Politika zasebnosti
Personal Data Protection Policy (Privacy Policy)
The purpose of this Personal Data Protection Policy (Privacy Policy) is to inform individuals, users of services, business partners, employees and other persons (hereinafter referred to as the “individual”) who cooperate with EUROPLAKAT d.o.o. (hereinafter referred to as the “Company”) about the purposes, legal bases, security measures and rights of individuals in relation to the processing of personal data carried out by our Company.
We value your privacy and therefore always handle your data with care and protect it appropriately.
We process personal data in accordance with European legislation (Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, hereinafter referred to as the “General Data Protection Regulation” or “GDPR”), applicable Slovenian legislation in the field of personal data protection and other legislation providing us with a legal basis for processing personal data.
This Personal Data Protection Policy contains information on how our Company, as the data controller, processes personal data received from individuals on the basis of applicable legal grounds.
1) Data Controller
The controller of personal data is:
EUROPLAKAT, d. o. o.
Koprska ulica 98, 1000 Ljubljana
Telephone: 080 23 34
Email: gdpr@europlakat.si
VAT ID: SI76457702
Company registration number: 5617669
2) Data Protection Officer
In accordance with Article 37 of the General Data Protection Regulation, we have appointed the following company as our Data Protection Officer:
DATAINFO.SI, d.o.o.
Tržaška cesta 37c, SI-2000 Maribor
https://datainfo.si
Email: dpo@datainfo.si
Telephone: +386 (0) 2 620 4 300
3) Personal Data
Personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or by reference to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
4) Purposes and Legal Bases for Data Processing
The Company collects and processes your personal data on the following legal bases:
- processing is necessary for compliance with a legal obligation to which the controller is subject;
- processing is necessary for the performance of a contract to which the individual is party or in order to take steps at the request of the individual prior to entering into a contract;
- processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party;
- the individual has given consent to the processing of his or her personal data for one or more specific purposes;
- processing is necessary in order to protect the vital interests of the individual or another natural person.
4.1) Compliance with a Legal Obligation
The Company may process personal data on the basis of obligations imposed on the Company by law, such as cooperation with public authorities in supervisory procedures, administrative procedures or judicial proceedings.
When processing personal data for the purpose of complying with a legal obligation, the Company always acts in accordance with applicable legislation.
4.2) Performance of a Contract
Where an individual enters into a contract with the Company, the contract constitutes the legal basis for the processing of personal data.
Personal data may therefore be processed for the purpose of entering into and performing a contract, such as the sale of goods and services, membership in loyalty programmes, participation in events, training courses, promotions and similar activities.
If the individual does not provide the required personal data, the Company may be unable to enter into the contract or provide the service or deliver goods in accordance with the concluded contract.
On the basis of its lawful business activities, the Company may also inform individuals and users of its services via their email address about its services, events, training courses, offers and other content.
The individual may at any time request that such communication and processing of personal data cease and may unsubscribe from receiving messages via the unsubscribe link contained in the message received, by sending a request via email to gdpr@europlakat.si, or by regular mail to the Company’s address.
4.3) Legitimate Interest
The Company may also process personal data on the basis of legitimate interests pursued by the Company.
Such processing is not permitted where such interests are overridden by the interests or fundamental rights and freedoms of the individual requiring the protection of personal data.
Where legitimate interest is used as a legal basis, the Company always carries out an assessment in accordance with the General Data Protection Regulation.
Processing of personal data for direct marketing purposes may be regarded as being carried out on the basis of legitimate interest.
The Company may process personal data of individuals obtained from publicly accessible sources or collected in the course of its lawful business activities for the purposes of offering goods, services, employment opportunities, information about benefits, events and similar activities.
For these purposes, the Company may use regular mail, telephone calls, email and other telecommunications channels.
For direct marketing purposes, the Company may process the following personal data: first and last name, permanent or temporary address, telephone number and email address.
The Company may process such personal data for direct marketing purposes even without the individual’s explicit consent where permitted by applicable law.
The individual may at any time request that such communication and processing cease and may unsubscribe from receiving messages via the unsubscribe link contained in the received message, by sending a request to gdpr@europlakat.si, or by regular mail to the Company’s address.
4.4) Processing Based on Consent
Where the Company does not have another legal basis arising from law, contractual obligations or legitimate interests, it may ask the individual to provide consent.
Where the individual gives consent, the Company may process certain personal data for purposes including:
- residential address and email address for notification and communication purposes;
- photographs, video recordings and other content relating to the individual, for example the publication of photographs of individuals on the Company’s website, for the purpose of documenting activities and informing the public about the Company’s work and events;
- other purposes to which the individual has consented.
