Privacy Policy: information about personal data protection
Your privacy is of paramount importance for the public institute Javni zavod za turizem Nova Gorica in Vipavska dolina to fulfil your wishes and meet your request. The Institute is constantly developing new organisational and technical measures to ensure your personal data are processed safely, to protect your privacy and enable you to enforce the rights from the applicable law, particularly compliant with the Personal Data Protection Act (ZVOP) and the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
The main purpose of this document is to inform you about the information collected, how are they processed, and how that affects you, i.e., your legitimate rights ensured by the public institute Javni zavod za turizem Nova Gorica in Vipavska dolina.
1. WHO IS THE CONTROLLER OF YOUR PERSONAL DATA?
The institute Javni Zavod za turizem Nova Gorica in Vipavska dolina, registered office in Trg Edvarda Kardelja 1, 5000 Nova Gorica (hereinafter: the Institute) acts as Personal Data Controller.
For any question regarding data processing and your rights please refer to the Data Protection Officer to the e-mail address gdpr@vipavskadolina.si.
2. HOW DO WE USE YOUR PERSONAL DATA?
Your personal data is collected upon filling the form on our webpages, when you contact us by e-mail, through telephone, by visiting our tourist information offices in Ajdovščina and Nova Gorica or otherwise.
You ensure the accuracy and correctness of the information provided.
Your data are used for various purposes:
Purpose | Legal basis |
Managing your requests submitted by any means (e-mail, telephone, website, social media or otherwise), such as: bike hire, bookings to guided tours, workshops or other activities, inquiries for accommodation, tours, experiences, etc. | Data processing required and legitimate compliant with the pre-contractual relation arising from your request. |
Managing the business relation within the scope of bike hire, guided tours, invoicing, etc. | Data processing legitimate compliant with the contract between the your and our party. |
Managing your requests | Data processing compliant with our legitimate interest (improvement of our products and services and prevention of legal proceedings). Should you disagree with this data processing, your requests cannot be managed. |
Carrying out activities related to satisfaction surveys, studies about our current destination range tourist products and services, and studies on the development of new range of tourist products and services, and sustainable mobility contents. | Data processing compliant with our legitimate interest (improvement of our products and services). You may disagree with this data processing. |
Monitoring the influence of our activities, sales performance analysis (reporting). | Data processing compliant with our legitimate interest (measuring the influence of our activities and improvement of destination range of tourist products and services). You may disagree with this data processing. |
Managing your involvement in events, giveaways, contests, competitions, workshops and similar. | Data processing compliant with our legitimate interest (organisation of events). Should you disagree with this data processing, your involvement shall be denied. |
When your consent is required by law, you shall receive promotional messages and information about our tourist destination, range of products and services, experiences, events, giveaways, contests, sustainable mobility and similar to your ordinary mail, e-mail address or telephone. | Data processing compliant with your explicit consent and/or without your consent and according to our legitimate interest (ensuring the appropriate content, enhancing the contractual relations with existing customers). You may disagree with this data processing. |
Responding to your requests for the rights regarding your personal data (see section What are your rights?). | Data processing compliant with our legal obligations and includes verifying your identity. |
Website usability and quality analysis, and ensuring its safe functionality. | Data processing compliant with our legitimate interest (enhancement of contents to improve the user experience). Should you disagree with this data processing, the access to the desired content shall be denied. |
The Institute is committed to collect only the personal data required for each purpose they are processed for.
Some data are mandatory. They are required to implement the business arrangements or comply with our legitimate or contractual commitments. If you do not wish to submit the information required, your request cannot be processed. The purpose of other information is to know you better, especially to send you tailor-made promotional messages, and are thus optional. Moreover, you have the right to request the cancellation of the information from our database at any time.
As customer of our products or services, you may be contacted based on our legitimate interest and with the aim to inquiry about your satisfaction with our range of tourist products and services, except when you explicitly object or cancel the processing.
