User rights

User rights

As a user, you have certain rights under the General Data Protection Regulation (GDPR) and the Personal Data Protection Act (ZVOP-2) in relation to the personal data concerning you that is processed by the Slovenian Tourist Board (STO), Dimičeva ulica 13, 1000 Ljubljana, Slovenia.

You may exercise each of these rights subject to the conditions and to the extent provided for by the GDPR and ZVOP-2.

Right to Withdraw Consent

Where the processing of your personal data is based on consent, you may withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

Right of Access

You may request confirmation from STO as to whether we process your personal data and obtain access to the personal data concerning you that we process, including a copy of those data.

You may also obtain information concerning, in particular, the purposes of the processing, the categories of personal data concerned, the recipients or categories of recipients of the data, the retention period or the criteria used to determine that period, the source of the personal data where they were not obtained directly from you, and the existence of automated decision-making, including profiling, where relevant.

Where personal data are transferred to a third country or an international organisation, you also have the right to be informed of the appropriate safeguards relating to such transfer.

Right to Rectification

You may request that STO rectify inaccurate personal data concerning you. Taking into account the purposes of the processing, you also have the right to have incomplete personal data completed.

Right to Erasure

You may request that STO erase your personal data, in particular where:

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• you withdraw the consent on which the processing is based and there is no other legal basis for the processing;
• you object to the processing and there are no overriding legitimate grounds for continuing the processing, or you object to processing for direct marketing purposes;
• the personal data have been unlawfully processed;
• the personal data must be erased to comply with a legal obligation;
• the personal data were collected in connection with the offer of information society services under the conditions laid down in the GDPR.

The right to erasure is not absolute. Erasure will not be carried out, among other circumstances, where continued processing is necessary to comply with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority, for reasons of public interest in the area of public health, for archiving purposes in the public interest, for scientific or historical research purposes or statistical purposes under the conditions laid down in the GDPR, or for the establishment, exercise or defence of legal claims.

Right to Restriction of Processing

You may request that STO restrict the processing of your personal data where:

• you contest the accuracy of the personal data, for a period enabling STO to verify their accuracy;
• the processing is unlawful, but you request the restriction of the use of the personal data instead of their erasure;
• STO no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims;
• you have objected to the processing, pending verification of whether STO’s legitimate grounds for processing override your grounds.

Right to Data Portability

Where processing is based on your consent or on a contract and is carried out by automated means, you have the right to receive the personal data that you have provided to STO in a structured, commonly used and machine-readable format and to transmit those data to another controller.

Where technically feasible, you may also request that the data be transmitted directly to another controller.

The right to data portability does not apply to processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Right to Object

Where the processing of your personal data is based on the performance of a task carried out in the public interest, the exercise of official authority or a legitimate interest, you may object to such processing at any time on grounds relating to your particular situation, including profiling related to such processing.

Where you object, STO will no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing that override your interests, rights and freedoms, or unless the processing is necessary for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, you may object to such processing at any time, including profiling to the extent that it is related to direct marketing. Following your objection, the personal data will no longer be processed for such purposes.

Automated Decision-Making and Profiling

You have the right not to be subject to a decision based solely on automated processing of personal data, including profiling, which produces legal effects concerning you or similarly significantly affects you, except in the circumstances expressly permitted by the GDPR.

On the website https://www.tasteslovenia.si, STO does not make decisions based solely on automated processing of personal data that produce legal effects concerning you or similarly significantly affect you. More detailed information on profiling is provided in the Privacy Policy.

Right to Lodge a Complaint

Where you consider that the processing of your personal data infringes personal data protection legislation, you have the right to lodge a complaint with the competent supervisory authority.

In the Republic of Slovenia, the competent supervisory authority is:

• Information Commissioner of the Republic of Slovenia
• Dunajska cesta 22
• 1000 Ljubljana
• Slovenia
• Email: gp.ip(at)ip-rs.si
• Telephone: +386 (0)1 230 97 30
• Website: www.ip-rs.si

Exercising Your Rights

You may submit a request to exercise your rights to:

• Slovenian Tourist Board
• Dimičeva ulica 13
• 1000 Ljubljana
• Slovenia
• Email: dpo(at)slovenia.info
• Telephone: +386 (0)1 589 85 50

STO will process your request within the time limits and in accordance with the procedures laid down in the GDPR and ZVOP-2.

More information on the processing and protection of personal data is available in the Privacy Policy. For additional information on exercising your rights, you may contact STO’s Data Protection Officer at dpo(at)slovenia.info.

Date of last update: 18 August 2026