Information on Personal Data Protection

The data controller is Agitavit Solutions d.o.o., Letališka cesta 33F, 1000 Ljubljana.

Personal data is information that identifies you as an identified or identifiable individual. A user is identifiable when they can be directly or indirectly determined, in particular by reference to an identifier such as a name, identification number, location data, online identifier or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.

The controller collects the following personal information:

• Basic user information, such as name, surname, title and workplace.
• Contact details and information about the user's communication with the controller, including email address, telephone number, date, time and content of postal or email communication.
• Information about participation in events organized by Agitavit Solutions d.o.o., the channel and campaign, and the source through which the user came into contact with the controller.
• Information about the user's use of the controller's website and received email or SMS messages, including visit times, pages, URLs, dwell time and website settings.
• Data from forms voluntarily completed by the user.
• Other information voluntarily provided to the controller for services that require it.

The controller does not collect or process a user's personal information unless the user permits or consents to it, there is a legal basis, processing is necessary to enforce contractual obligations, or processing is necessary for the controller's legitimate interests.

Agitavit Solutions d.o.o. processes personal data for the purposes below based on one of the following legal bases:

• Your consent or agreement.
• Meeting the controller's legal obligations.
• A legitimate interest.
• Fulfilment of contractual obligations.

Personal information is processed only for the purposes for which it was acquired and not for incompatible purposes. Only data necessary to achieve a particular purpose is collected.

3.1 Processing to fulfil contractual obligations

In some cases, processing personal data is necessary to fulfil the controller's contractual obligations. If a user does not provide the necessary information, the controller cannot enter into a contract with the user or perform services.

Personal data may be processed for:

• Contractual regulation of business cooperation.
• Activities set out in cooperation contracts, including consulting, marketing and sales strategies and campaigns, and computerization of processes.
• Communication with contractors and other customer contacts to carry out agreed activities.
• Registering a user for an event organized by the controller.

3.2 Processing based on consent or agreement

Based on written consent, Agitavit Solutions d.o.o. may process personal information for:

• Sending electronic messages about the controller's training, innovation, services and events.
• Telephone contact to present professional system solutions to the user or employer.
• Monitoring sent email messages, including opens, selected links and time spent reading or viewing content.
• Segmenting users and sending customized email messages to improve information and responsiveness.
• Analysing the user journey on the website, including traffic source, time on site, visited pages and downloaded or viewed content.
• Segmenting users and sending customized messages through multichannel communication.
• Other purposes to which you specifically agree.

You may withdraw consent at any time using the contact addresses for personal data protection. You may also manage or cancel consent for specific purposes or consent to other processing purposes through those contact addresses.

3.3 Processing necessary to meet legal obligations

Personal information is processed where required by law, for example for judicial or administrative proceedings.

3.4 Processing based on legitimate interest

The controller may process data based on a legitimate interest unless the interests or fundamental rights and freedoms of the data subject override those interests. The controller carries out an assessment in accordance with the General Data Protection Regulation.

Safeguards such as pseudonymisation, encryption, processing in aggregated form or deletion of certain personal-data types may be used for further processing based on legitimate interest.

Personal information may be processed based on legitimate interest for:

• Marketing, business and technical analysis, including event-participation analysis.
• Preventing abuse, ensuring safety, making claims or defending against claims in administrative and judicial proceedings. Where appropriate, information may be transmitted to the police, prosecutor's office or another competent authority.
• Direct marketing, including user-profile creation based on previously and lawfully acquired personal data. You may object to this processing at any time.

Personal data may be accessed only by directly authorized employees of Agitavit Solutions d.o.o. and personal-data processors. Agitavit Solutions d.o.o. will not forward personal data to unauthorized third parties.

Processors may handle personal information only on behalf of and according to written instructions from Agitavit Solutions d.o.o., within the powers set out in their contract and for the purposes for which the data was collected. Processors may not use personal data for their own interests.

Agitavit Solutions d.o.o. cooperates with the following processors:

• Frodx d.o.o., Celovška cesta 280, 1000 Ljubljana, for storing personal data in digital form.
• ActiveCampaign, LLC, for hosting and processing submitted request-demo contact details and the associated customer-relationship follow-up configured by Agitavit Solutions.

