Privacy policy

1. About the privacy policy

The purpose of the Privacy Policy of ANDUK D.O.O – website anduk.si (hereinafter: “Privacy Policy”) is to inform the users of the services of ANDUK d.o.o. and other persons (hereinafter also referred to as “Individuals”) of the purposes and the basis of the processing of personal data by ANDUK d.o.o., Kotnikova ulica 5, 1000 Ljubljana (hereinafter also “anduk”), and of the rights of individuals in this area.

The company takes special care of the security of your personal data. All personal data provided are treated confidentially and are used only for the purpose for which they were provided and collected. We manage your personal data with the utmost care, taking into account the applicable legislation and the highest standards of their processing. Among other things, we ensure the security of personal data with appropriate organisational measures and work procedures. In doing so, we use an appropriate level of protection and reasonable physical, electronic and administrative measures to protect the collected data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of and access to personal data that have been transmitted, stored or otherwise processed.

The privacy and personal data protection policy is in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, and with the legislation of the Republic of Slovenia, and covers the following information:

• the company's contact information,
• the purposes, bases and types of processing of the different types of personal data of individuals,
• the retention period of individual types of personal data,
• the rights of individuals regarding the processing of personal data,
• the right to lodge a complaint regarding the processing of personal data,
• the validity of the Privacy Policy.

2. Personal data collected by the company

If you are only a visitor to the website, we collect data about you only through cookies. If you are a user who uses our system in any other way (registration, e-newsletter, a purchase in the online shop, etc.), we also collect other personal data about you that we need to carry out the sales processes.

Registration

On registration, the anduk.si website collects the following data:

• first name and surname,
• e-mail address,
• contact telephone number,
• primary address and delivery address,
• time and date of registration,
• archive of communication with the anduk.si website,
• other data the individual enters when registering on the anduk.si website.

The online shop and the company are not responsible for the accuracy of the data entered by the user.

The controller will carefully protect the collected data in accordance with Slovenian and European legislation on the protection of personal data.

Until revoked, the controller will use the data entered at the user's registration to process the user's order, to analyse the user experience in order to improve it, and for marketing analyses that enable the preparation of suitable offers and the improvement of the sales process. The entered data may also be used for remarketing purposes. Registration allows the user to follow past purchases and shortens the purchasing procedure.

The anduk.si website keeps the data until the use of personal data is revoked in writing. When revoking the use and storage of data for the purposes mentioned in the previous paragraph, the user must state in the written revocation:

• the user's first name and surname,
• address,
• the e-mail address with which they registered,
• the request to revoke the use and storage of personal data for the purpose: REGISTRATION.

The message must be sent from the e-mail address with which the user is signed in as a registered member.

Please note that we may retain some data from closed accounts in accordance with the law – for the purposes of preventing fraud, debt collection, resolving disputes, troubleshooting, assisting investigations by the competent authorities, enforcing the terms of use of the services and taking other measures permitted by law. The data we retain will be treated in accordance with our privacy policy.

E-newsletter

The user can subscribe to the e-newsletter, in which the individual receives from the anduk website, until revoked, notifications about news in the online shop's offer, about marketing activities and other promotions.

When the user subscribes to the e-newsletter, the controller collects the following data:

• first name and surname,
• e-mail address,
• IP,
• if the user is registered, also the address and telephone number.

When the user confirms the message received at the e-mail address they gave when filling in the electronic form, they are subscribed to the e-newsletter of the anduk website until revoked.

The user may at any time, by a written request to the e-mail address info@anduk.si, ask the controller of personal data to permanently stop using their personal data for the purpose of receiving e-newsletter notifications. The request will be granted within the statutory deadlines.

In the written request, the individual must state the following data:

• the user's first name and surname,
• address,
• the e-mail address with which they are registered to receive the e-newsletter,
• the request to revoke the use and storage of personal data for the purpose: E-NEWSLETTER.

3. Controller of personal data

The controller of the personal data processed in accordance with this Privacy Policy is ANDUK d.o.o., Kotnikova ulica 5, 1000 Ljubljana.

4. Categories of individuals whose personal data are processed

This Privacy Policy is intended for all of you who have ordered and/or use our services or have submitted an enquiry, as well as for those who visit our website.

