Privacy Policy

With this Privacy Policy, ČETRTA POT, d.o.o., Kranj, Planina 3, 4000 Kranj (hereinafter referred to as "ČETRTA POT" or "Company"), provides clients, service users, customers and other legal and natural persons with whom the company enters or has entered into a contractual relationship (hereinafter collectively referred to as "Users") the information on the processing of personal data in accordance with the EU General Data Protection Regulation no. 2016/679 (hereinafter referred to as the "GDPR") and the Personal Data Protection Act (ZVOP-1, hereinafter referred to as the "Act").

Specific information and details related to the processing of personal data in the context of a particular contractual relationship may also be specified in the contract, general terms, special terms and sales offer for each contractual relationship or service.

This Privacy Policy applies mutatis mutandis to the processing of data of both legal entities and natural persons.

Information about the Controller

Unless stated otherwise in the documents governing a specific contractual relationship, ČETRTA POT is both the controller and the processor of personal data.

The person authorized for the protection of personal data in ČETRTA POT can be contacted in writing at the address ČETRTA POT, d.o.o., Kranj, Data Protection Officer, Planina 3, 4000 Kranj, or by e-mail at gdpr.dpo@cetrtapot.si and dpo@cetrtapot.si.

Co-controller of Personal Data

Specific ČETRTA POT'S services are sold or provided in cooperation with partners who also enter a contractual relationship with the User, and these partners are also data controllers in those specific cases and apply their own terms to personal data processing, which may include the terms of data transfer to third countries. In such cases, the business partner bears the responsibility for the partner's data processing in relation to the Users directly (and ČETRTA POT cannot be held responsible for business partner's processing).

Categories of Data

Types or categories of personal data processed by ČETRTA POT depend on specific service and are specified or described in the contract or general or special terms governing a contractual relationship or service. ČETRTA POT may acquire the personal data from an individual directly or indirectly by means of the User using a specific service. ČETRTA POT may acquire the personal data also from third parties, whereas in such case the acquired data matches the data obtained directly from the individual in terms of type and category. ČETRTA POT may transfer User's personal data to a third party that is entering or desires to enter in a contractual relationship with ČETRTA POT (e.g. User's employer or any other party who is ČETRTA POT'S User, contractual partners who specify individuals as contacts, and other). In such cases, the third party is obligated to provide appropriate authorization for the transfer of personal data to ČETRTA POT and inform or notify the User about this. 

ČETRTA POT acquires User's personal information at the time the User provides it e.g., when using the website and its functions, when communicating directly by e-mail, telephone, in writing or via social media, or in any other way the User may transmit personal information.

To verify data correctness and acquire correct data, ČETRTA POT may obtain data from third parties exclusively. In such cases, ČETRTA POT will acquire the same types of data as the User has or should have provided at the time of entering a contractual relationship (e.g., a new/correct address, etc.). 

ČETRTA POT may obtain personal information from publicly available sources, including public online databases, business directories, media publications, social media, and websites.

Grounds and Purposes for Processing

ČETRTA POT processes User's personal data in accordance with the grounds and purposes specified below.

Contract

ČETRTA POT uses the acquired data to conclude contracts and fulfil contractual obligations from contractual relationships with Users. The purpose of personal data processing is also evident from the contract and other documents governing a specific contractual relationship. When processing personal data for the purposes of implementing the contract, ČETRTA POT will only process the personal data that are necessary for the conclusion and implementation of the contract and the fulfilment of contractual obligations.

In providing specific services, ČETRTA POT processes personal data for the purposes defined in contracts or general or special terms governing a contractual relationship or service. In the event of changes or introduction of new services, ČETRTA POT will correspondingly update this Policy or modify the existing contract or terms or conclude or adopt new terms.

The Act and GDPR

In addition to the processing of personal data necessary to conclude and implement a contract, ČETRTA POT also processes personal data in cases provided for by the Act and GDPR.

Types or categories of personal data processed by ČETRTA POT based on laws and regulations are specified or described in the contract or general or special terms governing a contractual relationship or service. In the event of changes or introduction of new services, ČETRTA POT will correspondingly and in compliance with laws and regulations update this Policy or modify existing contracts or terms or conclude or adopt new terms.

Consent

In the case of having obtained User's consent, ČETRTA POT will only process personal data for the purposes provided for by the consent. When personal data processing is based on consent, the User may revoke such consent at any time. 

When personal data processing is based on consent, ČETRTA POT will diligently assess which information is needed for a particular purpose and will only use the information necessary to achieve the purpose. ČETRTA POT protects personal data during processing and applies adequate data protection activities. 