If an individual has given consent to the processing of personal data and later no longer wishes such processing to continue, the individual may request that the processing cease by sending a request to gdpr@europlakat.si or by regular mail to the Company’s address.
Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
4.5) Processing Necessary to Protect the Vital Interests of an Individual
The Company may process personal data relating to an individual where this is necessary to protect that individual’s vital interests.
In emergency situations, the Company may search for an individual’s identification document, check whether the person exists in its database, review relevant medical information or contact the individual’s relatives, without requiring the individual’s consent.
This applies where such processing is strictly necessary to protect the individual’s vital interests.
5) Retention and Deletion of Personal Data
The Company will retain personal data only for as long as necessary to fulfil the purpose for which the personal data were collected and processed.
Where the Company processes personal data on the basis of law, such data will be retained for the period prescribed by applicable legislation.
Certain data are retained for the duration of cooperation with the Company, while some data may be required to be retained permanently.
Personal data processed by the Company on the basis of a contractual relationship with an individual are retained for the period necessary to perform the contract and for an additional six years after its termination, except where a dispute relating to the contract arises between the individual and the Company.
In such cases, the Company will retain the data for an additional ten years following the final decision of a court, arbitration body or court settlement, or, where no court proceedings have taken place, for five years from the date on which the dispute was amicably resolved.
Personal data processed on the basis of the individual’s consent or the Company’s legitimate interest will be retained until consent is withdrawn or a request for deletion is submitted.
Following receipt of a withdrawal of consent or a deletion request, the data will be deleted no later than within 15 days.
The Company may also delete such data before consent is withdrawn where the purpose of processing has been achieved or where required by law.
Exceptionally, the Company may refuse a request for deletion on grounds provided for under the General Data Protection Regulation, including:
- exercising the right to freedom of expression and information;
- compliance with a legal obligation requiring processing;
- reasons of public interest in the area of public health;
- archiving purposes in the public interest;
- scientific or historical research purposes;
- statistical purposes;
- the establishment, exercise or defence of legal claims.
After the expiry of the applicable retention period, the Company will effectively and permanently delete or anonymise the personal data so that they can no longer be linked to an identifiable individual.
6) Contractual Processing of Personal Data and Data Transfers
The Company may entrust certain personal data processing activities to contractual processors on the basis of a data processing agreement.
Contractual processors may process the entrusted data exclusively on behalf of the controller, within the limits of the authority granted to them in a written agreement or other legal act and in accordance with the purposes specified in this Privacy Policy.
The Company’s contractual processors primarily include:
- accounting service providers and other providers of legal and business consulting services;
- infrastructure maintenance providers, including video surveillance and security service providers;
- information systems maintenance providers;
- email service providers and software or cloud service providers, such as Microsoft and Google;
- social media and online advertising providers, such as Google, Facebook, Instagram and others.
For the purpose of better oversight and control of contractual processors and their contractual relationships with the Company, the Company also maintains a list of contractual processors containing all specific processors with which the Company cooperates.
Under no circumstances will the Company disclose an individual’s personal data to unauthorised third parties.
Contractual processors may process personal data solely in accordance with the Company’s instructions and may not use personal data for any other purposes.
The Company, as controller, and its employees do not transfer personal data to third countries outside the European Economic Area — consisting of EU Member States, Iceland, Norway and Liechtenstein — or to international organisations, except to the United States.
Where personal data are transferred to contractual processors in the United States, such relationships are governed on the basis of Standard Contractual Clauses adopted by the European Commission and/or Binding Corporate Rules approved by competent supervisory authorities in the European Union.
7) Cookies
Please note that when browsing our websites, cookies may be installed in your web browser, primarily in order to provide you with an optimal browsing experience.
Cookies are data stored on the terminal equipment of an internet user.
More information about cookies and cookie management is available at:
https://europlakat.si/en/cookie-policy/
8) Data Security and Accuracy
The Company ensures information security and the security of its infrastructure, including premises, applications and system software.
Our information systems are protected, among other measures, by antivirus software and firewalls.
We have implemented appropriate organisational and technical security measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, and against other unlawful or unauthorised forms of processing.
Where special categories of personal data are transmitted, they are transmitted in encrypted form and protected by a password.
Individuals are responsible for ensuring that they provide their personal data securely and that the data provided are accurate and authentic.
The Company will endeavour to ensure that the personal data it processes are accurate and, where necessary, kept up to date. From time to time, the Company may contact an individual to confirm the accuracy of personal data.
9) Video Surveillance
EUROPLAKAT d.o.o. operates video surveillance.
Video surveillance cameras are installed in the vicinity of entrances and are used to monitor entry to and exit from our premises at the locations Letališka ulica, Ljubljana, and Avtomobilska cesta, Maribor, pursuant to Article 77 of ZVOP-2.
