Privacy policy

The Study Centre for National Reconciliation (hereinafter referred to as "controller") acquires and processes personal data of individuals in the course of its business. In order to provide basic information on the processing of personal data, we have prepared this Privacy Policy.

The Policy includes a number of separate sets of information as provided for in the General Data Protection Regulation (hereinafter referred to as "GDPR"), organised according to the purpose why the personal data of individuals is processed.

The controller processes personal data that it acquires from you when you:

use the www.zapori.si website,
submit an order in our online shop or order our services,
contact us through our email address or web form when you subscribe to our newsletter.

Controller information

Study Centre for National Reconciliation
Address: Tivolska cesta 42, 1000 Ljubljana, Slovenia
Registration number: 3325369000
VAT ID: SI71180079
Email: info@scnr.si
Phone: +386 (0)1 2306700

Data protection officer

Email: dpo@datainfo.si
Phone: +386 (0)2 620 4 300
Website: www.datainfo.si

1. Visiting the website

This information on personal data processing concerns individuals visiting the www.zapori.si website.

Purpose of the processing and categories of personal data

The controller processes your personal data when you visit the www.zapori.si website with the purpose of monitoring and ensuring the operation and secure use of the website.

When you visit the website, the following data is processed:

the time of accessing the website,
your IP address,
the web page address,
the configuration of the browser and information on your device's operating system,
the content you access on the website.

Processing the personal data listed above is necessary for visiting the website as the data relates to the so-called strictly necessary cookies. For more information on cookies, please read the Cookie Policy.

Legal basis for the data processing

This processing is carried out based on the controller's own legitimate interest (Article 6(1)(f) of the GDPR).

Justification of legitimate interests

The controller may process the personal data of an individual using the website or shopping in the online shop for reasons of:

a) Ensuring information security and the operation of information systems

The controller conducts personal data processing for reasons of ensuring information security and the operation of information systems, network and information security, the prevention of unauthorised access to the controller's information systems and responding to cybersecurity threats and incidents. For this purpose, the controller also performs technical maintenance of its websites and services. These measures and types of processing refer to the personal data of shoppers or third persons (e.g. website visitors).

b) Preventing and detecting abuse and conduct exhibiting signs of criminal conduct

If suspecting abuse or criminal conduct, the controller may, to an appropriate and proportional extent, process data on the users of its websites and online services for the purpose of identifying and preventing potential fraud or abuse (blacklist) and may, where appropriate, communicate this data to the competent authorities.

Categories of recipients of personal data

The controller may transmit the data of an individual visiting the website to the following persons:

an external IT service provider,
national authorities at their request or when criminal conduct is suspected.

Personal data storage period

Data processed based on a legitimate interest may be stored for as long as it is necessary to achieve the purpose of their processing.

As regards storing data on website activity (e.g. IP address), the processing and storage will not exceed the time defined in the Cookie Policy, except in cases of incidents and breaches. The data collected in the case of identified abuse is stored permanently.

Rights of the data subject

The data subject may request access to their personal data, its rectification, erasure (not in case of abuse or criminal conduct) or restriction of processing or may object to processing based on a legitimate interest. To enforce your rights, contact us at the address of the Study Centre for National Reconciliation, Tivolska cesta 42, 1000 Ljubljana, Slovenia, or by email at info@scnr.si.

The right to lodge a complaint with the supervisory authority

The controller makes every effort to process your personal data lawfully and protect it with appropriate technological and organisational means. If you believe your personal data is being processed by the controller in violation of the current regulations governing data protection, you have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia (address: Dunajska cesta 22, 1000 Ljubljana, Slovenia, email: gp.ip@ip-rs.si, phone: +386 (0)1 230 97 30, website: www.ip-rs.si).

For more information on analytics and advertising cookies used on this website, please consult the Cookie Policy, which is an integral part of this Privacy Policy.

2. Fulfilling a contractual requirement or steps prior to entering into a contract

This information on personal data processing concerns individuals who shop in the controller's online shop accessed at www.zapori.si or order other services from the controller.

Purpose of the processing and categories of personal data

The basic purpose of the processing of personal data in the case of shopping in the online shop is to enter into and perform a sales contract involving the individual and controller. This includes tracking customer satisfaction (including complaints) and managing contacts through different channels.

The controller's General Terms and Conditions apply to entering into a contract.

To make a purchase in our online shop, you may create an account. By registering, a user creates their profile, which enables them to track their order history and save time when entering data in future purchases. To do so, the user needs to provide:

the name and surname of a contact person,
email address,
company name,
residence address,
phone number.

