INFORMATION ON THE PROCESSING OF PERSONAL DATA FOR INDIVIDUALS AT SPORTINA BLED D.O.O.
I. PRESENTATION OF THE DATA CONTROLLER
Sportina, foreign and domestic wholesale and retail trade, brokering, agency, representation and organisation services Bled d.o.o., Alpska cesta 43, 4248 Lesce, founded in 14/03/1990, is a commercial enterprise with approximately 300 shops. We wish to get closer to our clients by creating an offer for a perfect lifestyle availing ourselves of collections of fashion brands as well as catering and tourism. We are also committed to respecting the privacy of our clients and protecting their personal data. Business operations are nowadays inevitably tied also to processing personal data. We will invite you to join our loyalty club in order to bring our offer even closer to you, to make it even more accessible and, if you will let us, also more tailored to your needs and interests. We will organise prize games, distribute various vouchers for discounts and other advantages. We will treat the collected personal data in accordance with the provisions of the Regulation (EU) 2016/679 of the European parliament and Council dated 27 April 2016 on the protection of individuals with regard to the processing of personal data and the free flow of data, and the repeal of Directive 95/46/EC (hereinafter referred to as: General regulation) and national regulations governing this area.
II. VISION OF PRIVACY PROTECTION OR PERSONAL DATA PROTECTION
Sportina Bled d.o.o. is a trustworthy personal data controller. We understand privacy and respect it.
III. PERSONAL DATA PROTECTION OFFICER
INFO HOUSE, Consulting, Ltd, Likozarjeva 14, 1000 Ljubljana, Slovenia, EU, firstname.lastname@example.org, +386 1 23 55 036; Available: Mon. & Thu. from 10 AM till noon“.
Individuals whom personal data refer to may contact the personal data protection officer with regard to all questions relating to the processing of their personal data and to exercising their rights on the basis of applicable regulations governing personal data protection.
IV. PURPOSES OF PROCESSING PERSONAL DATA AND LEGAL FOUNDATIONS
a) Sportina Bled d.o.o. shall process personal data of its clients within the framework and for purposes of implementing contracts for the purchase of goods and services, and also for purposes of concluding contracts, in the negotiation phase, after receiving an individual's offer (Article 6/l, point b, of the General regulation). In case of complaints regarding the goods, which may be made in accordance with consumer rights, the clients shall be obliged to present the invoice proving the purchase, their personal name and contact information, address and e-mail. Data shall be used for purposes of deciding on the established defect of the goods or on the exchange of flawless goods, if allowed by the controller.
Should Sportina Bled d.o.o. reserve certain goods at the buyer's request, it shall hold the goods or order it for the buyer, and for this purpose personal data on the buyer's name, address, e-mail and mobile phone number shall be processed in order to inform the buyer on the arrival of the goods and the later conclusion of a contract (purchase).
On the basis of a contract, Sportina Bled d.o.o. shall also process personal data of members of its loyalty clubs: Sportina Group and XYZ. Data that are obtained and subsequently processed for purposes of exercising the rights and obligations of club members are defined in detail in the General terms and conditions of the Sportina Group loyalty club and in the General terms and conditions of the XYZ loyalty club.
On the basis of a contract, Sportina Bled d.o.o. shall also process personal data of employees, which are necessary to conclude and exercise rights and obligations under the employment relationship and personal data of other associates, who are individuals (and do not exercise and economic activity on the market), to the extent specified by the Labour Market Act () or Employment Relationships Act ().
b) Sportina Bled d.o.o. shall process personal data of individuals also on the basis of a legal foundation (Article 6/I, point c, of the General regulation) and on the basis of other international contracts, EU regulations and national laws, requiring from Sportina Bled d.o.o. to forward in certain cases personal data of individuals to national authorities (such as the Financial Administration of the Republic of Slovenia (FURS), various inspectorates, courts, etc.) and other controllers (such as the Health Insurance Institute of Slovenia (ZZZS), the Employment Service of Slovenia (ZRSZ), the Pension and Invalidity Insurance Institute of Slovenia (ZPIZ), the Agency of the Republic of Slovenia for Public Legal Records and Related Services (AJPES) in order to fulfil their own or an individual's legal obligations or competences.
