Pravilnik o zasebnosti

PRIVACY POLICY

The purpose of this Privacy and Cookie Policy is to inform users (hereinafter also: the individual or you) of the website www.sirup-top7.si (the "website") of the purposes and legal basis for the processing of personal data by the company SHINE BROWN d.o.o., Pod topoli 5, 1218 Komenda, e-mail:  support@byrokko.com (hereinafter: Shine Brown d.o.o., the company, we or the controller).

We process, store and protect all personal data in accordance with the applicable legislation governing the protection of personal data, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: GDPR) and   the Personal Data Protection Act (Official Gazette of the Republic of Slovenia, No. 163/22, hereinafter: ZVOP-2). Please read our Privacy Policy carefully to understand how we protect your privacy.

By providing your personal data, you declare that you have read our Privacy and Cookie Policy and are aware of the methods of processing and the legal bases for the processing of personal data. If you do not agree with the methods of processing, we kindly ask you not to provide us with your personal data.

BASIC TERMS

Below are described the basic terms you will encounter when reading our Privacy and Cookie Policy:

Personal data: personal data is any information that identifies an individual as an identified or identifiable individual. An individual is identifiable when they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual.

Data subject: is an identified or identifiable natural person whose personal data is processed by the controller responsible for the processing.

Processing of personal data: means any operation or set of operations performed on personal data, in particular collection, acquisition, recording, organisation, storage, adaptation or alteration, consultation, use, disclosure by transmission, communication, dissemination or otherwise making available, alignment or combination, blocking, anonymisation, erasure or destruction of personal data. Processing may be manual or automated.

Restriction of processing of personal data: is the marking of stored personal data with the aim of limiting their processing in the future.

Profiling: means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to an individual, in particular to analyse or predict aspects concerning that individual's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

Automated decision-making: means a decision based solely on automated processing (including profiling) which produces legal effects or may significantly affect the individual.

Anonymisation: means the processing of personal data in such a manner that the personal data can no longer be attributed to the specific individual to whom the personal data relate without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable individual.

Controller of personal data: is a natural or legal person or other person in the public or private sector which, alone or jointly with others, determines the purposes and means of the processing of data, or a person designated by law which also determines the purposes and means of the processing.

Processor of personal data: is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Recipient of personal data: is a natural or legal person, public authority, agency or other body to which personal data are disclosed, whether a third party or not. Public authorities which may receive personal data in the framework of a particular inquiry in accordance with EU or Member State law shall not be regarded as recipients; the processing of personal data by those public authorities must be in compliance with the applicable rules on the processing of personal data according to the purposes of the processing.

Third party: is a natural or legal person, public authority, agency or other person other than the data subject, the controller, the processor or persons who are authorised to process personal data by the processor or the controller.

Consent of the individual: consent of the individual to whom the personal data relate means any freely given, specific, informed and unambiguous indication of the wishes of the individual to whom the personal data relate, by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.

CONTROLLER AND DATA PROTECTION OFFICER

The controller of personal data is: Shine Brown d.o.o., Pod topoli 5, 1218 Komenda, Slovenia, EU, Company registration number: 8224790000, Tax number: SI54529034

Our company has appointed a data protection officer, whose e-mail address is: support@byrokko.com

PURPOSE OF PROCESSING AND LEGAL BASES FOR DATA PROCESSING

  • Processing based on consent

We process personal data on the basis of the clear and unambiguous consent of the individuals concerned for the following purposes:

  • completing the contact form,
  • participating in promotional campaigns published on the website,
  • consent to the use of your telephone number and e-mail address for sending information and offers about products and services,
  • sending e-newsletters,
  • protecting our products and services.


  • Processing based on a contract

 Processing based on a contract covers the following processing operations:

  • placing an order for our products and/or services,
  • concluding and performing the contract,
  • notifying customers of a successful order,
  • performing the services,
  • handling complaints.