If the user performs a purchase as a guest, their data is processed solely for the purpose of performing the order submitted, without being stored in the online shop system for future visits. For every subsequent purchase, the user will have to re-enter their data. The controller acquires the following data from the individual in the course of a web purchase:

business name,
name and surname,
VAT ID and other company information,
shipping address and invoice address,
email address,
phone number,
identity document type and number,
order information (order status, item ordered, quantity, order submittal date, purchase price),
payment mode, information on the provider of the means of payment, information on whether the transaction was performed successfully or not,
other information that the individual adds in the "order notes" field (optional).

The personal data listed above is acquired directly from the individual. Providing this data is a contractual obligation for the individual. Providing the data, except that marked as "optional", is necessary to perform a purchase in the online shop. If the individual does not provide the data, they will be unable to perform a purchase.

During a purchase, a buyer may also enter the personal data of another person that will attend the tour. In this case, the personal data is not acquired directly from the data subject but rather from the buyer, who must thus ensure that they have the right to transmit the data and that the data subject is aware of the data processing. When a buyer enters the personal data of another person in the course of a purchase, they thereby confirm that they have the right to transmit that data and that they have the appropriate basis for entering it, i.e. the consent of the data subject.

We process visitor data for the purpose of selling and issuing tickets and of organising and performing tours. When you enter our premises, we may process some data for ensuring the safety of people and property, safeguarding confidential information and maintaining order within the premises. Mandatory identification of all persons is performed at the entrance to and exit from the building. In line with regulations on building security, the security service keeps a record that includes the following visitor data: name and surname, type and number of official identity document, name of the employee the visitor is visiting or organised tour, date and time of and reason for entering and exiting.

The personal data will be used to contact the individual – requesting them to complete the order, coordinating the order, delivering goods and other communication relating to the order.

The controller may also use the data on the email and postal address of the individual it has acquired during a purchase in the online shop for the direct marketing of its products.

The personal data of an individual may also be processed for the purpose of preventing and identifying abuse and conduct exhibiting signs of criminal conduct, to the extent necessary to achieve these aims.

Legal basis for the data processing

The legal basis for the processing of personal data during a purchase in the online shop is the performance of a contract that the data subject is party to or taking steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) of the GDPR).

The personal data of an individual performing a purchase in the online shop may also be processed based on legitimate interests pursued by the controller based on Article 6(1)(f) of the GDPR or based on Article 226(2) of the Electronic Communications Act (ZEKom-2) and justified in the following section.

Justification of legitimate interests

The controller may also process the personal data of an individual shopping in the online shop for reasons of:

a) Direct marketing

Pursuing business objectives, the controller may conduct the processing of customers' personal data with a view to sending advertising emails (Article 226(2) of ZEKom-2) or physical mail (legitimate interest). In this case, the controller may view an individual's past or incomplete purchases, if any, and perform basic segmentation (e.g. type of product you have bought in the past or added to your basket without finishing the purchase) as this is the only way to prepare a message relevant to the individual (e.g. offering new products, sending discount coupons, promotional gifts, event invitations, invitations to complete an online purchase process etc.). The individual may object to such processing at any time, following the procedure described below. The controller also has the right to send messages and letters accompanied by marketing content.

b) Preventing fraud and abuse

In the course of its business, the controller establishes and maintains a list of persons with whom entering into transactions is assessed as inappropriate based on past experience. The list includes customers suspected of fraud, swindling or other illegal conduct and abuse.

Categories of recipients of personal data

The controller may entrust individual types of data processing to a contractual processor, based on an agreement on contractual processing. Contractual processors may process the entrusted data solely on behalf of the controller, within the limits of its authorisation as noted in a written contract or another legal act and in line with the purposes defined in this privacy policy.

The controller may transmit the data of an individual shopping in the online shop to the following persons:

its security service,
an external IT service provider (website operations, technical maintenance, direct marketing),
its accounting firm (entering invoices in the books),
payment service providers (performing transactions),
national authorities at their request or when criminal conduct is suspected,
national authorities in line with their legal mandates (e.g. the Financial Administration of the Republic of Slovenia – FURS).

To have a better overview of and control over contractual processors and for orderly contractual relations, the controller also keeps a list of contractual processors specifying all the particular contractual processors the controller is collaborating with.

In no case will the controller transmit the individual's personal data to unauthorised third persons. The contractual processors may only process the personal data within the limits of the controller's instructions and may not use the data for any other purpose.

