Privacy Policy

The purpose of the Privacy Policy is to inform individuals, clients, users of products or services, associates, employees and other persons (hereinafter: the ‘individual’) who cooperate with INCOM GROUP d.o.o. (hereinafter: the ‘company’) of the purposes, legal bases, security measures and individuals’ rights in relation to the processing of personal data carried out by the company.

We value your privacy, which is why we always protect your data with care.

We process personal data in accordance with the applicable legislation on personal data protection and other legislation that provides us with a legal basis for processing personal data.

Any changes to this document will be published on our website. By using the website, you confirm that you are familiar with the entire content of the Privacy Policy.

 

Personal data controller:                                                                              COMPANY: INCOM GROUP Company for Economic and Organisational Management d.o.o. ADDRESS: Vipavska cesta 3 TOWN: 5270 Ajdovščina email: info@incom-group.si telephone: +386 30 222 666   Contact point: email: info@datainfo.si telephone: +386 2 620 4 300 website: www.datainfo.si

 

1) Personal data

Personal data means any information relating to an identified or identifiable individual; an identifiable individual is one who can be identified, directly or indirectly, in particular by reference to an identifier such as: a name, an identification number, location data, an online identifier or a reference to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual.

2) Purposes of processing and legal bases for data processing

The company collects and processes personal data on the following legal bases:

• processing is necessary for compliance with a legal obligation to which the controller is subject;
• processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract;
• processing is necessary for the purposes of the legitimate interests, pursued by the controller or by a third party;
• the data subject has given consent to the processing of their personal data for one or more specific purposes;
• processing is necessary to protect the vital interests of the data subject or of another natural person.

Informing individuals by email, e.g. e-newsletters

In the course of its lawful business activities, the company may inform clients, customers and users of its services, at their email addresses, about its services, events, training, offers and other content. An individual may at any time request the cessation of this type of communication and the processing of personal data, and unsubscribe from receiving messages via the unsubscribe link in the message received, or submit a request by email or by regular post to the company’s address.

The legal bases for data processing are legitimate interest and consent. Data will be processed until the individual unsubscribes from receiving messages or withdraws consent, or until the purpose of the processing has been fulfilled. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

 Video surveillance

We carry out video surveillance at INCOM GROUP d.o.o. Using video surveillance (cameras are installed in the vicinity of the entrances to the organisation), we monitor entry into and exit from the premises (pursuant to Article 77 of ZVOP-2). We also carry out video surveillance for the purpose of protecting individuals (users, employees and visitors) and the organisation’s property (on the basis of legitimate interest as provided for in point (f) of Article 6(1) of the General Regulation, in conjunction with Article 76 and subsequent articles of ZVOP-2). Video surveillance will assist us in detecting, handling or resolving incidents or emergencies, criminal offences, compensation claims or other claims. Recordings are retained for up to 2 months. Video surveillance allows an authorised person to monitor events in real time. All information regarding the implementation of video surveillance can be obtained at the organisation’s telephone number or email address. Individuals’ rights are described in this Privacy Policy.

Video surveillance and the installation, maintenance and management of the video surveillance system are carried out by INCOM GROUP d.o.o.

 Performance of concluded contracts

Where an individual enters into a contract with the company, that contract constitutes the legal basis for processing personal data. The company may therefore process personal data for the conclusion and performance of a contract, such as the sale of goods and services, the preparation of an offer, participation in various programmes, etc. If the individual does not provide personal data, the company cannot conclude a contract, nor can the company provide the service or deliver goods or other products in accordance with the concluded contract, as it does not have the data necessary for performance. On this basis, the company processes only and exclusively those personal data that are necessary for the conclusion and proper performance of contractual obligations.

The legal basis for data processing is the contract. The retention period is until the purpose of the contract has been fulfilled or up to 6 years after the termination of the contract, except where a dispute arises between the individual and the company in connection with the contract. In such a case, the company retains the data for a further 10 years after the court decision, arbitration award or court settlement becomes final or, if there was no litigation, for 6 years from the date of the amicable resolution of the dispute.

