Legal

Privacy policy

This is an English translation provided for convenience. In the event of any discrepancy, the Slovenian version prevails.

The purpose of this privacy policy is to inform individuals, users of our services, partners, employees and other persons (hereinafter: "individual") who work with BOKOSOFT d.o.o. (hereinafter: "the company") about the purposes, legal bases, security measures and rights of individuals regarding the processing of personal data carried out by our company.

We value your privacy, which is why we always take care to protect your data.

We process personal data in accordance with European legislation (Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter: "the General Regulation" or GDPR)), applicable Slovenian data protection legislation and other legislation that provides us with a legal basis for processing personal data.

This privacy policy explains how our company, as the controller, processes the personal data it receives from individuals on the basis of the applicable legal grounds.

1) Controller

The controller of personal data is:

• Organisation: BOKOSOFT d.o.o.
• Address: Na Lazih 30, 1351 Brezovica pri Ljubljani, Slovenia
• E-mail: infobokosoft.si

2) Data protection contact person (where no data protection officer has been appointed)

Individuals to whom personal data relates may contact the data protection contact person about any question concerning the processing of their personal data and the exercise of their rights under the General Regulation:

• Name: Borut Šuštar
• Address: Na Lazih 30, 1351 Brezovica pri Ljubljani, Slovenia
• E-mail: infobokosoft.si

3) Personal data

Personal data means any information relating to an identified or identifiable individual; an identifiable individual is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual.

4) Purposes and legal bases of processing

The company collects and processes your personal data on the following legal bases:

• processing is necessary for compliance with a legal obligation to which the controller is subject;
• processing is necessary for the performance of a contract to which the individual is party, or in order to take steps at the request of the individual prior to entering into a contract;
• processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party;
• the individual has given consent to the processing of their personal data for one or more specific purposes;
• processing is necessary in order to protect the vital interests of the individual or of another natural person.

4.1) Compliance with a legal obligation

On the basis of statutory provisions, the company processes data on its employees as permitted by employment and social security legislation. On the basis of a legal obligation, for employment purposes the company mainly processes the following types of personal data: name and surname, gender, date of birth, personal identification number (EMŠO), tax number, place, municipality and country of birth, citizenship, residence, etc.

4.2) Performance of a contract

Where an individual enters into a contract with the company, the contract constitutes the legal basis for processing personal data. We may therefore process personal data for the conclusion and performance of a contract, such as the sale of goods and services, membership of loyalty schemes, participation in events, training, promotions, etc. If the individual does not provide their personal data, the company cannot conclude the contract, nor can it perform the service or deliver the goods in accordance with the contract. On the basis of its lawful business activity, the company may inform individuals and users of its services at their e-mail address about its services, events, training, offers and other content. The individual may at any time request that such communication and processing of personal data be stopped and unsubscribe via the unsubscribe link in the message received, or by sending a request by e-mail to infobokosoft.si or by post to BOKOSOFT d.o.o., Na Lazih 30, 1351 Brezovica pri Ljubljani, Slovenia.

4.3) Legitimate interest

The company may also process personal data on the basis of a legitimate interest it pursues. This is not permitted where such interests are overridden by the interests or fundamental rights and freedoms of the individual which require the protection of personal data. Where legitimate interest is relied upon, the company always carries out an assessment in accordance with the General Regulation. The processing of personal data for direct marketing purposes is considered to be carried out in the legitimate interest. The company may process personal data of individuals collected from publicly available sources or in the course of its lawful business activity, including for the purposes of offering goods, services, employment, information about benefits, events, etc. To achieve these purposes, the company may use ordinary mail, telephone calls, e-mail and other telecommunication means. For direct marketing purposes, the company may process the following personal data: name and surname, permanent or temporary address, telephone number and e-mail address. The company may process this personal data for direct marketing purposes even without the individual's explicit consent. The individual may at any time request that such communication and processing of personal data be stopped and unsubscribe via the unsubscribe link in the message received, or by sending a request by e-mail to infobokosoft.si or by post to the company's address.

