Privacy policy | Flexido

1. Introduction

At Flexido, d.o.o., Veliki Otok 44D, 6230 Postojna (hereinafter: “Flexido” or “controller”) we are aware of the responsibility of handling the personal data of our customers, potential customers, visitors of the Flexido website and all individuals who disclose personal data to us on contact (hereinafter: “users”), and we therefore adopt this Personal-data protection policy (hereinafter: “Policy”), by which we inform our users in a transparent, understandable and simple manner of the purposes, the legal basis for the processing of their personal data and the rights in connection with processing, as guaranteed to them by the Personal Data Protection Act (ZVOP-2, Ur. l. RS, št. 163/2022) and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: “General Data Protection Regulation”).

Terms such as “controller”, “processing”, “restriction of processing”, “processor”, “profiling”, “pseudonymisation”, “third party” and “enterprise”, used in this Policy, have the meaning given to them by the General Data Protection Regulation.

In accordance with the General Data Protection Regulation the Policy governs the following areas:

contact information of the controller and contact of the data-protection officer,
purposes and legal bases for the processing of various types of users’ personal data, including profiling of users’ personal data,
recipients of personal data, contractual processing and transfer of data to third countries,
retention periods for individual types of personal data,
care for the security of personal data,
users’ rights in connection with the processing of personal data,
the procedure for exercising users’ rights in connection with the processing of personal data,
the right to lodge a complaint in connection with the processing of personal data.

2. Information on the controller and the person authorised for data protection

The controller of users’ personal data is Flexido d.o.o., Veliki Otok 44D, 6230 Postojna. Flexido has appointed a data-protection officer, who can be reached at info@flexido.eu.

3. Personal data

Personal data is information that identifies you as a particular or identifiable individual. A user is identifiable when the user can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the user’s physical, physiological, genetic, mental, economic, cultural or social identity. In accordance with the purposes defined later in the Policy, the controller collects the following personal data:

basic data about the user (first name and surname, title, job position and other data about the employer),
contact data and data about the user’s communication with the controller (e-mail address, telephone number, date, time and content of postal or e-mail communication, date, time and duration of telephone calls),
data about participation in events organised by Flexido (data about the event you attended, place and date of the event),
data about the user’s use of the controller’s website (dates and times of website visits, pages visited or URLs, time spent on each page, number of pages visited, total time of the website visit, settings made on the website) and data about the use of messages received (e-mail, SMS) from the controller,
data from forms completed voluntarily by the user,
other data that the user voluntarily provides to the controller when requesting certain services that require such data.

The controller does not collect and does not process the user’s personal data except where the user enables this or consents to it, i.e. when ordering products or services, at meetings at trade fairs or other professional events, where there is a statutory basis for collecting personal data, where processing is necessary for the performance of contractual obligations, or where processing is necessary for legitimate interests pursued by the controller (hereinafter: “legitimate interest”).

4. Bases for processing and purposes of processing

Flexido will process your personal data for one of the purposes stated below on the basis of the following legal bases:

your consent or permission,
fulfilment of the controller’s statutory obligations,
on the basis of legitimate interest,
performance of a contractual obligation.

Flexido will process your personal data only for the purposes for which they were obtained and will not process them for purposes that are incompatible with the purposes for which they were collected. Flexido collects from the user only those personal data that are strictly necessary to achieve the individual purpose.

Processing for the performance of contractual obligations

In certain cases the processing of personal data is strictly necessary for the performance of the controller’s contractual obligations. If the user does not provide the required data, the controller cannot conclude a contract with the user or perform the services.

The controller will process your personal data for the performance of contractual obligations for the following purposes:

contractual arrangement of business cooperation,
performance of activities specified in the cooperation contract,
communication with contractors and other contact persons of the client for the purpose of performing activities specified in the cooperation contract,
registration of the user for an event organised by Flexido or one of the controller’s partners.

Processing on the basis of consent or permission

Flexido will, on the basis of your written consent, process your personal data for the following purposes:

sending invitations to industry events,
informing about industry news,
occasional sending of offers,
contacting by telephone for the purpose of presenting the sales programme,
monitoring the reading of sent e-mail messages, namely which e-mail message you opened or did not open, which links you opened or clicked, how long you read them or viewed particular content,
segmenting users on the basis of the facts in the previous indent and further sending of tailored (individualised) e-mail messages,
for the purposes of analysing the user’s lifecycle on the website: where the user arrived at the website from, monitoring time spent on the website, which web pages the user visited, which content the user downloaded or viewed,
segmenting users on the basis of the facts in the previous indent and further sending of tailored (individualised) messages through multichannel communication,
for all other purposes with which you specifically agree when cooperating with the controller.