Based on your personal data (those acquired directly and obtained through our partners, or the ones collected automatically based on your consent expressed during your visit to our websites (e. g. demographic, sociographic and behavioral data, gender, language, age, residence – region, frequency, manner and time of use of services, webpages, previous purchasing habits, location or online identification – username) and compliant with our legitimate interest, except when you explicitly object or cancel the processing, the Institute has the right to develop commercial profiles or customer segmentation enabling the assessment and precise anticipation of your personal wishes and/or interests about our range of tourism products and services. Based on your consent, the Institute can better understand your wishes and provide tailor-made products and services to meet your desires. Profiling is not subject to any automated decision-making related to the content of messages the Institute shall send.
You can object to the processing of your personal data based on our legitimate interest by filing a notification to the public institute Javni zavod za turizem Nova Gorica in Vipavska dolina, Trg Edvarda Kardelja 1, 5000 Nova Gorica, or by e-mail to gdpr@vipavskadolina.si.
Beyond our legitimate interests, your personal data shall be processed upon your explicit consent for direct marketing to present you the most advantageous promotions. If you wish to receive tourism promotion and other benefits, please click Allow. This way you will receive only the promotions tailor-made to your needs you are really interested in.
3. WHICH DATA ARE COLLECTED?
Personal data are information which can be used to identify a natural person. Beside the most characteristic identification data, such as name, address, e-mail address or telephone number, personal data include the technical information assigned to a certain person, e. g. the IP-address.
- personal data for identification, such as full name, address, e-mail address, telephone number, tax number, date of birth, personal identification document number;
- purchase information, such as: contract/invoice number/date;
- information about customer relations, i.e.: type or date of request for information or complaint;
- marketing information, i.e.: type of marketing activity you are involved in, date of contact, data collected on the website.
Effectively, all these data are voluntary, unless relevant for the conclusion of contracts, the implementation of your requests or the functionality during your visit of our website. Without these data, such purposes could not be rendered.
Automatically collected data
Together with its partners, the Institute uses various technologies to collect and store the information about your visits to our websites, which may include the use of cookies or similar technologies to identify your browser or device. Such information is used to manage our webpages, to detect and prevent unauthorised accesses, and to improve your user experience. The legal bases acts as our legitimate interest to improve the user experience on our websites as well as offer tailor-made and content suitable to your interests.
The Institute follows your activities on our websites, recording data about the way you visit them, your settings and choices. The Institute collects the date, time and duration of your visit automatically, as well as you Internet service provider and the website from which you came our page. Moreover, it acquires the information about the quantity of data transferred, the browser, the operating system, and the device used. Automatically collected data become anonymous the moment they are gathered.
Please note that the function is entirely optional and thus shall not be performed without your consent. For more information about our cookie policy and instructions for managing your consent please visit www.vipavskadolina.si/en/splosno/piskotki.
4. WHO HAS ACCESS TO YOUR PERSONAL DATA?
The access to your data is granted only to those associates of the Institute who require such data to fulfil our contractual or legal commitments, and only within the scope necessary for the compliance with such obligations.
If required for the fulfilment of their commitments (e. g. website hosting; services related to the operation or maintenance of the website; services related to the communication of offers and information, satisfaction surveys, e-bike hire, etc.), all or part of your personal data can be shared with our contractual partners - service providers. Your personal data shall be transferred to the authorised offices only and solely for the purpose of implementation of their functions and within the scope in their competence.
Your personal data shall be transferred to third parties to fulfil our legal obligations, administrative or judicial provisions, i.e., to authorised offices only for their obligations and responsibilities. In some cases, the Institute may be asked to communicate your personal data to local authorities or agencies or EU authorities. Compliant with the applicable legislation, the Institute is obliged to communicate such data upon request.
Please note that our protection is not extended to the webpages of other providers which can be accessed through links published on our website.
As far as possible, your data are stored on the services regulated by the European Economic Area (EEA). The Institute usest he Thunderbird online platform on which personal data required for such purposes is stored (e-mail address, language, country) for sending the Vipavskadolina.si newsletter. The Institute uses the Arctur d.o.o. EML system on which personal data required for such purposes is stored (e-mail address) for sendinf the Turizem-novagorica-vipavskadolina.si newsletter.
