About the Privacy Policy

The purpose of the Privacy Policy of Radovna Chalet (hereinafter referred to as the "Privacy Policy") is to inform users of Radovna Chalet services and other individuals (hereinafter also referred to as "individuals") about the purposes and legal basis for processing personal data by Radovna Chalet, Zgornjna Radovna 5, 4281 Mojstrana (hereinafter referred to as the "Company"), as well as individuals' rights in this regard. The Company takes special care to ensure the security of your personal data. All provided personal data is treated confidentially and used only for the purpose for which it was provided. We manage your personal data with the utmost care, in compliance with applicable laws and the highest standards of their processing. We ensure the security of your personal data through appropriate organizational measures, work procedures, advanced technological solutions, and external experts to achieve the most effective protection of your personal data. We use an appropriate level of protection and reasonable physical, electronic, and administrative measures to protect the collected data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of personal data, or unauthorized access to personal data that has been transmitted, stored, or otherwise processed.

At the same time, this Privacy Policy further explains the consent you have given for the processing of your personal data.

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the "General Data Protection Regulation"), the following information is covered in this Privacy Policy:

• contact information of the company, 
• Purposes, legal bases, and types of processing of different types of individuals' personal data, 
• Retention periods for individual types of personal data, 
• Individuals' rights related to the processing of personal data, 
• Right to lodge a complaint regarding the processing of personal data,
• Validity of the Privacy Policy.

Personal Data Collected by the Company

If you are only a visitor to the website, we collect information about you only through the use of cookies. If you are a user of the services or a subscriber to the services offered by the company, we also collect other personal data about you that we need for the provision of the services you have ordered or are using. These personal data are:

• First and last name,
• Contact email address,
• Contact phone number,
• IP address, 
• Information for issuing an offer based on your inquiry (your address, tax number).

Personal Data Controller

The personal data controller processing data in accordance with this Privacy Policy is Radovna Chalet, Zgornjna Radovna 5, 4281 Mojstrana

Categories of Individuals Whose Personal Data are Processed

This Privacy Policy is intended for all those who have ordered and/or use our services, submitted inquiries, as well as those who visit our website.

Purposes of Processing and Legal Basis for Data Processing

Processing Based on a Contract:

In the context of the execution of contractual rights and the fulfillment of contractual obligations of the company, your personal data is processed for the following purposes: individual identification, preparation of an offer, contract conclusion, ensuring ordered services, informing about possible changes, additional details, and instructions for using the services, resolving technical issues, objections, or complaints, service billing, and other purposes necessary for the performance or conclusion of a contractual relationship between the company and the individual.

For the purpose of billing services, in accordance with tax regulations, we obtain and process your address for the correct issuance of an invoice.

Processing Based on the Law:

Based on a legitimate interest, we use your personal data to detect and prevent fraudulent use and abuse of services. Additionally, to ensure the stable and secure operation of our system and services, as well as for the purposes of implementing information security measures, fulfilling service quality requirements, and detecting technical system and service failures.

Based on a legitimate interest, we also use your personal information for the purposes of potential enforcement, judicial, and extrajudicial recovery.
In accordance with the General Regulation, the company may, in cases of suspected misuse, process individuals' data to an appropriate and proportionate extent for the purpose of identification and prevention of potential fraud or abuse. Additionally, if deemed appropriate, these data may also be shared with other providers of similar services, business partners, the police, the state prosecutor's office, or other competent authorities. For the purpose of preventing future misuse or fraud, data related to the history of identified misuse or fraud in connection with an individual, including information about the subscription relationship and, for example, IP address, may be retained for up to five years after the termination of the business relationship.

Processing Based on Consent for Processing Personal Data:

Data processing can also be based on your consent provided to the company.
Consent may relate, for example, to informing about offers, benefits, and improvements to the services provided by the company. The purpose of such communication is to align the services with your needs and preferences as much as possible, thereby increasing their value to you. Communication is carried out through the channels you selected in your consent. You can revoke communication at any time, in the manner defined by the Privacy Policy.

You can withdraw or change your consent at any time, either in the same way you gave it or in another way as defined by the Privacy Policy, subject to customer identification by the company. The change in consent can also be arranged through an email to the EMAIL address or by a written request sent to the company's registered address.

Withdrawal or modification of consent applies only to data processed on the basis of your consent. The most recent consent you provided to us is valid. The possibility of revoking consent does not constitute grounds for withdrawal from a contractual relationship between the individual and the company.

Data for which your consent has been given will be processed for up to two years after the termination of the business relationship with the company, in the absence of revocation.

Limitations on the Transfer of Personal Data

If necessary, we may authorize other companies and individuals to perform certain tasks that contribute to our services. In such cases, the company may also provide such carefully selected external processors with personal data, who will conclude a contract for the processing of personal data with the company or an equivalent agreement or other binding document (hereinafter referred to as the "Processing Agreement"). We will provide or grant access to such data to external processors only to the extent required for a specific purpose. Such external processors may not use this data for any other purposes, while complying with at least all the standards of personal data processing envisaged by the applicable law. External processors are contractually obliged to respect the confidentiality of your personal data.

Upon a reasoned request, the company may also provide personal data to competent state authorities with legal grounds for such disclosure. For example, Radovna Chalet will respond to requests from courts, law enforcement agencies, and other state authorities, which may also include state authorities of other EU member states.

