The purpose of this Privacy Policy is to inform individuals, customers, users of products or services, collaborators, employees, and other persons (hereinafter: the “individual”) who cooperate with Kaskader d.o.o. (hereinafter: the “company”) about the purposes, legal bases, security measures, and the rights of individuals regarding the processing of personal data carried out by the company.

We value your privacy and therefore always protect your data carefully.

We process personal data in accordance with the applicable personal data protection legislation and other laws that provide us with a legal basis for processing personal data.

Any changes to this document will be published on our website. By using the website, you confirm that you are familiar with the entire content of this Privacy Policy.

Data Controller

Kaskader d.o.o.
Spodnja Kanomlja 66
5281 Spodnja Idrija
e-mail: info@kaskader.si
telephone: +386 5 372 82 70
Website: https://kaskader.si/

Personal Data

Personal data means any information relating to an identified or identifiable individual; an identifiable individual is one who can be identified directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that individual.

Purposes and Legal Bases for Data Processing

The company collects and processes personal data on the following legal bases:

• processing is necessary for compliance with a legal obligation to which the controller is subject;
• processing is necessary for the performance of a contract to which the individual is a party or in order to take steps at the request of such individual prior to entering into a contract;
• processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party;
• the individual to whom the personal data relates has consented to the processing of their personal data for one or more specific purposes;
• processing is necessary in order to protect the vital interests of the individual to whom the personal data relates or of another natural person;
• informing individuals via e-mail, e.g. newsletters.

Based on its legitimate business activity, the company may inform customers, clients, and users of its services about its services, events, training sessions, offers, and other content via their electronic address. An individual may at any time request termination of such communication and personal data processing and unsubscribe from receiving messages via the unsubscribe link in the received message or by sending a request via e-mail or regular mail to the company’s address.

The legal bases for data processing are legitimate interest and consent. Data will be processed until the withdrawal of consent, the cancellation of message subscriptions, or until the purpose of processing has been fulfilled. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.

Video Surveillance

Kaskader d.o.o. carries out video surveillance. Through video surveillance (cameras installed around the entrances to the organization), we monitor entries into and exits from the premises (based on Article 77 of ZVOP-2). Video surveillance is also carried out for the purpose of protecting individuals (users, employees, and visitors) and the property of the organization (based on legitimate interest as defined in point (f) of paragraph 1 of Article 6 of the General Data Protection Regulation in connection with Articles 76 and following of ZVOP-2). In certain work areas (around the entrances to the organization where work processes occasionally take place), video surveillance is carried out where necessary for the safety of people or property or for the protection of confidential data or business secrets. Video surveillance helps us detect, handle, or resolve incidents, extraordinary events, criminal acts, compensation claims, or other claims. Recordings are stored for 1 month. Video surveillance is not carried out in a manner that would have a special impact on processing. Video surveillance allows authorized persons to monitor events live; however, live monitoring is not actively performed. All information regarding the implementation of video surveillance can be obtained via the organization’s telephone number or e-mail address. The rights of individuals are described in this Privacy Policy.

Performance of a Concluded Contract

In cases where an individual concludes a contract with the company, such contract represents the legal basis for the processing of personal data. The company may therefore process personal data for the purpose of concluding and performing a contract, such as the sale of goods and services, preparation of offers, participation in various programs, etc. If the individual does not provide personal data, the company cannot conclude the contract, nor perform the service or deliver goods or other products in accordance with the concluded contract, as it does not have the necessary data for execution. On this basis, the company processes only those personal data that are necessary for concluding and properly fulfilling contractual obligations.

The legal basis for processing is the contract. Data will be retained until the purpose of the contract has been fulfilled or for up to 10 years after termination of the contract, except in cases where a dispute arises between the individual and the company regarding the contract. In such a case, the company retains the data for 10 years after the final court judgment, arbitration, or judicial settlement, or, if no court dispute occurred, 6 years from the date of amicable settlement of the dispute.