By providing a consent, the User agrees with ČETRTA POT'S processing of personal data or categories of personal data obtained about the User or specified in User's consent. This may include information that the User provides when concluding and implementing contractual relationships (including but not limited to data from application forms, contracts, questionnaires, surveys, online forms, and other documents, including information about subscribed/selected services, products, and devices) and information about purchases of goods and the use of ČETRTA POT'S services.

Personalized offers comprise general offers provided to Users by ČETRTA POT when considered to be of interest to a specific User, as well as offers customized specifically for the User. In automated decision making, ČETRTA POT does not perform any profiling.

Based on the consent, ČETRTA POT may communicate to the User information and offers through all communication channels specified in the consent as part of the contractual relationship which the consent relates to. 

Except in cases where the User revokes the consent to process data for a specific purpose, ČETRTA POT may, to the extent allowed by laws and regulations, process personal data for such purpose for up to two years after the expiration of the contractual relationship for which the consent was given.

Revocation of Consent

Users may revoke the consent at any time by sending a written note to the address: ČETRTA POT, d.o.o., Kranj, Planina 3, 4000 Kranj, by submitting a written application in person at the Company's headquarters or by sending a written note by e-mail to info@cetrtapot.si.

In cases where consents are collected by means of electronic communication or information services, the consent may be revoked through these communication channels, as applicable.

Should the User revoke the consent, ČETRTA POT will cease to process the data collected based on the consent or cease to process the data for the purpose provided for by the consent.

Processing based on Legitimate Interest

ČETRTA POT processes Users' personal data based on legitimate business interest of the Company or third parties and for the purposes defined in this Policy or a contract or terms or any other documents governing a particular contractual relationship.

When processing the Users' personal data based on legitimate interest, ČETRTA POT considers any effects (both positive and negative) that such processing may have on Users and Users' rights associated with the intended processing. In doing so, ČETRTA POT'S legitimate interest does not automatically outweigh Users' interests, fundamental rights, or freedoms. ČETRTA POT does not process the data in cases where Users' interests override ČETRTA POT'S interests, unless a consent has been obtained from the User or such processing is mandated or permitted by laws and regulations.

When processing the personal data on the basis of legitimate interest, ČETRTA POT only processes the data needed to achieve the purpose in accordance with the obtained consent and implements appropriate personal data protection safeguards.

ČETRTA POT processes personal data based on legitimate interest in accordance with this Policy in cases and for purposes set out below. Additional cases of processing based on legitimate interest may also be specified in contracts, terms or other documents governing a specific contractual relationship.

Prevention of Abuse

ČETRTA POT is a holder of the international ISO 27001:2013 certificate thereby proving Company's compliance in information security management and implementation of appropriate procedures to protect information about business partners, internal information, and other confidential information. In relation to entering contractual relationships, the purchase of goods or services, the implementation of contractual relationships, and the use of services, ČETRTA POT implements procedures and measures to prevent any abuse and to ensure the security of its services and operations. When processing the data for the abovementioned purposes, ČETRTA POT processes Users' data and data on the use of company services. ČETRTA POT'S legitimate interest in preventing abuse normally prevails over the interests and fundamental rights or freedoms of Users. Based on processing, ČETRTA POT may take abuse prevention measures that may include the prevention or limitation of access to services and the limitation of rights arising from contractual relationships, the termination of a contractual relationship, activities necessary to identify users or offenders, initiation of appropriate civil, inspection or criminal proceedings preventing or limiting abuses, and other measures permitted by laws and regulations.

Marketing Analysis

Users' personal data may be used by ČETRTA POT for the development of services and direct marketing of goods and services to business users and Company's partners, for informing the Users about company's services, products, new developments, and events, to offer the Users services, and for other forms of e-marketing. The Users' personal data may be used by ČETRTA POT also for the purpose of communication related to updates of the Company's website, provision of services and responding to questions from the Users. Based on these data, ČETRTA POT will be able to periodically inform the Users about changes to the company's website, implement the concluded contract, prepare a quotation, or fulfil its legitimate interests. The Users' personal data will only be processed by ČETRTA POT and persons authorized by ČETRTA POT.

In accordance with the GDPR, legitimate interest may also be the legal basis for direct marketing. Based on legitimate interest, ČETRTA POT may process the User segmentation and profiling data for the purpose of direct marketing. In doing so, ČETRTA POT will process the data about the User and the use of Company's services, websites, and applications, and social networks. ČETRTA POT will not process telecommunication data comprising the data about the connection, or location data, unless a consent is obtained from the User. Data processing does not affect Users' rights arising from contractual relationships.

ČETRTA POT provides a wide range of services that are subject to regulation and several laws and regulations, and consequently the processing of personal data for direct marketing based on legitimate interest may be further specified in contracts, terms or other documents governing a specific contractual relationship.

