Privacy policy
1 Purpose of the Privacy policy
The purpose of the Privacy policy of VERSTOVŠEK ESTATE, d.o.o., Cankarjeva 16, 1000 Ljubljana, registered number: 7049447000 is to inform users of the company's services and other persons about the purposes and basis for the processing of personal data by the company and the rights of individuals in relation to the processing of their personal data.
The company takes special care to protect personal data. All personal data provided or obtained shall be treated confidentially and shall be used only for the purpose for which it was provided or obtained by the individual.
The company manages the personal data of individuals with the utmost care, taking into account the applicable legislation and the highest standards of processing.
It ensures the security of individuals' personal data by, among other things, appropriate organisational measures, work procedures and advanced technological solutions, as well as by external experts, in order to protect individuals' personal data as effectively as possible. In doing so, the company shall apply an appropriate level of protection and reasonable physical, electronic and administrative measures to safeguard the personal data collected against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to, personal data that has been transmitted, stored or otherwise processed.
2 Information about the company/controller
VERSTOVŠEK ESTATE, Services, Ltd.
Cankarjeva cesta 16
1000 Ljubljana
Registration number: 7049447000The company does not transfer or forward the personal data collected to third countries and/or international organisations.
3 Information about the data protection officer
The data protection officer can be contacted at the following e-mail address: dpo@verstovsek-estate.com or by telephone: 07/49-90-965.
4 Information on the data protection officer
The company collects various types of data related to the services within the scope of the company's activities, including:
-information received directly from the individual; and
-data collected in connection with an individual's use of the company's services.
If the individual is only a visitor to the company's website, the company collects information about the latter only through the use of so-called cookies.
If the individual is a user or subscriber of services provided by the company, the company also collects other personal data about the individual that is necessary for the provision of the services that the individual has subscribed to or wishes to use/ benefit from.
5 Purposes and legal basis of processing
The personal data of the data subject (collected online or in person) are processed in particular for the following purposes:
-carrying out marketing activities (in particular, information on new products on offer), information on seasonal promotions, prize draws and other events);
-making an offer on a specific service;
-the conclusion and performance of a contractual relationship;
-informing you of any changes, additional details and instructions for using the services;
-resolving any objections or complaints;
-taking appropriate measures to control and prevent possible fraud or other unlawful conduct to the detriment of the individual or the company;
-making reservations for certain services/products;
-billing and invoicing for services rendered, etc.
5.1 Processing of personal data based on the consent of the data subject
The processing of personal data may be based on the explicit consent of the data subject, which allows the Company to use or process the data, in particular for the purpose of carrying out the Company's marketing activities, such as, in particular, informing the data subject of new products, informing him/her of the expiry of the renewal of the registration and technical licence for the vehicle, informing him/her of seasonal promotions, prize draws and other events. The purpose of such information is to bring services as close as possible to the needs and preferences of individuals and thereby increase their use value.
The communication is carried out through the channels chosen by the individuals.
If an individual does not give consent to the Company's marketing activities listed above, gives partial consent or withdraws consent, the Company will not (continue to) inform such individual about the marketing activities.
Consent to the Company's marketing activities is not conditional on the use of services related to the Company's activities. Giving consent is entirely voluntary and the fact that an individual chooses not to give consent or subsequently withdraws consent shall in no way diminish his/her rights under the contractual relationship with the Company or impose additional costs or aggravating circumstances on the individual.Changes to or withdrawal of the consent given may be arranged by sending an e-mail to dpo@verstovsek-estate.com or by sending a written request to the Company's registered office.
The last consent or withdrawal of consent received shall be valid.
5.2 Processing of personal data on the basis of a contract
In the context of the exercise of contractual rights and the performance of contractual obligations of the Company and the individual, personal data of individuals are processed in particular for the following purposes:
identification of the individual, preparation of the quotation, conclusion of the contractual relationship, provision of the services ordered, notification of any changes, additional details and instructions for the use of the services, resolution of any technical problems, objections or complaints, billing of the services, and for other purposes necessary for the performance or conclusion of the contractual relationship between the Company and the individual.
