Privacy Policy

Privacy and Personal Data Protection Policy

At the Slovenian Tourist Board, we recognise the importance of the right to privacy and therefore handle individuals’ personal data responsibly and with due care. When processing data, we comply with the provisions of the EU General Data Protection Regulation (GDPR) and the Personal Data Protection Act (ZVOP-2). Through appropriate security measures, we ensure that personal data cannot be accessed by unauthorised persons, that its confidentiality and integrity are maintained, and that its loss or accidental destruction is prevented throughout the entire period of processing.

To achieve the above objectives, and pursuant to Articles 13, 14 and 15 of the EU General Data Protection Regulation (GDPR), we hereby provide you with the following information:

1. About us

The controller of your personal data is:

Slovenian Tourist Board

Dimičeva ulica 13, 1000 Ljubljana

Registration number: 6889859000

Tax number: 93477902

Telephone number: 01 589 85 50

Email: info(at)slovenia.info

Websites: www.tasteslovenia.si

2. What is personal data?

Personal data is information that identifies you directly or indirectly as an individual, where “indirectly” means in combination with other information, such as your name, postal address, email address and telephone number, or a unique identifier.

3. Legal basis for the processing of personal data

We process your personal data in accordance with the EU General Data Protection Regulation (GDPR), the Personal Data Protection Act (ZVOP-2), and other regulations governing this field. As the controller of personal data, the Slovenian Tourist Board processes certain data solely on the basis of your prior consent, while the processing of other data may be necessary for the performance of a contract, compliance with legal obligations, or the pursuit of the controller’s legitimate interests. Details of the legal bases for processing your data are provided below:

Performance of a contract

If you have attended a trade fair with us, participated in a workshop, seminar, or another event organised by us, or provided a service or supplied goods to us, the provision of your data is a contractual requirement. In such cases, we will process the data solely for the purpose of exercising the rights and fulfilling the obligations arising from the contract or purchase order.

Compliance with legal obligations

In certain cases, the processing of your personal data is a legal obligation. For example, we are required to provide the Financial Administration of the Republic of Slovenia with the personal data of prize draw winners when the value of the prize exceeds the statutory threshold.

Legitimate interests

We may process certain personal data on the basis of the controller’s legitimate interests where the processing is necessary for the pursuit of those interests and where they are not overridden by your interests or fundamental rights and freedoms requiring the protection of personal data. On the basis of legitimate interests, we may process personal data in particular to ensure the technical operation and maintenance of the website, ensure the security of information systems and protect confidential data, prevent misuse, fraud and other unlawful conduct, resolve potential disputes and complaints, and establish, exercise or defend legal claims.

Consent

Where no other appropriate legal basis is available for processing your data, we must obtain your consent for each specific purpose pursuant to Article 6(1)(a) of the EU General Data Protection Regulation (GDPR). On the basis of your consent, we process personal data, for example, to send newsletters or conduct prize draws.

You have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

4. Collection, use and retention of personal data

In accordance with the principle of proportionality, we collect only the data necessary to achieve the purpose of processing. Details of the circumstances in which your personal data is processed, the types of data concerned, and the purposes of processing are provided below.

If you are a recipient of our electronic newsletters

By subscribing to our electronic notifications and newsletters, you agree that we may send you communications such as Gastronomic Stories from Slovenia. For this purpose, we process data including your first and last name, email address, and the language in which you wish to receive the newsletters.

We process your data on the basis of your consent.

If you have participated in a prize draw

If you have participated in a prize draw, we will process the data you have provided solely for the purpose of administering the prize draw, including verifying compliance with the terms and conditions, contacting the persons selected in the draw, and announcing the winners. If the value of the prize exceeds the statutory threshold, we will also request your tax number in accordance with tax legislation and subsequently provide it to the Financial Administration of the Republic of Slovenia. Participation in a prize draw is voluntary, and by participating you consent to the processing of personal data for the purposes stated above. You may withdraw your consent at any time. If you do not provide the data or withdraw your consent, you will not be able to participate in the prize draw.