Your personal data stored shall be disclosed only to parties provided in this Privacy Policy and shall not be neither sold nor traded. It is of paramount importance for the Institute to guarantee that the information you provided are protected.
5. WHAT ARE YOUR RIGHTS?
The right to information/of access: you have the right to know which personal data are being collected, from which sources and for what purposes. The Institute is at your disposal to communicate such information at any time.
The right to rectification: you have the right to request the correct any mistake about your personal data. Any time the Institute contacts you, it is its responsibility to ensure the personal data processed are correct. Nevertheless, some information processed may still be incorrect. The Institute undertakes to correct the data upon request.
The right to erasure ('right to be forgotten'): you have the right to request the erasure of your personal data. Unless the applicable legislation provides otherwise, the Institute is obliged to fulfil your request. The Institute undertakes to erase or anonymise your personal data related to the processing the consent was given for from all databases.
The right to data portability: you have the right to request to transfer your data in structured and commonly used format. The Institute undertakes to respond within the legal deadline of 30 days upon the receipt of your request. The Institute shall send you only the personal data submitted or those acquired from publicly available sources or from our partners.
The right to restriction of processing: in certain cases, you are entitled to restrict the processing of your personal data pursuant to the Personal Data Protection Act. The Institute has performed an in-depth assessment of its purposes and means of processing, and has found no cases in which a restriction of processing is requested. Hence, all requests within this scope shall be considered as withdrawal of consent, meaning that the Institute shall cease sending any message other than the necessary communication.
The right to object: Personal Data Protection Act protects the right to object to any type of processing. Any objection shall be considered as withdrawal of consent, meaning that the Institute shall cease sending any message other than the necessary communication.
The right to avoid automated decision-making: The Institute does not apply automated decision-making other than for tailor-make online marketing with your prior explicit consent. Your consent can be withdrawn at any time.
The right to withdraw your consent to process personal data at any time for the purposes it was given, without affecting the legitimate data processing implemented until it was withdrawn compliant with your consent.
You can object the processing of your personal data which is based on our legitimate interest, or cancel your consent at any time.
Your personal data protection rights can be exercised by submitting a written or verbal notification to the public institute Javni zavod za turizem Nova Gorica in Vipavska dolina, Trg Edvarda Kardelja 1, 5000 Nova Gorica, or by e-mail to gdpr@vipavskadolina.si.
For any question regarding data processing and your rights, or in case of data abuse please refer to the Data Protection Officer to the e-mail address gdpr@vipavskadolina.si.
You shall be notified immediately or within 72 hours about any breach of personal data protection which is expected to pose a significant risk to your rights and freedoms.
The Institute cooperates with the competent regulatory authorities in resolving complaints regarding the processing of personal data it cannot solve directly with you. You have the right to legal protection. Please refer to the Information Commissioner of the Republic of Slovenia. Please contact us before filing any complaint. The Institute shall be glad to assist you.
6. HOW LONG IS YOUR DATA STORED FOR?
Compliant with the provisions, the Institute undertakes to store your personal data solely for the timeframe necessary to fulfil the specific purpose of processing. To calculate these retention and storage periods, the Institute according mainly to the following criteria:
- duration of the contract (if concluded with the Institute);
- time necessary to process your request or complaint;
- your interest and answer to our promotional messages;
- need to maintain the specific history of your interactions with the Institute for the due management of business relations;
- our legal and contractual commitments.
To react to any legal procedure within the period of validity of the regulations provided by the applicable legislation, some personal data must be kept in archives.
Personal data processed compliant with the contract can be processed and stored 5 years from the fulfilment of the contractual obligations of both parties. Pursuant to the act regulating the value added tax, invoices are stored 10 years after the end of the year which they relate to.
7. UPDATES TO THE PRIVACY POLICY
The Institute verifies the compliance of its Privacy Policy on a regular basis. The Privacy Policy may be subject to eventual amendments. Compliant with this Privacy Policy, your rights shall not be diminished without your explicit consent. Any change shall be published on this website. You shall be notified in case of significant variations.
Last update: February 2021