Privacy Policy

1. Introductory provisions

Vabo d.o.o. takes particular care to keep your personal data secure. We treat the personal data you provide as confidential and use it only for the purpose for which it was obtained. In doing so, we comply with applicable legislation and take appropriate organisational and technical measures to protect the data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

This policy sets out how the Kope mountain resort processes the personal data that you provide to us directly or that we obtain through our website, and what rights you have in this respect. It has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter: the General Data Protection Regulation (GDPR)) and the Slovenian Personal Data Protection Act (ZVOP-2).

This policy sets out:

information about the controller of personal data,
the types of personal data, and the purposes and legal bases of processing,
the recipients and processors of personal data,
retention periods,
your rights and the right to lodge a complaint.

The cookies used by the website are described in more detail in our cookie policy.

2. Basic information about the controller

Company name: Vabo d.o.o. podjetje za turizem, trgovino, gostinstvo in logistiko d.o.o.

Registered office: Glavni trg 43, 2380 Slovenj Gradec

Abbreviated name: Vabo d.o.o.

Company registration number: 2191393000

Company VAT number: SI28847261

Activity code: I55.100 – activities of hotels and similar accommodation establishments

Registration: District Court in Slovenj Gradec, entry number: 11001800, dated 03.04.2006

Business accounts:

0400 1004 9185 197 Nova KBM d.d.
1010 0003 9321 758 Banka Intesa San Paolo d.d.
6100 0000 5013 210 Delavska hranilnica d.d.

Company share capital: 2.100.000 EUR

Legal representatives: Boštjan Paradiž (director), Primož Kotnik (executive director), Ingrid Meh (procurator)

Data protection contact: rezervacije@kope.si or by post to the company's registered office.

3. What personal data we process and why

Personal data means any information relating to an identified or identifiable individual, such as a first and last name, address, email address, telephone number or an online identifier such as an IP address. Processing means any operation performed on personal data, such as collection, storage, use, disclosure or erasure.

Visiting the website

Each time you visit, our servers automatically record technical information about the request: your IP address, browser and device type, the page visited, and the date and time of the request. We use this information to operate and secure the website and to prevent abuse, such as an excessive number of requests from the same IP address.

The legal basis is our legitimate interest in the secure and reliable operation of the website.

Cookies, analytics and advertising

The website uses necessary cookies, without which it cannot function, and, with your consent, also analytics cookies (Google Analytics) and marketing cookies (Google Ads, Meta Pixel). We use them to monitor how the website is used and to measure the performance of our ads. You can change your consent at any time via the Cookie settings button on the Cookie policy page.

The legal basis for analytics and marketing cookies is your consent. A list of cookies, their purposes and their durations can be found in our cookie policy.

Purchases on the website

When you buy tickets, experiences or other services, we collect:

your email address, first and last name, address, postcode, town or city, country and telephone number,
any special requests you enter with your order, and your discount code,
if you choose to provide them, billing details: a different billing address, company name and VAT identification number,
order and payment details.

We use this data to complete your purchase, issue tickets and bookings, send you the order confirmation and notifications about your order (for example about a failed payment or a refund), and deal with questions and complaints. The legal basis is the conclusion and performance of a contract and, for retaining transaction records, a legal obligation under tax and accounting regulations.

You enter your payment card details directly into the secure fields of the payment service provider Bankart. Your card number and security code never reach our servers. For our payment records, we store only the card type, the last four digits, the expiry date and the cardholder's name. To process and verify the payment and to prevent fraud, Bankart also receives your name, email address, billing address and IP address.

The order confirmation contains a personal link to view your order. Do not share this link with others, as it gives access to your name, email address and order.

So that you do not lose your data while filling in the form, your browser temporarily keeps it in session storage. It does not keep payment card details, and the data is deleted when you close the tab or submit your order.

When you sign up for our newsletter, we collect your email address. We use it to send you news about the offers, events and special deals of the Kope mountain resort. The legal basis is your consent.

