Privacy policy

This is a courtesy translation. In the event of any discrepancy, the Slovene version prevails.

This privacy policy (hereinafter: Policy) explains in detail how the controller collects, uses, stores and protects the personal data of users, buyers and other individuals in connection with the use of the website and online shop and with the conclusion and performance of contracts.

The Policy is drawn up in accordance with Regulation (EU) 2016/679 (GDPR), the Slovenian Personal Data Protection Act (ZVOP-2) and other applicable legislation of the Republic of Slovenia. Its purpose is to provide transparent, understandable and comprehensive information in accordance with Article 13 GDPR.

1. Data controller

The controller of personal data is:

Neja Bonbek Natek s.p.
Address: Tinjan 33, 6281 Škofije, Slovenia
Registration number: 3515397000
Tax number: SI 94848661
E-mail: info@ekakovost.si
Phone: +386 41 962 662

The controller is responsible for the lawful and secure processing of personal data and for the exercise of individuals' rights.

2. Scope and individuals concerned

This Policy applies to all processing of personal data carried out by the controller in connection with:

• visiting and using the website,
• registering a user account (where available),
• placing orders and making purchases,
• communicating with buyers and users,
• marketing activities carried out on the basis of consent.

The Policy applies to all individuals whose personal data the controller processes (buyers, users, newsletter subscribers, business partners).

3. Categories of personal data

Depending on the purpose of processing, the controller may collect and process the following categories of personal data:

• basic identification data (first name, surname),
• contact data (e-mail address, phone number),
• delivery and billing address data,
• data on orders, purchased products and payments,
• data on communication with the controller,
• technical data (IP address, browser type, date and time of access),
• data collected through cookies and similar technologies.

The controller does not process special categories of personal data within the meaning of Article 9 GDPR.

4. Purposes and legal bases of processing

The controller processes personal data exclusively for predetermined, lawful and transparently described purposes.

4.1 Performance of a contract (Article 6(1)(b) GDPR)

Personal data is processed for the purpose of:

• processing and fulfilling orders,
• delivering goods or services,
• issuing invoices and keeping payment records,
• communicating about orders,
• handling claims for non-conformity of goods.

4.2 Compliance with legal obligations (Article 6(1)(c) GDPR)

The controller processes personal data where necessary to comply with legal obligations, in particular under tax, accounting and consumer-protection legislation.

4.3 Legitimate interest (Article 6(1)(f) GDPR)

The controller may process personal data on the basis of legitimate interest for:

• ensuring the security of the website,
• preventing abuse, fraud and unauthorised access,
• improving the user experience,
• limited notifications about an unfinished order (abandoned cart), following a prior balancing test.

4.4 Consent (Article 6(1)(a) GDPR)

On the basis of express consent the controller processes personal data for:

• sending newsletters and other marketing messages,
• using analytics and advertising cookies,
• other purposes for which the law requires consent.

Consent is voluntary and can be withdrawn at any time without adverse consequences.

5. Cookies and similar technologies

The website www.ekakovost.si uses cookies to ensure basic functionality, security and content personalisation.

Non-essential cookies (analytics and marketing) are loaded exclusively on the basis of the user's prior express consent given through the cookie-management pop-up. A detailed description of cookie types, durations and purposes is provided in the separate Cookie policy.

6. Use of Google Analytics

If the user gives the appropriate consent, the controller may use Google Analytics to analyse website usage. In doing so personal data may also be processed in third countries (e.g. the United States of America).

In such cases the controller ensures appropriate safeguards, including standard contractual clauses, and allows the user to change or withdraw consent at any time in the cookie settings.

7. Retention of personal data

Personal data is retained only for as long as necessary to achieve the purpose for which it was collected:

• data relating to the contractual relationship is retained for the duration of the relationship and for as long as required by statutory retention periods,
• data processed on the basis of consent is retained until consent is withdrawn or for a maximum of 5 years from the last activity,
• technical data is retained for the period specified in the Cookie policy.

8. Disclosure to third parties

The controller may disclose personal data to third parties only where necessary to achieve the purpose of processing or where required by law.

Recipients of personal data may be:

• processors (e.g. delivery services, IT service providers),
• public authorities on the basis of a legal requirement.

The controller has concluded appropriate data-processing agreements with all processors.

9. Rights of individuals

In relation to the processing of their personal data, individuals have the following rights:

• the right of access to personal data,
• the right to rectification of inaccurate or incomplete data,
• the right to erasure of personal data,
• the right to restriction of processing,
• the right to object to processing,
• the right to data portability,
• the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia.

Individuals may exercise their rights by sending a request to the controller's contact details.

10. Automated decision-making and profiling

The controller does not carry out automated decision-making or profiling within the meaning of Article 22 GDPR.

11. Final provisions

The controller reserves the right to amend this Policy. The amended Policy takes effect on the day of publication on the website.

This Policy is permanently available on the controller's website at www.ekakovost.si.