Privacy Policy

The purpose of the Greenpiece doo Privacy Policy (hereinafter: “Privacy Policy”) is to inform users of Greenpiece doo services and other persons (hereinafter also referred to as: “individuals”) about the purposes and basis of the processing of personal data by Greenpiece doo, Korytkova ulica 19, Ljubljana, Slovenia (hereinafter: “Greenpiece doo”) and the rights of individuals in this area.

The company takes special care to ensure the security of your personal data. All personal data provided is treated confidentially and is used only for the purpose for which it was provided. We manage your personal data with the utmost care, taking into account applicable legislation and the highest standards of their treatment. We ensure the security of your personal data, among other things, by using appropriate organizational measures, work procedures and advanced technological solutions and external experts in order to protect your personal data as effectively as possible. In doing so, we use an appropriate level of protection and reasonable physical, electronic and administrative measures to protect the collected data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of personal data or against unauthorized access to personal data that has been transferred, stored or otherwise processed.

At the same time, this Privacy Policy further clarifies the consent you have given for the processing of your personal data.

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: “General Data Protection Regulation”), the Privacy Policy includes the following information:

• company contact information,
• purposes, bases and types of processing of various types of personal data of individuals,
• the retention period for individual types of personal data,
• the rights of individuals regarding the processing of personal data,
• the right to lodge a complaint regarding the processing of personal data,
• validity of the Privacy Policy.

If you are just a visitor to the website, we collect data about you only through the use of cookies. If you are a user of services or a subscriber to services provided by the company, we also collect other personal data about you that we need to provide the services you have ordered or that you are using. This personal data is:

• first and last name
• address and place of residence
• email address
• contact phone number
• username
• password in encrypted form
• date of birth
• IP address
• other information when using the order form.

The controller of personal data processed in accordance with this Privacy Policy is Greenpiece doo, Korytkova ulica 19, Ljubljana, Slovenia.

This Privacy Policy is intended for everyone who has ordered and/or used our services, or submitted an inquiry, as well as those who visit our website.

Processing based on a contract:

In the context of exercising contractual rights and fulfilling contractual obligations, the company processes your personal data for the following purposes: identifying the individual, preparing an offer, concluding a contract, to provide the ordered services, informing about any changes, additional details and instructions for using the services, to resolve any technical problems, objections or complaints, billing for services and for other purposes necessary for the implementation or conclusion of a contractual relationship between the company and the individual.

When billing for services, based on tax regulations, we also obtain and process your address for correct invoice issuance.

Processing based on law:

Based on legitimate interest, we use your personal data to detect and prevent fraudulent use and abuse of services, further within the framework of ensuring the stable and secure operation of our system and services, as well as for the purposes of implementing information security measures, meeting requirements regarding the quality of services, and detecting technical failures of systems and services.

Based on legitimate interest, we also use your personal data for the purposes of potential enforcement, judicial and extrajudicial recovery.

In accordance with the General Regulation, in the event of suspected abuse, a company may process data about individuals to an appropriate and proportionate extent for the purpose of identifying and preventing possible fraud or abuse and may, if appropriate, also forward this data to other providers of such services, business partners, the police, the public prosecutor's office or other competent authorities. For the purpose of preventing future abuse or fraud, data on the history of identified abuse or fraud in connection with an individual, which includes data on the subscription relationship and, for example, the IP address, may be stored for five years after the termination of the business relationship.

Processing based on consent for the processing of personal data:

Data processing may also be based on your consent, which you have provided to the company.

Consent may, for example, refer to informing you about offers, benefits and improvements to the services provided by the company. The purpose of such informing is to make the services as close as possible to your needs and wishes and to increase their useful value for you. Informing is carried out through the channels you have chosen in the consent. You can cancel the informing at any time, in the manner defined in the Privacy Policy.

You can withdraw or change your consent at any time in the same way as you gave it or in another way as defined in the Privacy Policy, whereby the company reserves the right to identify the customer. The change of consent can also be arranged via e-mail to info@pikantno.si or by a written request sent to the company's registered office.

Withdrawal or change of consent only applies to data processed on the basis of your consent. Your last given consent that we received is valid. The possibility of withdrawing consent does not constitute a right of withdrawal in the business relationship of an individual with a company.

Data for which your consent is given is processed for up to two years after the termination of the business relationship with the company, in the absence of revocation.

If necessary, we will authorize other companies and individuals to perform certain tasks that contribute to our services. In such a case, the company may also provide personal data to such carefully selected external processors who will conclude a personal data processing agreement with the company or an agreement with the same content or another binding document (hereinafter: “Processing Agreement”). We will provide such data to external processors or make them accessible only to the extent required for a specific purpose. The external processor may not use this data for any other purposes, while meeting at least all personal data processing standards provided for by applicable law. External processors are contractually obligated to the company to respect the confidentiality of your personal data.

The company also provides personal data to competent state authorities based on a reasoned request, which have a legal basis for this. For example, Greenpiece doo will respond to requests from courts, law enforcement agencies and other state authorities, which may also include state authorities from another EU member state.

The data retention period is determined by the category of individual data. We retain data for a maximum of the time necessary to achieve the purpose for which it was collected or further processed, or until the expiration of the limitation periods for fulfilling obligations or the legally prescribed retention period.

