GDPR

GDPR (RIGHTS OF USERS)

Personal data protection policy

As a data subject, you have certain rights associated with personal data collected on you by LTO Rogla–Zreče, Economic Interest Grouping.

1 Retention and processing use, scale and purpose

Personal data (name and surname, e-mail address) shall be collected, processed and retained by the controller for the following purposes:

• maintaining contact with clients,
• purchases in its online store,
• e-marketing communications,
• remarketing,
• social media advertising,
• monitoring the reading level of sent e-mails, namely which e-mail you have or haven’t opened, which links you have opened or clicked (which content you have read or browsed), how long you have read them or browsed through specific content,
• for analysing the life cycle of a website user: from where the user has arrived at the website (traffic source), for monitoring the time spent on the website, visited websites, downloaded or browsed content.

When e-mails are sent, displays on communications received by individuals and clicks on links in received communications are recorded. No profiling and no automated decision-making shall be performed on the basis of recorded data.

In compliance with the General Data Protection Regulation (GDPR), the collector shall collect, process and retain personal data based on the data subject specific consent. Consents shall be retained together with their content and the content of the form used to obtain them.

Personal data shall be used by the controller for the specified purposes and shall be transmitted to its contractual processor therefor. The contractual processor shall use them solely to this extent and in the context of the authorisation of the controller and shall also ensure personal data protection of data subjects.

2 Export

Personal data filing systems shall be retained on the territory of the Republic of Slovenia and shall not be exported to other countries.

3 Retention period

Data subject personal data shall be retained until withdrawal of their processing and retention consent. Personal data of the data subject shall be immediately effectively and permanently erased following withdrawal of consent.

If the aforementioned purposes of the controller, for which personal data are processed and retained, as verified on an annual basis, when the accuracy of personal data of data subjects is verified as well, cease, filing systems of data whose purpose has ceased shall be immediately effectively and permanently erased unless their retention is necessary for the establishment, exercise or defence of legal claims.

Data on displays of received communications and clicks on the links therein shall be retained for a period of 12 months from the date of communication transmission.

4 Rights of data subjects

In compliance with the General Personal Data Protection Regulation (GDPR), the controller shall guarantee the following personal data protection rights as outlined in further detail below:

• right to withdraw consent,
• right to access to data,
• right to rectification,
• right to erasure (‘right to be forgotten’),
• right to restriction of processing,
• right to data portability,
• right to object.
• Right to withdraw consent: when the processing of your personal data is based on your consent, it can be withdrawn at any time in the same way as it was given (electronically).
• Right to access to data: you shall have the right to obtain from the controller at any time information on the processed and retained data, including information on which personal data are retained, what they are used for, where they are collected if not directly from you, whom they have been disclosed to, the retention period of your personal data, your rights associated with your personal data and information on the potential existence of automated decision-making (including profiling) and the reasons for it in addition to the significance and foreseen effects of their processing for you.
• Right to rectification: You shall have the right to obtain from the controller the rectification of inaccurate personal data concerning you.

1. Right to restriction of processing: You shall have the right to obtain from the controller restriction of processing of your personal data where you contest the accuracy of your personal data for a period enabling the controller to verify the accuracy of the personal data;
2. the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
3. the controller no longer needs the personal data for the purposes of the processing, but they are required for the establishment, exercise or defence of legal claims;
4. you have objected to processing pending the verification whether the legitimate grounds of the controller override yours.

• Right to portability of data: You shall have the right to have your personal data transmitted directly from one controller to another, where technically feasible, if the processing is based on your consent or it is necessary for the performance of a contract and the processing is carried out by automated means.
• Right to object: if the processing is based on your consent or it is necessary for the performance of a contract and it is carried out by automated means, you shall have the right to object on grounds relating to your particular situation, at any time to processing of personal data concerning you and these grounds. Where your personal data are processed for the purposes of direct marketing, you shall have the right to object to such processing, including profiling to the extent that it is related to such direct marketing, at any time. Where personal data are processed for scientific or historical research purposes or statistical purposes, you, on grounds relating to your particular situation, shall have the right to object to processing of personal data concerning you, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
• Right to lodge a complaint In the event of an alleged infringement of personal data protection legislation in force, you shall have the right to lodge a complaint with a supervisory authority in the Member State of your habitual residence or place of the alleged infringement.

• Right to erasure: You shall have the right to obtain from the controller erasure of your personal data:

1. where your personal data are no longer necessary in relation to the purposes for which they are collected or otherwise processed,
2. where the processing is based on your consent that has been withdrawn and no other lawful basis for the processing exists,
3. where the processing is based on your consent that you object to and no other lawful basis for the processing exists,
4. where your personal data have been unlawfully processed,
5. where this is necessary for compliance with a legal obligation,
6. where personal data have been collected in relation to the offer of information society services directly to a child. The processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if that consent is given or authorised by the holder of parental responsibility over the child.

Where the controller intends to further process the personal data for a purpose other than that for which the personal data were collected, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information.

Where the data subject feels that their rights relating to the protection of personal data concerning him or her are in any way infringed, they may lodge a complaint with the supervisory body: the Information Commissioner of the Republic of Slovenia at any time: Republika Slovenija, Informacijski pooblaščenec, Zaloška 59, 1000 Ljubljana, Slovenia, https://www.ip-rs.si.

5 Validity

In force as of 30/ 9/ 2019 and may be amended at any time.

All enquiries, queries and requests concerning the exercising of your statutory rights concerning the protection of personal data concerning you may be sent in writing to the following address:

LTO Rogla–Zreče, Economic Interest Grouping

Cesta na Roglo 13b,

SI - 3214 Zreče, Slovenia

Tel.: +386 3 759 04 70 or via e-mail: info@rogla-zrece.si