PERSONAL DATA PROTECTION

In our business operations, we process customers’ personal data in accordance with the Personal Data Protection Act (ZVOP-2) and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

You can read the entire law and regulation here: http://www.pisrs.si/Pis.web/pregledPredpisa?id=ZAKO7959

https://eur-lex.europa.eu/legal-content/SL/TXT/?uri=CELEX%3A32016R0679

The controller of personal data is Arbos doo, Batuje 1f, 5262 Črniče, VAT number SI46328289, registration number 6430970000.

1. COLLECTION AND PROCESSING OF PERSONAL DATA

The seller uses the buyer’s personal data for the purposes of processing the order, such as sending an order summary, information about the delivery of the order, creating an invoice and other necessary communication. The seller may also use the buyer’s email address to inform about benefits, news and for other promotional purposes. When sending promotional messages, the seller does not use automatic profiling, but only general messages. If the website user does not complete the purchase, the seller may inform him via e-mail about the unfinished purchase. The collected personal data may also be used for other general business purposes, such as maintaining user accounts, conducting internal and market research and measuring the effectiveness of advertising campaigns. We process data collected on social networks for the purpose of informing consumers about current promotions and offers.

The seller does not collect or process personal data, except when the website user expressly consents to this – that is, when placing an order, when entering an e-mail address in the box for receiving e-newsletters, when registering on the website, when participating in a prize draw, and when agreeing to the use of cookies on the website.

If you do not agree to the collection and processing of personal data, it is not possible to place an order on our website.

The personal data collected and processed by the seller are:

• customer contact information (e-mail address and phone number),
• delivery address,
• company, if the buyer enters this information,
• date and time of the order placed,
• cart contents,
• method of payment and delivery of goods,
• history of using promotional discount codes,
• data about the history of purchases made,
• data of issued invoices,
• data about communication between the seller and the buyer (e-mail messages),
• data about website users (IP address or unique device ID, advertising ID, date, time and duration of website visits, location or Internet access point data, operating system type and browser type and version, data about visited subpages, data about settings made),
• data about entries in online forms (e.g. within the framework of prize competitions and e-newsletter subscriptions),
• other information that users voluntarily provide to the seller when placing an order (e.g. notes, ratings, comments, etc.),
• comments, ratings and shares on our social networks.

Under no circumstances will the user’s data be passed on to unauthorized third parties.

Newsletter subscribers can cancel their subscription at any time by sending a cancellation request to [email protected], or by clicking on the unsubscribe link at the bottom of the newsletter.

Arbos doo and the online store instantdrinks.si do not use automated decision-making functions, including profiling.

The lawfulness of the processing of personal data is determined by Article 6 of Regulation (EU) 2016/679, points 1.(a) – consent of the individual to the processing of personal data, 1.(b) – processing of data for the performance of a contract and 1.(f) – legitimate interests of the personal data controller.

2. VISIT THE WEBSITE INSTANTDRINKS.SI

Each time you visit the online store, a web server log file is automatically stored on the web server (e.g. IP number – a number that identifies an individual computer or other device on the Internet). The website works in such a way that certain data about the visit to the website is recorded on the web server where the website is hosted. This data is the IP number, time of visit, content of the request (specific page), access status/HTTP status code, amount of data transferred each time, website from which the request comes (referrer URL), browser and similar. We collect the personal data collected in this way using cookies, and we will ask you for your consent before installing them.

The legal basis for processing the above data is our legitimate interest (Article 6 (1f) point of the Regulation), namely to ensure network security, prevent fraud and protect information in the online store.

The collected data is stored for 30 days from the date of your visit to the website. We process the (personal) data collected in this way separately and do not link it to other personal data of our website users, and we do not perform any profiling of your purchasing behavior.

3. DISCLOSURE OR TRANSFER OF PERSONAL DATA TO THIRD PARTIES

The seller may disclose personal data of customers and users of the instantdrinks.si website to third parties when required to do so by applicable law, when the seller receives a request from a competent authority, and in response to a court or other official proceeding.

Personal data of customers and website users will be processed by employees of Arbos doo, as well as representatives and legal entities with which Arbos doo has a contract (Slovenian Post, GLS courier service, PayPal payment platform, Stripe payment platform for all payments with credit or debit cards, NovaKBM and Intesa SanPaolo bank, where Arbos doo has an open transaction account).

4. PERIOD FOR STORAGE OF PERSONAL DATA

We store the personal data of customers and users of the instantdrinks.si website for as long as necessary to fulfill the purpose for which the data was collected and further used. After the retention period has expired, we will effectively and permanently delete or anonymize the personal data so that identification with the user is no longer possible.

We store the data we process for the purpose of performing the contractual relationship with the customer (name, surname, address, e-mail) for the period necessary to perform the contract and for a further 10 years, which is the legal retention period (e.g. accounting or tax data), and longer only in the event of a dispute regarding the contractual relationship.

5. YOUR RIGHTS AND HOW YOU CAN EXERCISE THEM

What your rights are and how you can exercise them are governed by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) and the Personal Data Protection Act (ZVOP-2). We have summarised your rights in accordance with the above Regulation (Articles 16, 17, 18, 19, 20, 21, 22) below.

