PRIVACY POLICY - PRIVACY STATEMENT
1. Introductory provisions

Vabo d.o.o. takes special care with the security of your personal data. All personal data provided is treated confidentially and is used only for the purpose for which it was obtained or provided. Your personal data is handled with the utmost care, taking into account the applicable legislation and the highest standards of treatment. We ensure the security of your personal data by, among other things, appropriate organisational measures, work procedures and advanced technological solutions, as well as by using external experts in order to protect your personal data as effectively as possible. In doing so, we use an appropriate level of protection and reasonable physical, electronic and administrative measures to safeguard the personal data collected against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to, personal data that has been transmitted, stored or otherwise processed.

This privacy statement sets out how KOPE Ski Resort processes your personal data that you provide to us directly or indirectly or that we obtain through our website, and the rights you have in relation to the processing of your personal data.

In the Personal Data Protection Statement, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ("GDPR"), we include the following information:

• contact information of the data controller,
• the purposes, grounds and types of processing of different types of personal data,
• the retention period for each type of personal data,
• the rights of individuals with regard to the processing of personal data,
• the right to lodge a complaint concerning the processing of personal data,
• the validity of the data protection declaration.

2. 
   Basic information about the administrator

Company name: Vabo d.o.o. podjetje za turizem, trgovino, gostinstvo in logistiko d.o.o.,
Company registered office: Glavni trg 43, 2380 Slovenj Gradec
Short name: Vabo d.o.o.
Company registration number: 2191393000
Company tax number: SI28847261
Activity code: I55.100 - activity of hotels and similar accommodation establishments
Registration: District Court in Slovenj Gradec, filing number: 11001800, dated 03.04.2006
Business accounts:
0400 1004 9185 197 Nova KBM d.d.

1010 0003 9321 758 Bank Intesa San Paolo d.d.

6100 0000 5013 210 Delavska hranilnica d.d.
Company's share capital: EUR 2,100,000
Legal representatives: Boštjan Paradiž (Director), Primož Kotnik (Executive Director), Ingrid Meh (Prokurist)

3. What personal data are processed?

What is personal data?
Personal data is any information relating to an identified or identifiable natural or legal person, such as: name, home address, location (a telephone may broadcast its location), internet identifier (IP address), email address, telephone number, etc.

What is personal data processing and when can personal data be processed?
Processing of personal data means any operation or set of operations which is performed upon personal data or sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Personal data may only be processed if required to do so by law or if there is an adequate legal basis.

We process, among other things, the following personal data about the individual:

• personal identification data(name, surname, address, temporary address, email address, date of birth, tax number, mobile phone number, photo of you, credit card number).

Each time you visit a website operated by Vabo, a web server log file is automatically stored on the web server (e.g. an IP number - a number that identifies the individual computer or a number that identifies you). The contractual processor (web server hosting provider) processes personal data only for the purpose of providing the website maintenance service at the company's web address.

For these purposes, the websites use cookies, the nature of which is set out in more detail in the Cookie Policy. This data is processed in order to keep statistics on visits to our website, to improve the functioning of the website and to ensure the security of information systems.

Vabo interacts with individuals and the general public through the digital social networks Facebook, Instagram, Youtube, and it is therefore important that individuals are also aware of the rules of these networks or their privacy policies and privacy settings.

When you access your Facebook account or the Kope online services through digital social networks or connect to a service through a digital social network, information about you may also include the user identification and/or username associated with each digital social network, any information or content that you allow the digital social network to share with us, such as a displayed photo, email address or friends list, and any information that you have publicly posted in connection with each digital social network.

More detailed information on the purposes and scope of the processing of personal data by digital content providers can be obtained directly from the providers of these services, the operators of these digital social networks or directly within these digital social networks. Vabo d.o.o. does not assume any responsibility for the protection of your personal data within the framework of the aforementioned social networks, online services and all their associated websites.

In the context of scientific research, we may process additional personal data for each research or study in addition to the above. The type and extent of personal data may vary in these cases; further information on this will accompany the research or study concerned.

