PERSONAL DATA PROTECTION POLICY

The purpose of this personal data protection policy is to inform individuals, users of services, partners, employees, and other persons (hereinafter: the “individual”) who cooperate with Center RINKA, Institute for Tourism and Sustainable Development of the Solčavsko Area (hereinafter: the “organization”) about the purposes, legal bases, security measures, and the rights of individuals regarding the processing of personal data carried out by our organization.

We value your privacy and therefore always protect your data with due care.

We process personal data in accordance with European legislation (Regulation (EU) 2016/697 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter: the “General Regulation”)), applicable Slovenian legislation in the field of personal data protection, and other legislation that provides a legal basis for the processing of personal data.

This personal data protection policy contains information on how our organization, as a controller, processes personal data received from an individual on the basis of legal grounds.

1) Controller

The controller of personal data is the organization:

CENTER RINKA, INSTITUTE FOR TOURISM AND SUSTAINABLE DEVELOPMENT OF THE SOLČAVSKO AREA

Solčava 29

3335 Solčava

info@solcavsko.info

038390710

2) Data protection officer

In accordance with Article 37 of the General Regulation, we have appointed the company below as our data protection officer:

DATAINFO.SI, d.o.o.

Tržaška cesta 37c, Ljubljana

www.datainfo.si

e-mail: dpo@datainfo.si

telephone: +386 (0) 2 620 4 300

3) Personal data

Personal data means any information relating to an identified or identifiable individual; an identifiable individual is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that individual.

4) Purposes of processing and legal bases for processing

The organization collects and processes your personal data on the following legal bases:

• processing is necessary for compliance with a legal obligation to which the controller is subject;
• processing is necessary for the performance of a contract to which the individual is a party, or in order to take steps at the request of the individual prior to entering into a contract;
• processing is necessary for the purposes of legitimate interests pursued by the controller or by a third party;
• the individual has consented to the processing of their personal data for one or more specific purposes;
• processing is necessary to protect the vital interests of the individual or of another natural person.

Purchasing goods and services in a physical store

When an individual makes a purchase in a physical store, the purchase can generally be completed without processing personal data, unless the nature of the purchase requires the processing of personal data for its execution.
The legal basis for processing is the contract. The retention period is until the purpose of the contract is fulfilled, or up to 6 years after the contract ends.

Purchasing goods and services in the online store
The company processes personal data in online operations within the online store when an individual submits an online form, registers (creates a user account), or makes a purchase (successfully places an order) via the online store as an unregistered user. When a user purchases a product without registration or logging into a user account, the company processes personal data that are necessary for fulfilling the given order, business communication, and the exercise of rights and obligations arising from the concluded contract, namely: first name, last name, delivery address, e-mail address, telephone number, information about the ordered product and payment.

When an individual registers a user account or makes a purchase as a registered user, they enter into a contract with the company for providing services to registered users. The categories of personal data processed during registration are: first name, last name, delivery addresses, e-mail address, telephone number, data on ordered/purchased products, data on favorite products, payment data, data on discounts obtained, or other data provided by the user in their profile. In the case of user account registration, personal data are stored in the user’s profile. In addition to the purposes stated above, the data are also processed for automated completion of data for placing orders, displaying purchase history, evaluating the offer, improving the services and offer of the online store, increasing customer satisfaction, studying user habits, and creating special offers and benefits intended exclusively for registered users.

The legal basis for processing is the contract. The retention period is until the purpose of the contract is fulfilled, or up to 6 years after the contract ends.

Notifying individuals by e-mail, e.g., newsletters
Based on its lawful activities, the company may inform customers and users of its services via their e-mail address about its services, events, education and training, offers, and other content. An individual may at any time request that such communication and processing of personal data be discontinued and may unsubscribe using the unsubscribe link in the received message, or submit a request by e-mail or by regular mail to the company’s address.

The legal bases for processing are legitimate interest and consent. The data will be processed until the individual unsubscribes or withdraws consent, or until the purpose of processing is fulfilled. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

4.1) Compliance with a legal obligation

On the basis of legal provisions, the organization processes data about its employees as permitted by labor and social security legislation. On the basis of a legal obligation, for employment purposes the organization processes primarily the following categories of personal data: first and last name, gender, date of birth, personal identification number (EMŠO), tax number, place, municipality and country of birth, citizenship, residence, etc. The legal basis for processing individuals’ personal data also includes: the Act on the Promotion of Tourism Development. In limited cases, the processing of personal data within the organization is also permissible on the basis of public interest. All applicable sectoral regulations in this field are collected on the website of the competent ministry: https://www.gov.si/drzavni-organi/ministrstva/ministrstvo-za-kulturo/zakonodaja/.

