Privacy Policy
How Apartmaji Žnidar, Daša Žnidar s.p. processes your personal data under GDPR and the Slovenian ZVOP-2. This policy applies to all users worldwide. Since our controller is established in Slovenia (EU), GDPR governs all processing regardless of your location.
At a glance
- What we collect
- Name, email, phone, preferred week, group size, your message
- Why
- To handle your booking inquiry. Marketing only if you opt in.
- Where it lives
- Slovenia (controller), Vercel and Google (processors, EU-US DPF)
- How long
- 12 months if you do not book, 10 years if you do (tax law)
- Cookies
- Strictly necessary only. No analytics, no tracking.
- Your rights
- Access, delete, withdraw consent, complain to IP-RS. Contact us anytime.
Full details below.
1. Data Controller
Apartmaji Žnidar, Daša Žnidar s.p., Savska cesta 6, 4264 Bohinjska Bistrica, Slovenia. Davčna številka: SI [XXXXXXXX]. Contact email: [to be confirmed].
2. What Data We Collect
When you submit a booking inquiry through our form, we collect:
- Name
- Email address
- Phone number
- Preferred week
- Number of people
- Any message you choose to provide
- Consent timestamp and your consent choices
We do not use analytics or tracking cookies. We do not collect data passively beyond what is strictly necessary for the booking form to function.
3. Purpose and Legal Basis
- Article 6(1)(b) GDPR - steps prior to entering into a contract: handling your booking inquiry and preparing your stay.
- Article 6(1)(a) GDPR - your consent: optional marketing communications. You can withdraw this consent at any time.
- Article 6(1)(c) GDPR - legal obligation: retention required by Slovenian tax law for completed bookings.
4. How Long We Keep Your Data
- Booking inquiries that do not convert: up to 12 months from the date of inquiry, then deleted.
- Completed bookings: 10 years (Slovenian tax law).
- Marketing consent records: until you withdraw consent, plus 12 months for evidence purposes.
5. Who Receives Your Data
Your data is handled by the controller and by the following processors:
- Vercel Inc. (USA) - website hosting and form endpoint. EU-US Data Privacy Framework certified.
- Google LLC (USA) - Google Sheets storage for inquiry records. EU-US Data Privacy Framework certified.
- Telegram FZ-LLC (UAE) - instant notification of new inquiries to authorised staff.
We do not sell your data. We do not share it with third parties for their own marketing purposes.
6. International Transfers
Some processors are located outside the European Economic Area. Transfers to the United States are covered by the EU-US Data Privacy Framework. Where this does not apply, transfers are protected by Standard Contractual Clauses approved by the European Commission.
7. Your Rights
Under GDPR you have the right to:
- Access your personal data (Article 15)
- Rectify inaccurate data (Article 16)
- Request erasure (Article 17)
- Restrict processing (Article 18)
- Data portability (Article 20)
- Object to processing (Article 21)
- Withdraw consent at any time, without affecting prior lawful processing
To exercise these rights, contact us using the email in Section 1. We will respond within one month.
You can also lodge a complaint with the Slovenian supervisory authority:
Informacijski pooblaščenec RS
Dunajska cesta 22, 1000 Ljubljana
www.ip-rs.si
8. Cookies
This website uses only strictly necessary technical functionality (such as remembering your cookie banner choice in your browser). We do not use analytics, advertising, or tracking cookies. If this changes in the future, we will update this policy and request fresh consent where required.
9. Security
We apply reasonable technical and organisational measures to protect your data, including access controls, two-factor authentication on systems holding personal data, and contractual safeguards with processors.
10. Changes to This Policy
We may update this Privacy Policy from time to time. The current version is always available at this URL. Material changes will be communicated to anyone who has provided us their email.
11. Contact
Questions about this Privacy Policy or how we handle your data: see Section 1 for contact details.