Privacy Policy
1. About the Privacy Policy
The purpose of the Privacy Policy of VENDOR d.o.o. (hereinafter: "Privacy Policy") is to inform users of VENDOR d.o.o.'s services and other persons (hereinafter also referred to as: "individuals") about the purposes and legal basis for the processing of personal data by the company VENDOR d.o.o, Stari trg 32A, Trebnje, 8210 Trebnje (hereinafter: "VENDOR") and the rights of individuals in this area.
The company takes special care for the security of your personal data. All personal data provided are treated confidentially and are used only for the purpose for which they were provided. We manage your personal data with the utmost care, in compliance with applicable legislation and the highest standards of data handling. Among other measures, we ensure the security of your personal data through appropriate organizational measures, work procedures, advanced technological solutions, and external experts to provide the most effective protection of your personal data. We use an appropriate level of protection and reasonable physical, electronic, and administrative measures to protect collected data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of personal data, or unauthorized access to personal data that have been transferred, stored, or otherwise processed.
At the same time, this Privacy Policy further explains the consent you have given for the processing of your personal data.
In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: "General Data Protection Regulation"), the Privacy Policy includes the following information:
company contact information,
purposes, legal bases, and types of processing of various types of personal data of individuals,
retention periods for different types of personal data,
rights of individuals regarding the processing of personal data,
the right to lodge a complaint regarding the processing of personal data,
validity of the Privacy Policy.
2. Personal data collected by the company
If you are only a visitor to the website, we collect data about you only through the use of cookies. If you are a user of services or a subscriber to services provided by the company, we also collect other personal data necessary for the provision of the services you have ordered or use. These personal data include:
first and last name
contact email address
contact phone number
IP address
data for issuing an offer based on your inquiry (your address, tax number).
3. Data controller
The data controller processing personal data in accordance with this Privacy Policy is VENDOR d.o.o, Stari trg 32A, Trebnje, 8210 Trebnje.
4. Categories of individuals whose personal data are processed
This Privacy Policy is intended for all who have ordered and/or use our services, or have submitted an inquiry, as well as those who visit our website.
5. Purposes of processing and legal bases for data processing
5.1. Processing based on contract:
In the course of exercising contractual rights and fulfilling contractual obligations, the company processes your personal data for the following purposes: identification of the individual, preparation of offers, conclusion of contracts, provision of ordered services, notification of possible changes, additional details and instructions for service use, resolving possible technical issues, objections or complaints, billing of services, and other purposes necessary for the execution or conclusion of the contractual relationship between the company and the individual.
For billing services, based on tax regulations, we also collect and process your address for correct invoice issuance.
5.2. Processing based on law:
Based on legitimate interest, we use your personal data to detect and prevent fraudulent use and abuse of services, to ensure stable and secure operation of our system and services, as well as for information security measures, compliance with service quality requirements, and detection of technical failures of systems and services.
Based on legitimate interest, we also use your personal data for possible enforcement, judicial and extrajudicial debt collection purposes.
In accordance with the General Data Protection Regulation, the company may, in case of suspected abuse, process data about individuals to the appropriate and proportionate extent for the purpose of identifying and preventing possible fraud or abuse and may, if appropriate, share this data with other providers of such services, business partners, police, public prosecutor's office, or other competent authorities. For the purpose of preventing future abuses or frauds, data on the history of identified abuses or frauds related to the individual, including subscription relationship data and, for example, IP address, may be retained for up to five years after the termination of the business relationship.
5.3. Processing based on consent for personal data processing:
Processing of data may also be based on your consent provided to the company.
Consent may, for example, relate to notifications about offers, benefits, and improvements of services provided by the company. The purpose of such notifications is to better tailor services to your needs and wishes and thereby increase their usefulness for you. Notifications are sent through channels you selected in the consent. You can withdraw your consent at any time in the manner defined by the Privacy Policy.
You can withdraw or change your consent at any time in the same way as it was given or in another manner defined by the Privacy Policy, whereby the company reserves the right to identify the customer. Changes to consent can also be arranged via email to b2b@vendor.si or by written request sent to the company's registered office address.
Withdrawal or change of consent applies only to data processed based on your consent. Your latest consent received by us is valid. The possibility of withdrawing consent does not constitute a right to terminate the business relationship with the company.
Data for which you have given consent will be processed, in the absence of withdrawal, for up to two years after the termination of the business relationship with the company.
6. Restrictions on the disclosure of personal data
If necessary, to perform certain tasks contributing to our services, we will authorize other companies and individuals. In such cases, the company may disclose personal data to carefully selected external processors who will enter into a personal data processing agreement or an equivalent binding document with the company (hereinafter: "Processing Agreement"). We will provide or make such data accessible to external processors only to the extent required for the specific purpose. External processors must not use this data for any other purposes and must comply with at least all data processing standards required by applicable law. External processors are contractually bound to the company to maintain the confidentiality of your personal data.
The company will provide personal data upon justified request also to competent state authorities that have a legal basis for this. For example, VENDOR d.o.o. will respond to requests from courts, law enforcement agencies, and other state authorities, which may include authorities from other EU member states.