 Legitimate interest

The company may also process personal data on the basis of a legitimate interest that it pursues. This is not permissible where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data. When relying on legitimate interest, the company carries out an assessment in accordance with the legislation. The processing of individuals’ personal data for direct marketing purposes is regarded as being carried out in a legitimate interest.

The company may also process individuals’ personal data collected from publicly accessible sources or in the course of its lawful business activities for the purposes of offering goods, services and employment, providing information about benefits, events, etc. To achieve these purposes, the company may use regular post, telephone calls, email and other telecommunications means. For direct marketing purposes, the company may process the following personal data of individuals: the individual’s first name and surname, permanent or temporary residential address, telephone number and email address. The company may also process the aforementioned personal data for direct marketing purposes without the individual’s express consent. An individual may at any time request the cessation of this type of communication and the processing of personal data, and unsubscribe from receiving messages via the unsubscribe link in the message received, or submit a request by email or by regular post to the company’s address.

The legal basis for data processing is legitimate interest. Data will be processed until the individual unsubscribes from receiving messages or until the purpose of the processing has been fulfilled. Unsubscribing does not affect the lawfulness of processing based on consent before its withdrawal.

Processing on the basis of consent or agreement

If the company does not have a legal basis established by law, a contractual obligation, a legitimate interest or the protection of an individual’s life, it may ask the individual for consent or agreement. It may thus also process certain personal data of an individual for the following purposes where the individual gives consent for this:

• residential address and email address (for information and communication purposes);
• photographs, video recordings and other content relating to the individual (e.g. publication of images of individuals on the website for the purposes of documenting activities and informing the public about the company’s work and events);
• other purposes to which the individual agrees by giving consent.

If an individual gives consent to the processing of personal data and at some point no longer wishes this, they may request the cessation of the processing of personal data by submitting a request by email or by regular post to the company’s address. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. Following receipt of the withdrawal or request for erasure, the data will be erased within 15 days at the latest. The company may also erase these data before consent is withdrawn where the purpose of processing the personal data has been achieved or where required by law.

By way of exception, the company may refuse a request for erasure on the grounds set out in the General Regulation in cases involving the exercise of the right to freedom of expression and information, compliance with a legal obligation to process data, reasons of public interest in the area of public health, archiving purposes in the public interest, scientific or historical research purposes, statistical purposes, or the exercise or defence of legal claims.

The legal basis for data processing is consent. Data will be processed until consent is revoked or withdrawn, or until the purpose of the processing has been fulfilled. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Protection of the individual’s vital interests

The company may process the personal data of a data subject where this is necessary to protect their vital interests. In emergencies, the company may locate the individual’s identity document, check whether that person is included in its database, examine their medical history or contact their relatives, for which the company does not require the individual’s consent. This applies where it is strictly necessary to protect the individual’s vital interests.

3) Retention and erasure of personal data

The company will retain personal data only for as long as necessary to fulfil the purpose for which the personal data were collected and processed. Where the company processes data on the basis of law, it will retain them for the period prescribed by law. Some data are retained for the duration of cooperation with the company, while some data must be retained permanently. The company retains personal data processed on the basis of a contractual relationship with an individual for the period necessary to perform the contract and for a further 6 years after its termination, except where a dispute arises between the individual and the company in connection with the contract. In such a case, the company retains the data for a further 10 years after the court decision, arbitration award or court settlement becomes final or, if there was no litigation, for 6 years from the date of the amicable resolution of the dispute. The company will retain personal data processed on the basis of the individual’s personal consent or legitimate interest until consent is withdrawn or a request for erasure of the data is made. Following receipt of the withdrawal or request for erasure, the data will be erased without undue delay. The company may also erase these data before consent is withdrawn where the purpose of processing the personal data has been achieved or where required by law. Where an individual exercises their rights, the company retains that individual’s personal data until a final decision has been made on the matter and, after the decision becomes final, in accordance with the final decision in the matter.