5. Purposes of processing and bases for processing data

Processing on the basis of a contract:

For the purpose of exercising contractual rights and fulfilling contractual obligations, the company processes your personal data for the following purposes: identification of the individual, preparation of an offer, conclusion of a contract for the provision of the ordered services, notification of any changes, additional details and instructions for using the services, resolving any technical problems, objections or complaints, billing of services, and other purposes necessary for performing or concluding the contractual relationship between the company and the individual.

When billing services, in accordance with the tax regulations on issuing invoices, we also obtain and process your address.

Processing on the basis of law:

On the basis of legitimate interest, we use your personal data to detect and prevent fraudulent use and abuse of the services, further within the framework of ensuring the stable and secure operation of our system and services, and for the purposes of implementing information security measures, meeting requirements relating to the quality of the services and detecting technical failures of systems and services.

On the basis of legitimate interest, we also use your personal data for the purposes of any enforcement and judicial and out-of-court debt collection.

In accordance with the General Regulation, in the event of suspected abuse the company may, to an appropriate and proportionate extent, process data on individuals for the purpose of identifying and preventing possible fraud or abuse, and may, where appropriate, also forward these data to other providers of such products, business partners, the police, the state prosecutor's office or other competent authorities. To prevent future abuse or fraud, data on the history of established abuse or fraud in connection with the individual, which include data on the subscription relationship and, for example, the IP address, may be kept for a further five years after the end of the business relationship.

Processing of data on the basis of consent to the processing of personal data:

By using the anduk.si website, the user agrees to the applicable General Terms and Conditions. The user can regularly follow any changes to the general terms and conditions and to the manner and purpose of the use of the collected personal data.

Data processing may also be based on your consent, which you have given to the company.

Consent may relate to notifications about offers, benefits and improvements of the services offered by the company. The purpose of such notifications is to bring the services as close as possible to your needs and wishes and so increase their usefulness for you. Notifications are sent through the channels you chose in the consent. You can cancel the notifications at any time, in the manner defined by the Privacy Policy.

You may withdraw or change your consent at any time in the same way as you gave it, or in another way defined by the Privacy Policy, whereby the company reserves the right to identify the customer. A change of consent can be arranged, among other ways, by e-mail to info@anduk.si or by a written request sent to the address of the company's registered office.

The withdrawal or change of consent applies only to the data processed on the basis of your consent. The last consent you gave that we received is valid. The possibility of withdrawing consent does not constitute a right of withdrawal in the individual's business relationship with the company.

The controller of personal data also uses the collected data to study the individual's purchasing habits for the purpose of direct and targeted marketing. The user has the right to request in writing at any time that the controller temporarily or permanently stop using their personal data for direct marketing purposes.

6. Restrictions on the transfer of personal data

Where necessary, we may authorise companies and individuals to carry out certain work that contributes to our services. In this case, we may also transfer personal data to such carefully selected external processors, who will conclude an appropriate personal data processing agreement or a substantively equivalent arrangement with the company. We will transfer personal data to external processors only to the extent required by a specific purpose. The external processor may not use the transferred data for any other purpose. The external processor must meet all the standards of personal data processing provided for by the applicable legislation. External processors are contractually bound to the company to respect the confidentiality of your personal data.

We may also transfer your personal data to the competent state authorities on the basis of an attached request for the transfer of your personal data. In this way we respond to requests received from courts, law enforcement authorities and other state authorities, which may also include state authorities of other EU member states.

7. Retention period of personal data

The retention period depends on the category to which the collected personal data belong. We keep your personal data for at most as long as is necessary to achieve the purpose for which they were collected or further processed, or until the statutory retention period expires.

Billing data and the contact data related to billing may be kept for the purpose of fulfilling contractual obligations until the debt is fully paid or at the latest until the expiry of the limitation period for the individual claim, which by law may be from one to five years. Invoices are kept for a further 10 years after the end of the year in which the invoice was issued – as determined by the Value Added Tax Act.

After the retention period expires, the data are deleted, destroyed, blocked or anonymised, unless the law provides otherwise for a particular type of data.

Data about you that are no longer needed for the purposes for which they were collected or otherwise processed may be anonymised and combined with other data that do not allow the identification of the individual. They give us insight into statistical information that is commercially useful for the anduk.si website.

