DATA PROTECTION POLICY FOR THE COMPANY Bandos d.o.o.
Privacy Policy of the company Bandos d.o.o. (hereinafter: the company).
Data about the controller:
Name: Bandos d.o.o.
address: Tržaška ulica 7, 3000 Celje
registration number: 8637849000
VAT ID number: SI34907254
website: www.earth-flow.net
phone: +386 69 662 432
email: team@earth-flow.net
Data protection officer details:
Nejc Volarič
Phone: +386 69 662 432
Email: nejc@earth-flow.net
About the personal data protection policy
The purpose of the Personal Data Protection Policy (hereinafter: the Policy) is to inform Subscribers, Users and other persons (hereinafter: Individuals) of the purposes and basis for the processing of personal data by the company and the rights of Individuals in this area. At the same time, this Policy further explains consent to data processing. In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the General Data Protection Regulation), the Policy includes the following information:
contact information of the company and the contact person authorized for data protection,
purposes, grounds and types of processing of various types of personal data of Individuals, including profiling of personal data of Individuals,
transfer of data to third parties and to third countries,
retention period of individual types of personal data,
rights of Individuals in relation to the processing of personal data,
right to lodge a complaint in relation to the processing of personal data.
Where appropriate, the provisions relating to Individuals also apply to issues of confidentiality and privacy of communications of users who are legal entities. The controller and data protection officer, the controller of the personal data of Individuals processed in accordance with the Personal Data Protection Policy, is the company Bandos d.o.o.
Purposes of processing and basis for data processing
Processing based on a contract: The company processes the personal data of individuals for the purposes of informing about new entries on the website, direct marketing purposes, segmentation purposes.
In the context of exercising rights and fulfilling contractual obligations, the company processes the personal data of individuals for the following purposes:
Email address and name (for the purposes of informing, sending email newsletters, offers, events, meetings)
Telephone number (for the purposes of informing about the implementation of business services, offers, events, meetings)
Home address (for fulfilling obligations arising from payment obligations – creating and sending invoices)
Company information (for fulfilling obligations arising from payment obligations – creating and sending invoices).
Processing based on the law
The Company processes the personal data of Individuals for the purposes of concluding, implementing, monitoring and terminating a subscription relationship. Processing based on consent for the processing of personal data: Data processing may be based on the consent given by the individual to the Company. Consent may, for example, relate to informing about the offer and services, preparing an offer tailored to the individual’s user habits or providing value-added services. The notification is carried out through the channels chosen by the Individual in the consent.
Notification using an e-mail address includes the provision of an e-mail address to an external processor for the purpose of displaying the Company’s advertising messages while browsing the Internet.
The individual to whom the personal data relate may withdraw or change their consent at any time in the same way as the consent was given or in another way specified by the Company, whereby the Company reserves the right to identify the customer. Withdrawal or change of consent only applies to data processed on the basis of consent. The last consent given by the Individual and received by the Company is valid. The possibility of withdrawing consent does not constitute a right of withdrawal in the business relationship of the Individual with the Company. Consent may be given by one of the parents, foster parent or guardian for a minor child who, in accordance with applicable law, cannot give consent on his/her own. Such consent will be valid until it is revoked or changed by one of the parents, foster parent or guardian or the child himself/herself, when he/she acquires this right in accordance with applicable law.
Transfer of data to third parties and transfer of data to third countries (countries that are not members of the European Union or the European Economic Area) The company may, if this is consistent with the purpose for which personal data is processed under EU law and Slovenian regulations, transfer personal data about individuals:
to persons who perform individual processing tasks for the company, such as: preparing and sending invoices or data analytics, maintenance and development of services, when these tasks include the processing of personal data to the necessary extent;
to persons who perform sales and marketing services for the company, including sales and marketing in the field, or participate in with the company in the field of marketing and selling its own services or services of third parties, to the extent necessary for such tasks within the scope of the purposes and grounds defined in this Policy.