Legitimate Interest

The company may also process personal data on the basis of legitimate interest pursued by the company. This is not permitted where such interests are overridden by the interests or fundamental rights and freedoms of the individual requiring protection of personal data. When relying on legitimate interest, the company carries out an assessment in accordance with applicable legislation. Processing of personal data for direct marketing purposes is considered to be carried out on the basis of legitimate interest.

The company may process personal data of individuals collected from publicly available sources or within the framework of lawful business operations for the purposes of offering goods, services, employment opportunities, informing about benefits, events, etc. For these purposes, the company may use regular mail, telephone calls, e-mail, and other telecommunication means. For direct marketing purposes, the company may process the following personal data: first name and surname, permanent or temporary address, telephone number, and e-mail address. The company may process these personal data for direct marketing purposes even without the explicit consent of the individual. The individual may at any time request termination of such communication and personal data processing and unsubscribe from receiving messages via the unsubscribe link in the received message or by sending a request via e-mail or regular mail to the company’s address.

The legal basis for processing is legitimate interest. Data will be processed until cancellation of subscriptions or until the purpose of processing has been fulfilled. Withdrawal does not affect the lawfulness of processing based on consent prior to its withdrawal.

Processing Based on Consent

If the company does not have a legal basis established by law, contractual obligation, legitimate interest, or protection of vital interests, it may request the individual’s consent. The company may therefore process certain personal data for the following purposes when consent is provided:

• residential address and e-mail address (for notification and communication purposes);
• photographs, video recordings, and other content relating to the individual (e.g. publication of images of individuals on the website for documenting activities and informing the public about the company’s work and events);
• other purposes for which the individual has given consent.

If the individual has provided consent for the processing of personal data and later no longer wishes such processing, they may request termination of processing via e-mail or regular mail sent to the company’s address. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal. Upon receipt of withdrawal or deletion request, the data will be deleted no later than within 15 days. The company may also delete such data prior to withdrawal when the purpose of processing has been achieved or if required by law.

Exceptionally, the company may refuse a deletion request for reasons arising from the General Regulation in cases involving the exercise of the right to freedom of expression and information, compliance with legal obligations, reasons of public interest in the field of public health, archiving purposes in the public interest, scientific or historical research purposes, statistical purposes, or the establishment, exercise, or defence of legal claims.

The legal basis for processing is consent. Data will be processed until consent is withdrawn or until the purpose of processing has been fulfilled. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Protection of Vital Interests of the Individual

The company may process personal data relating to an individual where this is necessary to protect their vital interests. In urgent cases, the company may inspect the individual’s identity document, verify whether the person exists in its database, review their medical history, or contact their relatives, without requiring the individual’s consent. This applies where such action is necessary to protect the vital interests of the individual.

Retention and Deletion of Personal Data

The company will retain personal data only for as long as necessary to achieve the purpose for which the personal data was collected and processed. Where the company processes data based on law, it will retain the data for the period prescribed by law. Certain data are retained for the duration of cooperation with the company, while some data must be retained permanently. Personal data processed by the company on the basis of a contractual relationship with the individual are retained for the period necessary to perform the contract and for an additional 10 years after its termination, except where a dispute arises between the individual and the company regarding the contract. In such a case, the company retains the data for 10 years after the final court judgment, arbitration, or judicial settlement, or, if no court dispute occurred, 6 years from the date of amicable settlement of the dispute. Personal data processed based on the individual’s consent or legitimate interest are retained until the consent is withdrawn or until a request for deletion is submitted. Upon receipt of a withdrawal or deletion request, the data are deleted without undue delay. The company may also delete such data before withdrawal if the purpose of processing has been fulfilled or if required by law.

In the event of exercising individual rights, the company retains the personal data of that individual until the matter is finally resolved, and thereafter in accordance with the final decision.

Exceptionally, the company may refuse a deletion request for reasons such as exercising the right to freedom of expression and information, compliance with legal obligations, reasons of public interest in the field of public health, archiving purposes in the public interest, scientific or historical research purposes, statistical purposes, or the establishment, exercise, or defence of legal claims. After the retention period expires, the company must effectively and permanently delete or anonymize personal data so that they can no longer be associated with a specific individual.