We process personal data for the purpose of administering a prize draw on the basis of your consent. Where processing is necessary to comply with obligations under tax legislation, we process the data on the basis of a legal obligation.

If you have visited our website

If you visit our websites, the server automatically collects details of your visit, including your IP address, browser type, information about the operating system of your computer or mobile device, records of individual content viewed for a period of 10 days, and the date of your visit to the Slovenian Tourist Board’s website.

On our websites, you will also encounter the term “Cookies”. Further information is available via the Cookies link which forms an integral part of this Policy. Cookies are small text files that most websites store on the devices you use to access the internet. Their storage is under your control, as you can restrict or disable cookies in the browser you use. They provide a convenient way to keep content current and relevant to your interests and preferences. Based on statistical data concerning visits to the website, we can assess the effectiveness of our website content and, in combination with advertising cookies, the relevance of the content and advertisements shown to you on other websites. Cookies enable websites to remember your preferences, interests and experiences, saving time and making browsing more efficient and user-friendly.

We obtain your prior consent for the use of cookies that are not strictly necessary for the operation of the website or for the provision of a service explicitly requested by the user. You can change your cookie settings during each visit via this link, where you can also view the retention periods for individual cookies.

5. Data retention periods

We retain your personal data for as long as necessary to achieve the purpose for which the data is processed. After that period, we delete, destroy, block or anonymise your data.

In some cases, the data retention period is prescribed by law. Such data is therefore retained for as long as necessary to comply with legal obligations.

If your data is processed for the performance of a contract, we retain it until the end of the contractual relationship and, on the basis of legitimate interests, for as long thereafter as any legal claims related to the contract may be asserted.

Data processed on the basis of your consent is retained until you withdraw that consent or request the deletion of the data. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

6. Recipients of data

In certain cases, and where an appropriate legal basis has been established, your data may also be disclosed to third parties:

Contracted processors

To perform specific tasks and achieve the processing purposes referred to above, we may also disclose your data to our contracted processors, who process your personal data on our behalf and in accordance with our instructions. These include providers of data processing and analytics services, email delivery and marketing automation tools, online advertising solutions, certified data storage services, external maintenance providers for ICT equipment, external maintenance providers for the software packages and applications we use, and external maintenance providers for our websites.

Legal obligations or the performance of statutory duties

In cases prescribed by law, we may provide your personal data to public authorities where this is necessary for us to comply with our legal obligations or for those authorities to perform their official duties, including the police, courts, tax authorities and others.

7. Transfers of data to third countries

The use of certain external service providers may involve the transfer of personal data to countries outside the European Economic Area (EEA). Such transfers are carried out only where an appropriate legal basis and safeguards are in place in accordance with the GDPR.

8. Technical and organisational measures for protecting your personal data

The Slovenian Tourist Board takes data security very seriously. We apply an appropriate level of protection and reasonable physical, electronic and administrative measures to protect the data collected against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of personal data, or unauthorised access to personal data. We protect the application software used to process personal data, prevent unauthorised access to personal data during transmission, provide effective methods for blocking, destroying, deleting or anonymising personal data, and enable subsequent verification of when specific data was entered into a personal data filing system, used or otherwise processed, and by whom.

9. Rights relating to the processing of personal data

In relation to the processing of personal data, you have the right of access, the right to rectification and completion of incomplete personal data, the right to erasure, the right to restriction of processing, the right to data portability, and the right to object. You may submit a request to exercise these rights by email to dpo(at)slovenia.info.

Right of access

You may request confirmation from us as to whether we process your personal data. You have the right to request information on whether your personal data is transferred to third countries or international organisations. In this connection, you may also request information on the appropriate safeguards under Article 46 of the EU General Data Protection Regulation.

Right to rectification and completion of incomplete personal data

You have the right to rectification and/or completion if the personal data we process about you is inaccurate or incomplete. The controller must rectify the data without delay.

Right to erasure

In certain cases, you have the right to obtain the erasure of your data. You may exercise this right in the following circumstances:

• where the data is no longer necessary for the purposes for which it was collected;
• where you withdraw your consent to the processing of the data and there is no other legal basis for the processing;
• where you have exercised your right to object to the processing of personal data that we process on the basis of legitimate interests;
• where personal data has been processed unlawfully.