  • Processing based on legitimate interest:

Where circumstances so require, we process personal data on the basis of legitimate interest for the purposes of:

  • responding to your enquiry about products and/or services,
  • measuring satisfaction with your purchase, via e-mail or telephone communication,
  • e-mail communication based on your having started the online purchasing process,
  • if you have added selected products to your shopping basket but have not completed the purchase, we occasionally send e-mail messages relating to the uncompleted purchase, with the aim of attempting to complete the purchase or of offering assistance and information in this regard,
  • informing you about new products and services (direct marketing), on the basis of point (f) of Article 6(1) of the GDPR or Article 226 of the Electronic Communications Act (ZEKom-2),
  • website optimisation,
  • ensuring the security of IT systems,
  • preventing misuse and/or fraud.


  • Processing based on law

On the basis of law and in accordance with the relevant legislation, we process personal data:

  • in connection with your order for lawful purposes (e.g. for reasons of tax legislation).

DATA WE COLLECT

We collect the following types of data:

Voluntarily provided data

For the purposes of doing business, responding to enquiries, participating in promotional offers and processing your order for products/services, we collect the following personal data, which we obtain if you expressly provide them:

  • first name and surname,
  • delivery address,
  • e-mail address,
  • telephone number,
  • other data you provide.


Providing personal data is a condition for using our services or ordering products, as we cannot carry out the order without the necessary personal data.

Automatically generated data

We obtain device data or other log data automatically when you use our website.

We collect anonymous data from every visitor for the purpose of monitoring traffic and troubleshooting. This information helps us understand who uses our website, which helps us improve and market our website, and in particular our online products and services. We collect data such as IP address, web requests, data sent in response to such requests, browser type, browser language, the timestamp of the request and other anonymous statistical data relating to the use of our website. This information cannot in itself be used to identify or contact you. We may automatically combine the collected data and other non-personal data with personal data. In that case, we will treat the combined data as personal data in accordance with this Privacy Policy, and we will use it for marketing purposes.

We are not responsible for the accuracy of the data you enter.

DISCLOSURE OF PERSONAL DATA TO THIRD PARTIES OR THIRD COUNTRIES

We do not sell your personal data. We may share your personal data with third parties only as set out in this Privacy Policy.

We share personal data with third parties:

  • On the basis of your consent, we may share your personal data with those third parties for which you have given your consent.
  • With our service providers, business partners and contractors who provide services on our behalf or whom we use to support our business, such as:
    • the online payment platform provided by Mollie,
    • our accounting service,
    • the provider for managing and generating invoices or quotations,
    • the provider of marketing activities.


  • We may report to law enforcement authorities any activities that we reasonably believe to be unlawful, or that we reasonably believe may assist a law enforcement investigation into unlawful activity. In addition, we reserve the right to disclose your personal data to law enforcement authorities if, in our sole discretion, we determine that you are either in breach of the rules of our Privacy and Cookie Policy, or that disclosing your personal data may protect the rights, property or safety of us or another person. We will disclose only such personal data as the law enforcement authorities request on a lawful or lawfully obtained basis for each concrete, specific case.
  • We may disclose your personal data when required by law, regulations or official orders, in order to protect the safety of any person from death or serious bodily injury, to prevent fraud or misuse of products and/or services or users, or to protect our property rights. We will disclose personal data to government officials or third parties on the basis of court judgments or decisions of administrative authorities or other binding acts. We will disclose such personal data as the aforementioned authorities request on a lawful or lawfully obtained basis for each concrete, specific case.


We disclose your personal data where this is necessary to fulfil our obligations to you, and only to the minimum extent required.

We do not transfer the collected personal data to third countries. Your data are processed only within the territory of the European Union. Should your data be transferred to third countries, you will be informed of this.

CONSENT OF MINORS

We are committed to protecting children's online privacy and internet safety. We do not offer products and services to children, nor do we knowingly collect or request personal data from children under the age of 15.

We will not retain any communications that we have well-founded and reasonable grounds to believe come from a child under the age of 15. We encourage parents or guardians of children under the age of 15 to regularly check and monitor their children's use of e-mail and other online activities.