If the company is merged or taken over by another company, personal data is transferred to the acquirer in accordance with the law. By using our services, you consent to the further processing of your personal data by the acquirer.
Retention period for personal data
Invoice data and related contact information about individuals may be stored for the purpose of fulfilling contractual obligations until full payment for the service or until the expiration of the limitation periods in relation to an individual claim, which may range from one to five years according to the law. Invoices are stored for 10 years after the end of the year to which the invoice relates in accordance with the law governing value added tax. If traffic data is processed based on the consent of the individual for the purpose of marketing services, selling goods or providing value-added services, such data may be processed to the extent necessary for such marketing or services. All other data obtained for the purposes of information and direct marketing shall be stored until revocation.
Rights of individuals in relation to the processing of personal data
The Company ensures that individuals exercise their rights without undue delay and in any case within one month of receiving the request. The Company may extend the deadline for exercising the individual’s rights by a maximum of two additional months, taking into account the complexity and number of requests. If the Company extends the deadline, it shall inform the individual of any such extension within one month of receiving the request, together with the reasons for the delay. The Company accepts requests regarding the individual’s rights by phone, at 069 662 432 or by email at info@earth-flow.net. Where the data subject makes a request by electronic means, the information shall, where possible, be provided by electronic means, unless the data subject requests otherwise. Where there is reasonable doubt as to the identity of the Data Subject making a request in relation to any of his or her rights, the Company may request the provision of additional information necessary to confirm the identity of the Data Subject. If the requests of the Data Subject are manifestly unfounded or excessive, in particular because they are repetitive, the Company may: charge a reasonable fee, taking into account the administrative costs of providing the information or communication or of implementing the requested action, or refuse to act on the request.
The Company provides individuals with the following rights in relation to the processing of personal data:
the right of access to data,
the right to rectification,
the right to erasure (“right to be forgotten”),
the right to restriction of processing,
the right to data portability.
Right of access to data
The data subject shall have the right to obtain from the company confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to the personal data and further information relating to the processing of personal data, including:
the purposes of the processing;
the types of personal data;
the users or categories of users to whom the personal data have been or will be disclosed, in particular users in third countries or international organisations;
where possible, the envisaged period for which the personal data will be stored or, where that is not possible, the criteria used to determine that period;
the existence of the right to obtain from the controller rectification or erasure of personal data or restriction of processing of personal data concerning him or her, or the existence of the right to object to such processing;
the right to lodge a complaint with a supervisory authority;
where the personal data are not collected from the individual, all available information as to their source;
the existence of automated decision-making, including profiling, and meaningful information about the reasons for it, as well as the significance and envisaged consequences of such processing for the individual.
Upon request, the company shall provide a copy of the personal data that are being processed. For additional copies of the data requested by the data subject, the company may charge a reasonable fee, taking into account administrative costs.
Right to rectification
The data subject shall have the right to obtain from the company without undue delay the rectification of inaccurate personal data concerning him or her. The data subject shall have the right, taking into account the purposes of the processing, to have incomplete personal data completed, including by providing a supplementary statement. Right to erasure (“right to be forgotten”) The data subject shall have the right to obtain from the company, without undue delay, the rectification of inaccurate personal data concerning him or her, including by providing a supplementary statement.
without undue delay, the personal data relating to him/her shall be erased, and the company shall be obliged to erase the personal data without undue delay:
when the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
when the individual withdraws consent, which is the basis for the processing of the data, and there is no other legal basis for the processing;
when the individual objects to the processing based on the legitimate interest of the company, and there are no overriding legitimate grounds for the processing;
when the individual objects to the processing for direct marketing purposes;
when the personal data must be erased for compliance with a legal obligation under EU law or Slovenian law; when the data in question is improperly collected from a child in connection with the provision of information society services who cannot provide such data in accordance with applicable law.
In the case of directory or otherwise published data, the company shall take reasonable steps, including technical measures, to inform controllers processing personal data that the data subject has requested the erasure of any links to or copies of such personal data.