Surveys

User feedback is necessary and greatly facilitates the provision of high-quality services that meet Users' needs. ČETRTA POT endeavours to obtain the best relevant information from the Users about their satisfaction with Company's services and product portfolio. Periodically and during contacts with the Users, ČETRTA POT may send the Users an invitation to fill out a questionnaire or provide feedback on ČETRTA POT'S services and product portfolio. In doing so, ČETRTA POT will process User's contact information (telephone, e-mail) and information about the contact. Users are asked to fill out questionnaires on a voluntary basis, and failure to fill out any questionnaire does not affect User's rights in any way. 

Risk Management

When conducting business with the Users, ČETRTA POT acts with due diligence, which also includes risk management. To manage risks, ČETRTA POT monitors the fulfilment of contractual relationships with the Users, and as part of this activity processes the data about the User and the use of ČETRTA POT'S services. In managing the risks, ČETRTA POT may process also the data obtained from public records and other sources (e.g. SISBON, credit rating agencies, and other). If doing business with a particular User poses risk to ČETRTA POT, the Company may apply appropriate risk management measures including, but not limited to the restriction of access to services. Additionally, certain ČETRTA POT'S services or products may only be available to users who meet certain conditions in relation to such services or products, which may include a certain degree of risk.

Analysis

ČETRTA POT continuously aspires to adapt and improve Company's services and products, and consequently maintains a legitimate interest to monitor the implementation of contractual relationships and analyse the use of services by the Users, specifically to design and develop services and applications, evaluate the market and measure sales performance, and for marketing activities and activities to improve user experience and service quality. In doing so, ČETRTA POT will process the data about the User and the use of Company's services, websites, and applications, as well as social networks, and will also use protective measures that may include anonymization or pseudonymization. Data processing for the purpose of analysis in no way affects the rights of Users arising from contractual relationships. 

Acquisition of Consents

In providing products and services, ČETRTA POT aspires to provide relevant information to the Users and process the personal data in accordance with Users' preferences and expectations as closely as possible. Thus, ČETRTA POT has a legitimate interest to invite Users to give their consent in the implementation of contractual relationships. In doing so, ČETRTA POT processes telephone numbers, e-mail addresses, name, surname and postal address, username and the data about the consent that has been used to invite Users to give their consent.

Right to Objection

The User has the right to object and may at any time object to the processing of data for the abovementioned purposes. In this case, ČETRTA POT will, to the extent possible and if Company's reasons and interests do not override User's interests, rights, and freedoms, stop processing data for such purposes. Users may submit the objection by sending a written request by e-mail to info@cetrtapot.si or to the address ČETRTA POT, d.o.o., Kranj, Planina 3, 4000 Kranj, or by delivering it in person to ČETRTA POT'S registered office.

Users of Personal Data

Users of personal data are ČETRTA POT, suppliers, and governmental authorities. Prior to enabling any access to the personal data to suppliers or business partners, ČETRTA POT will verify that they meet the requirements for personal data processing and protection. Unless explicitly stated otherwise in the contract related to a particular contractual relationship governing the personal data processing by suppliers and business partners, ČETRTA POT bears responsibility towards the Users. ČETRTA POT'S suppliers and business partners may access personal data for the purpose and to the extent necessary for the supply of goods or the provision of the service.

Official authorities may obtain personal data from ČETRTA POT in cases and according to procedures laid down by laws and regulations.

Transfer to Third Countries

ČETRTA POT commonly does not transfer personal data to third countries. In cases when ČETRTA POT'S suppliers or contractual partners originate from third countries and may, in providing their services, process personal data, ČETRTA POT will enable such processing subject to terms and conditions determined by the GDPR – in particular by applying appropriate safeguards as stipulated by the GDPR (which may include the conclusion of an appropriate personal data processing agreement or other safeguards provided for by the GDPR).

In certain services, Users' personal data may be transferred to third countries due to the nature of the service (e.g. phone calls, communication with Users in third countries, the use of web services in third countries, etc.).

Retention Period

ČETRTA POT will retain and processes personal data for the duration of contractual relationship, until the arrangement and fulfilment of contractual obligations, settlement, or statute-barring of all receivables, or for the period for which a consent has been given by the User (applies in cases where retention period is longer than the above-mentioned periods). In relation to types of data, specific services may have a shorter retention period.

In accordance with tax and financial regulations, legislation and standards governing accounting, bookkeeping and document retention, ČETRTA POT is obligated to keep invoices and supporting documents for a period of 10 years from the end of the year to which the business event relates. ČETRTA POT'S invoices and related billing information, as well as the data about the Users, will be retained for a maximum of 10 years from the end of the year to which the business event relates. ČETRTA POT will use the specified data to fulfil legal obligations and for the purpose of establishment, exercise or defence of legal claims that may arise directly from the relationship between an individual and ČETRTA POT, or from the relationships between ČETRTA POT and third parties.