We use all available technology and make efforts to verify whether the holder of parental responsibility for the child has given or authorised consent.

LINKS TO OTHER WEBSITES

Our websites may contain links to third-party websites. These websites have their own privacy policies, which you should read, as we are not responsible for them.

  1. Links to social media

Our websites contain links to social networks (social plug-ins), into which we have incorporated links that redirect you to these social networks when you click on their icons. The processing of personal data obtained by the social networks when you click on a plug-in and are redirected to the social network is carried out by the social networks listed below and in accordance with their privacy policies, which are available at:


AUTOMATED DECISION-MAKING AND PROFILING

The individual's personal data are not subject to automated decision-making, nor are they subject to profiling.

HOW WE PROTECT DATA

We appreciate that you trust us and share your personal data with us.  We are committed to protecting them and therefore adopt appropriate technical and organisational measures to ensure a high level of data protection (some of the measures we implement are: the use of firewalls and data encryption, physical access control – protection of premises and IT equipment – and control over authorisations for access to information through a password system for user authorisation and identification).

We restrict access to personal data to our employees, service providers and agents who need to know them in order to develop or improve our services.

Please understand that our website provides links to other websites that are not owned and/or operated by us. Your use of these third-party services is entirely optional. We are not responsible for the content and/or practices of third parties.

MANAGING PERSONAL DATA AND OPTING OUT (OPT-OUT)

You may update, remove or unsubscribe your personal data at any time.

  • Updates: If you still wish to use our products and services and want to change your relevant personal data (name, e-mail, postal address, telephone number, etc.), please let us know at support@byrokko.com.
  • Erasure of personal data: If you wish to have your data removed entirely from our databases, please send us an erasure request at support@byrokko.com.
  • Unsubscribe (opt-out): If you no longer wish to receive e-mails or other marketing materials, you can unsubscribe at any time using the "unsubscribe" link in any marketing e-mail you receive from us. We will be sorry to see you go, but we respect your privacy.

Processing of a request you send to support@byrokko.com may take up to 10 days. After this period, the request will be processed and, if it meets the conditions, will take effect.

Once we receive your withdrawal of consent, we will stop processing your personal data and will erase them. We will inform you that your withdrawal has been taken into account.

RIGHTS OF THE INDIVIDUAL

In accordance with the provisions of the GDPR, the individual has the right of access to personal data, the right to rectification, the right to erasure ("to be forgotten"), the right to data portability, the right to request restriction of processing of personal data, the right to object and the right to lodge a complaint with a supervisory authority.

To exercise  your rights or to obtain additional information, you may contact the e-mail address: support@byrokko.com. Your request will be answered within 10 days and in accordance with the GDPR.

Where there is reasonable doubt concerning the identity of the individual making a request in relation to any of their rights, we may request the provision of additional information necessary to confirm the identity of the individual to whom the personal data relate.

Where requests from the individual to whom the personal data relate are manifestly unfounded or excessive, in particular because of their repetitive character, we may charge a reasonable fee, taking into account the administrative costs of providing the information or communication or taking the action requested, or refuse to act on the request.

RIGHT OF ACCESS TO DATA

The individual to whom the personal data relate has the right to obtain confirmation from us as to whether or not personal data concerning them are being processed, and, where that is the case, access to the personal data and to additional information regarding the processing of personal data, which includes:

  • the purposes of the processing;
  • the categories of personal data;
  • the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
  • where possible, the envisaged period for which the personal data will be stored or, if that is not possible, the criteria used to determine that period;
  • the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the individual to whom the personal data relate, or the existence of the right to object to such processing;
  • the right to lodge a complaint with a supervisory authority;
  • where the personal data are not collected from the individual, any available information as to their source;
  • the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the individual.

At the individual's request, we provide a copy of their personal data that we process. For any further copies requested by the individual to whom the personal data relate, we may charge a reasonable fee based on administrative costs.

