1. General Information
This Privacy Policy explains how Tajfun Planina d.o.o., Planina pri Sevnici 41a, 3225 Planina pri Sevnici, Slovenia (hereinafter: “Company”, “we”, “us”) processes personal data collected through the Company website.
The Company is committed to protecting personal data and handling it responsibly, transparently, and in accordance with:
- Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR)
- the Personal Data Protection Act (ZVOP-2),
- the Electronic Communications Act (ZEKom-2),
- other Slovenian data protection legislation.
This Privacy Policy informs individuals about:
- the controller of personal data,
- the categories of personal data collected,
- the purposes and legal bases of processing,
- retention periods,
- data recipients,
- international transfers,
- individuals’ rights,
- the right to lodge a complaint.
2. Controller of Personal Data
The controller of personal data is:
Tajfun Planina d.o.o.
Planina pri Sevnici 41a
3225 Planina pri Sevnici
Slovenia
E-mail: info@tajfun.com
All requests regarding personal data protection and the exercise of data subjectrights may be submitted to the above contact address.
3. Categories of Individuals
This Privacy Policy applies to:
- visitors of the Company website,
- individuals submitting enquiries via contact forms,
- business partners and potential customers,
- representatives and employees of business partners,
- individuals subscribing to newsletters (if applicable),
- individuals communicating with the Company via email or other business communication channels,
- individuals interacting with the Company through its social media profiles (where applicable).
4. Categories of Personal Data Collected
The Company may collect the following personal data:
a) Data provided voluntarily (e.g. contact form):
- name and surname
- company name
- email address
- telephone number
- country
- message content
b) Technical data collected automatically:
- IP address
- browser type and version
- device information
- date and time of access
- pages visited
- cookie data
The Company does not collect special categories of personal data through its website.
5. Purposes and Legal Bases for Processing
5.1 Processing Based on Contract or Pre-Contractual Steps
Personal data may be processed for:
- responding to enquiries,
- preparing offers,
- establishing business cooperation,
- providing requested information about products and services.
Legal basis:
Article 6(1)(b) GDPR – processing necessary for the performance of a contract or to take steps prior to entering into a contract.
Provision of personal data is voluntary; however, without certain personal data the Company may not be able to respond to the enquiry or provide the requested services.
5.2 Processing Based on Legal Obligations
Personal data may be processed where necessary to comply with legal obligations, including accounting and tax requirements, responding to requests from public authorities, and fulfilling other statutory duties.
Legal basis:
Article 6(1)(c) GDPR – legal obligations.
5.3 Processing Based on Legitimate Interest
The Company may process personal data for:
- ensuring website security and system integrity,
- preventing misuse or fraud,
- maintaining server logs,
- improving website functionality,
- internal analytics and business development,
- enforcing or defending legal claims.
Legal basis:
Article 6(1)(f) GDPR – legitimate interest.
The Company ensures that such processing does not override the rights and freedoms of individuals.
Individuals have the right to object to processing based on legitimate interests, including direct marketing, at any time.
5.4 Processing Based on Consent
Where required, personal data is processed on the basis of consent, for example:
- sending newsletters,
- marketing communications,
- use of non-essential cookies (analytics, marketing).
Legal basis:
Article 6(1)(a) GDPR – consent.
Consent may be withdrawn at any time by:
- clicking the unsubscribe link in emails,
- sending a request to marketing@tajfun.com.
Withdrawal does not affect the lawfulness of processing prior to withdrawal.
5.4 Processing Based on Consent
The Company does not carry out automated decision-making or profiling within the meaning of Article 22 GDPR.
6. Cookies
The website uses cookies to ensure proper functionality and improve user experience.
Cookies may include:
- essential cookies (necessary for website operation),
- analytical cookies (e.g., website traffic analysis),
- marketing cookies (if applicable).
Non-essential cookies are installed only after the user provides explicit consent via the cookie banner.
Users may manage their cookie preferences at any time through browser settings or the cookie management panel available on the website.
A detailed list of cookies, including providers and retention periods, is available in the cookie management panel.
7. Disclosure of Personal Data
Personal data may be disclosed to:
- IT service providers,
- website hosting providers,
- marketing service providers,
- analytics service providers (e.g., Google),
- other contractual processors.
8. International Transfers
If personal data is transferred outside the European Economic Area (EEA), the Company ensures appropriate safeguards are in place, such as:
- Standard Contractual Clauses (SCC),
- participation in the EU-US Data Privacy Framework, where applicable
- other mechanisms compliant with GDPR,
- additional technical and organisational safeguardswhere necessary.
9. Retention Period
Personal data is retained only as long as necessary for the purposes for which it was collected.
All processors process data on behalf of the Company under data processing agreements in accordance with Article 28 GDPR.
Personal data may also be disclosed to public authorities where required by law.
In general:
- contact form data: up to 3 years after last communication, unless business cooperation is established,
- marketing data: until consent is withdrawn,
- accounting data (if applicable): 10 years in accordance with tax legislation,
- technical data: in accordance with cookie retention settings.
Where specific retention periods cannot be determined in advance, data is retained based on the duration of the business relationship, statutory limitation periods, legal obligations, and the necessity for the establishment, exercise or defence of legal claims.
After the retention period expires, data is deleted or anonymized.
10. Security of Personal Data
The Company implements appropriate technical and organisational measures to ensurea level of security appropriate to the risk, including access control, secure data transmission, system monitoring, restricted access on a need-to-know basis, and confidentiality obligations for employees and processors.
11. Rights of Individuals
Individuals have the right to:
- access their personal data,
- rectification of inaccurate data,
- erasure (“right to be forgotten”),
- restriction of processing,
- data portability,
- objection,
- withdrawal of consent at any time.
Requests may be submitted to: marketing@tajfun.com
The Company will respond within one month of receiving the request.
Where necessary and considering the complexity and number of the requests, the response period may be extended by a further two months. The individual shall be informed of any such extension within one month of receipt of the request, including the reasons for the delay.
The Company may request additional information to verify the identity of the requester where necessary.
The exercise of rights is free of charge, except where requests are manifestly unfounded or excessive.
12. Right to Lodge a Complaint
If an individual believes their personal data is being processed unlawfully, they have the right to lodge a complaint with:
Information Commissioner of the Republic of Slovenia
Dunajska cesta 22
1000 Ljubljana
Slovenia
www.ip-rs.si
Individuals also have the right to judicial protection.
13. Changes to this Privacy Policy
The Company reserves the right to amend this Privacy Policy.
Any updates will be published on the website.
14. Validity
This Privacy Policy is effective as of: 01.01.2026