In case the personal data are anonymized in a way that they can no longer be matched with a particular person, such data may be retained and processed without any limitation to the retention period.

Upon receiving a request to erase the data or limit the scope of data processing, ČETRTA POT will fulfil the request by limiting the scope of data processing to the purposes provided for by law or for the purpose of establishment, exercise, or defence of legal claims. 

Personal data processed based on the User's personal consent or legitimate interest will be retained until the consent will be revoked or a request to cease the processing will be submitted.

Payment Services

Pursuant to the Prevention of Money Laundering and Terrorist Financing Act, ČETRTA POT is obligated to retain the data on the business relationship and each transaction for a period of 10 years from the termination of such business relationship or transaction.

Rights of and Individual in Relation to their Personal Data

The Users are eligible to request:

• a printout or insight into the data, so that they can get acquainted with their personal data processed by ČETRTA POT,
• rectification of data in cases where the User considers that their personal data processed by ČETRTA POT are incorrect,
• erasure of personal data and restriction on the processing of their personal data if they want ČETRTA POT to cease or restrict the processing of all or part of their personal data.

Additionally, the Users are eligible to:

• object to the processing of personal data based on legitimate interest or for the purpose of direct marketing,
• exercise the right to the portability of personal data they have provided to ČETRTA POT or require the withdrawal of their consent to the use of their personal data, in cases when the processing is carried out based on consent. If the User revokes their consent, this does not affect the lawfulness of the use and processing of User's personal data based on the User's consent before the day the User revoked the consent,
• click the unsubscribe link at the bottom of every marketing e-mail sent to the User by ČETRTA POT and follow the instructions that appear in the browser after clicking the link with which the User requests to stop receiving commercial messages.

Users may exercise their rights by sending a written request to ČETRTA POT to the e-mail addresses gdpr.dpo@cetrtapot.si or dpo@cetrtapot.si, or to the address ČETRTA POT, d.o.o., Kranj, Planina 3, 4000 Kranj, or by delivering it in person to ČETRTA POT'S registered office.

In the request with which the User exercises their rights, the User must properly identify themselves and clearly define their request.

Data rectification may be communicated by Users in writing or by signing a new contractual relationship document defining the rectified data. 

Certain user rights may in particular cases be restricted under laws and regulations (e.g. prohibition of disclosure of information about an investigation, etc.). 

ČETRTA POT will provide the User with information on measures taken based on received requests normally within one month, but in no case later than in three months. 

Every time a User objects to ČETRTA POT'S direct marketing carried out through a communication method that differs from the method used in commercial messages received from ČETRTA POT, the User shall provide ČETRTA POT with their name and sufficient information to enable identification in relation to receive messages.

Right to Appeal

Should the User consider that ČETRTA POT violates User's rights during the processing of personal data, the User may file an appeal with ČETRTA POT. Users may submit the appeal to the address ČETRTA POT, d.o.o., Kranj, Planina 3, 4000 Kranj, or to the e-mail addresses gdpr.dpo@cetrtapot.si or dpo@cetrtapot.si, or deliver it in person to ČETRTA POT'S registered office.

Should the User consider that ČETRTA POT violates User's rights or personal data protection regulations, they may file an appeal with the competent authority. The competent authority in Slovenia is the Information Commissioner of the Republic of Slovenia (Zaloška 59, 1000 Ljubljana, telephone: 01 230 97 78, e-mail: gp.ip@ip-rs-si).

Failure to Submit Data and Consequences

In concluding contractual relationships with Users, ČETRTA POT only requests information that may be requested in accordance with laws and regulations, or the information necessary for the conclusion and implementation of a contract. The required information is specified in the contract or general or special terms governing a contractual relationship or service. Should the user fail to submit the information or ČETRTA POT is unable to obtain it, ČETRTA POT may refuse to conclude the contract, or terminate the contract. The User may submit to ČETRTA POT also other, additional data.

Final Provisions

In addition to this Privacy Policy, the data processing within a contractual relationship is also governed by the contract and terms and conditions that additionally govern the contractual relationship. 

On 25 May 2018, the GDPR began to apply, while the procedure of drafting and adopting the new Personal Data Protection Act (ZVOP-2) has been initiated. This Privacy Policy has been compiled in accordance with the GDPR. 

If a particular contract or terms and conditions governing a business relationship are in collision with this Privacy Policy, the data shall be used to the extent permissible in accordance with the GDPR or the applicable Personal Data Protection Act. 

This Privacy Policy is published on ČETRTA POT'S website and applies from 25 May 2018.

Any changes to the Privacy Policy will be made available on ČETRTA POT'S website.

ČETRTA POT, d.o.o., Kranj

Last change: 20. 3. 2019