Information on transfers of personal data to a third country or an international organisation

Data from email correspondence or web purchases may be transferred to third countries as we use the services of Microsoft Corporation (One Microsoft Way, Redmond, WA, USA) for electronic communication and of payment processors based in the USA for payments. All these providers process data within the limits of the EU-US Data Privacy Framework (DPF) and have corresponding contractual clauses included in their general terms and conditions.

The controller or its employees do not transfer personal data to third countries (outside the member states of the European Economic Area, which includes EU member states as well as Iceland, Norway and Liechtenstein) or to international organisations, with the exception of the USA; the relations with contractual processors from the USA are governed based on standard contractual clauses (model contracts adopted by the European Commission) and/or binding corporate rules (which are adopted by the controller and approved by supervisory authorities in the EU).

Personal data storage period

Data on contracts entered into will be stored until the purpose of the contract is fulfilled or up to 6 years after the contract has expired. If necessary for legal procedures, data on customers can be stored even longer. Data from the blacklist is stored permanently. Personal data for direct marketing will be processed while there is a legitimate interest or until you object to the processing.

Rights of the data subject

The data subject may enforce the right to access their personal data, to rectify it, to restrict its processing and to transfer the data. To enforce these rights, contact us by post at Study Centre for National Reconciliation, Tivolska cesta 42, 1000 Ljubljana, Slovenia, or by email at info@scnr.si.

A data subject may object to the processing for direct marketing based on Article 226(2) of ZEKom-2. This does not affect the legitimacy of the processing conducted on this basis prior to the objection and does not affect the processing of personal data under other legal bases. You can enforce this right by unsubscribing from marketing messages, which you can do by clicking on a link in a marketing email or contacting us at info@scnr.si.

We will ensure your rights are enforced within one month of receiving your request; this period can be extended for two months due to the complexity and number of cases. Should we decide to extend the period, we will notify you about it and the reasons for it within one month of the request.

The right to lodge a complaint with the supervisory authority

3. Inquiry sent by email or contact form

This information on the processing of personal data concerns individuals contacting us by email at info@scnr.si or through our contact forms.

Purpose of the processing and categories of personal data

The controller processes the personal data you have included in your emails sent to the controller's email address or in contact forms on its website with the purpose of providing information you have requested.

Legal basis for the data processing

This processing is carried out based on the controller's own legitimate interest (Article 6(1)(f) of the GDPR).

The data you provide when you contact us includes:

contact information (name, surname, organisation, country, email address, phone number etc.),
the content of your message (description of the request, inquiry).

The controller processes your data for the purpose of communicating when you wish it to do so. Personal data and contact information are not used for other purposes. Providing the required personal data is key to responding to your query.

Recipient categories

The controller collaborates with processors in technical aspects of the establishment, operation and security of electronic communications. The controller has entered into appropriate contracts with the providers in accordance with Article 28 of the GDPR.

Information on transfers of personal data to a third country or an international organisation

Data from online communications can be transferred to the USA as the controller's email service provider is Microsoft Corporation (One Microsoft Way, Redmond, WA, USA).

Personal data storage period

The controller will process personal data from the contact form until the purpose of its processing is achieved, i.e. until the communication with the individual is finished. If the communication is part of a contract, it is stored in accordance with the storage period for online orders from Section 2 of this policy.

Rights of the data subject

The data subject may enforce the right to access their personal data, to rectify it, to restrict its processing or erase the data or may object to the processing. To enforce these rights, contact us by post at Study Centre for National Reconciliation, Tivolska cesta 42, 1000 Ljubljana, Slovenia, or by email at info@scnr.si.

We will ensure your rights are enforced within one month of receiving your request; this period can be extended for two months in certain conditions. Should we decide to extend the period, we will notify you about it and the reasons for it within one month of the request.

The right to lodge a complaint with the supervisory authority

4. Data protection and data accuracy

The controller ensures information security and the security of the infrastructure (the premises and application and system software). For example, our information systems are protected with antivirus software and a firewall. We have put in place appropriate organisational and technical measures aimed at protecting personal data from accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access as well as other unlawful and unauthorised forms of processing. When special categories of personal data are transmitted, they are encrypted and password-protected. It is the data subject's responsibility that they transmit their personal data securely and that the transmitted data is accurate and reliable.

We do not conduct automated decision making, including profiling.

Adopted in Ljubljana on 4 August 2026

Document number: 1

Study Centre for National Reconciliation