In all cases where you give consent for the processing of your personal data, you may withdraw that consent at any time via the e-mail address info@flexido.eu.

Processing is necessary for fulfilment of the statutory obligations of Flexido

We also process your personal data when this is required of us by law. An example of the purpose of such processing is the processing of your personal data for the needs of court or administrative proceedings.

Processing on the basis of a legitimate interest pursued by Flexido

The controller may also process data on the basis of legitimate interest, except where such interests are overridden by the interests or fundamental rights and freedoms of the user to whom the personal data relate, which require protection of personal data. Where legitimate interest is used, the controller always carries out an assessment in accordance with the General Data Protection Regulation.

In certain cases Flexido may, for further processing of your personal data on the basis of legitimate interest, collected on the basis of one of the legal bases stated above (consent, contract), adopt certain safeguards for the protection of your personal data, such as pseudonymisation, encryption, processing in aggregated form and/or deletion of certain types of personal data. Flexido will process your personal data on the basis of legitimate interest for the following purposes:

Marketing, business and other technical analyses, such as analysing and determining from which organisations event participants come and what functions they hold in those organisations, keeping records of how many and which events the user attended, keeping records in connection with certificates, certifications and licences granted to event participants.
Prevention of abuse, ensuring security, asserting claims or defending against claims in administrative and court proceedings.
Direct marketing, including profiling of users, on the basis of previously lawfully obtained personal data.

Web analytics

If you consent, we use Vercel Web Analytics for anonymous statistics about visits to the website. The tool is not activated before your consent and is not used for advertising or profiling purposes. You may withdraw consent at any time in the cookie settings in the page footer.

If you consent, we also use Google Analytics 4, a service of Google, for statistics about the use of the website (for example, which pages are viewed). Google Analytics stores analytics cookies on your device (for example _ga) and processes data about your visit, such as the address of the visited page and technical data about your device and connection. Before you consent, the Google Analytics script is not loaded and no data is sent to Google through it. If you do not consent, Google Analytics is not active. When you withdraw consent, further collection through Google Analytics stops and the website attempts to delete the Google Analytics cookies known to it; withdrawal does not delete data collected before it.

The provider of this service and recipient of website usage data is Google (the Google company providing Google Analytics), acting as processor to the extent provided in the agreement with Google. Data may also be processed in third countries outside the European Economic Area; such transfers are governed by the legal mechanisms provided for by data-protection law, and each party is responsible for them within its own role. Details of the processing are available in Google’s terms and privacy policy. You may withdraw consent at any time in the cookie settings in the page footer; withdrawal does not affect the lawfulness of processing carried out before it.

5. Recipients of personal data, contractual processing and transfer of data to third countries

Only employees of Flexido and processors of personal data who are directly authorised for this may access your personal data.

Flexido will never transfer your personal data to unauthorised third parties.

By using Flexido websites and other services you agree that Flexido may entrust individual tasks in connection with your personal data to the processors listed below. The stated processors may process your personal data exclusively on behalf of and in accordance with the written instructions of Flexido, within the limits of the authorisation arising from the contract between Flexido and the processor, and in accordance with the purposes defined in the Policy.

Flexido cooperates with the following processors:

Vasco d.o.o.
Cores d.o.o.
Hitrost.com d.o.o.
KMS d.o.o.
Vercel Inc. (spletna analitika, ob soglasju uporabnika)

6. Retention period of personal data

The controller does not process personal data longer than necessary to achieve the purposes for which the personal data were collected and further processed.

Personal data that Flexido processes due to performance of a contract are retained by Flexido for the period needed to perform the contract and a further 20 years after its termination, except in cases where a dispute arises between you and the controller in connection with the contract. In such a case Flexido retains the data for a further 25 years after a court or arbitration decision or settlement becomes final or, if there was no court dispute, 25 years from the day of amicable resolution of the dispute.

Personal data that Flexido processes on the basis of law are retained by Flexido for the period prescribed by law.

Personal data that the controller processes on the basis of your personal consent or legitimate interest are retained by Flexido permanently, until withdrawal of your consent or a request to stop processing. Flexido deletes such data before withdrawal only if the purpose of processing the personal data has already been achieved or if the law so provides.

After expiry of the retention period Flexido will effectively and permanently delete or anonymise your personal data so that they can no longer be linked to you.

7. Care for the security of personal data

Flexido is committed to protecting your personal data. Unauthorised access to them, their use and disclosure are prevented by the following measures:

data are protected by premises, equipment and system software, including input-output units,
data are protected by the application software with which personal data are processed,
Flexido prevents unauthorised access to personal data during their transfer, including transfer via telecommunications means and networks,
Flexido ensures an effective method of blocking, destroying, deleting or anonymising personal data when the purpose for which they were collected ceases,
Flexido enables later determination of when individual data were entered into the personal-data collection, used, transferred or otherwise processed and who did so.