RIGHT TO RECTIFICATION

The individual to whom the personal data relate has the right to have us rectify inaccurate personal data concerning them  without undue delay. Taking into account the purposes of the processing, the individual to whom the personal data relate has the right to have incomplete personal data completed, including by means of providing a supplementary statement.

RIGHT TO ERASURE ("to be forgotten")

The individual to whom the personal data relate has the right to obtain from us the erasure of personal data concerning them without undue delay:

  • where the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  • where the individual withdraws the consent on which the processing is based and there is no other legal ground for the processing;
  • where the individual objects to processing based on the legitimate interest of the controller and there are no overriding legitimate grounds for the processing;
  • where the individual objects to processing for direct marketing purposes;
  • where the personal data have to be erased for compliance with a legal obligation under EU law or the Slovenian legal order; where the data concerned have been unlawfully collected, in relation to the offer of information society services, from a child who, under the applicable legislation, cannot provide such data.


Where directory or otherwise published data are concerned, we take reasonable steps, including technical measures, to inform other controllers processing the personal data that the individual to whom the personal data relate has requested them to erase any links to, or copies of, those personal data.

RIGHT TO RESTRICTION OF PROCESSING

The individual to whom the personal data relate has the right to have us restrict processing where:

  • the individual contests the accuracy of the data, for a period enabling us to verify the accuracy of the personal data;
  • the processing is unlawful and the individual opposes the erasure of the personal data and requests the restriction of their use instead;
  • we no longer need the personal data for the purposes of the processing, but they are required by the individual to whom the personal data relate for the establishment, exercise or defence of legal claims;
  • the individual has objected to the processing, pending verification of whether our legitimate grounds override those of the individual to whom the personal data relate.

RIGHT TO DATA PORTABILITY

The individual to whom the personal data relate has the right to receive the personal data concerning them that we hold in a structured, commonly used and machine-readable format, and the right to transmit those data to another controller without hindrance from us, where:

  • the processing is based on the individual's consent or on a contract, or where the processing is carried out by automated means.

RIGHT TO OBJECT

The individual to whom the personal data relate has the right to object, on grounds relating to their particular situation, at any time to the processing of personal data where that processing is based on legitimate interests pursued by us or by a third party. We shall stop processing the personal data unless we demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the individual to whom the personal data relate, or for the establishment, exercise or defence of legal claims. Where personal data are processed for direct marketing purposes, the individual has the right to object at any time to the processing of personal data concerning them for such marketing, which includes profiling to the extent that it is related to such direct marketing. Insofar as direct marketing is based on consent, the right to object may be exercised by withdrawing the personal consent given.

Automated individual decision-making, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which may produce legal or similarly significant effects concerning you, unless such a decision is necessary for entering into, or the performance of, an agreement between you and us, or is authorised by Union law to which we are subject and which lays down suitable measures to safeguard your rights and freedoms and legitimate interests, or is based on your explicit consent.

RIGHT TO LODGE A COMPLAINT REGARDING THE PROCESSING OF PERSONAL DATA

The individual may submit any complaint regarding the processing of personal data to the e-mail address: support@byrokko.com or by post to the address Shine Brown d.o.o., Pod topoli 5, 1218 Komenda, SLOVENIA

In the event of a personal data breach, we will notify the competent supervisory authority, unless the breach is unlikely to have endangered the rights and freedoms of individuals. Where a breach gives rise to a suspicion that a criminal offence has been committed, we will notify the police and/or the competent public prosecutor's office.

Where a breach is likely to result in a high risk to the rights and freedoms of individuals, we will notify the individuals to whom the personal data relate of the breach immediately or, where this is not possible, without undue delay.

If the individual has exercised the right of access to data with the controller and, upon receiving the decision, considers that the personal data received are not the personal data requested, or that they have not received all the personal data requested, they may, before lodging a complaint with the Information Commissioner, lodge a reasoned complaint with the controller (Shine Brown d.o.o.) within 15 days. We will decide on the complaint as a new request within five working days.

