PERSONAL DATA PROTECTION POLICY

We treat your personal data in accordance with the law, fairly, securely and transparently for you. We process personal data in accordance with European legislation (Regulation (EU) 2016/697 on the protection of individuals with regard to the processing of personal data and on the movement of such data (the “General Regulation”), applicable Slovenian legislation on the protection of personal data and privacy in electronic communications, and other regulations governing the protection of personal data.

We are aware of our responsibility because you have entrusted us with your personal data. Therefore, the following is all the key information regarding data processing, our obligations and your rights.

The purpose of the Personal Data Protection Policy is to inform the users of the service, individuals, colleagues, business partners, employees and other persons (hereinafter referred to as “the individual”) who cooperate with the company TURISTIKO D.O.O., Kozje 50a, 3260 Kozje, DŠ: SI14030446 (hereinafter referred to as “the company”) about the purposes and legal bases, data security measures and the rights of individuals with regard to the processing of their personal data carried out by our company.

When processing personal data, we rely on the legal bases for lawfulness of processing set out in Article 6(1) of the GDPR, namely: consent (a), performance of a contract (b), fulfilment of a legal obligation (c), performance of a task carried out in the public interest (e) and legitimate interest (f).

This policy describes the purposes for which and the manner in which we process the personal data we receive from you on the legal bases described below.

1. Personal data controller

The data controller is TURISTIKO D.O.O.

Company address: KOZJE 50 A, 3260 KOZJE
Telephone: 051 264 360
E-mail: INFO@KOZJANSKI-DVOR.SI

2. Data Protection Officer

In accordance with Article 37 of the General Regulation, we have not appointed an authorised person. If you have any questions regarding the processing of your personal data, you can contact us by e-mail: INFO@KOZJANSKI-DVOR.SI

3. Personal data

Personal data means any information relating to an identified or identifiable individual. This means that personal data is not only the name, surname, date of birth, address, registration number and tax identification number of an individual, but any information that allows a link to be established with a specific individual.

Individual – means an identified or identifiable natural person to whom personal data relate; a natural person is identifiable if he or she can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his or her physical, physiological, mental, economic, cultural or social individuality.

4. Purposes of processing and grounds for processing

The company collects and processes your personal data on the following legal bases:
– processing is necessary for compliance with a legal obligation to which the controller is subject;
– processing is necessary for the performance of a contract to which the data subject is a party or for the performance of measures at the request of such data subject prior to the conclusion of the contract;
– processing is necessary for the legitimate interests pursued by the controller or by a third party;
– the data subject has consented to the processing of his or her personal data for one or more specified purposes;
– processing is necessary for the protection of the vital interests of the data subject or of another natural person.

4.1. Compliance with the legal obligation

Under a legal obligation, companies mainly process data on their employees, as allowed by employment and social security legislation. As can be seen from the register of personal data files for controllers.

The company processes the following types of personal data for recruitment purposes, in particular on the basis of a legal obligation:

– name and surname
– address
– place and country of birth
– telephone number
– e-mail address
– gender
– date of birth
– EMN
– tax number

In limited cases, the processing of personal data is also permitted on the basis of public interest.

The company processes data on the amount of service payments in order to monitor monthly payments. We rely on a contractual legal basis to collect this data, and we are obliged to collect it under the VAT Act. In order to comply with our legal obligations, we will process your personal data in accordance with the tax regulations, which means that we will keep your data, such as the payer’s details (TRR, first name, last name), for ten years after the end of the calendar year in which we invoiced you, in the event of a financial transaction. The legal basis for this processing is the fulfilment of a legal obligation.

4.2. Implementation of the Contract

Where an individual enters into a contract with a company, this constitutes the legal basis for the processing of personal data. We are thus allowed to process personal data for the purpose of concluding and performing the contract. When we enter into a contract with an individual or a company, we obtain the following data:

– name and surname
– name of company
– address
– contact details
– email address
– telephone number
– tax number

If the data subject does not provide personal data, the company cannot conclude the contract, nor can the company perform the service or deliver the goods or other products to you in accordance with the contract, as it does not have the necessary data to perform the contract. The company may, on the basis of its lawful activity, inform individuals and users of its services of its services, events, training, offers and other content by sending an email to their email address. An individual may at any time request to cease such communications and processing of personal data and to opt-out of receiving communications via the unsubscribe link in the communication received, or as a request by email to INFO@KOZJANSKI-DVOR.SI or by regular mail to the Company’s address.

4.3. Legitimate interest

The legitimate interest ground is limited to processing by public authorities in the performance of their tasks. However, the company may also process personal data on the basis of legitimate interest, which the company pursues to a limited extent.