Unauthorised access to personal data, their use and disclosure are prevented by Flexido with the following security technologies and procedures:

control of physical access,
locking of premises, cabinets, computers,
storage of personal-data carriers in secured premises,
prevention of inspection of personal data by maintainers of premises, clients and other visitors of the premises of the contractual processor,
prevention of the use of passwords by persons to whom the password was not directly assigned or for a purpose other than that specified,
restriction of data exports by employees,
control of copies and exports of data,
limited, recorded and secured transfer of data via telecommunications networks,
withdrawal of data from persons whose contract with the contractual processor ends,
strict separation from the data of any other controllers.

8. Users’ rights in connection with the protection of personal data

In accordance with the General Data Protection Regulation Flexido guarantees you the following rights in connection with the protection of personal data, which are set out in more detail below:

the right of access to data,
the right to rectification,
the right to erasure (“right to be forgotten”),
the right to restriction of processing,
the right to data portability,
the right to object.

Right of access to data

You have the right to obtain from Flexido confirmation as to whether Flexido is processing your personal data, and where that is the case you have the right to obtain access to your personal data and the following information in connection with the processing of personal data:

the purposes of processing,
the types of personal data,
where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period,
the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data,
the right to lodge a complaint with a supervisory authority,
where the personal data are not collected from the user, any available information as to their source,

On the basis of your request Flexido will provide you with a free copy of your personal data that are being processed.

Right to rectification

You have the right to obtain from Flexido without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Right to erasure (“right to be forgotten”)

You have the right to obtain from Flexido the erasure of personal data concerning you without undue delay, and Flexido must erase your personal data without undue delay in the following cases:

where the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed,
where you withdraw consent which is the basis for the processing of your personal data, and there is no other legal basis for the processing,
where you object to processing on the basis of the controller’s legitimate interest, and there are no overriding legitimate grounds for the processing,
where you object to processing for direct-marketing purposes,
where the personal data have to be erased for compliance with a legal obligation in accordance with EU law or the Slovenian legal order.

Right to restriction of processing

You have the right to obtain from Flexido restriction of processing of your personal data where one of the following applies:

where you contest the accuracy of the data, for a period enabling the controller to verify the accuracy of your personal data,
where the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead,
where Flexido no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims,
where you have objected to processing, pending the verification whether the legitimate grounds of the controller override your grounds.

Right to data portability

You have the right to receive the personal data concerning you, which Flexido has been in possession of, in a structured, commonly used and machine-readable format, and the right to transmit those data to another controller without hindrance from Flexido, to which the personal data have been provided, where:

the processing is based on your consent or on a contract and
the processing is carried out by automated means.

Right to object

On grounds relating to your particular situation, you have the right to object at any time to processing of personal data if it is based on legitimate interests pursued by Flexido or a third party. Flexido will cease processing the personal data unless it demonstrates compelling grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct-marketing purposes, you have the right to object at any time to processing of your personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing. If direct marketing is based on consent, the right to object may be exercised by withdrawing the personal consent given.

9. Procedure for exercising rights

All of the above requests concerning the exercise of rights in connection with your personal data may be exercised via the e-mail address info@flexido.eu or by post to Flexido d.o.o., Veliki Otok 44D, 6230 Postojna.

If you submit a request in accordance with the preceding paragraph by electronic means, the information will, where possible, be provided to you by electronic means, unless you request otherwise.

The controller may, for the purpose of reliable identification when you exercise your rights in connection with personal data, request from you additional data needed to confirm your identity, and may refuse to act in accordance with this chapter only if it demonstrates that it cannot reliably identify you.

The controller will respond to a request by which you exercise your rights in connection with your personal data without undue delay and at the latest within one month of receipt of the request. Flexido may extend the period for exercising rights by a maximum of two further months, taking into account the complexity and number of the requests.

If your requests in accordance with this chapter are manifestly unfounded or excessive, in particular because of their repetitive character, Flexido may:

charge a reasonable fee, taking into account the administrative costs of providing the information or communication or taking the action requested,
refuse to act on the request.

10. Right to lodge a complaint in connection with the processing of personal data

Any complaint in connection with the processing of your personal data may be sent to the e-mail address info@flexido.eu or by post to Flexido d.o.o., Veliki Otok 44D, 6230 Postojna.

You also have the right to lodge a complaint directly with the Information Commissioner if you consider that the processing of personal data concerning you infringes Slovenian regulations or EU regulations in the field of personal-data protection.

11. Validity of the Policy

The Policy is valid from 26. 1. 2023 onwards and may be changed or supplemented at any time.