If the individual considers that their rights or the regulations on the protection of personal data have been infringed, they may lodge a complaint with the competent state authority: the Information Commissioner of the Republic of Slovenia (Zaloška 59, 1000 Ljubljana, telephone: 01 230 97 30, fax: 01 230 97 78, e-mail: gp.ip@ip-rs.si).

RETENTION PERIOD OF PERSONAL DATA

We will retain the individual's personal data for as long as is necessary to fulfil the purpose for which the personal data were collected and further processed.

We obtain certain data through the use of cookies and other similar technologies by analysing your behaviour on our website and your response to e-mail messages, as well as from third parties whose cookies are placed on your device with your consent (social media providers, etc.).

Data that we process on the basis of legitimate interest or for the purpose of taking steps at your request prior to entering into a contract will be retained for a maximum of five years from the time the purpose of our mutual communication has been fulfilled, or until the expiry of the limitation periods for any possible claims.

Where applicable sector-specific legislation (e.g. tax legislation) lays down mandatory periods for the retention of personal data, we erase the personal data after the expiry of the statutory period.

COOKIES

Cookies are small text files that a website stores on the devices individuals use to access the internet. Their storage is under the full control of the individual, who can restrict or disable the storage of cookies in the browser they use. Cookies perform numerous functions – they enable tracking of website visits and enable various campaigns and discounts, and cookies are also used to store information on, for example, whether an individual is eligible for certain discounts or benefits.

Cookies provide a convenient way of keeping content fresh and relevant, in line with the interests and preferences of website visitors. On the basis of statistical data on website traffic, which are also made possible by cookies, we can assess the effectiveness of the design of our websites, as well as the suitability of the type and number of advertisements we offer on the website.

Consent to the placement of cookies is, however, not required for necessary cookies. These enable the normal functioning of the website. These cookies enable the basic use of the website. Without these cookies, the website does not function normally or does not function at all, which is why they are placed even when the individual refuses the placement of cookies.

How do I change my cookie settings?

You can change your cookie settings at any time by clicking the "________" icon. You can then set the available sliders to "On" or "Off" and then click "Save and close".

WHICH COOKIES DO WE USE?

Cookie

Duration

Purpose

keep_alive

30 minutes

Other

secure_customer_sig

1 year

Necessary

localization

1 year

Functionality

_cmp_a

1 day

Other

_tracking_consent

1 year

Other

_shopify_y

1 year

Analytics

_shopify_s

1 hour

Analytics

_orig_referrer

14 days

Necessary

_landing_page

14 days

Analytics

_shopify_sa_t

1 hour

Analytics

_shopify_sa_p

1 hour

Analytics

X-AB

1 day

Functionality

_ga

1 year 1 month 4 days

Analytics

_gat

1 minute

Performance

_ttp

1 year 24 days

Advertising

_scid

1 year 1 month

Functionality

_scid_r

1 year 1 month

Other

_tt_enable_cookie

1 year 24 days

Advertising

_ttp

1 year 24 days

Advertising

_fbp

3 months

Analytics

cart

session duration

Necessary

key

session duration

Other


MANAGING AND DELETING COOKIES

If you wish to change the way cookies are used in your browser, including blocking or deleting them, you can do so by changing your browser settings accordingly. To manage cookies, most browsers allow you to accept or reject all cookies, accept only certain types of cookies, or alert you when a website wishes to store a cookie. Cookies stored by the browser can easily be deleted. If you change or delete your browser's cookie file, or change or upgrade your browser or device, you may need to disable cookies again. The procedure for managing and deleting cookies differs from browser to browser.

CHANGES TO THE PRIVACY AND COOKIE POLICY

We reserve the right, at our own discretion, to update, amend or replace any part of the Privacy and Cookie Policy by publishing the update or amendment on the website without prior notice. Any amendment takes effect from the day the amended Privacy and Cookie Policy is publicly published on our website.

 Published on: 28.11.2024