4. For what purposes do we process your personal data?

Personal data of individuals is processed for the following purposes:

• the company's operations,
• information on the implementation of programmes and activities, benefits and news;
• for the design and distribution of publications;
• information on current events and sending newsletters, invitations to participate, information on prize draws;
• sampling, surveys, statistical and market analysis;
• segmenting users.

The personal data we obtain from visitors to our websites is processed for the following purposes:

• to compile statistics on users,
• promoting security and improving our websites; and
• improve our services.

5. 
   What is the legal basis for processing personal data?

In order for us to process your personal data, there must be a legal basis for doing so, as set out in the GDPR. Processing is lawful only if and to the extent that at least one of the following conditions is met:

• the data subject has consented to the processing of his or her personal data for one or more specified purposes;
• the processing is necessary for the performance of a contract to which the data subject is a party or for the performance of measures at the request of such data subject prior to the conclusion of the contract;
• the processing is necessary for compliance with a legal obligation to which the controller is subject;
• processing is necessary to protect the vital interests of the data subject or of another natural person;
• the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• processing is necessary for the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child.

At Vabo d.o.o., the lawful basis depends on the type of personal data, i.e. whether the processing is for the performance of a contract or a contractual relationship, processing for the fulfilment of a legal obligation, processing for the pursuit of a legitimate interest, or processing on the basis of your consent.

1. Processing for the performance of a contract or a contractual relationship
   In the context of the exercise of the contractual and contractual rights and obligations of Vabo d.o.o. vis-à-vis individuals.
2. Processing for compliance with legal obligations:
   We are required to process certain data about individuals on the basis of legislation such as the Occupational Health and Safety Act, the Act on the Protection of Documentary and Archival Material and Archives, etc.
3. Processing for the Purpose of Legitimate Interest:
   For reasons of balance of interests, we may process your personal data for the purpose of protecting the legitimate interests of ourselves or third parties. In any case, processing is carried out in the following cases to protect legitimate interests:

• measures to manage and further develop our services and products;
• keeping records of users' personal data to improve services for all users;
• measures to protect against illegal practices;
• in the context of legal proceedings.

This means that we process your data for purposes such as:

• providing, maintaining and improving our services to meet the needs of our users,
• developing new services useful to visitors,
• understanding how individual service users use our services to ensure and improve the effectiveness of our services,
  
  d.Consent-based processing of personal data
  If none of the above legal bases for processing personal data apply, we will ask for your consent to process certain personal data.
  You may withdraw your consent at any time.

Unsubscribe from the newsletter; send an email to: reservations@kope.si

Unsubscribe from the newsletter; in the newsletters you receive by email, there is an "Unsubscribe" link in the footer of the message, which you can click on to follow the unsubscribe procedure.

Events organised by Vabo d.o.o. occasionally involve image recording, which involves taking photographs of the participants or video recording the event. In the case of image recording of events, the company reserves the right to take images of participants without their explicit consent, provided that the image recording is of a large number of participants, where the individual is not the central subject of the image, and therefore it cannot be argued that the photograph constitutes his/her personal data.

The company carries out video surveillance. Any visitor who enters the video surveillance area is informed of this through video surveillance notices. Video surveillance recordings shall be kept for up to 60 days.

7. Period of retention of personal data

The retention period is determined according to the category of the individual personal data. We keep the data for no longer than is necessary to achieve the purpose for which they were collected or further processed or until the expiry of the limitation periods for compliance with the obligation or the statutory retention period.

• Web server log files 30 days;
• Name, address, temporary address, date of birth, tax number: permanently or until revoked or until the time limit set by individual legislation (e.g. tax);
• Telephone number: permanently or until revoked by the holder;
• Email address: permanently or until revoked by the holder;
• Credit card number: not stored;
• Photo: 2 years after the last activity;

After the retention period has expired, the data will be deleted, destroyed, blocked or anonymised, unless otherwise provided by law for a specific type of data.

8. 
   Rights of the data subject in relation to the processing of personal data

We ensure that your rights in relation to the processing of your personal data are exercised without undue delay. We will decide on your request within one month of receiving your request. In case of complexity and a large number of requests, we may extend the time limit by up to two additional months. If we extend the deadline, we will inform you of any such extension within one month of receipt of the request, together with the reasons for the delay.

