• performing activities based on purchase and/or use of our services and products
• communication with contractors and other client contact persons for the purpose of performing activities specified in the cooperation agreement,
• user registration for access to services organized by SVETKOM

4.5 Users of Personal Data, Contractual Processing and Transfer of Data to Third Countries (countries that are not members of the European Union or European Economic Area)

Only employees and associates at SVETKOM and personal data processors who are directly authorized may access your personal data.

SVETKOM will never forward your personal data to unauthorized third parties.

By using the SVETKOM website and other services, you agree that SVETKOM may entrust certain operations regarding your personal data to external processors. These processors may process your personal data exclusively on behalf of and in accordance with written instructions from SVETKOM, within the limits of authorization as stated in the contract between SVETKOM and the processor, and in accordance with the purposes defined in the Policy. Processors may not use your personal data in any case to pursue any of their own interests.
​
For information about which external processors SVETKOM cooperates with, contact info@svetkom.si.

4.6. Personal Data Retention Period

The personal data controller does not process data longer than necessary to achieve the purposes for which the personal data was collected and further processed.

Personal data that SVETKOM processes due to contract execution is retained by the controller for the period necessary for contract execution and 5 years after its termination, except in cases where a dispute arises between you and the controller regarding the contract. In such case, the controller retains the data for 5 years after the final court or arbitration decision or settlement, or if there was no judicial dispute, 5 years from the day of peaceful resolution of the dispute.

Personal data that SVETKOM processes based on law is retained by the controller for the period prescribed by law.

Personal data that the controller processes based on your personal consent or legitimate interest is retained by SVETKOM permanently, until revocation of your consent or request to terminate processing. The controller will delete such data before revocation only if the purpose of personal data processing has already been achieved or if required by law.
​
After the retention period expires, SVETKOM will effectively and permanently delete, destroy or anonymize your personal data so that it can no longer be connected to you.

4.7 Care for Personal Data Security

SVETKOM is committed to protecting your personal data. Unauthorized access to them, their use and disclosure is prevented by the following measures:
​

• data is protected by premises, equipment and system software,
• SVETKOM prevents unauthorized access to personal data during their transmission, including transmission via telecommunications means and networks,
• SVETKOM provides an effective way of blocking, destroying, deleting or anonymizing personal data when the purpose for which they were collected ceases to exist.

SVETKOM prevents unauthorized access to personal data, their use and disclosure through the following security technologies and procedures:

• control of physical access,
• locking of premises, cabinets, computers,
• storing personal data carriers in secure areas,
• preventing access to personal data by maintenance staff, clients and other visitors to the premises of the contractual processor,
• preventing the use of passwords by persons to whom the password was not directly assigned or for a purpose other than specified,
• restricting data removal by employees,
• controlling copies and data removal,
• limited, recorded and secured data transfer via telecommunications networks,
• revoking data access from persons whose contract with the contractual processor terminates,
• strict separation from data of potential other controllers.

4.8 User rights regarding personal data protection

In accordance with the General Data Protection Regulation, SVETKOM provides you with the following rights regarding personal data protection, which are detailed further in the Policy:
​

• right of access to data,
• right to rectification,
  right to erasure (“right to be forgotten”),
• right to restriction of processing,
• right to data portability,
• right to object.

Right of access to data

You have the right to obtain confirmation from SVETKOM whether SVETKOM is processing your personal data, and where that is the case, you have the right to access your personal data and the following information regarding the processing of personal data:
​

• purposes of processing,
• categories of personal data,
• recipients or categories of recipients to whom your personal data have been or will be disclosed, in particular recipients in third countries or international organizations,
  where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period,
• the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing,
• where the personal data are not collected from the data subject, any available information as to their source,
• the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Based on your request, SVETKOM will provide you with one free copy of your personal data undergoing processing. For any additional copies of the data that you might request, SVETKOM will charge a fee taking into account the administrative costs.

Right to rectification

You have the right to obtain from SVETKOM without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Right to erasure (“right to be forgotten”)

You have the right to obtain from SVETKOM the erasure of personal data concerning you without undue delay and SVETKOM shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
​

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed,
• you withdraw consent on which the processing is based and where there is no other legal ground for the processing,
• you object to the processing pursuant to the controller’s legitimate interests and there are no overriding legitimate grounds for the processing,
• you object to processing for direct marketing purposes,
• the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject.

Where SVETKOM has made the personal data public in accordance with the Policy and is obliged to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

Right to restriction of processing

You have the right to obtain from SVETKOM restriction of processing where one of the following applies:
​

• you contest the accuracy of the personal data, for a period enabling the controller to verify the accuracy of the personal data,
• the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead,
• SVETKOM no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defense of legal claims,
• you have objected to processing pending the verification whether the legitimate grounds of the controller override your grounds.

Right to data portability

You have the right to receive the personal data concerning you, which you have provided to SVETKOM, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:
​

the processing is based on consent or on a contract; and
the processing is carried out by automated means.

Right to object

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on legitimate interests pursued by SVETKOM or by a third party. SVETKOM shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims. Where personal data are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing. Where direct marketing is based on consent, the right to object can be exercised by withdrawing consent.

4.9 Procedure for exercising rights

All the above-mentioned requests concerning the exercise of rights in relation to your personal data can be submitted in writing to the controller, either by email to info@svetkom.si or by post to SVETKOM d. o. o., Litostrojska cesta 40, 1000 Ljubljana.

If you submit a request in accordance with the above paragraph by electronic means, the information will, where possible, be provided to you by electronic means.

For the purposes of reliable identification in case of exercising your rights in relation to personal data, the controller may request additional information from you necessary to confirm your identity, and may refuse to act on the request only if it proves that it cannot reliably identify you.

The controller will respond to the request by which you exercise your rights in relation to your personal data without undue delay and at the latest within one month of receipt of the request. SVETKOM may extend the time period for exercising the rights by a maximum of two additional months, taking into account the complexity and number of requests. If SVETKOM extends the deadline, it will inform you of any such extension within one month of receipt of the request, together with the reasons for the delay.

If your requests under this section are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may:
​

• charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested,
• refuse to act on the request.

4.10 Right to lodge a complaint in relation to the processing of personal data

You may send any complaint regarding the processing of your personal data to the email address info@svetkom.si or by post to SVETKOM d. o. o., Litostrojska cesta 40, 1000 Ljubljana.
​
You have the right to lodge a complaint directly with the Information Commissioner if you consider that the processing of personal data relating to you infringes Slovenian or EU regulations in the field of personal data protection.

4.11 Validity of the Policy

The Policy is valid from May 25, 5. 2018 onwards and may be changed or supplemented at any time. The controller is not obliged to notify you of changes to the Policy.