Billing data and related contact information about individuals may be stored for the purpose of fulfilling contractual obligations until full payment for the service or until the expiration of the limitation periods in relation to the individual claim, which may be from one to five years by law. Invoices are stored for 10 years after the end of the year to which the invoice relates in accordance with the law governing value added tax.

We store other data that we have obtained based on your consent for the duration of the business relationship and for 2 years after its termination, unless the law stipulates a longer retention period. If an individual who has given consent to the processing of personal data has not entered into a business relationship with us, their consent is valid for 2 years from the date of its provision or until its revocation.

After the retention period has expired, the data is deleted, destroyed, blocked or anonymized, unless the law provides otherwise for a particular type of data.

We ensure that you exercise your rights in relation to the processing of your personal data without undue delay. We will decide on your request within one month of receiving your request. In the event of complexity and a large number of requests, we may extend the deadline for a maximum of two additional months. If we extend the deadline, we will inform you of any such extension within one month of receiving your request, together with the reasons for the delay.

We accept requests regarding the exercise of your rights by email at info@pikantno.si or by mail at Greenpiece doo, Korytkova ulica 19, Ljubljana, Slovenia.

When you submit a request by electronic means, we will provide you with the information by electronic means, where possible, unless you request otherwise.

Where there is reasonable doubt regarding the identity of an individual submitting a request regarding one of their rights, we may request the provision of additional information necessary to confirm the identity of the data subject.

If the data subject's requests are manifestly unfounded or excessive, in particular because they are repetitive, the company may:

• charge a reasonable fee, taking into account the administrative costs of providing the information or communication or taking the action requested, or
• refuses to act on the request.

We grant you the following rights in relation to the processing of your personal data:

• right to access data
• right to rectification
• the right to erasure ("right to be forgotten")
• the right to restriction of processing
• the right to data portability
• right to object

Right to access data

You always have the right to be informed whether personal data concerning you is being processed and, if so, to access the personal data and the following information:

• purposes of processing,
• the types of personal data being processed,
• the users or categories of users to whom personal data has been or will be disclosed,
• the envisaged period for which the personal data will be stored or, if this is not possible, the criteria used to determine this period,
• the existence of the right to request the controller to correct or erase personal data or to restrict the processing of your personal data, or the existence of the right to object to such processing,
• the right to lodge a complaint with a supervisory authority,
• where personal data is not collected from you, all available information regarding its source.

Right to rectification

You have the right to obtain from us, without undue delay, the rectification of inaccurate personal data concerning you and, taking into account the purposes of the processing, the right to have incomplete personal data completed, including by providing a supplementary statement.

Right to erasure (“right to be forgotten”)

You have the right to obtain from us the erasure of your personal data without undue delay where one of the following reasons applies:

• when personal data are no longer necessary for the purposes for which they were collected or otherwise processed,
• when you withdraw the consent on the basis of which the processing is taking place and there is no other legal basis for the processing,
• when you object to the processing of your data and there are no overriding legitimate grounds for its processing,
• when personal data have been processed unlawfully,
• when personal data must be erased to comply with a legal obligation under EU law or Croatian law.

Right to restriction of processing

You have the right to obtain from us restriction of the processing of your personal data where one of the following applies:

• when you dispute the accuracy of the data, for a period that allows us to verify the accuracy of the personal data,
• the processing is unlawful and you oppose the erasure of your personal data and instead request the restriction of their use,
• we no longer need your personal data for the purposes of the processing, but you need it to assert, exercise or defend legal claims,
• if you have lodged an objection to processing based on the legitimate interests of the company, pending verification that our legitimate grounds override your grounds.

Where the processing of your personal data has been restricted in accordance with the previous paragraph, such personal data, with the exception of their storage, shall only be processed with your consent, or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person.

We are obliged to inform you before revoking the restriction on the processing of your personal data.

Right to data portability

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from the company, where the processing is based on your consent and the processing is carried out by automated means. At your request, where technically feasible, the personal data may be transmitted directly to another controller.

Right to object

Where we process your data based on legitimate interest for marketing purposes, you may object to such processing at any time.

We will stop processing your personal data unless we demonstrate compelling reasons for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.

Any complaint regarding the processing of your personal data can be sent to the email address info@pikantno.si or by post to Greenpiece doo, Korytkova ulica 19, Ljubljana, Slovenia.

If we do not decide on your request within the legal deadline or if we reject your request, you have the option of filing a complaint with the Information Commissioner.

You also have the right to file a complaint directly with the Information Commissioner if you believe that the processing of your personal data violates Croatian or EU regulations in the field of personal data protection.

If you have exercised your right to access data and, after receiving a decision, you believe that the personal data you have received is not the personal data you requested, or that you have not received all the personal data you requested, you may, before filing a complaint with the Information Commissioner, file a reasoned complaint with the company within 15 days. We must decide on your complaint as a new request within five working days.

Applicable law applies to anything not regulated by this Privacy Policy.

The company reserves the right to change this Privacy Policy. We will inform you of the change by posting it on the official Greenpiece doo website 30 days before it comes into force.

If you have any questions about the Privacy Policy or the data we hold about you, please contact us at info@pikantno.si.

This Privacy Policy is published on the Greenpiece doo website and enters into force on 1.6.2025.