Video surveillance is also carried out for the purpose of protecting individuals, including users, employees and visitors, and the Company’s property, on the basis of legitimate interest as provided for in Article 6(1)(f) of the General Data Protection Regulation in conjunction with Article 76 and the following provisions of ZVOP-2.
Video surveillance is carried out inside certain work areas, such as corridors, where strictly necessary for the safety of persons or property or for the protection of classified information or trade secrets.
Video surveillance assists us in detecting, investigating and resolving incidents or emergency events, criminal offences, compensation claims and other claims.
Recordings are retained for up to 30 days.
Video surveillance is not carried out in a manner that would have a particular impact on individuals.
Video surveillance does not enable unusual further processing, such as transfers to entities in third countries.
The video surveillance system enables live monitoring.
All information relating to video surveillance may be obtained by telephone at 01 200 15 50 or by email at gdpr@europlakat.si.
The rights of individuals are described in this Privacy Policy.
Additional questions may also be addressed to the Data Protection Officer at dpo@datainfo.si.
10) Call Recording
Telephone calls made to EUROPLAKAT’s general telephone numbers are not recorded.
Only telephone calls from users of the MBajk and BicikeLJ services to telephone numbers intended for customer support are recorded.
Where a telephone conversation is recorded, you will be specifically informed before the conversation begins or by an automated recorded message, and you will have the option to refuse the recording.
Recordings are retained and processed for the purpose of dealing with reports concerning bicycle faults, accidents or information concerning missing bicycles, particularly for the purpose of establishing the facts and circumstances of individual cases and verifying information provided by users in accordance with the provisions of the legislation governing electronic communications.
The legal basis for recording and processing such recordings is the user’s consent.
If, after receiving prior notification, the user leaves a voice message, the user is deemed to have given consent to the recording and processing of the recording for the purposes described above.
Recordings are retained for two months.
11) Rights of Individuals Regarding Data Processing
Under the General Data Protection Regulation, individuals have the following rights regarding the protection of their personal data:
- the right to request information as to whether we hold their personal data and, if so, what data we hold, on what basis and for what purpose they are used;
- the right to request access to their personal data, enabling them to receive a copy of the personal data held by the Company and to verify that the Company is processing them lawfully;
- the right to request rectification of personal data, including correction of incomplete or inaccurate personal data;
- the right to request erasure of personal data where there is no reason for further processing or where the individual exercises the right to object to further processing;
- the right to object to further processing of personal data where the Company relies on a legitimate business interest, including the legitimate interest of a third party, where there are grounds relating to the individual’s particular situation; the individual has the right to object at any time where the Company processes personal data for direct marketing purposes;
- the right to request restriction of processing, meaning suspension of the processing of personal data, for example where the individual wishes the Company to establish the accuracy of the data or verify the reasons for continued processing;
- the right to request data portability, meaning the transfer of personal data in a structured electronic format to another controller, where this is possible and technically feasible;
- the right to withdraw consent previously given for the collection, processing and transfer of personal data for a specific purpose; once the Company receives notice of withdrawal of consent, it will cease processing personal data for the purposes originally accepted by the individual, unless the Company has another lawful legal basis for continuing such processing.
If an individual wishes to exercise any of the rights listed above, the individual may submit a request by email to gdpr@europlakat.si or by regular mail to the Company’s address.
The Company will respond to a request concerning an individual’s rights without undue delay and in any event within one month of receipt of the request.
Where, taking into account the complexity and number of requests, this period must be extended by up to two additional months, the individual will be informed accordingly.
Access to an individual’s personal data and the exercise of rights are free of charge.
However, the Company may charge a reasonable fee where an individual’s request is manifestly unfounded or excessive, particularly where requests are repetitive. In such cases, the Company may also refuse the request.
When an individual exercises rights under this section, the Company may need to request certain information from the individual in order to confirm the individual’s identity. This is a security measure intended to ensure that personal data are not disclosed to unauthorised persons.
If an individual believes that his or her rights have been infringed, the individual may contact the supervisory authority for protection or assistance at:
Republic of Slovenia
Information Commissioner
Dunajska cesta 22
1000 Ljubljana
Telephone: 01 230 97 30
Email: gp.ip@ip-rs.si
If an individual has any questions concerning the processing of his or her personal data, the individual may contact our Company at any time by email at gdpr@europlakat.si or by regular mail to the Company’s address.
12) Publication of Changes
Any amendments to our Personal Data Protection Policy will be published on the Company’s website:
By using the website, the individual confirms that he or she accepts and agrees with the entire content of this Personal Data Protection Policy.
Ljubljana, 30 June 2026