The controller does not process data longer than necessary for the purposes for which it was collected and further processed.

Personal data processed for contract performance is kept for the time needed to execute the contract and for five years after termination. If there is a contractual dispute, data is kept for five years after the final judicial or arbitral decision or settlement, or for five years from an amicable settlement where there is no litigation.

Data processed on the basis of law is kept for the period prescribed by law. Data processed based on consent or legitimate interest is kept until consent is withdrawn or a request is made to discontinue processing. It may be deleted earlier if the processing purpose has already been fulfilled or the law requires it.

After the retention period expires, personal information is permanently deleted or anonymised so it can no longer be associated with you.

Under the General Data Protection Regulation, Agitavit Solutions d.o.o. provides the following personal-data protection rights:

• The right of access to information.
• The right of rectification.
• The right to erasure (the right to be forgotten).
• The right to restrict processing.
• The right to data portability.
• The right to object.

6.1 The right of access to information

You have the right to obtain confirmation of whether your personal data is processed and, if so, access to that data and information about:

• The purposes of processing.
• The types of personal data.
• Recipients or recipient categories, especially recipients in third countries or international organizations.
• The expected retention period or the criteria used to determine that period.
• The right to request rectification, erasure or restriction, or to object to processing.
• The right to lodge a complaint with a supervisory authority.
• Available information about the source where data was not collected from you.
• The existence of automated decision-making, including profiling, meaningful information about its logic, and its significance and anticipated consequences.

On request, Agitavit Solutions d.o.o. will provide one free copy of personal data being processed. A reasonable fee reflecting administrative costs may be charged for additional copies.

6.2 Right of rectification

You may request the correction of inaccurate personal data without undue delay. Considering the processing purposes, you may also have incomplete data completed, including by providing a supplementary declaration.

6.3 The right to erasure (the right to be forgotten)

You may request erasure without undue delay where:

• The data is no longer needed for the purposes for which it was collected.
• You withdraw consent and there is no other legal basis for processing.
• You object to processing based on legitimate interest and there are no overriding legitimate reasons.
• You object to processing for direct marketing.
• Erasure is required to comply with European Union law or the Slovenian legal order.

Where Agitavit Solutions d.o.o. has transmitted your information, it will take reasonable steps, including technical measures, to inform processors that you require links to, or copies of, that personal data to be erased.

6.4 The right to restrict processing

You may request restriction where:

• You dispute the data's accuracy for the period needed to verify it.
• Processing is unlawful and you oppose erasure, requesting restricted use instead.
• Agitavit Solutions d.o.o. no longer needs the data, but you need it to establish, exercise or defend legal claims.
• You object to processing while it is verified whether the controller's legitimate reasons override yours.

6.5 The right to data portability

You have the right to receive personal data relating to you in a structured, commonly used and machine-readable form and to transmit it to another controller where processing is based on consent or agreement and is carried out by automated means.

6.6 The right to object

On grounds relating to your particular situation, you may object at any time to processing based on legitimate interests pursued by Agitavit Solutions d.o.o. or a third party. Processing will stop unless compelling reasons override your interests, rights and freedoms or processing is required to establish, exercise or defend legal claims.

You may object at any time to processing for direct marketing, including related profiling. Where direct marketing is based on consent, you may withdraw that consent.

6.7 Procedure for asserting your rights

Requests concerning your rights may be addressed in writing to the controller using the personal-data protection contact details. If you submit a request electronically, information will be provided electronically where possible unless you request otherwise.

The controller may request additional information needed to confirm your identity. It may refuse to act only if it proves that you cannot be reliably identified.

Requests will be answered without undue delay and no later than one month after receipt. This period may be extended by up to two months based on complexity and the number of requests. You will be informed of an extension and its reasons within one month.

If requests are manifestly unfounded or excessive, particularly because they are repeated, Agitavit Solutions d.o.o. may charge a reasonable fee reflecting administrative costs or refuse to act on the request.

6.8 The right to lodge a complaint

Complaints concerning processing may be directed to the personal-data protection contact addresses.

You may lodge a complaint directly with the Information Commissioner if you believe processing violates Slovenian or European Union personal-data protection rules.

This information is valid from 25 May 2018 and may be amended or supplemented at any time.