7. Personal data retention period
The retention period of data depends on the category of individual data. We retain data for no longer than necessary to achieve the purpose for which they were collected or further processed or until the expiration of statutory limitation periods for fulfilling obligations or legally prescribed retention periods.
Billing data and related contact data about individuals may be retained for the purpose of fulfilling contractual obligations until full payment of the service or at most until the expiration of limitation periods related to the claim, which by law can range from one to five years. Invoices are retained for 10 years after the end of the year to which the invoice relates, in accordance with the law governing value-added tax.
Other data obtained based on your consent are retained for the duration of the business relationship and for 2 years after termination, unless the law prescribes a longer retention period. If an individual who gave consent for personal data processing has not entered into a business relationship with us, their consent is valid for 2 years from the date of consent or until its withdrawal.
After the retention period expires, data are deleted, destroyed, blocked, or anonymized unless the law provides otherwise for specific types of data.
8. Rights of individuals regarding the processing of personal data
We ensure the exercise of your rights regarding the processing of your personal data without undue delay. We will decide on your request within one month of receipt. In case of complexity and a higher number of requests, the deadline may be extended by up to two additional months. If we extend the deadline, we will inform you of each extension within one month of receiving the request, including reasons for the delay.
Requests regarding the exercise of your rights are accepted at the email address b2b@vendor.si or by mail to VENDOR d.o.o, Stari trg 32A, Trebnje, 8210 Trebnje.
If you submit a request electronically, we will provide information by electronic means where possible, unless you request otherwise.
If there is a justified doubt regarding the identity of the individual submitting a request related to any of their rights, we may require additional information necessary to confirm the identity of the individual to whom the personal data relate.
If requests of an individual related to personal data are manifestly unfounded or excessive, particularly because they are repetitive, the company may:
charge a reasonable fee taking into account administrative costs of providing information or communication or taking the requested action, or
refuse to act on the request.
We provide you with the following rights regarding the processing of your personal data:
right of access to data
right to rectification
right to erasure ("right to be forgotten")
right to restriction of processing
right to data portability
right to object
right of access to data
You always have the right to know whether personal data concerning you are being processed and, if so, access to the personal data and the following information:
purposes of processing,
types of personal data being processed,
recipients or categories of recipients to whom the personal data have been or will be disclosed,
the envisaged period for which the personal data will be stored or, if not possible, the criteria used to determine that period,
the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of your personal data, or the right to object to such processing,
the right to lodge a complaint with a supervisory authority,
where personal data are not collected from you, all available information as to their source.
right to rectification
You have the right to obtain without undue delay the rectification of inaccurate personal data concerning you and, taking into account the purposes of processing, the right to have incomplete personal data completed, including by means of providing a supplementary statement.
right to erasure ("right to be forgotten")
You have the right to obtain without undue delay the erasure of your personal data where one of the following grounds applies:
where personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed,
where you withdraw consent on which the processing is based and where there is no other legal ground for processing,
where you object to the processing and there are no overriding legitimate grounds for the processing,
where personal data have been unlawfully processed,
where personal data have to be erased for compliance with a legal obligation under EU or Slovenian law.
right to restriction of processing
You have the right to obtain restriction of processing where one of the following applies:
you contest the accuracy of the personal data, for a period enabling the controller to verify the accuracy,
the processing is unlawful and you oppose erasure and request restriction instead,
the controller no longer needs the personal data for the purposes of processing, but you require them for the establishment, exercise or defense of legal claims,
you have objected to processing based on legitimate interests until it is verified whether the legitimate grounds of the controller override yours.
Where processing has been restricted according to the previous paragraph, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person.
We will inform you before lifting the restriction on processing of your personal data.
right to data portability
You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, and the right to transmit those data to another controller without hindrance from the company, where the processing is based on your consent and is carried out by automated means. At your request, where technically feasible, personal data can be transmitted directly to another controller.
right to object
Where your data are processed based on legitimate interest for marketing purposes, you may object to such processing at any time.
We will stop processing your personal data unless we demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or for the establishment, exercise or defense of legal claims.
9. Right to lodge a complaint regarding the processing of personal data
You may send any complaint regarding the processing of your personal data to the email address b2b@vendor.si or by mail to VENDOR d.o.o, Stari trg 32A, Trebnje, 8210 Trebnje.
If we do not decide on your request within the statutory deadline or reject your request, you have the option to lodge a complaint with the Information Commissioner.
You also have the right to lodge a complaint directly with the Information Commissioner if you believe that the processing of your personal data violates Slovenian or EU data protection regulations.
If you have exercised the right of access to data and after receiving the decision believe that the personal data you received are not the personal data you requested or that you did not receive all requested personal data, you may lodge a reasoned complaint with the company within 15 days before lodging a complaint with the Information Commissioner. We must decide on your complaint as a new request within five working days.
10. Final provisions
For all matters not regulated by this Privacy Policy, applicable legislation applies.
The company reserves the right to amend this Privacy Policy. We will inform you of changes by publishing them on the official website of VENDOR d.o.o. 30 days before their effective date.
If you have questions about the Privacy Policy or the data we hold about you, please write to us at the email address b2b@vendor.si
11. Validity of the Privacy Policy
This Privacy Policy is published on the VENDOR d.o.o. website and comes into effect on 1.4.2021.
VENDOR d.o.o.