If you no longer want Arbos doo to process your personal data, you have the right to withdraw consent. Withdrawal of consent does not affect the lawfulness of data processing that was carried out until its withdrawal. You can send a request for withdrawal to [email protected].

You can request Arbos doo to inform you whether your data is being processed (right to access personal data). If the data is being processed, Arbos doo will provide you with a list of personal data. Arbos doo will also provide you with information about the purpose of the processing of personal data, the intended period of storage of personal data, how the individual can correct or supplement personal data, how the individual can complain to the supervisory authority, information about whether the data is collected for automated decision-making, including profiling, and whether the personal data was collected from the individual or from a third party. The individual may also request a copy of the personal data being processed from the controller.

You have the right to correct or supplement inaccurate personal data. You can notify us of any corrections and supplements in a supplementary statement at [email protected].

You have the right to delete your data (“right to be forgotten”). Arbos doo will delete your personal data at your request if one of the reasons referred to in Article 17 of the Regulation exists (if the data is no longer necessary for the purposes for which it was collected or otherwise processed, if you withdraw your consent to processing for which there is no legal basis, if you object to processing for which there are no overriding legitimate interests, if the personal data have been processed unlawfully).

You have the right to obtain from Arbos doo restriction of the processing of your personal data if one of the following applies:

• if you dispute the accuracy of the data processing, for a period enabling the controller to verify the accuracy of the data;
• if the processing is unlawful and you request restriction of processing instead of erasure,
• if the controller no longer needs the data, but you need it to assert, exercise or defend legal claims;
• if you have lodged an objection to the processing, pending verification whether the legitimate grounds of the controller override your grounds.

You have the right to be informed by Arbos doo about any correction or deletion of your personal data or restriction of their processing.

As an individual, you have the right to receive your personal data in a commonly used and machine-readable format and the right to transmit this data to another controller without being hindered by Arbos doo (right to data portability).

If the processing of your data is based on our legitimate interests, you have the right, on grounds relating to your particular situation, to object to the processing of your personal data at any time. In such a case, we will continue to process your personal data only if we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims. You may object at any time, without giving any reasons, to the processing of your personal data for direct marketing purposes, including profiling, by sending us an email to [email protected]. If you object to the processing of your data for direct marketing purposes, we will immediately cease processing your data for these purposes. We will also provide you with other information regarding your personal data that we process, at your request and in accordance with applicable law.

The data subject has the right, on grounds relating to his or her particular situation, to object at any time to processing of personal data concerning him or her, including profiling based on automated decision-making. We would like to inform you that Arbos doo and the instantdrinks.si online store do not use automated decision-making functions, including profiling.

If you suspect that the processing of your data violates the legislation in the field of personal data protection, you have the right to file a complaint with the Information Commissioner of the Republic of Slovenia, at Dunajska cesta 22, 1000 Ljubljana, Slovenia, telephone number: 00 386 (0)1 230 97 30, e-mail address: [email protected].

If you wish to exercise the rights listed above or to object to the way your personal data is processed, please contact us at [email protected]. Please send your request regarding the exercise of your rights in relation to your personal data with clear indications: which personal data you wish to access and review, which personal data you wish to supplement, correct or delete, transfer or process, which of your personal data you object to and for what reasons. If the request is submitted by a person on your behalf and you do not provide authorization that the request has been lawfully submitted on your behalf, the request will be rejected. If you send such a request by post to Arbos doo, Batuje 1f, 5262 Črniče, the request must be signed and dated. Arbos doo will process your request as soon as possible and within the legal deadlines.

6. PERSONAL DATA SECURITY

We have ensured that shopping on our website is completely secure, as we use appropriate website coding to prevent third parties from accessing your data. These systems and measures are regularly tested and updated as necessary. By constantly using appropriate technical, organizational and personnel measures, we ensure that only the personal data that is necessary to achieve each individual processing purpose is processed.

7. COOKIES

Various cookies are also necessary for the proper functioning of the website. These are small text files that, with your consent, are stored on your device (computer, mobile phone or other web browsing device). They help you automatically log in to the website and verify your authenticity. They enable you to successfully complete your shopping process, complete your order, help you pay using PayPal or a card, etc. They can also be used for statistical analysis. Cookies usually do not reveal the identity of a specific user. Cookies are not harmful, as they do not contain viruses or other malicious code. You can always delete cookies, either automatically (if you have this marked in the settings) or manually in your browser. You can also refuse to install cookies.

For more information about cookies, their impact on you and your web browsing, we recommend viewing the answers to frequently asked questions of the Information Commissioner at the following link: https://www.ip-rs.si/varstvo-osebnih-podatkov/informacijske-tehnologije-in-osebni-podatki/pi%C5%A1kotki-odgovori-na-pogosta-vpra%C5%A1anja

8. FACEBOOK AND GOOGLE ANALYTICS

The instantdrinks.si website uses Facebook Pixel for advertising, which tells us the success of an individual campaign. Facebook records statistics on clicks on links and general responsiveness to our ads, but does not share personal data with this service. The same applies to the Google Analytics service, which allows us to view statistics on visits to our website, demographic data, and the like. However, exact personal data is never visible and is anonymous.

In Batuje, 9.9.2024