Privacy Policy
Privacy Policy and Personal Data Protection
At the Slovenian Tourist Board, we are aware of how important the right to privacy is, and we therefore handle individuals' personal data responsibly and carefully. When processing data, we comply with the provisions of the EU General Data Protection Regulation (GDPR) and the Personal Data Protection Act (ZVOP-2). Through appropriate security measures, we ensure that unauthorized persons cannot access personal data, that its confidentiality and integrity are preserved, and that its loss or accidental destruction is prevented throughout the processing period.
To achieve the above objectives, and in accordance with Articles 13, 14 and 15 of the EU General Data Protection Regulation (GDPR), we inform you of the following:
1. About Us
The controller of your personal data is:
Slovenian Tourist Board
Dimičeva ulica 13, 1000 Ljubljana
Registration number: 6889859000
Tax number: 93477902
Phone number: 01 589 85 50
Email: info(at)slovenia.info
Websites: www.tasteslovenia.si, and two other websites: https://www.slovenia.info, https://www.karieravturizmu.si
2. What is Personal Data?
Personal data is information that directly or indirectly identifies you as an individual, where "indirectly" means in combination with other information, such as your name, postal address, email address and telephone number, or a special identification mark.
3. Legal Basis for the Processing of Personal Data
We process your personal data in accordance with the EU General Data Protection Regulation (GDPR), the Personal Data Protection Act (ZVOP-2), and other regulations governing this field. As the controller of personal data, the Slovenian Tourist Board processes certain data exclusively on the basis of your prior consent, while the processing of certain other data requires either the performance of a contract, compliance with a legal obligation, or the pursuit of the controller's legitimate interest. Details of the legal bases for processing your data can be found below:
Performance of a Contract
If you have visited a trade fair, participated in a workshop, training session or other event organized by us, or if you have provided us with a service or delivered goods, the provision of your data is a contractual obligation. In this case, we will process the data only for the purpose of fulfilling the rights and obligations arising from the contract or purchase order.
Compliance with Legal Obligations
In certain cases, the processing of your personal data is a legal obligation. For example, we are required to provide the Financial Administration of the Republic of Slovenia with the personal data of prize competition winners when the value of the prize exceeds the legally prescribed amount.
Legitimate Interest
We may process certain personal data on the basis of the company's legitimate interest, where that interest outweighs your fundamental rights and freedoms. On the basis of legitimate interest, we process your data for the purposes of improving and developing our services, technical maintenance of websites, security of information systems, protection of confidential data, and ensuring the safety of our employees and company assets. Legitimate interest for processing also includes measures to prevent fraud and criminal offenses, resolve potential disputes and complaints, and protect legal claims.
Consent
Where no other appropriate legal basis is available for the processing of your data, we must obtain your consent for each individual purpose, based on Article 6(1)(a) of the EU General Data Protection Regulation (GDPR). On the basis of your consent, we process personal data, for example, to send newsletters or to run prize competitions.
You have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
4. Collection, Use and Retention of Personal Data
In accordance with the principle of proportionality, we collect only the data that is necessary to achieve the purpose of processing. Details on the cases of processing your personal data, the types of data, and the purposes of processing are set out below.
If you are a recipient of our electronic newsletters
By subscribing to our electronic notifications and newsletters, you agree that we may send you, for example, gastronomic stories from Slovenia. For this purpose, we process data such as: first and last name, email address, and the language in which you wish to receive the newsletters.
We process your data on the basis of your consent.
If you participated in a prize competition
If you participated in a prize competition, we will process the data you provided exclusively for the purpose of conducting the prize competition (verifying eligibility, contacting the winners drawn, and announcing the winners). If the value of the prize exceeds the legally prescribed amount, we will, in accordance with tax legislation, also request your tax number, which we will then forward to the Financial Administration of the Republic of Slovenia.
Participation in a prize competition is voluntary, and by participating you consent to the processing of personal data for the purposes stated above. You may withdraw your consent at any time. If you do not provide the data or if you withdraw your consent, you cannot participate in the prize competition.
In the cases above, we process your data on the basis of your consent.
