PERSONAL DATA PROTECTION

Privacy Policy

Last updated: 1 October 2026

We take the protection of your personal data seriously. This policy explains which personal data we collect through the vrhweb.si website and in the course of doing business with us, why we collect it, how long we keep it and what rights you have. We process personal data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679 – GDPR), the Slovenian Personal Data Protection Act (ZVOP-2) and the Slovenian Electronic Communications Act (ZEKom-2).

In short:
• We only use your details (name, email, phone and message) to reply to you and prepare a quote.
• We do not sell your details or give them to others for advertising.
• We only use statistics cookies (Google Analytics) if you allow them in the cookie banner. We do not use advertising cookies.
• You can ask at any time what details we have about you, or ask us to delete them. Write to office@vrhweb.si.

1. Data controller

Ivica Zaviršek – VRHWEB
(business in the process of registration; once registered: Zaviršek Ivica, s.p.)
Email: office@vrhweb.si
Phone: +386 69 687 939

Once the business is officially registered, we will publish its registered address, registration number and tax number here.

We have not appointed a data protection officer, as we are not legally required to do so. For any questions about how we process your data, please write to office@vrhweb.si.

2. What data we process and why

Enquiries via the contact form, email or phone
• Data: name or company, email address, selected package, content of your message, and your phone number if you call us.
• Purpose: replying to your enquiry and preparing a quote.
• Legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR) or our legitimate interest in answering general questions (Article 6(1)(f)).
• Retention: up to 12 months after our last contact if no cooperation follows.

Working with clients
• Data: contact and identification details and the data needed to issue invoices.
• Purpose: delivering the agreed services, communication and billing.
• Legal basis: performance of a contract (Article 6(1)(b)) and compliance with legal obligations (Article 6(1)(c) GDPR).
• Retention: for the duration of our cooperation; invoices and accounting records are kept for as long as tax regulations require (for invoices, 10 years after the end of the year to which they relate).

Technical data when you visit the website
• Data: IP address, date and time of the visit, browser type and the page visited (server log files).
• Purpose: operation, security and troubleshooting of the website.
• Legal basis: our legitimate interest in running the website securely (Article 6(1)(f) GDPR).
• Retention: the logs are kept by our hosting provider within the EU, only for as long as necessary for server security and operation, in line with the provider's terms.

Providing your data is voluntary. Without your contact details, however, we cannot reply to you or prepare a quote.

3. Cookies

This website uses two types of cookies.

Necessary cookies – needed for the website to work, so under Article 225 of the Slovenian Electronic Communications Act (ZEKom-2) they do not require your consent:
• pll_language – remembers the language you selected (Slovenian or English). Duration: 1 year.
• cmplz_* (e.g. cmplz_banner-status, cmplz_statistics) – remember your choice in the cookie banner. Duration: 1 year.
• WordPress login cookies – set only for site administrators when they log in to the dashboard, not for visitors.

Statistics cookies (Google Analytics) – set only if you allow them in the cookie banner:
• _ga and _ga_* – tell visits apart and count how many people visit the website. Duration: up to 2 years.

We do not use advertising cookies. You can change your choice at any time with the “Manage consent” button at the bottom of the page, and you can also delete or block cookies in your browser settings.

4. Website statistics (Google Analytics)

If you allow it in the cookie banner, we use Google Analytics, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). It shows us how many people visit the website, where they come from and which buttons they use (for example, clicking the phone number or sending an enquiry). We only see the data in aggregate form and do not use it to find out who you are.

• Legal basis: your consent (Article 6(1)(a) GDPR and Article 225 ZEKom-2), which you can withdraw at any time.
• Google Analytics 4 does not store IP addresses.
• Retention: Google keeps visit data for a maximum of 14 months.
• More information: policies.google.com/privacy.

The fonts used to display the website are stored on our own server, so they are not loaded from Google's servers when you visit.

5. Who has access to your data

We do not sell your personal data or pass it on to third parties for their own purposes. Access is limited to external providers who perform services for us and are bound to protect the data:

• website and email hosting provider: NEOSERV (Avant.Si d.o.o., Poslovna cona A 49, 4208 Šenčur, Slovenia), which stores data within the EU,
• an accounting service for issuing and storing invoices, once selected,
• Google Ireland Limited (Google Analytics, see section 4 – only with your consent).

We may also disclose data to public authorities where required by law.

6. Transfers outside the EU

We generally process your data within the European Union or the European Economic Area. When Google services are used, data may be transferred to the United States. Such transfers are based on the European Commission's adequacy decision (EU–US Data Privacy Framework) or on standard contractual clauses.

7. Your rights

Under the GDPR you have the right to:

• access your personal data (Article 15),
• have inaccurate data corrected (Article 16),
• have your data erased (Article 17),
• restrict processing (Article 18),
• data portability (Article 20),
• object to processing based on legitimate interest (Article 21),
• withdraw your consent at any time where processing is based on consent (Article 7(3)).

Send your request to office@vrhweb.si. We will reply without undue delay and within one month at the latest. Exercising your rights is free of charge.

8. Right to lodge a complaint

If you believe that we process your personal data in breach of the law, you can lodge a complaint with the supervisory authority:

Information Commissioner of the Republic of Slovenia
Dunajska cesta 22, 1000 Ljubljana, Slovenia
Email: gp.ip@ip-rs.si · Phone: +386 1 230 97 30
www.ip-rs.si

9. Security and automatic decisions

We protect your data with appropriate technical and organisational measures: an encrypted connection (HTTPS), restricted access to the administration area and regular backups. No program makes automatic decisions about you, and we do not build a profile of you.

Data we process on behalf of our clients
When we build or maintain a website, online shop or smart assistant (AI) for a client, we may process personal data of that client's visitors or customers. In that case the client is responsible for this data, and we only process it on the client's instructions and under a written data processing agreement (Article 28 GDPR).

10. Changes to this policy

We may update this policy from time to time, for example when we introduce new services or when regulations change. The current version is always published on this page, with the date of the last update shown at the top.