Privacy Policy

1. Controller of personal data

The controller of personal data is VITALIT d.o.o., Jakčeva ulica 12, 1000 Ljubljana, Slovenia.

• Identity number: 9067850000
• Tax number: SI11865717 (VAT person)
• Date of entry in the court register: 21 February 2022
• Email: info@vitalit.si
• Phone: 040 810 803

For all questions regarding the processing of personal data and the exercise of rights, please contact info@vitalit.si. We do not appoint an authorized data protection officer (DPO), because we are not obliged to do so according to Art. 37 GDPR — if this changes, we will update the policy.

2. What personal data we process

We process only those personal data that are necessary for the provision of services, communication with customers and the fulfillment of legal obligations:

• Contact information:first and last name, company, email address, phone number.
• Content of the communication: messages you send us via contact form, email or phone.
• Data of customers and business partners: data required for issuing an offer, concluding a contract and issuing an invoice (company name, address, tax number, contact person).
• Technical data of users of the support portal: username, e-mail, devices and requests registered in the portal dopora.vitalit.si.
• Server technical and log data: IP address, time of visit, browser type — processed as part of standard web server logs for security and abuse detection purposes.

We do not collect or process special types of personal data (e.g. health data, religious data, biometric data).

3. Processing purposes and legal basis

4. Terms of storage

• Inquiries from the contact form and email: as a rule, up to 12 months after the end of the communication, unless a contractual relationship arises from them.
• Data of customers and business partners: for the duration of the contractual relationship and 5 years after its termination for the purposes of potential claims.
• Accounting and tax documents: 10 years in accordance with ZDDV-1 or valid deadlines.
• Information in the support portal: for the duration of the engagement and the period reasonably necessary for the reference and defense of legal claims.
• Web server logs: generally up to 30 days, except in the case of a detected security incident.

After the deadline, the data is permanently deleted or anonymized.

5. Data users and contractual processors

We do not sell or provide personal information to third parties for direct marketing purposes. Data may be processed to a limited extent by the following contractual processors who provide technical and business services for us:

• Microsoft Ireland Operations Ltd. (Microsoft Azure and Microsoft 365 / Exchange Online) — website, database and business email hosting, processing in data centers within the EU/EEA,
• ISL Online (ISL Online Ltd. / XLAB d.o.o.) — ISL Light remote assistance service, only during an active session and at the express invitation of the user,
• accounting service for the needs of issuing and keeping invoices,
• legal and other outside counsel in the event of legal claims.

Support portalsupport.vitalit.si is managed and hosted internally by VITALIT d.o.o. (on Microsoft Azure infrastructure in the EU) — we do not use an external software provider for this portal.

We have concluded contracts with all contract processors on the processing of personal data in accordance with Art. 28 GDPR. We forward data to state authorities only on the basis of an explicit legal requirement.

6. Transfers to third countries

As a rule, we process personal data within the EU or the European Economic Area (EEA) — hosting and e-mail run in Microsoft Azure or Microsoft 365 data centers in the EU. If a certain service (e.g. ISL Online) also processes data outside the EU/EEA, the transfer is carried out on the basis of the decision of the European Commission on adequacy or standard contractual clauses in accordance with Art. 46 GDPR.

7. Security of personal data

We implement reasonable technical and organizational measures to protect personal information from unauthorized access, loss, alteration or disclosure. These include encryption of connections (HTTPS/TLS), access control, the principle of least rights, regular system updates and secure authentication settings. However, no data transmission over the Internet can be considered completely secure — if you detect any suspected abuse or breach, please notify us at info@vitalit.si.

8. Your Rights

Pursuant to the GDPR and ZVOP-2, you as a data subject have the following rights:

• the right to access your personal data,
• the right to correct inaccurate data,
• the right to erasure ("right to be forgotten"), when the legal basis for further processing is not met,
• right to restriction of processing,
• the right to data portability,
• the right to object to processing based on legitimate interests,
• the right to revoke consent when the processing is based on consent (revocation does not affect the lawfulness of the processing before the revocation),
• the right not to be subject to a decision made solely on the basis of automated processing, including profiling — we do not carry out such processing.

To exercise your rights, write to us at info@vitalit.si. We will respond to the request without undue delay and within one month at the latest. In order to protect against abuse, we may request additional information from the applicant to confirm identity.

If you believe that the processing of personal data violates the regulations, you have the right to complain to the supervisory authority: Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si, www.ip-rs.si.

9. Minors

The website and services are intended for business users and do not appeal to minors. We do not knowingly collect personal data from persons under the age of 16.

10. Privacy Policy Changes

We may update this privacy policy from time to time due to changes in the law, our services or the technologies we use. Any new version becomes effective on the date of publication on this page. The date of the last update is indicated at the top of the document.