The sign-up form is protected against bots by Cloudflare Turnstile, which receives your IP address and browser information for verification. We send the newsletter via the elektronskaposta.si service.

You can unsubscribe from the newsletter at any time via the "Unsubscribe" link in the footer of every email or by writing to rezervacije@kope.si.

Enquiries and job applications

When you write to us or call us, we process the data you provide (for example your name, email address, telephone number and the content of your message) so that we can reply to you. The legal basis is our legitimate interest in answering your enquiry or, if you are asking about a purchase or booking, taking steps prior to entering into a contract.

You send applications for advertised jobs to us by email. We process the data in your application to carry out the selection process, on the basis of taking steps prior to entering into a contract.

Social networks

We communicate with individuals and the wider public via the social networks Facebook and Instagram. When you write to us or respond to our posts, we process the data you share with us in doing so, such as your username and the content of your message. The processing of data on these networks is also subject to their own rules and privacy policies, so we recommend that you familiarise yourself with them and with the privacy settings of your account. The links to our profiles on the website are ordinary links and do not send any data to the social networks when you visit the page.

Events and video surveillance

We occasionally take photographs and make video recordings at events organised by Vabo d.o.o. We may record participants without their explicit consent where the recording shows a larger number of people and no individual is its central subject.

We operate video surveillance within the mountain resort to protect people and property. Notices inform you of areas under video surveillance.

4. Legal bases for processing

We process personal data only where at least one of the legal bases under the GDPR applies:

contract – the processing is necessary to enter into or perform a contract with you, for example when you make a purchase,
legal obligation – the processing is required by law, for example retaining accounting records,
legitimate interest – the processing is necessary for our legitimate interests, for example the secure operation of the website, protecting property or answering enquiries, except where such interests are overridden by your interests or fundamental rights,
consent – you have consented to the processing, for example for the newsletter and for analytics and marketing cookies.

You can withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

5. Recipients and processors of personal data

We do not sell your personal data. We share it only with processors who help us provide our services and who process the data on our instructions, and with public authorities where required by law.

Bankart (Slovenia) – processing card payments. The secure card entry fields are provided by its technical partner IXOPAY (Austria).
Axess – issuing ski passes and bike park tickets.
PHOBS – accommodation bookings.
Resend – sending order confirmations and order notifications by email.
Vercel, Railway and Neon – hosting the website, servers and database.
elektronskaposta.si – sending the newsletter.
Cloudflare – protecting the newsletter sign-up against bots.
Google Ireland Limited – Google Analytics, Google Tag Manager and Google Ads, with your consent.
Meta Platforms Ireland Limited – Meta Pixel, with your consent.
Cloudinary, OpenStreetMap, Esri and whatsupcams – displaying photos, maps and webcam footage; they receive only technical information about the request, such as your IP address and browser type.

Some processors (for example Google, Meta, Vercel, Railway, Neon, Resend, Cloudflare and Cloudinary) may also process data outside the European Economic Area, mainly in the USA. Such transfers are based on the EU-US Data Privacy Framework or on standard contractual clauses adopted by the European Commission.

6. Retention period of personal data

We keep data only for as long as is necessary for the purpose for which it was collected, or until the statutory retention period or the limitation periods expire.

Server logs: up to 30 days.
Order, invoice and payment data: 10 years after the end of the year in which the transaction took place, as required by tax and accounting regulations.
Data from an incomplete purchase: 7 days.
Email address for the newsletter: until you unsubscribe.
Analytics and marketing cookie data: as set out in our cookie policy; Google Analytics retains data linked to individual visitors for 14 months.
Messages and enquiries: for as long as is necessary to deal with them, and then until the limitation periods expire.
Job applications: until the selection process is completed, unless you consent to longer retention.
Video surveillance recordings: up to 60 days.
Photograph: 2 years after the last activity.

When the retention period expires, we delete or anonymise the data, unless the law provides otherwise for a particular type of data.

7. Rights of the individual

We will act on requests to exercise your rights without undue delay and at the latest within one month of receiving the request. If the request is complex or we receive a large number of requests, we may extend this period by up to two months. We will inform you of any extension and the reasons for it within one month of receiving the request.