Right to restriction of processing

In relation to the processing of your personal data, you also have the right to request restriction of processing, under which we temporarily cease processing your personal data where:

• you contest the accuracy of the data;
• the processing is unlawful and, instead of erasure, you request restriction of the use of the data;
• we no longer need the data for processing purposes, but you require it for the establishment, exercise or defence of legal claims;
• you have lodged an objection to the processing of the data.

Right to object

You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data based on points (e) or (f) of Article 6(1) of the General Data Protection Regulation. The controller will cease processing the personal data concerning you unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless the processing is required for the establishment, exercise or defence of legal claims. Where personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing, to the extent that the processing is related to such direct marketing.

Right to data portability

Where we process your personal data by automated means on the basis of consent or a contract, you have the right to receive your personal data in a structured, commonly used and machine-readable format and to transmit it to another controller.

Where we process personal data on the basis of your consent, you also have the right to withdraw your consent to the processing of personal data temporarily or permanently at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.

If you believe that our processing of personal data infringes personal data protection rules, you also have the right to lodge a complaint with the Information Commissioner at: Dunajska 22, 1000 Ljubljana; email: gp.ip@ip-rs.si; telephone: 01 230 97 30; website: www.ip-rs.si.

10. Further processing of personal data for a purpose other than that for which the personal data was collected

We do not process your data for a purpose other than that for which the personal data was collected.

11. Sources of personal data

We obtain data directly from the individual, for example through newsletter subscriptions and prize draws, and automatically through the use of the portal or the devices and technologies described in the Cookie Policy.

12. Automated decision-making and profiling

In most cases, your data is not subject to automated decision-making.

On the Taste Slovenia website, the Slovenian Tourist Board does not make decisions based solely on automated processing of personal data, including profiling, that would produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 of the General Data Protection Regulation (GDPR).

If you consent to the use of segmentation cookies, we may analyse your interests and assign you to specific user segments or profiles based on your activities on the website, such as visits to individual content items, clicks and expressed interests. On this basis, we may display or send you content that we consider may be of interest to you in view of your expressed interests, and measure your responses to the content displayed or sent.

Profiling is used exclusively to personalise content and improve the user experience and does not result in decisions that would produce legal effects concerning you or similarly significantly affect you.

You may withdraw or change your consent to the use of segmentation cookies at any time in the cookie settings. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

13. Data Protection Officer

The Slovenian Tourist Board has appointed a Data Protection Officer. You may therefore address any questions concerning data processing to the Data Protection Officer at Dimičeva ulica 13, 1000 Ljubljana, or by email at dpo(at)slovenia.info.

14. Exercise of data subject rights under Articles 13, 14 and 15 of the General Data Protection Regulation

As stated in Section 9, in relation to the processing of personal data, you have the right of access, the right to rectification, the right to erasure (the “right to be forgotten”), the right to restriction of processing, the right to data portability, the right to object, and the right to lodge a complaint concerning the processing of personal data. Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal. Please submit a written or electronic request to exercise these rights by email to dpo(at)slovenia.info.

In addition, you have the right to lodge a complaint concerning the processing of personal data with the Information Commissioner at: Dunajska 22, 1000 Ljubljana; email: gp.ip(at)ip-rs.si; telephone: +386 (0)1 230 97 30; website: www.ip-rs.si.

Pursuant to point (e) of the second paragraph of Article 13 of the General Data Protection Regulation, the Slovenian Tourist Board provides information on:

• whether the provision of personal data is a statutory or contractual requirement: this is specified for each purpose of processing your data in Section 4;
• whether the individual is required to provide personal data and the possible consequences of failing to provide it: if the individual does not provide the data, the Slovenian Tourist Board cannot fulfil its obligations related to the consent, for example, you will not receive notifications or be able to participate in a prize draw.

15. Amendments

Any amendment to the Slovenian Tourist Board’s Privacy and Personal Data Protection Policy will be published on the www.tasteslovenia.si web portal.

August 2026