The latter shall not be admissible where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data. Where legitimate interest applies, the company shall always carry out an assessment in accordance with the GDPR.

This allows us to inform individuals about services, events, training, offers and other content from time to time by email, phone calls and regular mail.

The individual may at any time request the cessation of such communication and processing of personal data and cancel the receipt of communications via the unsubscribe link in the communication received, or as a request by email to INFO@KOZJANSKI-DVOR.SI si or by regular mail to the company’s address.

The purposes for which the personal data are processed, the legal basis for processing and the retention period.

Visit the website WWW.KOZJANSKI-DVOR.SI

Purpose of the processing of personal data: whenever you visit the WWW.KOZJANSKI-DVOR.SI website, the log files of the web server are automatically stored on the web server of the hosting provider. The web server hosting the WWW.KOZJANSKI-DVOR. website records information about the website visit, namely the IP address of the visitors, the browser version, the date and time, and the reconnection information.

TURISTIKO D.O.O. does not process the data collected in this way separately and does not link it to other data. The contractual processor (web server hosting provider) processes personal data only for the purpose of providing the website maintenance service at WWW.KOZJANSKI-DVOR.SI.

The purpose of these procedures is to ensure network and information security, i.e. to enable the detection and prevention of unauthorised access that may compromise the availability, integrity and confidentiality of stored or transmitted personal data and the security of related services accessible through these networks and systems. Such processing is necessary for the legitimate interests pursued by the company.

Legal basis for processing personal data:
Article 6(1)(e) of the General Data Protection Regulation and Article 6(4) of the Personal Data Protection Act (Official Gazette of the Republic of Slovenia No 136/22, hereinafter referred to as ZVOP-2).
Users or categories of users of personal data:
The contractual processor that maintains the website, for the purposes of ensuring the security and maintenance of the website.

Information on transfers of personal data to a third country or international organisation:
Data are not transferred to third countries or international organisations.

Retention period: the retention period of the web server log files is limited to 30 days.

Responding to enquiries (via the contact form)

Purpose of the processing of personal data: whenever an enquiry is sent from the contact form, a message from the visitor is sent to the company’s e-mail address. The following personal data is processed for the purpose of responding to the enquiry:

– name and surname
– address
– telephone number
– e-mail address

TURISTIKO D.O.O. collects and processes personal data of senders or potential buyers (name and surname, address, e-mail and telephone number) for the purpose of responding to enquiries, making an offer according to the buyer’s enquiry or for the purpose of possible offer matching.

Legal basis: TURISTIKO D.O.O. collects and processes personal data for the purpose of responding to enquiries. Such processing is necessary for the legitimate interests pursued by the company.

TURISTIKO D.O.O. does not collect personal data from individuals for the purpose of sending them unnecessary advertising messages, but only for the purpose of mandatory information.

Retention period: we will keep personal data of customers for our own use only and will delete it at the customer’s request.

Cookies and other data

When you use the services at WWW.KOZJANSKI-DVOR.SI , other data or information may also be recorded on a systemic basis and processed by us for the purposes of
internal analysis, to improve our services, for statistical processing and for security reasons.

The data we process for the purposes described are:
1. cookies,
2. data about the use of the services (web browser and current IP address of the device, time and duration of access to these websites, websites from which these websites are clicked),

In the case referred to in point 1, your personal data is processed on the basis of the provisions of the Electronic Communications Act (Journal of Laws of the Republic of Slovenia, No. 130/22, as amended). With the exception of the processing of personal data by means of cookies that are necessary for the operation of the Websites, other cookies are only placed with the prior consent of the data subject (legal basis referred to in point a of Article 6/I of the General Data Protection Regulation).

In the case referred to in point 2, we base the processing of personal data on point (f) of Article 6/I of the General Data Protection Regulation (the legitimate interests of the controller to provide user-friendly services tailored to users’ needs, to reduce the risk of abuse, to detect abuse and to ensure the security of its network and information). Where the purpose pursued can be achieved, anonymised data will be used in the statistical processing. Anonymised data can no longer be linked to the user who provided such personal data, and therefore this Privacy and Data Protection Policy does not apply to the processing of such data).

Age limit for information society services
The services of WWW.KOZJANSKI-DVOR.SI are intended for persons over 16 years of age, and when sending an enquiry or registering for educational content or online analysis, the user must confirm that he/she is over 16 years of age, that the information provided is true and authentic, and that he/she has read and understood the explanatory notes to the consent to the processing of personal data.