4.4) Processing based on consent

Where the company has no legal basis under the law, a contractual obligation or a legitimate interest, it may ask the individual for consent. It may then also process certain personal data of the individual for the following purposes, where the individual has given consent:

• residential address and e-mail address for the purposes of information and communication;
• photographs, video recordings and other content relating to the individual (e.g. publication of photographs of individuals on the company's website) for the purposes of documenting activities and informing the public about the company's work and events;
• other purposes to which the individual consents.

If an individual has given consent to the processing of personal data and at some point no longer wishes it, they may request that processing be stopped by sending a request by e-mail to infobokosoft.si or by post to BOKOSOFT d.o.o., Na Lazih 30, 1351 Brezovica pri Ljubljani, Slovenia. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

4.5) Processing necessary to protect the vital interests of the individual

The company may process the personal data of the individual to whom the data relates where this is necessary to protect their vital interests. In emergencies, the company may look for the individual's identity document, check whether the person exists in its records, review their medical history or contact their relatives, for which the company does not need the individual's consent. This applies where it is strictly necessary to protect the vital interests of the individual.

4.6) Enquiry form on the website

The data you enter in the enquiry form (name and surname, company, e-mail address, telephone number, content of the message) is stored in our customer relationship management system (CRM) and used solely to respond to your enquiry and prepare a quote. The legal basis is taking steps at your request prior to entering into a contract. We keep the data for as long as necessary to handle the enquiry or until you request its erasure. To protect the form from abuse we use ALTCHA: your browser solves a short computational task prepared by our server. ALTCHA uses no cookies, does not track visitors and does not send data to third parties.

5) Retention and erasure of personal data

The company will keep personal data only for as long as necessary to fulfil the purpose for which the personal data was collected and processed. Where the company processes data on the basis of law, it will keep it for the period prescribed by law. Some data is kept for the duration of the cooperation with the company, while some data must be kept permanently. Personal data processed on the basis of a contractual relationship with the individual is kept by the company for the period necessary to perform the contract and for a further 6 years after its termination, except where a dispute arises between the individual and the company in connection with the contract. In that case, the company keeps the data for a further 10 years after the final court decision, arbitration award or court settlement or, if there was no court dispute, for 5 years from the date of the amicable resolution of the dispute. Personal data processed on the basis of the individual's consent or legitimate interest will be kept until consent is withdrawn or erasure is requested. After receiving a withdrawal or erasure request, the data is erased within 15 days at the latest. The company may also erase this data before withdrawal where the purpose of processing has been achieved or where the law so provides.

Exceptionally, the company may refuse a request for erasure for reasons set out in the General Regulation, namely: exercising the right of freedom of expression and information, compliance with a legal obligation requiring processing, reasons of public interest in the area of public health, archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, or the establishment, exercise or defence of legal claims. After the retention period has expired, the company must effectively and permanently erase or anonymise the personal data so that it can no longer be linked to a specific individual.

6) Processing by processors and transfers of data

The company may entrust certain processing of personal data to a processor on the basis of a data processing agreement. Processors may process the entrusted data only on behalf of the controller, within the limits of its authorisation set out in a written contract or other legal instrument, and in accordance with the purposes defined in this privacy policy.

The processors with which the company works are mainly:

• accounting services and other providers of legal and business advice;
• infrastructure maintenance providers (video surveillance, security services);
• information system maintenance providers;
• providers of e-mail services and of software and cloud services (e.g. Arnes, Microsoft, Google);
• providers of social networks and online advertising (Google, Facebook, Instagram, etc.).

For better oversight and control of processors and orderly contractual relationships, the organisation also keeps a list of processors, listing all specific processors with which it works.

The company will under no circumstances disclose an individual's personal data to unauthorised third parties. Processors may process personal data only within the company's instructions and may not use the personal data for any other purposes.

The company as controller and its employees do not transfer personal data to third countries (outside the member states of the European Economic Area – the EU member states plus Iceland, Norway and Liechtenstein) or to international organisations, except to the USA, where relationships with US processors are governed by standard contractual clauses (model contracts adopted by the European Commission) and/or binding corporate rules (adopted by the organisation and approved by EU supervisory authorities).