Right to restriction of processing
The data subject shall have the right to obtain from the company restriction of processing where:
The data subject contests the accuracy of the data, for a period enabling the data subject to verify the accuracy of the personal data;
the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
the company no longer needs the personal data for the purposes of the processing, but
the data subject requires them for the establishment, exercise or defence of legal claims;
the data subject has objected to the processing, pending verification whether the legitimate grounds of the controller override those of the data subject.
Right to data portability
The data subject shall have the right to receive the personal data concerning him or her, which a company has held, in a structured, commonly used and machine-readable format and to transmit those data to another controller without hindrance from the company to which the personal data have been provided, where:
the processing is based on the consent of the data subject or on a contract and the processing is carried out by automated means.
Right to object
The data subject shall have the right, on grounds relating to his or her particular situation, to object at any time to processing of personal data which is based on the legitimate interests pursued by the company or a third party. The company shall cease processing the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. Where personal data are processed for direct marketing purposes, the individual has the right to object at any time to processing of personal data concerning him or her for such marketing purposes, including profiling to the extent that it is related to such direct marketing. Where direct marketing is based on consent, the right to object may be exercised by withdrawing the personal consent given.
Right to lodge a complaint regarding the processing of personal data
The individual may communicate any complaint regarding the processing of personal data to 069 662 432 or to the email address info@earth-flow.net.
Each individual to whom personal data are related also has the right to lodge a complaint directly with the Information Commissioner if he or she believes that the processing of personal data concerning him or her violates Slovenian or EU regulations on the protection of personal data.
If an individual has exercised the right to access data with a company and, after receiving the company’s decision, believes that the personal data they received is not the personal data they requested, or that they did not receive all the requested personal data, they may, before filing a complaint with the Information Commissioner, file a reasoned complaint with the company within 15 days. The company must decide on the complaint as a new request within five working days.
OBTAINING PERSONAL DATA WHEN VISITING OUR WEBSITE
User data
When visiting the Website, certain data (IP address, date, time, address of the page you came from) is stored on the server. This data is anonymous and is used only for statistical processing.
By visiting our website, you do not provide us with any personal data; we only obtain the data that your browser transmits to our server. Technical data (IP address, date and time, content, access status, amount of data transferred each time, website from which the request comes, browser, operating system and its interface, language and version of browser software, end device
a, screen resolution, screen color depth, Flash and Javascript support) are required to display the website to you and to ensure stability and security.
Cookies
We use various services to analyze the use of our website and optimize it, which partly use cookies and other technologies. If you do not agree to the use of these services, you can object to this data processing or set your browser to prevent the storage of cookies. For individual services, it is stated how you can object. By exercising your objection, the individual providers will no longer process your data for the purposes of web analysis.
SOCIAL NETWORK SERVICES AND OTHER APPLICATIONS
We currently use the social media services Facebook and YouTube on this website.
When you visit our website and click on the logo of a particular social service, you will be redirected to the respective external page of this network service provider. If you click on one of these buttons while you are logged in to the provider, the information that you visited our website can be assigned to your user account there. If you are a member of a particular service and do not want the social networks to collect data about you via the online offer and to link it to your membership data, please log out of Facebook or YouTube before clicking on one of these logos.
We would like to point out that we, as the provider of this website, are not aware of the content of the data transmitted and how the social service providers use it. More information about which data is collected when you call up the social media services of Facebook or YouTube and how it is used can be found in the individual data protection declarations at:
Social media provider
Facebook Inc.
1601 S. California Ave, Palo Alto
CA 94304, USA https://sl-si.facebook.com/about/privacy/
Youtube Google Inc.
1600 Amphitheatre Parkway, Mountain View
CA 94043, USA https://policies.google.com/privacy?hl=sl&gl=sl
Policy Validity
This Policy is published on the website www.earth-flow.net and becomes effective on 1.1.2022.