Information about age is not a condition for using WWW.KOZJANSKI-DVOR.SI and we are not obliged to verify which information relates to persons under the age of 16. Parents and legal guardians of children under the age of 16 are advised to properly instruct children under the age of 16 about the safe use of the Internet and the provision of their personal data. All risks arising from the inability of a minor to assume the applicable obligations are the responsibility of his/her parents and guardians.

4.4. Processing on the basis of consent or consent

If the company does not have a legal basis based on the law, a contractual obligation or a legitimate interest, it may ask the individual for consent or assent. In this way, it may also process certain personal data of the data subject for the following purposes, where the data subject has given his or her consent:

– your home address and email address for information and communication purposes;
– photographs, videos and other content relating to the individual (e.g. publication of photographs of individuals on the company’s website) for the purposes of documenting the activities and publicising the work and events of the company:
– other purposes for which the individual has consented.

Newsletter subscription (series of educational e-mails, occasional e-newsletters)

Purpose of the processing of personal data:
When subscribing to the newsletter (series of educational e-mails) WWW.KOZJANSKI-DVOR.SI processes, in addition to your IP number, your e-mail address (e-mail address) that you enter in the online form and the date and time of your subscription. TURISTIKO D.O.O. processes this data solely for the purpose of carrying out the series of educational e-mails to which the user has subscribed or, when submitting the online analysis, has agreed to receive periodic e-mails.

Legal basis for processing personal data:
We process personal data (e-mail address) on the basis of the individual’s valid consent (Article 6(a) of the Regulation). When filling in the online newsletter subscription form, please indicate that you consent to TURISTIKO D.O.O. using your e-mail address for the purpose of online sales training and that you are aware that you can unsubscribe from receiving the newsletter at any time.

To do this, click on the unsubscribe link in the email sent to you. If you do not confirm that you agree to the above in two steps (entering your email address and clicking on the confirmation message), TURISTIKO D.O.O. will not send you notifications to your email address, nor will it collect or process your email address.

TURISTIKO D.O.O. uses a system of prior approval of the use of e-mail addresses to subscribe to the newsletter, which means that it only sends e-mails to persons who explicitly agree to receive e-mail notifications.

Retention period: we will keep your email data until you cancel or unsubscribe from our newsletter. If you do not unsubscribe from our newsletter, we will keep your email details for the duration of the newsletter.

If the data subject has given his or her consent to the processing of personal data and at some point no longer wishes to do so, he or she may also request that the processing of personal data be terminated by sending a request by e-mail to INFO@KOZJANSKI-DVOR.SI or by regular mail to the Company’s address. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.

4.5. Processing is necessary for the protection of the vital interests of the individual

The company may process the personal data of the data subject insofar as this is necessary to protect his or her vital interests. In urgent cases, the company may search for a personal document of the data subject, check whether that person exists in its database, examine his/her medical history or contact his/her relatives, without the company needing the data subject’s consent. The above applies in the case where it is strictly necessary to protect the vital interests of the individual.

5. Retention and deletion of personal data

The company will keep personal data only for as long as necessary to fulfil the purpose for which the personal data were collected and processed. If the company processes the data on the basis of the law, it will keep the data for the period prescribed by the law.

Some data is retained for the duration of your relationship with the company, while some data must be retained permanently. We will keep the personal data that the company needs for the performance of the contract for as long as is necessary for the performance of the contract and for five years after the end of the calendar year in which the contract has ended, unless a longer retention period would be necessary due to a dispute relating to the contract. In such case, we will retain your personal data for 10 years after the end of the calendar year in which the court decision, arbitration or court settlement becomes final or, if there has been no litigation, for 5 years after the end of the calendar year from the date of amicable settlement of the dispute.

Those personal data that are processed by the company on the basis of the individual’s personal consent or legitimate interest will be kept by the company until the consent is withdrawn or until the data are erased. Upon receipt of a revocation or a request for erasure, the data shall be erased within a maximum of 15 days. The company may also delete the data prior to revocation where the purpose of the processing of personal data has been achieved or where required by law.

Exceptionally, a company may refuse a request for erasure on the grounds set out in the GDPR, such as the following: the exercise of the right to freedom of expression and information, compliance with a legal obligation to process, grounds of public interest in the field of public health, archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, the exercise or defence of legal claims.

After the retention period, the company must effectively and permanently erase or anonymise the personal data so that it can no longer be linked to a specific individual.

6. Contractual processing of personal data and data export

The company may entrust individual processing of personal data on the basis of a contractual processing contract to a contractual processor with whom it has a contractual processing contract. The contractual processors may process the entrusted data exclusively on behalf of the controller, within the limits of its authorisation, which is enshrined in a written contract or other legal act and in accordance with the purposes set out in this privacy policy.