If you visited our website
If you visited our websites, the server automatically collects details about your visit, such as: IP address, browser type and information about the operating system of your computer or mobile device, views of individual content for a period of 10 days, and the date of your visit to the Slovenian Tourist Board's website.
On our websites you will also come across the term "Cookies," about which you can learn more at the Cookies link, which forms an integral part of this policy. Cookies are small text files that most websites store on the devices you use to access the internet. Their storage is under your control, as you can restrict or disable the storage of cookies in the browser you use. They provide a convenient way to keep content fresh and relevant, in line with your interests and preferences. Based on statistical data on website traffic, we can assess the effectiveness of our website's content, and, combined with advertising cookies, also the relevance of the content and advertisements offered to you on other websites. Cookies help websites remember your preferences, interests and experience, thereby saving time and making browsing more efficient and user-friendly.
The data we process is processed on the basis of our legitimate interest or your consent, if given. You can change your cookie settings on each visit via this link, where you can also view the retention periods for individual cookies.
5. Data Retention Period
We retain your personal data for as long as necessary to achieve the purpose for which the data is processed. After this period, we delete, destroy, block or anonymize your data. In certain cases, the data retention period is determined by law, and such data is therefore retained for as long as necessary to fulfill legal obligations.
If your data is processed for the performance of a contract, we retain it until the end of the contractual relationship, and on the basis of legitimate interest, for as long as it is possible to assert any legal claims related to the contract.
Data that we process on the basis of your consent is retained until that consent is withdrawn or until you request deletion of the data, whereby withdrawal does not affect the lawfulness of processing carried out on the basis of consent prior to its withdrawal.
6. Recipients of Data
In certain cases, provided there is an appropriate legal basis, your data may also be disclosed to third parties:
Data Processors
To carry out individual tasks and achieve the processing purposes mentioned above, we may also disclose your data to our data processors, who process your personal data on our behalf and according to our instructions. These include providers of hotel and transport services, tour guides, organizers and co-organizers of business events, data processing and analytics providers, providers of email dispatch and marketing automation tools, providers of online advertising solutions, certified storage providers, external ICT equipment maintenance providers, external maintenance providers of the software packages and applications we use, and external maintenance providers of our websites.
Legal Obligation or Enforcement of Legal Obligations
In cases specified by regulations, we may forward your personal data to public authorities where necessary to fulfill our legal obligations or for them to carry out their official duties, such as the police, courts, tax authorities, and others.
7. Transfer of Data to Third Countries
Your personal data is processed only within the territory of the European Union and the European Economic Area, and the Slovenian Tourist Board does not transfer it to third countries.
8. Technical and Organizational Measures for the Protection of Your Personal Data
The Slovenian Tourist Board takes a very serious approach to data security. We apply an appropriate level of protection and reasonable physical, electronic and administrative measures to protect the collected data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of personal data, or unauthorized access to personal data. We protect the application software used to process personal data, prevent unauthorized access to personal data during its transfer, ensure an effective method for blocking, destroying, deleting or anonymizing personal data, and enable subsequent verification of when individual data was entered into the personal data collection, used or otherwise processed, and by whom.
9. Rights Regarding the Processing of Personal Data
Regarding the processing of personal data, you have the right of access to data, the right to rectification and completion of incomplete personal data, the right to erasure, the right to restriction of processing, the right to data portability, and the right to object. Requests to exercise these rights may be sent to the email address dpo(at)slovenia.info.
Right of Access to Data
You may request confirmation from us as to whether we process your personal data. You have the right to request information on whether your personal data is transferred to third countries or international organizations. In this connection, you may also request information on appropriate safeguards in accordance with Article 46 of the EU General Data Protection Regulation.
Right to Rectification and Completion of Incomplete Personal Data
You have the right to rectification and/or completion if the personal data we process about you is inaccurate or incomplete. The controller must carry out the correction without delay.
Right to Erasure
In certain cases, you have the right to obtain the erasure of your data. This can be achieved in the following cases:
- when the data is no longer necessary for the purposes for which it was collected;
- when you withdraw your consent to processing and there is no other legal basis for the processing;
- when you have exercised the right to object to the processing of personal data that we process on the basis of legitimate interest;
- in the case of unlawful processing of personal data.