5.3 Processing of personal data based on law or legitimate interest
On the basis of the law or the legitimate interest of the Company, the personal data of individuals are processed in particular for the purpose of billing and invoicing for the Company's services, for the implementation of appropriate measures to control and prevent possible fraud or other unlawful conduct to the detriment of the individual or the Company, and, furthermore, in the context of ensuring the stable and secure operation of the Company's systems and services, also for the purposes of implementing information security measures, complying with service quality requirements and detecting technical malfunctions of the systems and services.
On the basis of the law or the legitimate interest of the Company, the personal data of individuals are also used for the purposes of possible enforcement, judicial and extrajudicial recovery and in accordance with tax legislation.
In the case of billing for services, the address of the individual is also obtained and processed for the purpose of correct invoicing on the basis of tax regulations.
6 Transmission or contractual processing of personal data
If necessary, other external companies and individuals (hereinafter referred to as "contract processors") are authorised to carry out certain processing tasks which contribute to the Company's services.
In such a case, the Company may also transfer personal data to such carefully selected contract processors who will have previously entered into a contract with the Company for the processing of personal data or a substantively identical agreement or other binding document (hereinafter referred to as the "Processing Contract").
The personal data of individuals shall only be provided to the contractual processors to the extent required for the specific purpose. Such data may not be used for any other purpose by the contract processor, which shall at least comply with all the standards for the processing of personal data provided for by the applicable law. The contract processors are contractually bound to the Company to respect the protection and confidentiality of the personal data of individuals.
For more detailed information on the Contract Processors, individuals may obtain, upon written request, information from the Data Protection Officer at: dpo@verstovsek-estate.com.
Upon a reasoned request, the Company shall also disclose personal data to the competent state authorities which have a legal basis to do so. For example, the Company will respond to requests from courts, law enforcement authorities and other public authorities, which may include public authorities of another EU Member State.
7 Period of retention of personal data
Personal data shall not be kept for longer than is necessary for the purpose for which it was collected. This means that personal data shall be destroyed or deleted from the Company's system when it is no longer needed, unless otherwise provided by applicable law or other lawful basis.
The Company has appropriate measures in place to ensure that the data it processes about individuals is held in accordance with these principles:
-at least for as long as is necessary for the performance of the service, including any complaints, objections or claims regarding the service provided;
-as required by law, contract or legal obligation of the company or until the consent is withdrawn, if the data is processed on that basis; or
-for as long as necessary for the purposes for which it was collected or for a longer period if required by applicable law or for statistical purposes, subject to appropriate security measures.
Billing data and related contact details of individuals may be retained for the purpose of fulfilling contractual obligations until payment for the service has been made in full or, at the latest, until the expiry of the limitation periods in respect of a particular claim.
Invoices shall be kept for a period in accordance with tax legislation.
After the expiry of the retention period, the data shall be deleted, destroyed, blocked or anonymised.
8 Rights of individuals with regard to the processing of personal data
The persons who become aware of personal data are, in particular, the Company's external contractors and the Company's employees, who are obliged to respect and protect the personal data of customers/individuals on the basis of the labour law and the employment contract or other cooperation agreement.
9 Rights of individuals in relation to the processing of personal data
Individuals have the following rights in relation to the processing of personal data in accordance with the applicable data protection legislation:
-the right of access to data;
-the right to rectification;
-the right to erasure ("right to be forgotten");
-the right to restriction of processing;
-the right to data portability;
-the right to object;
-the right to lodge a complaint with the Information Commissioner.
The exercise of the individual's rights relating to the processing of personal data shall be ensured without undue delay.
The Company shall decide on the individual's request within one month of receipt of the request. In the case of complexity and a large number of requests, the time limit may be extended by up to two additional months. Any such extension shall be notified to the individual within one month of receipt of the request, together with the reasons for the delay and the possibility of lodging a complaint with the Information Commissioner.Requests concerning the exercise of individuals' rights should be addressed to dpo@verstovsek-estate.com or physically by post to the address of the Company's registered office.
Where the request is made by electronic means, the information shall, where possible, be provided by electronic means, unless the individual requests otherwise.