c) On the basis of the legitimate interest (Article 6/I, point f, of the General regulation), Sportina Bled d.o.o. shall process personal data for the purpose of reducing the risks of their website being hacked (ensuring information safety, reducing risks of unauthorised access to important business information, personal information and IT system of Sportina Bled d.o.o.). Sportina Bled d.o.o. monitors data used for identification (IP address of the computer, date and time and visited pages) on the server in relation to the access to the Sportina Bled d.o.o. website. In addition to reducing risks of intrusion and unauthorised access, these data may also be used for analytical and statistical purposes. On the basis of the overriding legitimate interest, Sportina Bled d.o.o. shall process legally collected personal data for purposes of various analyses and statistics necessary for verifying the correctness of current business decisions and the planning of new ones.
d) In certain cases Sportina Bled d.o.o. is asking its clients and other individuals (also candidates for employment) to give their consent (Article 6/I, point f, of the General regulation) for the processing of their personal data for purposes of designing and providing offers of goods, services and even job posts tailored to their interests and capabilities. The types of an individual’s processed personal data are listed in detail in the invitation to give consent and differ depending on the category of individuals (clients, loyalty club members, candidates for employment). Sportina Bled d.o.o. also asks its clients and other individuals (visitors of its website) to give consent for the processing of their personal data for purposes of sending notifications on novelties in its sales programme, sales programme of the Sportina Group, on various events, and also consent for purposes of sending notifications on the sales programme of the business partners of Sportina Bled d.o.o. In these cases the processing of personal data is carried out within the framework of an individual’s statement regarding the allowed scope of personal data, purpose and agreed notification channels, until revocation.
If the client is under 16, the consent is given by their parents or legal guardians on their behalf in case of information society services.
e) The processing of personal data of visitors of the Sportina Bled d.o.o. website depends on their consent, except for processing personal data necessary to ensure the correct operation of the website (e.g. login, purchasing process, etc.). The processing of personal data using cookies, which is carried out based on consent, is described in detail following the link below: http://www.sportina-club.com/sl/?cookie_settings.
f) Sportina Bled d.o.o. also uses tools for marketing automation, such as SharpSpring, on its web pages. On 05/05/2018, SharpSpring was recognised as conforming to the requirements of EU regulations in the area of personal data protection on the basis of the EU - US “Privacy Shield” agreement. The tool is intended for a better understanding of the interests and preferences of the website's visitors, and Sportina Bled d.o.o. may offer, in relation to activities related to marketing, a condensed user ID to social networks managed by third parties or other online operators (such as Twitter, LinkedIn, Facebook, Instagram or Google), where these data are then compared to data of social networks or own databases of online operators in order for users to view more relevant information.
V. USERS OF PERSONAL DATA AND EVENTUAL TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES
In addition to Sportina Bled d.o.o., personal data are being processed on its behalf and in its name also by its processors. Typically these are IT support operators involved in the processing of personal data, online advertisement agencies or agencies for a different implementation of direct marketing, and business analysis service providers.
Personal data of clients shall not be exported to third countries, except for personal data processed using the SharpSpring marketing automation tool. In this case data are exported outside the EU territory or the European Economic Area, whereby the prescribed protective measures shall always be respected; in case of exporting data to the USA, the “Privacy Shield” agreement between the EU and the USA shall apply.
VI. RIGHTS OF INDIVIDUALS
By sending a request to the following address: Sportina Bled, d.o.o, Alpska cesta 43, Lesce or DPOSI@sportina.si, individuals may request to access, modify, correct, block or limit data processing or delete personal data, object to the processing of data being processed in relation to that individual, and request the transfer of data.
Individuals may at any time revoke their given consents for processing personal data, permanently or temporarily, entirely or partially, by a written request sent to the following address: Sportina Bled, d.o.o, Alpska cesta 43, Lesce or DPOSI@sportina.si, or they may manage their consents on the website: www.sportina-club.com. The revocation of the consent shall not impact the legality of the processing, which was implemented on the basis of the consent up to its revocation.
Individuals shall have the right to submit a complaint to the information commissioner of the RS, if they believe that their personal data are being kept or in any way processed in contrast with the applicable regulations governing personal data protection.
VII. PERSONAL DATA RETENTION PERIODS
Sportina Bled d.o.o. shall process personal data to the extent necessary for realising its processing purposes and until it shall be necessary in order to achieve the pursuit objective.
Thus, Sportina Bled d.o.o. shall process personal data until the fulfilment of the purpose or within the framework of limitation periods for obligations that could stem from the processing of these personal data, in particular when the processing of personal data is necessary as part of concluding or implementing a contract, except in cases when the personal data retention period is prescribed by law. In the latter case, Sportina Bled d.o.o. shall keep data in accordance with the legal prescription.
Date: 23 May 2018