8. Rights of individuals regarding the processing of personal data

We ensure the exercise of your rights regarding the processing of your personal data without undue delay. We will decide on your request within one month of receiving it. In more complex cases and with a larger number of requests received, we may extend this deadline by at most two further months. If the deadline is extended, we will inform you of this within one month of receiving the request, together with the reasons for the delay.

We accept requests regarding the exercise of your rights at the e-mail address info@anduk.si or by post at ANDUK d.o.o., Kotnikova ulica 5, 1000 Ljubljana.

Where there is reasonable doubt about the identity of the individual who submits a request regarding any of their rights, we may request additional information necessary to confirm the identity of the individual to whom the personal data relate.

If the requests of the individual to whom the personal data relate are manifestly unfounded or excessive, in particular because they are repetitive, the company may charge a reasonable fee, taking into account the administrative costs of providing the information or communication or taking the requested action, or refuse to act on the request.

Regarding the processing of your data, we provide you with the following rights:

• the right of access to data,
• the right to rectification of data,
• the right to erasure of data (the so-called right to be forgotten),
• the right to restriction of processing,
• the right to data portability,
• the right to object.

Right of access to data

At any time you have the right to know whether your personal data are being processed and, if so, the right to access your data and the following information:

• the purposes of processing,
• the types of personal data,
• the users or categories of users to whom the personal data have been or will be disclosed,
• the envisaged period of retention of the personal data or, if this is not possible, the criteria used to determine that period,
• the existence of the right to request from the controller the rectification or erasure of personal data or the restriction of the processing of your personal data, or the existence of the right to object to such processing,
• the right to lodge a complaint with the supervisory authority,
• where the personal data are not collected from you, all available information about their source.

Right to rectification

You have the right to request that we rectify your personal data without undue delay and, taking into account the purposes of the processing, the right to have incomplete personal data completed, including by providing a supplementary statement.

Right to erasure

You have the right to obtain the erasure of your personal data without undue delay where one of the following grounds applies:

• where the personal data are no longer necessary for the purposes for which they were collected or otherwise processed,
• where you withdraw the consent on which the processing is based and there is no other legal ground for the processing,
• where you object to the processing and there are no overriding legitimate grounds for it,
• where the personal data have been unlawfully processed,
• where the personal data must be erased to comply with a legal obligation under EU law or the Slovenian legal order.

Right to restriction of processing

You have the right to obtain the restriction of the processing of your personal data where one of the following applies:

• where you contest the accuracy of the data, for a period enabling us to verify the accuracy of the personal data,
• where the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead,
• where we no longer need your personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims,
• if you have objected to processing based on the company's legitimate interests, pending the verification whether our legitimate grounds override yours.

Where the processing of your personal data has been restricted in accordance with the previous paragraph, such personal data are, with the exception of storage, processed only with your consent, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person.

Before the restriction of the processing of your personal data is lifted, we are obliged to inform you of this.

Right to data portability

You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, and the right to transmit those data to another controller without hindrance from the company, where the processing is based on your consent and is carried out by automated means. At your request, the personal data may be transmitted directly to another controller where this is technically feasible.

Right to object

Where we process your data on the basis of legitimate interest for marketing purposes, you may object to such processing at any time.

We stop processing your personal data unless we demonstrate compelling grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.

9. Right to lodge a complaint regarding the processing of personal data

You can send any complaint regarding the processing of your personal data to the e-mail address info@anduk.si or by post to ANDUK d.o.o., Kotnikova ulica 5, 1000 Ljubljana.

If we do not decide on your request within the statutory deadline or we reject your request, you have the option of lodging a complaint with the Information Commissioner.

You also have the right to lodge a complaint directly with the Information Commissioner if you believe that the processing of your personal data violates Slovenian or EU regulations in the field of personal data protection.

If you have exercised the right of access to data and, after receiving the decision, you believe that the personal data you received are not the personal data you requested, or that you did not receive all the requested personal data, you may, before lodging a complaint with the Information Commissioner, file a reasoned complaint with the company within 15 days. We must decide on your complaint as on a new request within five working days.

10. Final provisions

For everything not regulated by this Privacy Policy, the applicable legislation applies.

The company reserves the right to amend this Privacy Policy. We will inform you of any change by publishing it on the official Anduk website 30 days before the new policy comes into force.

If you have any questions about the Privacy Policy or about the data we hold about you, we are available at the e-mail address info@anduk.si.