Personal Data Controller

The personal data controller is the Public Institute for Tourism and Culture Radovljica, Linhartov trg 9, 4240 Radovljica (hereinafter: the public institute).

Purpose of Personal Data Collection

The public institute processes the personal data of individuals to fulfill its tasks as defined by the Institutes Act and the statute of the public institute, for the fulfillment and execution of a contractual relationship, for the performance of tasks in the public interest, or processes personal data based on the individual's consent.

To meet the needs of individuals, the public institute performs the following tasks in particular:

To fulfill its tasks and to ensure transparency of its operations, the institute may organize various public events that are audio or video recorded, and recordings of these events are publicly published on web portals and other media managed by the institute.

To fulfill its tasks and to ensure transparency of its operations, the institute also uses information equipment for direct communication via the institute's website, a so-called "chatbot," within which personal data may be processed. Personal data is processed for the performance of a task in the public interest or in the exercise of public authority vested in the public institute.

Legal Basis for Personal Data Processing

The public institute processes personal data in the following cases:

• if the individual has given consent for the processing of personal data for one or more specific purposes,
• if processing is necessary for the performance of a contract to which the data subject is a party,
• if processing is necessary for compliance with a legal obligation to which the public institute is subject,
• if processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the public institute.

Types of Personal Data Processed and Source of Acquisition

The public institute may acquire and process the following personal data about individuals:

• unique personal identification number;
• personal name;
• address of permanent or temporary residence;
• date and place of birth;
• employment;
• email address;
• telephone number.

The public institute may obtain the personal data from the preceding paragraph directly from the individual to whom the data relates. The public institute may also obtain personal data from the controller of the central population register, the civil register, the land cadastre, or another controller, if so provided by law.

Categories of Individuals Whose Personal Data is Processed

The public institute processes the personal data of individuals who are involved in the procedures and tasks carried out by the institute, which primarily include:

• employees of the public institute,
• contractual collaborators of the public institute,
• individuals who have a contract with the public institute,
• visitors and users of the public institute's services,
• other individuals who come into contact with the public institute where personal data processing occurs.

The categories of individuals for each specific personal data collection are defined in more detail in the record of processing activities, which is available on the public institute's website.

Users of Personal Data

The public institute will allow the processing or transfer of personal data exclusively to the following authorized users:

• authorized employees of the public institute,
• authorized persons who process personal data at an authorized contractual processor of the public institute,
• persons who demonstrate authorization for access to personal data within the framework of the law or by-laws,
• persons to whom the individual to whom the personal data relates has granted authorization for access.

Storage of Personal Data

The public institute appropriately stores and protects personal data in both physical and electronic form. Data processed for the purpose of fulfilling contractual obligations are stored until all obligations from the contractual relationship are fulfilled. Data are stored for as long as defined by regulations that determine the retention periods for each type of material in accordance with written professional instructions for selecting archival from documentary material based on the Archival and Documentary Material and Archives Protection Act. After the purpose of processing has been fulfilled or the legally prescribed retention period has expired, the personal data are deleted, destroyed, blocked, or anonymized.

Data processed on the basis of the individual's consent is stored by the public institute until the consent is withdrawn. The user can at any time submit a written request to the official address of the public institute for the withdrawal of consent and the processing of personal data.

Privacy Protection

The public institute ensures the protection of privacy by complying with all applicable legal regulations. The public institute also provides all necessary technological and organizational support for the protection and security of personal data against loss, alteration, theft, and access by unauthorized third parties:

• internal acts on personal data security have been adopted,
• internal acts on information security have been adopted,
• maintenance of personal data collections,
• procedures for exercising the rights of individuals have been established,
• appropriate procedures and appropriate actions have been established in case of identified personal data protection breaches,
• a data protection officer has been appointed,
• appropriate contracts have been concluded with contractual processors of personal data,
• measures for physical and communication data security are used.

Transfer of Personal Data to Third Parties

All personal data processed by the public institute are stored on information systems located in the territory of the Republic of Slovenia and the European Union and are not transferred to third countries outside the EU.

Existence of Automated Decision-Making

As a responsible organization, the public institute does not use automated decision-making, including profiling.

User Rights

An individual can at any time request from the personal data controller:

• confirmation as to whether or not personal data concerning them are being processed, and, where that is the case, access to the personal data and the following information:
  • the purposes of the processing;
  • the categories of personal data concerned;
  • the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations;
  • the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
  • the existence of automated decision-making, including profiling;
• the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject;
• one copy of the personal data in electronic form (free of charge);
• if the individual requests further copies, the controller may charge a reasonable fee based on administrative costs;
• restriction of processing where one of the following applies:
  • the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
  • the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
  • the controller no more needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defense of legal claims;
• rectification of inaccurate or incorrect personal data;
• erasure of all personal data on the basis of the conditions of Article 17 of the General Regulation being met, more specifically if the data subject withdraws consent on which the processing of personal data is based;
• the data subject has the right to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided;
• withdrawal of the use of personal data for direct marketing purposes, including profiling;
• the data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them in accordance with Article 22 of the General Data Protection Regulation.

The individual has the right to lodge a complaint against the controller with the Information Commissioner if they consider that the processing of personal data infringes the General Data Protection Regulation (address: Dunajska 22, 1000 Ljubljana, e-mail: gp.ip@ip-rs.si, telephone: 012309730, website: www.ip-rs.si).

An application for the exercise of rights may be sent by the individual to the address of the public institute. Additional information can also be obtained from the data protection officer at dpo@virtuo.si .

Persons Under the Age of 15

Persons under the age of 15 may provide their data via the website or in any other relationship with the public institute only with the express permission of their parents or legal guardians.

Data Protection Officer

The data protection officer at the public institute is Virtuo d.o.o.; e-mail: dpo@virtuo.si .

Record of Processing Activities

The public institute maintains a record of processing activities in electronic form, which is available on the institute's website.

Final Provisions

The public institute reserves the right to amend and supplement this privacy policy. Individuals whose personal data is processed by the public institute and users of the public institute's website will be informed of all changes to this privacy policy on the public institute's website.