Right to Restriction of Processing
Regarding the processing of your personal data, you also have the right to request a restriction of processing, whereby we temporarily stop processing your personal data if:
- you contest the accuracy of the data;
- the processing is unlawful and, instead of erasure, you request a restriction on the use of the data;
- we no longer need the data for the purposes of processing, but you need it for the establishment, exercise or defense of legal claims;
- you have lodged an objection in connection with the processing of the data.
Right to Object
You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data based on points (e) or (f) of Article 6(1) of the General Data Protection Regulation. The controller shall stop processing personal data relating to you, unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defense of legal claims. Where personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing, to the extent that it is related to such direct marketing.
Right to Data Portability
Where we process your personal data on the basis of consent or a contract using automated means, you have the right to receive your personal data in a structured, commonly used and machine-readable format and to transmit it to another controller.
Where personal data is processed on the basis of your consent, you also have the right to withdraw your consent to the processing of personal data at any time, temporarily or permanently, without affecting the lawfulness of the processing carried out on the basis of consent prior to its withdrawal.
If you believe that we are violating the provisions on the protection of personal data through our processing of personal data, you also have the right to lodge a complaint with the Information Commissioner at: Dunajska 22, 1000 Ljubljana, email: gp.ip@ip-rs.si, phone: 01 230 97 30, website: www.ip-rs.si.
10. Further Processing of Personal Data for a Purpose Other Than That for Which the Data Was Collected
We do not process your data for a purpose other than the purpose for which the personal data was collected.
11. Sources of Personal Data Collection
The data we process about you is provided by you.
12. Automated Decision-Making and Profiling
In most cases, your data is not subject to automated decision-making.
However, your personal data may be subject to automated decision-making, including profiling, in cases where you accept segmentation cookies on our websites. In such cases, when you visit content, you accumulate additional points, on the basis of which the system may display or send you additional content, measure responses to displayed notifications and content, and track your activities on the website. Automated decisions enable faster and more efficient data processing, particularly in cases where this is necessary to improve the user experience. In this context, profiling may also be used, whereby, based on certain criteria (e.g., visits to specific content by tourism-product keywords such as "outdoor" content, "wellbeing" content, etc.), decisions are made about displaying or sending additional content for which the system records higher traffic than other types of content, based on specific profiles in the system.
Automated processing, including profiling, forms the basis for decisions that have legal effects concerning you or similarly significantly affect you. If such a decision has legal effects for you or similarly significantly affects you, you have the right to request human intervention, to express your point of view, or to contest the decision.
13. Data Protection Officer
The Slovenian Tourist Board has also appointed a Data Protection Officer, so any questions regarding the processing of data may be sent to the Data Protection Officer at Dimičeva ulica 13, 1000 Ljubljana, or by email at: dpo(at)slovenia.info.
14. Exercising Individual Rights under Articles 13, 14 and 15 of the General Data Protection Regulation
As stated in Section 9, regarding the processing of personal data you have the right of access to data, the right to rectification, the right to erasure (the "right to be forgotten"), the right to restriction of processing, the right to data portability, the right to object, and the right to lodge a complaint regarding the processing of personal data. Where processing is based on your consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of the processing carried out on the basis of consent prior to its withdrawal. Please send written or electronic requests to exercise these rights to: dpo(at)slovenia.info.
In addition, you also have the right to lodge a complaint regarding the processing of personal data with the Information Commissioner at: Dunajska 22, 1000 Ljubljana, email: gp.ip(at)ip-rs.si, phone: +386 (0)1 230 97 30, website: www.ip-rs.si.
Pursuant to point (e) of the second paragraph of Article 13 of the General Data Protection Regulation, the Slovenian Tourist Board provides the following information:
- whether the provision of personal data is a legal or contractual obligation: this is stated for each respective purpose of processing your data in Section 4;
- whether the individual must provide the personal data and the possible consequences of not doing so: if an individual does not provide the data, the Slovenian Tourist Board cannot fulfill its obligation related to the consent (e.g., you will not receive notifications, you will not be able to participate in a prize competition).
15. Changes
Any change to the Slovenian Tourist Board's Privacy Policy and Personal Data Protection Policy will be published on the website www.tasteslovenia.si.
January 2025
