Privacy Policy

Apartmaji Žnidar, Daša Žnidar s.p., Savska cesta 6, 4264 Bohinjska Bistrica, Slovenia. Davčna številka: SI92460909. Contact email: info@bohinjskiweek.com.

When you submit a booking inquiry through our form, we collect:

• Name
• Email address
• Phone number
• Preferred week
• Number of people
• Any message you choose to provide
• Consent timestamp and your consent choices

For visitor statistics we use Vercel Web Analytics, which counts page views without cookies and without collecting personal data or tracking you across other sites. Beyond this anonymized counting, we collect nothing passively unless you accept the Meta pixel in the cookie banner, which is described in Section 9.

• Article 6(1)(b) GDPR - steps prior to entering into a contract: handling your booking inquiry and preparing your stay.
• Article 6(1)(a) GDPR - your consent: optional marketing communications. You can withdraw this consent at any time.
• Article 6(1)(c) GDPR - legal obligation: retention required by Slovenian tax law for completed bookings.

• Booking inquiries that do not convert: up to 12 months from the date of inquiry, then deleted.
• Completed bookings: 10 years (Slovenian tax law).
• Marketing consent records: until you withdraw consent, plus 12 months for evidence purposes.

Your data is handled by the controller and by the following processors:

• Vercel Inc. (USA) - website hosting and form endpoint. EU-US Data Privacy Framework certified.
• Google LLC (USA) - Google Sheets storage for inquiry records. EU-US Data Privacy Framework certified.
• Telegram FZ-LLC (UAE) - instant notification of new inquiries to authorised staff.
• Meta Platforms Ireland Ltd. (Ireland) - advertising measurement, and only if you accept the pixel in the cookie banner. See Section 9.

We do not sell your data. We do not share it with third parties for their own marketing purposes.

Some processors are located outside the European Economic Area. Transfers to the United States are covered by the EU-US Data Privacy Framework. Where this does not apply, transfers are protected by Standard Contractual Clauses approved by the European Commission.

Under GDPR you have the right to:

• Access your personal data (Article 15)
• Rectify inaccurate data (Article 16)
• Request erasure (Article 17)
• Restrict processing (Article 18)
• Data portability (Article 20)
• Object to processing (Article 21)
• Withdraw consent at any time, without affecting prior lawful processing

To exercise these rights, contact us using the email in Section 1. We will respond within one month.

You can also lodge a complaint with the Slovenian supervisory authority:

Informacijski pooblaščenec RS
Dunajska cesta 22, 1000 Ljubljana
www.ip-rs.si

By default this website sets no cookies. Your cookie banner choice is remembered locally in your browser (local storage), not in a cookie. For visitor statistics we use Vercel Web Analytics, which is cookie-free and anonymized: it counts page views without storing anything on your device, without collecting personal data, and without tracking you across other websites. It runs regardless of your banner choice because it identifies nobody.

The only component that sets cookies is the Meta pixel, and it loads only if you press Accept in the cookie banner. If you press Reject, or make no choice at all, it is never loaded and no request is sent to Meta. Details in Section 9.

If you press Accept in the cookie banner, we load the Meta pixel (Facebook pixel, ID 1941240377263284). Until you do, no request goes to Meta at all: the script is injected on your click, not on page load.

What it does. It records that a page of this website was viewed, and that you asked us to email you the ski program (a "Lead" event, without your email address). Meta receives your IP address, browser and device information, the page URL, and cookies it sets on your device. We use this to measure our Facebook and Instagram ads and to build advertising audiences. We never send Meta your name, phone number, or the content of your messages.

Legal basis. Your consent, Article 6(1)(a) GDPR. Meta Platforms Ireland Ltd. acts as a joint controller for the collection and transmission stage; its handling of the data afterwards is governed by the Meta Privacy Policy.

How to withdraw. Clear this website's local storage in your browser settings (or use a private window), then reload the page: the banner appears again and you can press Reject. Withdrawal stops any further collection; it does not affect what was lawfully collected before.

We apply reasonable technical and organisational measures to protect your data, including access controls, two-factor authentication on systems holding personal data, and contractual safeguards with processors.

We may update this Privacy Policy from time to time. The current version is always available at this URL. Material changes will be communicated to anyone who has provided us their email.

If you ask us to email you the ski program, we use your email address to send you the program and, only if you tick the optional box, occasional news about Bohinj Ski Week. This data is stored in Google Sheets under the same safeguards described in Sections 5 and 6, and is not passed on to any other third party. You can ask us to delete it at any time by writing to info@bohinjskiweek.com.

Questions about this Privacy Policy or how we handle your data: see Section 1 for contact details.