You can send requests to rezervacije@kope.si or by post to the company's registered office. If you send your request by email, we will reply by email unless you ask otherwise. If we have reasonable doubts about your identity, we may ask for additional information to confirm it.

You have the following rights:

(i) the right of access to data,
(ii) the right to rectification,
(iii) the right to erasure ("right to be forgotten"),
(iv) the right to restriction of processing,
(v) the right to data portability,
(vi) the right to object,
(vii) the right to withdraw consent.

(i) The right of access to data

You have the right to know whether we process your personal data and, if we do, to access it and to receive the following information:

the purposes of processing,
the types of personal data,
the recipients or categories of recipients to whom the data has been or will be disclosed,
the envisaged retention period or the criteria used to determine it,
the existence of the right to rectification, erasure or restriction of processing and of the right to object,
the right to lodge a complaint with a supervisory authority,
the source of the data, where we did not obtain it from you.

(ii) The right to rectification

You have the right to have inaccurate personal data concerning you rectified, and incomplete data completed, without undue delay.

(iii) The right to erasure ("right to be forgotten")

You have the right to have your personal data erased without undue delay where:

the data is no longer necessary for the purposes for which it was collected,
you withdraw your consent and there is no other legal basis for the processing,
you object to the processing and there are no overriding legitimate grounds for it,
the data has been processed unlawfully,
the data has to be erased to comply with a legal obligation.

We cannot erase data that we are required by law to retain, such as accounting records, until the prescribed period has expired.

(iv) The right to restriction of processing

You have the right to have the processing of your personal data restricted where:

you contest the accuracy of the data, for a period enabling us to verify its accuracy,
the processing is unlawful and you request restriction of its use instead of erasure,
we no longer need the data, but you need it for the establishment, exercise or defence of legal claims,
you have objected to processing based on legitimate interest, pending verification of whether our grounds override yours.

Apart from storing it, we process restricted data only with your consent, for legal claims or to protect the rights of other persons. We will inform you before the restriction is lifted.

(v) The right to data portability

You have the right to receive the data you have provided to us in a structured, commonly used and machine-readable format and to transmit it to another controller, where the processing is based on consent or a contract and is carried out by automated means. Where technically feasible, we can transmit the data directly to another controller at your request.

(vi) The right to object

You can object at any time to processing based on legitimate interest. We will then stop processing the data, unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or we need the data for legal claims. You can object to processing for direct marketing purposes at any time and without giving reasons.

(vii) The right to withdraw consent

You can withdraw your consent at any time: for cookies via the Cookie settings button on the Cookie policy page, for the newsletter via the "Unsubscribe" link in every email, and in all cases also by writing to rezervacije@kope.si.

8. Right to lodge a complaint

You can send a complaint about the processing of your personal data to rezervacije@kope.si or by post to our address.

If we do not decide on your request within the statutory period or we reject it, you can lodge a complaint with the Information Commissioner. You can also lodge a complaint with the Information Commissioner directly if you believe that the processing of your personal data infringes the regulations:

Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si, www.ip-rs.si

If you have exercised your right of access and believe that the data you received is not the data you requested, or that you did not receive all of it, you can lodge a reasoned complaint with us within 15 days before lodging a complaint with the Information Commissioner. We will decide on it as a new request within eight working days.

9. Data security

The website uses an encrypted connection (HTTPS). We do not receive or store payment card details, as they are processed by the payment service provider. Access to personal data is restricted to the persons and processors who need it for their work.

10. Data protection contact

Vabo d.o.o. has not appointed a data protection officer. For any questions about the processing of personal data or to exercise your rights, write to us at rezervacije@kope.si or by post to Vabo d.o.o., Glavni trg 43, 2380 Slovenj Gradec.

11. Changes and validity

We update this policy whenever the ways in which we process personal data, or the regulations, change. For all matters not covered by this policy, the applicable legislation applies.

This policy applies from 11 September 2026.