Requests concerning the exercise of your rights can be sent to us by e-mail at reservation@kope.si or by post to.

Where you make a request by electronic means, we will, where possible, provide you with the information by electronic means, unless you request otherwise.

Where there is reasonable doubt as to the identity of the data subject making a request in relation to any of his or her rights, we may request the provision of additional information necessary to confirm the identity of the data subject.
We provide you with thefollowing rights in relation to the processing of your personal data:

(i) the right of access to data
(ii) the right to rectification
(iii) the right to erasure ("right to be forgotten")
(iv) the right to restriction of processing
(v) the right to data portability
(vi) the right to object
(i) the right of access to data

You always have the right to know whether personal data concerning you is being processed and, if so, to have access to your personal data and to the following information:

• the purposes of the processing,
• the types of personal data processed,
• the users or categories of users to whom personal data have been or will be disclosed,
• the envisaged period of retention of the personal data or, if this is not possible, the criteria to be used to determine that period,
• the existence of a right to have the controller rectify or erase personal data or restrict the processing of your personal data, or the existence of a right to object to such processing,
• the right to lodge a complaint with the supervisory authority,
• where the personal data is not collected from you, any available information regarding its source.

(ii) the right to rectification

You have the right to have inaccurate personal data concerning you rectified without undue delay and, taking into account the purposes of the processing, the right to have incomplete personal data completed, including by submitting a supplementary declaration.

(iii) the right to erasure ('right to be forgotten')

You have the right to have your personal data erased without undue delay where one of the following applies:

• where the personal data are no longer necessary for the purposes for which they were collected or otherwise processed,
• where you withdraw the consent on the basis of which the processing is carried out and there is no other legal basis for the processing,
• where you object to the processing of data and there are no overriding legitimate grounds for processing,
• where personal data have been unlawfully processed,
• where personal data must be erased in order to comply with a legal obligation under EU or Slovenian law.

(iv) the right to restrict processing

You have the right to have us restrict the processing of your personal data where one of the following applies:

• where you contest the accuracy of the data, for a period which allows us to verify the accuracy of the personal data,
• the processing is unlawful and you object to the erasure of your personal data and request instead that its use be restricted,
• we no longer need your personal data for the purposes of the processing, but you need it to assert, exercise or defend legal claims,
• if you have raised an objection to processing based on the legitimate interests of the company, until it is verified that our legitimate grounds override yours.

Where the processing of your personal data has been restricted in accordance with the preceding paragraph, such personal data shall, with the exception of their storage, be processed only with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person.

We are obliged to inform you before revoking the restriction on the processing of your personal data.

(v) the right to data portability

You have the right to receive your personal data that you have provided to us in a structured, commonly usable and machine-readable format and the right to transmit that data to another controller without hindrance from the underlying controller, where the processing is based on your consent and the processing is carried out by automated means. At your request, where technically feasible, personal data may be transferred directly to another controller.

(vi) right to object

Where we process your personal data on the basis of legitimate interest and use it for marketing purposes, you may object to such processing at any time.

We will stop processing your personal data unless we can demonstrate compelling reasons for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

9. 
   Right to lodge a complaint concerning the processing of personal data

Any complaint regarding the processing of your personal data can be sent to us via the e-mail address reservation@kope.si or by post to our address.

If we do not decide on your request within the statutory time limit or if we refuse your request, you have the right to lodge a complaint with the Information Commissioner.

You also have the right to lodge a complaint directly with the Information Commissioner if you believe that the processing of your personal data violates Slovenian or EU data protection laws.

If you have exercised your right of access and, after receiving a decision, you consider that the personal data you have received is not the personal data you requested or that you have not received all the personal data requested, you may lodge a reasoned complaint with the company within 15 days before lodging a complaint with the Information Commissioner. We must decide on your complaint as a new request within eight working days.

10. 
    Final provisions

Anything not covered by this Privacy Statement is subject to applicable law.

11. 
    Data Protection Officer

Data Protection Officer at Vabo d.o.o.