Contractual Processing of Personal Data and Data Transfers

The company may entrust certain personal data processing activities to contractual processors based on a data processing agreement. Contractual processors may process entrusted data exclusively on behalf of the controller, within the scope of authority specified in a written agreement or another legal act, and in accordance with the purposes defined in this Privacy Policy.

Contractual processors with whom the company cooperates primarily include:

• accounting services and other providers of legal and business consulting;
• infrastructure maintenance providers (video surveillance, security services);
• information system maintenance providers;
• e-mail service providers and software/cloud service providers (e.g. Microsoft) – subject to the general terms and conditions of each provider;
• social media and online advertising providers (Google, Facebook, Instagram, LinkedIn, YouTube) – subject to the general terms and conditions of each provider;
• website maintenance providers;
• web hosting providers.

For the purpose of better oversight and control of contractual processors and the regulation of contractual relationships, the company also maintains a list of contractual processors specifying all concrete contractual processors with whom it cooperates.

Under no circumstances will the company disclose personal data to unauthorized third parties. Contractual processors may process personal data solely within the scope of the company’s instructions and may not use personal data for any other purposes.

The company as controller and its employees do not transfer personal data to third countries (outside the member states of the European Economic Area – EU member states and Iceland, Norway, and Liechtenstein) or to international organizations. The exception is Switzerland, where relationships with contractual processors are regulated on the basis of standard contractual clauses (template agreements adopted by the European Commission) and/or binding corporate rules (adopted by the company and approved by supervisory authorities in the EU).

Cookies

The company’s website does not use so-called cookies or other tracking technologies. This policy ensures that we do not collect, store, or process any personal data through cookies or similar technologies. In the event that the company’s website begins using cookies that are important for providing online services and are used for storing website status data, helping collect statistics on users and website visits, etc., the company will inform website users through a notice and publication on the website.

In such a case, only those cookies strictly necessary for the functioning of the website will be loaded upon visiting the website. Other cookies will only be loaded with the individual’s consent. The individual may change the settings and delete cookies at any time (instructions are available on the websites of individual browsers).

Data Security and Accuracy

The company ensures information security and infrastructure security (premises and application/system software). Our information systems are protected, among other things, by antivirus software and firewalls. We have implemented appropriate organizational and technical security measures intended to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, and against other unlawful and unauthorized forms of processing. When transmitting special categories of personal data, we transmit them in encrypted form and protected by password. The individual is solely responsible for securely providing their personal data and ensuring that the data provided are accurate and truthful.

Rights of Individuals Regarding Data Processing

The individual to whom personal data relates has the right to request access to personal data and rectification or deletion of personal data or restriction of processing concerning them, as well as the right to object to processing and the right to data portability. Requests from individuals are handled in accordance with the provisions of the General Regulation and applicable personal data protection legislation.

All the above rights and any questions may be exercised by sending a request to the company’s address. The company will respond to the individual’s request without undue delay and no later than within one month of receipt of the request. This period may be extended by up to two additional months, taking into account the complexity and number of requests, about which the individual will be informed together with the reasons for the delay. Exercising rights is free of charge for the individual; however, the company may charge a reasonable fee if the request is manifestly unfounded or excessive, particularly if repetitive. In such a case, the company may also refuse the request. In the event of doubt regarding the individual’s identity, additional information necessary to confirm identity may be requested.

In its decision regarding the individual’s request, the company will also inform the individual of the reasons for the decision and provide information about the right to lodge a complaint with the supervisory authority within 15 days of being informed of the decision. The right to lodge a complaint with the supervisory authority may be exercised before the Information Commissioner of the Republic of Slovenia at: Dunajska 22, 1000 Ljubljana (e-mail: gp.ip@ip-rs.si, website: www.ip-rs.si).

This Privacy Policy applies from 01 January 2025 onwards.

Responsible person of the company: Director Tamara Poljanec