Personal data controller and contact details
This policy applies to the processing (use) of any personal data carried out by or on behalf of M-tek d.o.o. (the controller).
Information about the Controller:
PRO-NASA d.o.o., Industrijska cesta 1, 1290 Grosuplje
Tax number: SI 41611799
Registration number: 8776873000
E-mail: [email protected]
Which personal data are processed
Legal bases for processing personal data
We may process your personal data on the following legal bases:
Purposes of processing personal data
We may use your personal data for one or more of the following purposes:
How long we keep your personal data and what happens to it after that
We keep basic personal data for as long as you are a registered user of our websites.
Personal data that we process on the basis of your consent is retained permanently or until you withdraw that consent.
We keep data on invoices issued for 10 years from the date of issue.
We retain the data necessary for the conclusion and performance of a contract between you and us for 5 years from the performance of the contract (delivery of the goods).
After the expiry of the retention period, we effectively delete or anonymise the personal data, which means that we process it in such a way that it can no longer be linked to you or attributed to you.
Voluntary provision of data and consequences of non-provision
The provision of personal data is voluntary. You are not obliged to provide us with personal data, but if you do not provide us with personal data, you will not be able to enter into a contract with us (as we need it in order to deliver your order). We will specify which data is such that its non-disclosure will have the consequences set out above each time we collect personal data from you.
Who has access to your personal data
We do not provide or make your personal data available to third parties (outside the company, except those who have a written contract with us, on the basis of which they carry out certain data processing tasks and are obliged to comply with the legislation on the processing and protection of personal data (so-called “contract processors”). The contract processors to whom we provide personal data are:
Contract processors may only process personal data within the scope of our instructions and may not process personal data for their own purposes. They, together with their employees, are committed to protecting the confidentiality of your personal data.
Contract processors do not export personal data to third countries (outside the member states of the European Economic Area – these are EU member states plus Iceland, Norway and Liechtenstein).
What rights do you have in relation to your personal data, how can you withdraw your consent to processing and what are the consequences of withdrawal?
You have the following rights in relation to your personal data:
to confirm whether we are processing your personal data;
access to personal data and the following information: the purposes of the processing; the types of personal data; the users or categories of users to whom the personal data have been or will be disclosed, in particular users in third countries or international organisations; the envisaged period of retention of the personal data or, if this is not possible, the criteria used to determine this period; the existence of automated decision-making, including profiling, and the reasons therefor, as well as the significance for you and the foreseeable consequences for you of such processing;
one (free) copy of the personal data in the format you specify (if the request is made by electronic means of communication and you do not request otherwise, the copy will be provided in electronic form); we may charge a reasonable fee, taking into account costs, for additional copies you request;
correction of inaccurate personal data;
restriction of processing where:
Procedure for exercising your rights
You may address your requests concerning the exercise of your rights in relation to your personal data in writing to any of the contacts listed at the top of this document under Data Controller and contact details.
We may request additional information from you for the purposes of reliable identification in the event that you exercise your rights in relation to personal data, and we may refuse to take action only if we can demonstrate that we cannot identify you reliably.
We must respond to your request to exercise your rights in relation to personal data without undue delay and at the latest within one month of receipt of your request.