By way of exception, the company may refuse a request for erasure on grounds such as: the exercise of the right to freedom of expression and information, compliance with a legal obligation to process data, reasons of public interest in the area of public health, archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, or the exercise or defence of legal claims. Once the retention period has expired, the company must effectively and permanently erase or anonymise the personal data so that they can no longer be linked to a particular individual.

4) Contractual processing of personal data and data transfers

The company may entrust individual personal data processing operations to a contractual processor on the basis of a data processing agreement. Contractual processors may process the data entrusted to them exclusively on behalf of the controller, within the scope of its authorisation as set out in a written contract or other legal act, and in accordance with the purposes defined in this Privacy Policy.

The contractual processors with which the company cooperates are primarily:

• accounting services and other providers of legal and business advice;
• infrastructure maintenance providers (video surveillance, security services);
• information system maintenance providers;
• email service providers and providers of software and cloud services (e.g. Microsoft, Google);
• providers of social networks and online advertising (Google, Facebook, Instagram, etc.).

For the purposes of improving its overview and supervision of contractual processors and ensuring that their mutual contractual relationships are properly regulated, the company also maintains a list of contractual processors, identifying all specific contractual processors with which the company cooperates.

Under no circumstances will the company disclose an individual’s personal data to unauthorised third parties. Contractual processors may process personal data only within the scope of the company’s instructions and may not use personal data for any other purposes.

The company, as controller, and its employees do not transfer personal data to third countries (outside the member states of the European Economic Area: EU member states and Iceland, Norway and Liechtenstein) or to international organisations, except to the USA, where relationships with contractual processors from the USA are regulated on the basis of standard contractual clauses (model contracts adopted by the European Commission) and/or binding corporate rules (adopted by the company and approved by supervisory authorities in the EU).

5) Cookies

The company’s website operates using so-called cookies, which are important for the provision of online services and are used to store information about the state of an individual webpage, to assist in collecting statistics on users and website visits, etc. Upon entering the website, only those cookies that are strictly necessary for the operation of the website (e.g. for the shopping cart) are loaded onto the device. Other cookies will be loaded only with the individual’s consent. The individual may change the settings and delete cookies at any time (instructions are available on the websites of the respective browsers).

6) Data security and data accuracy

The company ensures information security and the security of its infrastructure (premises and application and system software). Our information systems are protected, among other things, by antivirus software and a firewall. We have introduced appropriate organisational and technical security measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, and against other unlawful and unauthorised forms of processing. When transmitting special categories of personal data, we transmit them in encrypted and password-protected form. Individuals are responsible for ensuring that they transmit their personal data securely and that the data provided are accurate and authentic.

7) Individuals’ rights in relation to data processing

The data subject has the right to request access to personal data and the rectification or erasure of personal data or restriction of processing concerning them, as well as the right to object to processing and the right to data portability. An individual’s request is handled in accordance with the provisions of the General Regulation and the applicable personal data protection legislation.

An individual may exercise all the aforementioned rights and raise any questions by submitting a request to the company’s address. The company will respond to the individual’s request without undue delay and no later than one month after receipt of the request. Taking into account the complexity and number of requests, this period may be extended by a maximum of two additional months, of which the individual will be informed, together with the reasons for the delay. The exercise of rights is free of charge for the individual; however, the company may charge a reasonable fee if a request is manifestly unfounded or excessive, in particular if it is repetitive. In such a case, the company may also refuse the request. Where there is doubt about the individual’s identity, additional information needed by the company to establish identity may be requested.

In its decision on the request, the company will also inform the individual of the reasons for the decision and of the right to lodge a complaint with the supervisory authority within 15 days of being informed of the decision. The individual may exercise the right to lodge a complaint with the supervisory authority at: the Information Commissioner of the Republic of Slovenia, at the address: Dunajska 22, 1000 Ljubljana (email: gp.ip@ip-rs.si, website: www.ip-rs.si).

The Privacy Policy applies from 24 September 2026 onwards.

In Ajdovščina, 23 September 2026

 

INCOM GROUP d.o.o.

Director Andrej Slokar