7) Cookies

A cookie is a small file that a website stores on your device. This website uses:

We set analytics cookies only after you choose "Accept all" in the banner or enable them in the settings. If you decline, the Google script is not loaded at all. You can change your decision at any time via the "Cookie settings" link in the footer; when you withdraw consent, we delete the Google Analytics cookies.

Google Analytics is provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics 4 does not store IP addresses. Data may be transferred to the USA under the EU-U.S. Data Privacy Framework. More: Google Privacy Policy.

You can also delete cookies at any time in your browser settings.

8) Data security and accuracy

The company ensures information security and the security of its infrastructure (premises and application and system software). Among other things, our information systems are protected by antivirus software and a firewall. We have implemented appropriate organisational and technical security measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access and against other unlawful and unauthorised forms of processing. Where special categories of personal data are transmitted, we transmit them in encrypted form, protected by a password.

Individuals are themselves responsible for transmitting their personal data securely and for ensuring that the data they provide is accurate and truthful. The company will endeavour to keep the personal data it processes accurate and, where necessary, up to date, and may occasionally contact the individual to confirm the accuracy of their personal data.

9) Rights of the individual regarding data processing

Under the General Regulation, individuals have the following data protection rights:

• to request information on whether we hold their personal data and, if so, what data we hold, on what basis we hold it and why we use it;
• to request access to their personal data, allowing them to receive a copy of the personal data held by the company and to check whether the company processes it lawfully;
• to request rectification of personal data, such as the correction of incomplete or inaccurate personal data;
• to request erasure of their personal data where there is no reason for further processing, or where they exercise their right to object to further processing;
• to object to further processing of personal data where the company relies on a legitimate business interest (including the legitimate interest of a third party), where there are grounds relating to the individual's particular situation; the individual has the right to object at any time if the company processes personal data for direct marketing purposes;
• to request restriction of processing of their personal data, meaning that processing is suspended, for example if the individual wants the company to establish the accuracy of the data or to verify the grounds for further processing;
• to request the transfer of their personal data in a structured electronic format to another controller, where this is possible and feasible;
• to withdraw the consent given for the collection, processing and transfer of their personal data for a specific purpose; after receiving notice that consent has been withdrawn, the company will stop processing the personal data for the purposes originally agreed, unless it has another lawful legal basis for doing so.

An individual wishing to exercise any of the above rights may send a request by e-mail to infobokosoft.si or by post to BOKOSOFT d.o.o., Na Lazih 30, 1351 Brezovica pri Ljubljani, Slovenia. The organisation will respond to a request concerning the rights of the individual without undue delay and in any event within one month of receipt. Should this period need to be extended (by up to two further months), taking into account the complexity and number of requests, you will be informed. Access to personal data and the exercise of rights is free of charge for the individual. However, the company may charge a reasonable fee where a request is manifestly unfounded or excessive, in particular because of its repetitive character. In such a case the company may also refuse the request. When rights are exercised, the company may need to ask the individual for certain information to help confirm their identity; this is merely a security measure ensuring that personal data is not disclosed to unauthorised persons.

When exercising these rights, the individual may use the form of the Slovenian Information Commissioner, available on its website: https://www.ip-rs.si/fileadmin/user_upload/doc/obrazci/ZVOP/Zahteva_za_seznanitev_z_lastnimi_osebnimi_podatki__Obrazec_SLOP_.doc

If the individual believes that their rights have been infringed, they may turn to the supervisory authority (the Information Commissioner of the Republic of Slovenia) for protection or assistance: https://www.ip-rs.si/zakonodaja/reforma-evropskega-zakonodajnega-okvira-za-varstvo-osebnih-podatkov/kljucna-podrocja-uredbe/prijava-krsitev/

If you have any questions regarding the processing of your personal data, you can always contact our company by e-mail at infobokosoft.si or by post at BOKOSOFT d.o.o., Na Lazih 30, 1351 Brezovica pri Ljubljani, Slovenia.

10) Publication of changes

Any change to our privacy policy will be published on the company's website: www.bokosoft.si. By using the website, the individual confirms that they accept and agree to the entire content of this privacy policy.

This privacy policy was adopted by the responsible person of the organisation on 1 October 2020.

Brezovica, 1 October 2020 — Responsible person of the organisation: Borut Šuštar