Where there is reasonable doubt as to the identity of the individual making a request in relation to any of his or her rights, the Company may request the provision of additional information necessary to confirm the identity of the data subject.
If the data subject's requests are manifestly unfounded or excessive, in particular because they are repetitive, the Company may:
-harge a reasonable fee, taking into account the administrative costs of providing the information or communication or of carrying out the requested action; or
-refuse to act on the request.
9.1 Right of access to information
The data subject shall at all times have the right of access to his or her personal data and to the simple exercise of this right at reasonable intervals in order to inform himself or herself about processing and to verify its lawfulness.
The individual shall also at all times have the right to know whether personal data concerning him or her are being processed and, if so, to the following information:
-the purpose of the processing,
-the types of personal data processed,
-the users or categories of users to whom the personal data have been or will be disclosed,
-the envisaged period of retention of the personal data or, if this is not possible, the criteria to be used to determine that period,
-the existence of a right to request the rectification or erasure of personal data or the restriction of the processing of such personal data, and the existence of a right to object to such processing,
-the right to lodge a complaint with the Information Commissioner.
9.2 Right to rectification
The data subject shall have the right to obtain the rectification, without undue delay, of inaccurate personal data relating to him or her and, taking into account the purposes of the processing, the right to have incomplete personal data completed, including by submitting a supplementary declaration.
9.3 Right to erasure ('right to be forgotten')
The individual has the right to obtain the erasure of his or her personal data without undue delay where one of the following applies:
-where the personal data are no longer necessary for the purposes for which they were collected or otherwise processed, where the data subject withdraws the consent on the basis of which the processing is carried out and there is no other legal basis for the processing,
-where he or she objects to processing and there are no overriding legitimate grounds for processing,
-where the personal data have been unlawfully processed,
-where the personal data must be erased in order to comply with a legal obligation under EU or Slovenian law.
9.4 Right to restriction of processing
The data subject shall have the right to obtain the restriction of the processing of personal data concerning him or her where one of the following applies:
- where the data subject contests the accuracy of the personal data, for a period which permits verification of the accuracy of the personal data,
- where the processing is unlawful and the data subject objects to the erasure of the personal data and requests instead the restriction of their use,
- where the personal data of the data subject are no longer necessary for the purposes of the processing, but are necessary for the establishment, exercise or defence of legal claims,
- where the data subject raises an objection to processing based on the legitimate interests of the company, pending verification whether the legitimate interests of the company override those of the data subject.
Where the processing of personal data has been restricted in accordance with the above paragraph, such personal data shall, with the exception of their storage, be processed only with the consent of the data subject or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person.
Before revoking the restriction on the processing of personal data, the Company shall inform the data subject thereof.
9.5 Right to data portability
The data subject shall have the right to receive the personal data provided in a structured, commonly used and machine-readable format, and the right to have that data transmitted to another controller, without being hindered by the Company, where the processing is based on the data subject's consent and the processing is carried out by automated means (means of information technology).
At the request of the data subject, where technically feasible, personal data may be directly transferred to another controller.
9.6 Right to object
Where personal data are processed for direct marketing purposes, the data subject shall have the right to object to processing of personal data concerning him or her for such marketing.
Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for those purposes.
9.7 Right to lodge a complaint concerning the processing of personal data
A complaint may be lodged with the Information Commissioner against the Company's silence (i.e. the Company's failure to respond to the individual within 1 month) or against the Company's refusal to respond to the individual's right, and the Information Commissioner is competent to deal with such complaints.
The individual also has the right to lodge a complaint directly with the Information Commissioner if he or she considers that the processing of personal data breaches Slovenian or EU data protection law.
10 Final provisions
Anything not covered by the Privacy Policy shall be governed by the applicable law in force at the time.
The Company reserves the right to amend this document. Individuals shall be informed of the amendment by posting it on the Company's official website www.verstovsek-estate.com or by other appropriate means, 8 days before it becomes effective.
Questions about the Privacy Policy or about the information the Company holds about individuals should be sent to the following email address: dpo@verstovsek-estate.com or directly to the Company.
11 Publication of the Privacy Policy
The Privacy Policy is published and accessible on the website www.verstovsek-estate.com and in physical form at the Company's registered office.