Privacy policy

Controller and contact

Jasmina Audič
Planina 23, 4000 Kranj, Slovenia
awodiran@gmail.com

For questions about privacy or to exercise your rights, please contact us at the email or postal address provided. Telephone: +386 41 810221.

Data, purposes and legal bases

• Enquiries and arrangements: your name, contact details and message content are used to respond and arrange the contact you have requested. Where processing is necessary to take steps at your request before entering into a contract or to provide an agreed service, the legal basis is Article 6(1)(b) GDPR. For other routine correspondence, the legal basis is Article 6(1)(f) GDPR: the legitimate interest in responding to questions received and managing communications.
• Registration and delivery of activities: contact details, the selected activity and necessary organisational information are processed under Article 6(1)(b) GDPR where needed for the agreed participation. The rules in the next section also apply to special categories of personal data.
• Newsletters: if you subscribe separately to receive updates, your email address is used for that purpose on the basis of consent under Article 6(1)(a) GDPR. Sending an enquiry, visiting the website or registering for an event does not constitute a newsletter subscription. You can withdraw consent by email or by using the unsubscribe option in the message.
• Operation and security: technical data, such as your IP address, the time of the request and browser information, may be processed in hosting and security tool logs to keep the website operational, resolve errors and prevent misuse. The legal basis is Article 6(1)(f) GDPR: the legitimate interest in maintaining a secure, functioning website.
• Mandatory records: where a particular service gives rise to a legal obligation to keep business or accounting records, the relevant data is processed to meet that obligation under Article 6(1)(c) GDPR.

Providing contact details is voluntary, but we cannot respond without a way to reach you. Without the data needed for a requested activity or a legal obligation, it may not be possible to fulfil the arrangement. When data is collected for a particular activity, any mandatory data and the consequences of not providing it must be clearly identified. Consent to newsletters is not a condition of receiving a service.

Religious beliefs and other special categories of personal data

Participation in religious activities, membership or the content of a message may reveal religious or philosophical beliefs. Such data, as well as health data, receives additional protection under Article 9 GDPR. A contract or legitimate interest alone is not sufficient for processing it: both a legal basis under Article 6 and an applicable exception under Article 9(2) are required, for example explicit consent for a specific purpose.

Please do not send health data, personal photographs, dates of birth or information about relatives in a routine enquiry. Where a particular activity requires additional data, its purpose, the data needed, recipients, retention and legal bases are covered by a separate notice at the time of collection. The same applies to any photography, recording and publication. Sending a message, visiting the website or consenting to cookies does not in itself constitute explicit consent for these purposes.

How long data is kept

Retention periods depend on the purpose and the following criteria:

• correspondence is kept until the enquiry has been dealt with, and then only to the extent and for as long as needed for a further agreed obligation or to establish, exercise or defend legal claims;
• registration data is kept until the activity has taken place and related organisational tasks have been completed, subject to any mandatory record-keeping requirements;
• contractual and accounting data is kept for the period required by an applicable legal obligation or until the end of the period during which it is needed for a specific legal claim;
• newsletter data is kept until consent is withdrawn or newsletters are discontinued; minimal evidence of consent or unsubscription is kept only for as long as necessary to provide proof or honour the unsubscription;
• technical logs are kept for as long as needed to identify errors, security events and misuse; data relating to a specific incident is kept until the incident is resolved and any proceedings have concluded.

Once the purpose and relevant obligations no longer apply, data must be deleted or anonymised. Backups are intended for system recovery, and their retention is limited by that purpose and the backup replacement cycle. You can request details about the retention of your data using the contact details above.

Recipients and external services

Depending on the service used, data may be accessed to the extent necessary by people handling an enquiry or organising an activity, as well as providers of hosting, email, technical maintenance, security and backup services. Where additional services are requested, providers of video conferencing, newsletters, payment and accounting services may also be involved. Data is disclosed to competent authorities where there is a legal basis for doing so.

An external provider’s role depends on the service. A processor may process data on the controller’s instructions under an arrangement complying with Article 28 GDPR; a provider acting as an independent controller for its own purposes explains its processing in its own notice. You can request information about the recipients of your data at the email address above.

Online meetings via Google Meet

Mini meetings take place via Google Meet, with arrangements made by email. When you use the service, Google may process account and connection data, as well as audio, video and other content you share. Access details and information about how the individual meeting will be conducted are provided when arrangements are made. Before any recording or use of recordings, you must receive a separate notice and there must be an appropriate legal basis; participation alone does not constitute general consent to recording or public disclosure.

Processing outside the European Economic Area

The use of external services may involve processing or access to data outside the European Economic Area (EEA). In addition to a legal basis for processing, such transfers are subject to the conditions of Chapter V GDPR: an adequacy decision, appropriate safeguards or, only where the conditions are met, a specific derogation under Article 49. A general cookie preference does not authorise all international transfers.

Before data is collected for a service involving such a transfer, the information about that service must identify the recipient, country, purpose and legal basis used for the transfer. You can request information about the safeguards and how to obtain a copy using the contact details above. Where explicit consent under Article 49(1)(a) is used, the individual must also first receive information about the risks arising from the absence of an adequacy decision and appropriate safeguards.

Cookies and privacy settings

The website uses essential technical functions, localStorage and sessionStorage. A detailed list, purposes and durations are set out in the cookie policy. Statify is installed for basic page-view counting and does not use tracking cookies or an external analytics provider. This does not exclude technical logs maintained by hosting and security tools.

For optional external content, where available, you can make and change your choice using the “Privacy settings” button. Continuing to browse, scrolling or closing the notice does not constitute consent. Refusing consent does not prevent access to the basic content. Withdrawal stops optional embeds from loading further; cookies already stored by other domains can be removed in your browser settings.

Your rights

Subject to the conditions of the GDPR, you can request access to your data and a copy of it, rectification, erasure, restriction of processing and data portability for automated processing based on consent or a contract. You can object to processing based on legitimate interests on grounds relating to your particular situation; you can object to direct marketing at any time. The right to erasure is not unconditional, particularly where an applicable legal obligation or necessary legal claims are involved. Where the conditions of Article 22 GDPR are met, you also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

You can withdraw consent at any time by emailing the address above, and for optional online content you can also use the privacy settings. Withdrawal does not affect the lawfulness of processing before it was withdrawn. In your request, please provide enough information to identify the matter; where there are reasonable doubts, proportionate additional information may be requested to verify your identity.

Requests must be answered without undue delay and no later than one month after receipt. Depending on the complexity or number of requests, this period may be extended by up to two further months; you must be informed of the extension and the reasons for it within the first month. If your request is not granted, you must receive the reasons and information about lodging a complaint and seeking a judicial remedy within one month. Exercising your rights is generally free of charge.

Complaints and changes to this policy

You can lodge a complaint with the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, Slovenia; gp.ip@ip-rs.si; +386 1 230 97 30, or with another competent supervisory authority, in particular in the place of your habitual residence, place of work or the alleged infringement.

The current version of this policy is published on this page. Changes to the purpose of processing or other material information must be communicated to the individual before such processing begins.