This policy applies to the processing (use) of personal data of visitors to our website, carried out by ŠTRUKELJ mit d.o.o. (controller) or on behalf of the controller.
Controller’s information:
ŠTRUKELJ mit d.o.o.,
Šempas 32a, 5261 Šempas, Slovenija
Tax number SI: 48437794
Company registration number: 1414925000
Phone number: +386 5 3077200
Email: info@sofo.eu
Types of Personal Data Processed
We collect your personal data when you provide it to us, such as when you contact us directly by email, phone, in writing, or through social media. This includes when you order services or use our website in any way that involves providing personal information.
The types of information we collect about you may include:
– Basic contact information (name, surname, phone number, email address)
– Data about the use of our websites (clicks on links, time spent)
– Data necessary for the fulfillment of a contract and delivery of purchased goods (purchase details, price, delivery address, delivery time, payment method, payment date, complaint data, invoice data, etc.)
Legal Basis for Processing Personal Data
We may process your personal data on the following legal bases:
– When necessary to fulfill our legal obligations (e.g., issuing invoices for purchased goods)
– When processing your personal data is necessary for the performance of a contract you have entered into with us or because you have requested an offer
– When you have given consent for processing for a specific purpose, with the right to withdraw your consent at any time (e.g., for personalized updates on our offers)
– When we have a legitimate interest in processing your personal data
Purposes of Processing Personal Data
We may use your personal data for one or more of the following purposes:
– Communication regarding the provision of our services and responding to your inquiries
– Contract formation and fulfillment of obligations arising from the contract
– Marketing communication (email, postal mail, SMS)
– Marketing communication based on personalized offers and messages
– Handling legal claims and resolving disputes
– Statistical analysis of the sale of our goods and the use of our websites
– Managing and improving our websites, including customizing the user experience
– Sharing personal data with third parties connected to us in providing services (e.g., email service providers, IT service providers)
Data Retention and Disposal
Personal data processed based on your consent is retained until you revoke that consent. Invoice data is retained for 10 years from the date of issue. Data needed for the contract’s fulfillment is retained for 10 years from the contract’s completion (goods delivery). Data collected for other e-marketing activities is retained according to the cookie manufacturer’s specified duration. After the retention period, personal data is effectively deleted or anonymized.
Voluntariness of Data Provision and Consequences of Non-Provision
Providing personal data is voluntary. However, if you do not provide certain data, you may not receive specific services or enter into contracts with us. We will specify the consequences of non-provision each time we collect personal data from you.
Access to Your Personal Data
We do not disclose or allow third parties (outside ŠTRUKELJ MIT d.o.o.) access to your personal data except those who have a written contract with us to perform specific tasks related to data processing and are obligated to comply with data protection laws (contract processors). Contract processors may only process personal data within our instructions and may not process the data for their own purposes. They, along with their employees, are bound to confidentiality regarding your personal data.
Your Rights Regarding Personal Data
You have the following rights regarding your personal data:
– To request confirmation of whether we process your personal data
– Access to personal data and information about the processing purposes, types of personal data, recipients or categories of recipients to whom the personal data has been or will be disclosed, especially recipients in third countries or international organizations, the intended period of personal data storage, or, if not possible, the criteria used to determine this period; the existence of automated decision-making, including profiling, and the reasons for it, as well as the significance and expected consequences of such processing for you
– One (free) copy of personal data in a format of your choice (if the request is made by electronic means of communication, and unless you specify otherwise, the copy will be provided in electronic form); reasonable fees may be charged for additional copies
– Correction of inaccurate personal data
– Restriction of processing when you dispute the accuracy of personal data for a period allowing us to verify its accuracy; when processing is unlawful and you oppose the erasure of personal data, requesting restriction of its use instead; when personal data is no longer needed for processing purposes but is required by you for the establishment, exercise, or defense of legal claims
– Erasure of all personal data (right to be forgotten) if the conditions of Article 17 of the General Data Protection Regulation are met, especially if you withdraw consent for processing personal data
– Obtaining personal data in a structured, commonly used, and machine-readable format, with the right to transmit this data to another controller without hindrance from us
– Ceasing the use of personal data for direct marketing purposes, including profiling
– To not be subject to a decision based solely on automated processing, including profiling, if the conditions of the General Data Protection Regulation are met
You have the right to lodge a complaint with the Information Commissioner if you believe that the processing of your personal data violates the General Data Protection Regulation.
Procedure for Exercising Rights
Requests related to the exercise of rights regarding personal data can be submitted in writing to any contact listed at the top of this document under “Controller of Personal Data and Contact Information.” For reliable identification, we may request additional information from you, and we can only refuse action if we can demonstrate that we cannot reliably identify you. We must respond to your request regarding your rights regarding personal data without undue delay and no later than one month after receiving your request.