The contractual processors with which the company cooperates are:
– accounting services and other providers of legal and business advice,

-web server hosting providers,
– information systems maintainers,
– email service providers and software providers, cloud services,
– providers of social networks and online advertising (Google, Facebook, Instagram, Linkedin, etc.).

In order to improve the overview and control of the contractual processors and the regularity of the contractual relationship between them, the company also maintains a list of contractual processors, which lists all the specific contractual processors with which the company cooperates.

For some services, we may also disclose your personal data to potential project partners, supervisory authorities or upon request by a judicial authority. Under no circumstances will the company pass on personal data of an individual to unauthorised third parties. Contract processors may only process personal data within the scope of the Company’s instructions and may not use personal data for any other purpose.

The company as controller and its employees do not export personal data to third countries (outside the Member States of the European Economic Area – EU Member States plus Iceland, Norway and Liechtenstein) and to international organisations, except to the USA, where the relationship with US contract processors is governed by standard contractual clauses (standard contracts adopted by the European Commission) and/or binding corporate rules (adopted by the company and approved by the supervisory authorities in the EU).

Transmission of personal data to third parties

Please note that your personal data may also be accessible:

1. our verified contractual processors who enable us to develop and maintain the website, store databases, provide electronic information, prepare web analyses and educational content (on the basis of a service contract and an agreement pursuant to Article 28 of the General Data Protection Regulation),

2. to authorised persons and competent state authorities which have the appropriate legal basis in their own legal provisions for obtaining and processing the data (on the basis of Article 6(c)(I) of the GDPR – the implementation of a legal obligation).

Whenever we transmit your personal data, we take appropriate technical and organisational measures to ensure the security of your personal data and all recipients of your data are obliged to take the same measures.

Transfers of personal data to third countries

We only transfer data to third countries (outside the EU and EEA) if we have your explicit consent to such transfer and where it is strictly necessary for the performance of our contractual and legal obligations. In the event of an export of your personal data, we will do so to the minimum extent necessary to provide the services at WWW.KOZJANSKI-DVOR.SI .

Your data may be transferred:
– to the USA in the case of your consent to the display of personalised advertisements on this website (e.g. to Google, Inc.), in the case of the transmission of e-notifications (Elasticmail), in the case of the input of your personal data in the context of the various forms through which WWW.KOZJANSKI-DVOR.SI communicates with its users (Ninja Form) and in the case of communication with social networks.

When transferring your personal data to third countries, in addition to the appropriate legal basis for such transfer, we also ensure that additional measures are in place to maintain an adequate level of security of your data during the transfer, based on the principles of Chapter V of the General Data Protection Regulation.

Social networks

For the purpose of communication and providing interesting content to WWW.KOZJANSKI-DVOR.SI users, we also use business profiles on the following social networks:
Meta Platforms, Inc., which operates Facebook and Instagram;
LinkedIn Ireland Unltd. Co., which operates the LinkedIn network;
Google, Inc., which operates YouTube

In these cases, we may obtain and process your data without transferring it to our internal databases WWW.KOZJANSKI-DVOR.SI
When using the business profiles mentioned above, authorised persons of the controller have access to your private messages and public announcements. However, we obtain statistical reports from social networking sites on visits to our profiles, general interests of visitors and demographic data. These reports do not contain personal data and are only used to help us provide interesting content to users of our services.

In the case of the use of the services of these social networks and their interaction with these websites, the data is transferred to the USA, and the companies operating each network also independently manage the personal data they receive, which means that they determine the types of personal data they process and the purposes and legal bases on which the processing of personal data is carried out, and they also manage cookies on their websites and determine their purposes of use entirely independently.

We urge you, if you interact with the social networks referred to in the first paragraph of this point, to read their privacy policies, which are available at the links below:
Facebook
Instagram
LinkedIn
Youtube
Twitter

7. Cookies

The company’s website works with the help of cookies. A cookie is a file that stores the settings of web pages. Cookies are stored by websites on users’ devices that access the internet in order to identify the individual devices and the settings that users have used to access the internet. Cookies allow websites to identify if a user has already visited a website. In the case of advanced applications, they can be used to adjust individual settings accordingly. Their storage is under the full control of the browser used by the individual – which can restrict or completely disable the storage of cookies if desired.

Cookies are essential for providing personalised online services. They are used to store information about the state of a particular website, to help collect statistics about users and website traffic, etc. We use cookies to evaluate the effectiveness of our website design.