4.2) Performance of a contract

Where an individual concludes a contract with the organization, this contract constitutes the legal basis for processing personal data. We may process personal data for the conclusion and performance of the contract, such as the sale of tickets, etc. If an individual does not provide personal data, the organization cannot conclude the contract, nor can it provide the service or deliver goods or other products in accordance with the contract, because it lacks the data required for performance. Based on its lawful activities, the organization may inform individuals and users of its services via their e-mail address about its services, events, education and training, offers, and other content. An individual may at any time request that such communication and processing of personal data be discontinued and may unsubscribe using the unsubscribe link in the received message, or submit a request by e-mail to info@solcavsko.info or by regular mail to the organization’s address: Center Rinka, Institute for Tourism and Sustainable Development of the Solčavsko Area, Solčava 29, 3335 Solčava.

4.3) Legitimate interest

The organization may also process personal data on the basis of a legitimate interest it pursues. This is not permissible where such interests are overridden by the interests or fundamental rights and freedoms of the individual which require the protection of personal data. When relying on legitimate interest, the organization always performs an assessment in accordance with the General Regulation. Processing personal data for direct marketing purposes is considered to be carried out in the legitimate interest. The organization may process personal data of individuals collected from publicly available sources or in the course of lawful activities, also for the purposes of offering goods, services, employment, informing about benefits, events, etc. To achieve these purposes, the organization may use regular mail, telephone calls, e-mail, and other telecommunications means. For direct marketing purposes, the organization may process the following personal data: first and last name, permanent or temporary residence address, telephone number, and e-mail address. The organization may process these personal data for direct marketing purposes even without the individual’s explicit consent. An individual may at any time request that such communication and processing of personal data be discontinued and may unsubscribe using the unsubscribe link in the received message, or submit a request by e-mail to info@solcavsko.info or by regular mail to the organization’s address: Center Rinka, Institute for Tourism and Sustainable Development of the Solčavsko Area, Solčava 29, 3335 Solčava.

4.4) Processing based on consent

If the organization does not have a legal basis established by law, contractual obligation, or legitimate interest, it may request the individual’s consent. In that case, it may process certain personal data for the following purposes, where the individual provides consent:

• residential address and e-mail address for the purposes of notifications and communication;
• photographs, video recordings, and other content relating to the individual (e.g., publication of images of individuals on the organization’s website) for the purposes of documenting activities and informing the public about the organization’s work and events;
• other purposes to which the individual agrees by giving consent.

If an individual gives consent for the processing of personal data and later no longer wishes this, they may request that the processing be discontinued by sending a request by e-mail to info@solcavsko.info or by regular mail to the organization’s address: Center Rinka, Institute for Tourism and Sustainable Development of the Solčavsko Area, Solčava 29, 3335 Solčava. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

4.5) Processing necessary to protect the individual’s vital interests

The organization may process personal data where this is necessary to protect the vital interests of the individual. In urgent cases, the organization may locate the individual’s identity document, verify whether the person exists in its records, review their history, or contact their relatives, for which the organization does not need the individual’s consent. This applies where it is necessary to protect the vital interests of the individual.

5) Storage and deletion of personal data

The organization will store personal data only for as long as necessary to fulfill the purpose for which the personal data were collected and processed. Where the organization processes data on the basis of law, it will store them for the period prescribed by law. Some data are stored for the duration of cooperation with the organization, while some must be stored permanently. Personal data processed on the basis of a contractual relationship are stored for the period necessary to perform the contract and for 6 years after its termination, except where a dispute arises between the individual and the organization regarding the contract. In such a case, the organization stores the data for 10 years after the finality of a court decision, arbitration, or court settlement, or, if there was no judicial dispute, for 5 years from the date of an amicable resolution of the dispute. Personal data processed on the basis of the individual’s consent or legitimate interest will be stored until consent is withdrawn or until a request for deletion is made. Upon receipt of withdrawal or a deletion request, the data will be deleted no later than within 15 days. The organization may delete the data earlier if the purpose of processing has been achieved or if required by law.

Exceptionally, the organization may refuse a request for deletion on grounds set out in the General Regulation, such as: exercising the right to freedom of expression and information, compliance with a legal obligation, reasons of public interest in the area of public health, archiving in the public interest, scientific or historical research purposes or statistical purposes, and the establishment, exercise, or defense of legal claims. After the retention period expires, the organization must effectively and permanently delete or anonymize personal data so that they can no longer be linked to an identified individual.

6) Contract processing of personal data and data export

The organization may, on the basis of a data processing agreement, entrust specific personal data to a contractual processor. Contractual processors may process the entrusted data exclusively on behalf of the controller, within the limits of the controller’s authorization set out in a written agreement or other legal act, and in accordance with the purposes defined in this privacy policy.

Contractual processors with whom the organization cooperates include in particular:

• accounting services and other providers of legal and business consulting;
• information systems maintainers;
• tour guiding service providers,
• e-mail service providers and providers of software and cloud services (e.g., ARNES, Microsoft, Google);
• social media and online advertising providers (Google, Facebook, Instagram, etc.).

