PRIVACY POLICY

Information on the processing of personal data under the GDPR and ZVOP-2

1. Introduction and controller

TIPRO, design, manufacture and marketing of computer terminals and peripherals, Ltd., Ljubljanska cesta 64, 1290 Grosuplje, Slovenia, registration No. 5448441000, VAT ID SI 44131488 (hereinafter: "the Controller" or "TIPRO"), acting as the controller of personal data, pays special attention to the protection of personal data.

This Privacy Policy describes how the Controller collects, uses, stores, shares and protects personal data in accordance with:

•       Regulation (EU) 2016/679 ("GDPR");

•       Slovenian Personal Data Protection Act (ZVOP-2);

•       Slovenian Electronic Communications Act (ZEKom-2) – with regard to cookies;

•       other applicable data protection legislation.

2. Contact details of the Controller

Controller: TIPRO Ltd., Ljubljanska cesta 64, 1290 Grosuplje, Slovenia

Privacy contact e-mail: gdpr@tipro.si

For any questions, requests or complaints regarding the processing of personal data, individuals may contact the Controller at the above e-mail address or in writing at its business address.

3. Categories of personal data processed

3.1 Customer and visitor data

•       identification: first name and surname, company name, tax number;

•       contact details: delivery and billing address, e-mail, telephone;

•       order and payment data: goods ordered, customisation data (templates, specifications), price, payment method, order/invoice numbers;

•       communication data: e-mails and phone calls;

•       technical data: IP address, browser type, timestamps, URLs, cookie data.

3.2 Account data

•       username and hashed password;

•       order history, wish lists, addresses.

3.3 Marketing data

•       e-mail address and name for newsletters (based on consent);

•       interaction history with marketing communications.

4. Purposes and legal bases of processing

4.1 Performance of contract (Art. 6(1)(b) GDPR)

Conclusion and performance of the sales contract – order processing, delivery, customisation/imprinting, invoicing, complaint handling, warranty procedures, communication.

4.2 Legal obligation (Art. 6(1)(c) GDPR)

•       retention of invoices under tax and accounting rules (10 years);

•       consumer law obligations;

•       disclosures to public authorities upon legal request.

4.3 Consent (Art. 6(1)(a) GDPR)

•       newsletters and marketing communications;

•       non-essential (analytical, marketing) cookies;

•       personalisation not strictly necessary for the contract.

Consent is voluntary and may be withdrawn at any time without negative consequences. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

4.4 Legitimate interests (Art. 6(1)(f) GDPR)

•       ensuring website and IT systems security, fraud prevention;

•       establishment, exercise or defence of legal claims;

•       direct marketing to existing customers for similar goods/services (soft opt-in under Article 226(2) ZEKom-2), with right to object;

•       statistical and analytical processing in aggregated form.

5. Retention periods

•       orders, payments and invoices: 10 years from the end of the financial year;

•       customisation data (files, templates): for the duration of the contract plus 5 years for complaints and repeat orders, unless earlier deletion is requested;

•       account data: until deletion by the user or by the Controller after 5 years of inactivity;

•       warranty/complaint data: warranty period plus 5-year general limitation period;

•       marketing data (consent): until consent withdrawn, max 3 years from last active contact;

•       customer communications: up to 2 years after closure;

•       security/log data: up to 12 months.

6. Recipients and processors

•       logistics/courier providers (DPD);

•       payment service providers (card processors, banks, PayPal);

•       accounting and tax service providers;

•       IT service, hosting, e-mail, CRM and marketing tool providers – as processors under Article 28 GDPR;

•       external law firm – as legal adviser to the Controller, bound by professional confidentiality;

•       competent public authorities where required by law.

7. Transfers to third countries

Where personal data is transferred outside the EEA, the Controller ensures an adequate level of protection under Articles 44–49 GDPR (adequacy decisions, Standard Contractual Clauses, other safeguards).

8. Automated decision-making and profiling

The Controller does not engage in automated decision-making producing legal or similarly significant effects on individuals within the meaning of Article 22 GDPR.

9. Data subject rights

•       right of access (Art. 15);

•       right to rectification (Art. 16);

•       right to erasure (Art. 17);

•       right to restriction of processing (Art. 18);

•       right to data portability (Art. 20);

•       right to object, in particular to direct marketing (Art. 21);

•       right to withdraw consent (Art. 7);

•       right to lodge a complaint with the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si.

Requests can be sent to gdpr@tipro.si or in writing to the Controller’s business address. The Controller responds without undue delay, no later than one month from receipt.

10. Security

The Controller implements appropriate technical and organisational measures (encryption in transit, access controls, security updates, incident response procedures, staff training, confidentiality undertakings). Personal data breaches with high risk are notified to the Information Commissioner and the affected data subjects in accordance with Articles 33–34 GDPR.

11. Children

The online shop is not intended for children under 15, and the Controller does not knowingly collect their personal data. Where processing is based on consent, the consent of a child under 15 is valid only if given or authorised by a parent or guardian (Article 8 GDPR and Article 8 ZVOP-2).

12. Changes to this Privacy Policy

The Controller may update this Privacy Policy from time to time. The current version is always published on the website.