Privacy policy
This is a privacy policy, a document in which you will find all the information about the processing of personal data carried out by the controller (hereinafter referred to as the Controller).
The Controller takes special care of the security of your personal data. All personal data provided is treated confidentially and is used only for the purposes for which it was provided.
1. Who processes my personal data?
The processing of personal data is carried out by the controller of personal data.
Information about the controller:
Name: Novo Polje, cesta VII 125, Ljubljana, 1260 LJUBLJANA-POLJE
Address and post office: Vodovodna cesta 99, 1000 Ljubljana
You can contact the controller at: info@umologija.com
2. Definitions:
“Personal data” is any information relating to an identified or identifiable individual (including name, surname, e-mail address, telephone number, as well as identifiers specific to the physical, physiological, genetic, mental identity of an individual, etc.)
“Controller” is a legal or natural person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing.
“Processor” is a natural or legal person, public authority or other body which processes personal data on behalf of the controller.
“Processing” means the collection, storage, access and all other forms of use of personal data.
3. How do we obtain data?
We obtain your personal data directly from you when we provide you with our services. We also obtain your personal data indirectly, e.g. through the use of our website.
4. What personal data do we collect and process?
The subject of processing is the data that the Controller collects through direct communication with you, through various channels, inquiries, purchases, etc. This personal data includes:
- Basic personal data (name and surname, company information, address, username);
- Contact information (e-mail, phone number);
- Data about the selected service and data from the quiz;
- Data that the Controller learns when providing services;
- Payment data, delivery data and company data.
5. Why do we process your personal data?
This privacy policy is intended for:
- Customers,
- Website visitors.
We process all personal data collected by the controller only when we have an appropriate legal basis for this and for the specific purposes specified in the table below. We process all personal data on an appropriate legal basis, as defined below. In the event that we process data for a purpose not specified in this policy, we will inform you in advance.
| Purpose | Types | Legal basis | Retention period |
| Provision of our services | Name and surname, address, e-mail, telephone number, data on the ordered service and data generated during the provision of services | Contractual relationship | 5 years after the termination of the service |
| Sending e-newsletters | E-mail address | Consent | Until cancellation consent |
| Performing a quiz for the Ministry of Education and Science | E-mail address, quiz data | Legitimate interest in acquiring new interested parties for the product | 6 months after sending the quiz results |
| Ordering free samples | Name and surname, address, e-mail address, telephone number (where necessary), delivery data (where necessary), company data | Pre-contractual relationship | 5 years after delivery of the free sample |
| Purchase in an online store | Name and surname, address, e-mail address, telephone number (where necessary), payment data, data for delivery, company data | Contractual relationship | 5 years after the purchase, and for the storage of invoices 10 years after the termination of the contractual relationship (tax legislation) |
| Implementation of the referral program | First and last name, username, email address | Contractual relationship | For the entire duration of the program and for 5 years after the termination of cooperation |
| Enforcement of legal claims and protection of our rights | The data set depends on the situation | Law | In accordance with the law |
The provision of personal data is voluntary, except when the provision of personal data is required by law. In this case, you are obliged to provide personal data. We need certain personal data to provide you with a service. If you decide not to provide us with data, we cannot provide you with certain services.
We process personal data only for as long as is necessary to fulfill the purpose for which the data was collected. After the retention period has expired, the data is deleted or anonymized so that data reconstruction is no longer possible.
6. Do we share your data with third parties?
We share your personal data with third parties in the following cases:
- Website hosting,
- IT support,
- Accounting,
- Marketing service provider,
- Advertising provider,
- Mass email provider,
- Payment system provider.
We only share your personal data with third parties when it is necessary to fulfill the purpose of processing your personal data. Third parties may access and process your personal data only to the extent and in the manner specified in the contract we have concluded with them. Third parties may not process personal data that is not necessary for the purpose for which they process the personal data. All third parties are obliged to respect the level of personal data protection provided by the controller.
7. Further processing of personal data in an automated manner
The controller does not carry out automated decision-making or profiling when processing personal data.
8. How do we protect your personal data?
We ensure the security of your personal data by adopting various technical and organizational measures, including:
- Regularly updating our hardware and software;
- Protecting hardware and software with security software;
- Protecting our business premises;
- Training employees or external collaborators in the field of personal data protection;
- Ensuring that unauthorized persons have limited access to personal data.
We are aware that, despite the security mechanisms we have established, a security incident may occur. For this purpose, we have created a special protocol with which we will handle such incidents quickly, efficiently and in accordance with the law.
Should a security incident occur in which there is a likelihood that the rights and freedoms of individuals have been threatened, we will notify the competent supervisory authority of such an incident immediately, but no later than within 72 hours. However, in the event of a security incident that may pose a significant risk to the rights and freedoms of individuals, we will also immediately notify the individuals concerned.
9. What rights do you have?
Regarding the processing of your personal data that we carry out, you have the following rights:
- Right to access and print personal data:This right allows you to obtain information about the processing of personal data, and at the same time you also have the option of viewing or obtaining a copy of your personal data that we store about you.
- Right to rectification of personal data: You have the right to request the correction of inaccurate or incomplete data that we keep about you.
- Right to restrict the processing of personal data:This right allows you to restrict the processing, e.g. for the duration of the decision-making process on the correction or objection, which is being carried out by the controller.
- Right to erasure of personal data: This right allows you to request the erasure of data we keep about you in certain cases. When the legal basis for the processing of personal data is a law or a valid contract, we cannot erase your personal data.
- Right to withdraw consent: When we process your personal data on the basis of consent (consent), you have the option to withdraw this consent at any time. Withdrawal of consent does not entail negative consequences for you. We would like to point out that after withdrawal of consent, we will no longer be able to provide you with certain services.
- Right to object to the processing of personal data: This right is available to you when personal data is processed on the basis of legitimate interests. It allows you to request the controller to cease processing. We would like to point out that in certain cases the controller has the option to reject such an objection. In any case, the controller will cease processing if you object to direct marketing. You can withdraw your consent by sending us an email to info@umologija.com.
- Right to data portability: This right allows you to request that we transmit your personal data to another controller in a machine-readable format. This is only possible if we process your data by automated means and when it concerns data collected on the basis of consent or a contractual relationship.
If you believe that there has been a violation of personal data protection, you can always file a complaint with the competent supervisory authority, which in Slovenia is represented by the Information Commissioner.
We will process your requests regarding the rights defined above as soon as possible, but no later than 30 days from receipt. If a specific request is so extensive that it will take longer to resolve, we will inform you in advance and give you a tentative deadline for preparing a response.
We reserve the right to identify you if you make a request to exercise any of your rights. If you do not send us personal data with your request, on the basis of which we can reliably identify you, we will ask you for additional personal data. If you do not provide us with additional personal data within the deadline, we will reject your request.
You can exercise your rights by writing to us at info@umologija.com.
10. Changes
Any changes to our privacy policy will be published on this website. You are deemed to agree to the new version of the policy if you continue to use our website or other services that are subject to this policy after the policy has been changed.
11. Do you have a question?
You can contact us at any time with additional questions regarding the protection of personal data by writing to us at: info@umologija.com.