In no case will the organization disclose an individual’s personal data to unauthorized third parties. Contractual processors may process personal data only within the scope of the organization’s instructions and may not use personal data for any other purposes.

As a controller, the organization and its employees do not transfer personal data to third countries (outside the member states of the European Economic Area – EU member states and Iceland, Norway, and Liechtenstein) or to international organizations.

For the purpose of better oversight and control over contractual processors and the proper arrangement of the contractual relationship, the organization maintains a list of contractual processors, which includes all specific contractual processors with whom the organization cooperates.

7) Cookies

The organization’s website operates with so-called cookies. A cookie is a file that stores website settings. Websites store cookies on users’ devices with which they access the internet in order to recognize individual devices and the settings used when accessing the website. Cookies enable websites to recognize whether a user has already visited the site. In advanced applications, certain settings can be adjusted accordingly. Cookie storage is fully controlled by the browser used by the individual, which can restrict or completely disable the storing of cookies as desired.

Cookies are essential for providing user-friendly online services. They are used to store data about the status of individual web pages, help collect statistics on users and website traffic, etc. With the help of cookies, we evaluate the effectiveness of our website design.

The organization’s website uses the following cookies:

Cookies stored by the browser can be deleted by the individual (instructions are available on the websites of individual browsers).

8) Data security and data accuracy

The organization ensures information security and the security of infrastructure (premises and application/system software). Our information systems are protected, among other things, by antivirus software and a firewall. We have implemented appropriate organizational and technical security measures intended to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, and against other unlawful and unauthorized forms of processing. When transmitting special categories of personal data, we transmit them in encrypted form and protected by a password.

The individual is responsible for providing personal data securely and for ensuring that the data provided are accurate and truthful. The organization will make efforts to ensure that personal data it processes are accurate and, where necessary, kept up to date; from time to time, the organization may contact the individual to confirm the accuracy of personal data.

9) Rights of the individual regarding data processing

Under the General Regulation, the individual has the following personal data protection rights:

• to request information on whether we have their personal data and, if so, which data we have, on what basis we have them, and why we use them;
• to request access to their personal data, enabling them to receive a copy of the personal data held by the organization and to verify whether the organization processes them lawfully;
• to request rectification of personal data, such as correcting incomplete or inaccurate personal data;
• to request erasure of their personal data where there is no reason for continued processing, or where they exercise their right to object to further processing;
• to object to further processing of personal data where the organization relies on a legitimate business interest (including a legitimate interest of a third party), where there are reasons relating to the individual’s particular situation; the individual has the right to object at any time if the organization processes personal data for direct marketing purposes;
• to request restriction of processing of their personal data, meaning the suspension of processing, for example if the individual wants the organization to establish the accuracy of the data or to verify the reasons for further processing;
• to request the transfer of their personal data in a structured electronic form to another controller, where possible and feasible;
• to withdraw consent given for the collection, processing, and transfer of their personal data for a specific purpose; upon receiving notice of withdrawal, the organization will stop processing personal data for the purposes for which it was originally collected, unless the organization has another lawful legal basis to do so.

If an individual wishes to exercise any of the rights listed above, they may submit a request by e-mail to info@solcavsko.info or by regular mail to the organization’s address: Center Rinka, Institute for Tourism and Sustainable Development of the Solčavsko Area, Solčava 29, 3335 Solčava. The organization will respond to a request concerning the rights of the individual without undue delay and in any event within one month of receiving the request. If, taking into account the complexity and number of requests, this period needs to be extended (by up to two additional months), you will be informed of this. Access to and exercise of these rights are free of charge. However, the organization may charge a reasonable fee or refuse to act on the request if it is manifestly unfounded or excessive, in particular if it is repetitive. In such a case, the organization may also refuse the request. In the course of exercising rights under this section, the organization may require certain information from the individual to help confirm the individual’s identity; this is a security measure ensuring that personal data are not disclosed to unauthorized persons.

In exercising rights under this section, or if an individual believes that their rights have been violated, they may contact the supervisory authority, the Information Commissioner of the Republic of Slovenia, at: https://www.ip-rs.si/.

If an individual has any questions regarding the processing of their personal data, they may always contact our organization by e-mail at info@solcavsko.info or by regular mail to the organization’s address: Center Rinka, Institute for Tourism and Sustainable Development of the Solčavsko Area, Solčava 29, 3335 Solčava.

10) Publication of changes

Any changes to our Personal Data Protection Policy will be published on the organization’s website at: https://www.logarska-solcavsko.si/politika-zasebnosti/. By using the website, the individual confirms that they accept and agree to the full content of this personal data protection policy.

This personal data protection policy was adopted by the responsible person of the organization on 7 April 2023.