We need essential cookies for the website to function and you cannot turn off such cookies. Additionally and with your prior consent, we may also use cookies for the purposes of website usage analytics, social networking or to provide additional functionality. We use these cookies to evaluate the effectiveness of the design of our solutions and to provide you with the best possible user experience. Because we want to improve your user experience, we try to understand your use of our websites, services or tools. To do this, we use either internal or external tools to analyse application usage and user experience.

To manage cookies, we use the Cookieyes plugin, which allows users to be informed about the cookies that have been placed and to manage the consent to place individual cookies on the user’s device. More information about the cookies used by the WWW.KOZJANSKI-DVOR.SI website can be found by clicking on the cookie symbol at the bottom of the page, where you will find information about the type, duration and use of cookies.
When you first visit our site, you can set your preferred cookies or accept or reject all cookies.

For internal tools, we rely on the legal basis of our legitimate interest ((Article 6(1)(f) GDPR), and for third-party analytics tools, we will ask for your consent to provide data to these tools before using them. The legal basis for the cookie notice is the amended Act on Electronic Communications (Official Gazette No. 109/2012; hereinafter referred to as ZEKom-1), which entered into force on 15 January 2013.

8. Data protection and accuracy

The company takes care of information security and infrastructure security (premises and application system software). Our IT systems are protected by antivirus and firewall software, among other things. The company has put in place appropriate organisational and technical security measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access and against other unlawful and unauthorised forms of processing.

In the case of specific types of personal data, we provide them in encrypted and password-protected form. As an individual, it is your responsibility to provide us with your personal data securely and to ensure that the information provided is accurate and authentic. The Company (the Controllers) will endeavour to ensure that the personal data it processes is accurate and, where necessary, kept up to date, and may from time to time contact the individual to confirm the accuracy of the personal data.

9. Your rights regarding data processing

Under the GDPR (EU), the data subject has the following rights with regard to the protection of personal data:

– you can request information about whether we hold personal data about you and, if so, what data we hold, on what basis we hold it and why we use it;

– can request access to his/her personal data, which allows him/her to receive a copy of the personal data held by the company and to check whether the company is processing it lawfully;

– may request rectification of personal data, such as rectification of incomplete or inaccurate personal data;

– may request the erasure of his/her personal data where there is no longer any reason for further processing or where he/she exercises his/her right to object to further processing;

– to object to further processing of personal data where the company relies on legitimate business interest (including in the case of legitimate interest of a third party), where there are grounds relating to the particular situation of the data subject; the data subject has the right to object at any time if the company processes personal data for direct marketing purposes;

– may request the restriction of the processing of his or her personal data, which means the interruption of the processing of personal data, for example if the data subject wishes the company to establish its accuracy or to verify the grounds for further processing of personal data;

– may request the transfer of his/her personal data in a structured electronic format to another controller, insofar as this is possible and feasible;

– you may withdraw the consent or consent you have given to the collection, processing and transfer of your personal data for a specific purpose; upon notification that you have withdrawn your consent, the company will cease to process your personal data for the purposes for which you originally consented, unless the company has no other lawful legal basis to do so lawfully.

If you wish to exercise any of the above rights, you can send your request by email to INFO@KOZJANSKI-DVOR.SI or by regular mail to our address.
We will respond to a request relating to the rights of an individual without undue delay and in any event within one month of receipt of the request. Should this time limit be extended (by up to two additional months), taking into account the complexity and number of requests, you will be informed.
Access to personal data and the exercise of rights is free of charge to the individual, but we may charge a reasonable fee if your request is excessive, manifestly unfounded or excessive, in particular if it is repetitive.

In this case, we may also refuse your request. If you exercise your rights under this Privacy Policy, we may need to request certain information from you to help us confirm your identity, as a security measure to ensure that your personal data is not disclosed to unauthorised persons.

At any time, and in particular if you feel that our exercise of your data protection rights is inadequate, you can contact us atINFO@KOZJANSKI-DVOR.SI.

In exercising your rights under this Title, or if you believe that your rights have been violated, you may contact the supervisory authority for protection or assistance, which in Slovenia is the Information Commissioner, Dunajska 22, 1000 Ljubljana, https://www.ip-rs.si.
If you have any further questions regarding our processing of your personal data, you may contact us at any time by email at INFO@KOZJANSKI-DVOR.SI or by regular mail to our address.

10. Publication of amendments

Any changes to our Personal Data Protection Policy will be published on the company’s website: www.KOZJANSKI-DVOR.SI. We strive to ensure that this policy is always in line with the law and our real activities in the field of personal data processing. We will therefore amend this policy from time to time and publish it on this website.

By using the website, the individual confirms that he or she accepts and agrees to the entire content of this Privacy Policy.

Last modified: 28.10.2025