Retention Period for Personal Data

The data retention period is determined based on the category of individual data. We keep the data for no longer than necessary to achieve the purpose for which it was collected or further processed, or until the expiry of the statutory limitation periods for the performance of obligations or the legally prescribed retention period.

Billing data and related contact data of individuals can be retained for the purpose of fulfilling contractual obligations until full payment for the service, or at the latest until the expiration of the limitation period in connection with a specific claim, which can range from one to five years according to the law. In accordance with the law governing value-added tax, invoices are kept for an additional 10 years after the end of the year to which the invoice relates.

Other data obtained based on your consent is retained for the duration of the business relationship and an additional 2 years after its termination, unless the law specifies a longer retention period. If an individual who has given consent for the processing of personal data has not entered into a business relationship with us, their consent remains valid for 2 years from its provision or until its withdrawal.

After the storage period expires, the data will be erased, destroyed, blocked, or anonymized, unless the law specifies otherwise for a particular type of data.

Individual Rights Regarding Personal Data Processing

We ensure the realization of your rights concerning the processing of your personal data without undue delay. We will respond to your request within one month from the receipt of your request. In cases of complexity and a large number of requests, we may extend this period by a maximum of two additional months. If an extension is applied, we will inform you within one month of receiving the request, along with the reasons for the delay.
Requests related to the exercise of your rights can be submitted via email at EMAIL or by mail to Radovna Chalet, Zgornja Radovna 5, 4281 Mojstrana.

When you submit a request electronically, we will provide information electronically whenever possible, unless you request otherwise.

If there is reasonable doubt about the identity of the individual submitting a request related to any of their rights, we may request additional information necessary to confirm the identity of the individual to whom the personal data relates.

If the requests of the individual to whom the personal data relates are evidently unfounded or excessive, especially if they are repetitive, the company may:
Charge a reasonable fee, taking into account the administrative costs of providing information or communication or carrying out the requested action, or
Refuse to act on the request.

The following rights regarding the processing of your personal data are available to you:
Right to Access Data

Right to Rectification

Right to Erasure ("Right to be Forgotten")

Right to Restriction of Processing

Right to Data Portability

Right to Object

Right to Access Data

You always have the right to know whether personal data concerning you is being processed and if so, access to personal data and the following information:
Purposes of processing,
Types of personal data being processed,
Recipients or categories of recipients to whom personal data has been or will be disclosed,
Intended period of personal data storage or, if not possible, the criteria used to determine this period,
Right to request correction or deletion of personal data or restriction of processing from the data controller, and the right to object to such processing,
Right to lodge a complaint with the supervisory authority,
When personal data is not collected from you, all available information about its source.

Right to Rectification

You have the right to have inaccurate personal data corrected without undue delay and considering the purposes of processing, the right to have incomplete personal data completed, including by providing a supplementary statement.

Right to Erasure ("Right to be Forgotten")

You have the right to have your personal data erased without undue delay if one of the following reasons applies:

Personal data is no longer necessary for the purposes for which it was collected or otherwise processed,
You withdraw consent on which processing is based, and there is no other legal basis for processing,
You object to processing, and there are no overriding legitimate grounds for processing,
Personal data has been unlawfully processed,
Personal data must be erased to fulfill a legal obligation under EU law or Slovenian law.

Right to Restriction of Processing

You have the right to obtain restriction of processing of your personal data in certain cases:

You contest the accuracy of the data, for a period enabling the controller to verify the accuracy of the personal data,
Processing is unlawful, and you oppose the erasure of the personal data and request the restriction of its use instead,
The controller no longer needs the personal data for processing purposes, but you require it for the establishment, exercise, or defense of legal claims,
If you have objected to processing based on the legitimate interests of the company, pending verification whether the legitimate grounds of the controller override yours.

When processing of your personal data is restricted as described above, such data, except for storage, shall be processed only with your consent or for the establishment, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person.

You must be informed before the restriction of processing of your personal data is lifted.

Right to Data Portability

You have the right to receive your personal data which you have provided to us in a structured, commonly used, and machine-readable format, and have the right to transmit those data to another controller, without hindrance from us, where processing is based on consent and is carried out by automated means. Upon your request and if technically feasible, personal data can be directly transferred to another controller.

Right to Object

If we process your data based on a legitimate interest for marketing purposes, you can object to this processing at any time.

We will cease processing your personal data, unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.

Right to Lodge a Complaint Regarding Personal Data Processing

Any complaint related to the processing of your personal data can be sent to EMAIL or by mail to Radovna Chalet, Zgornja Radovna 5, 4281 Mojstrana.

If we do not respond to your request within the legal timeframe or if we reject your request, you have the option to file a complaint with the Information Commissioner.

You also have the right to directly lodge a complaint with the Information Commissioner if you believe that the processing of your personal data violates Slovenian regulations or EU regulations related to personal data protection.

If you have exercised the right to access data and upon receiving a decision you believe that the personal data received is not the personal data you requested, or that you have not received all the requested personal data, you can file a reasoned complaint with the company within 15 days before filing a complaint with the Information Commissioner. We must decide on your complaint as a new request within five working days.

Final Provisions

All matters not regulated by this Privacy Policy are subject to applicable legislation.

The company reserves the right to change this Privacy Policy. You will be informed of any changes through a publication on the official website of Chocolate Village 30 days before it takes effect

For questions about the Privacy Policy or the data we hold about you, please contact us at EMAIL.

Validity of the Privacy Policy

This Privacy Policy is published on the Radovna Chalet website and becomes effective on __,__________2023..