1. PERSONAL DATA PROTECTION POLICY
1) About the Personal Data Protection Policy
The purpose of the Personal Data Protection Policy (hereinafter: the Policy) is to inform Subscribers, Users, and other individuals (hereinafter: Individuals) about the purposes and legal bases for the processing of personal data by the company BRST psihologija, psihoterapija in izobraževanje, Kaja Strniša s.p., Šorlijeva ulica 11, 4000 Kranj, registration number: 8120625000 (hereinafter: the Company), as well as the rights of Individuals in this area.
At the same time, this Policy further explains consent for data processing.
In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: the General Data Protection Regulation – GDPR), this Policy includes the following information:
– contact details of the Company and contact details of the data protection officer,
– purposes, legal bases, and types of processing of different types of personal data of Individuals, including profiling,
– transfer of data to third parties and to third countries,
– retention periods for individual types of personal data,
– rights of Individuals regarding the processing of personal data,
– the right to lodge a complaint regarding the processing of personal data.
Where appropriate, provisions referring to Individuals also apply to issues of secrecy and confidentiality of communications of users who are legal entities.
2) Data Controller and Data Protection Officer
The controller of personal data of Individuals processed in accordance with this Personal Data Protection Policy is BRST psihologija, psihoterapija in izobraževanje, Kaja Strniša s.p., Šorlijeva ulica 11, 4000 Kranj.
The Company has appointed a Data Protection Officer, who can be reached at the email address info@brstpsihologija.si.
3) Purposes of Processing and Legal Bases for Data Processing
Processing based on a contract:
The Company processes personal data of Individuals for the purposes of informing them about new content on the website (subscription to psychology-related newsletters, notifications about the latest posts on the BRSTOLOGIJA blog), for direct marketing purposes (online courses, events, free books and guides, presentation of new products), and for segmentation purposes (subscription to tailored and individually created emails and Facebook advertisements).
Within the exercise of rights and fulfillment of contractual obligations, the Company processes personal data of Individuals for the following purposes:
– Email address and name (for notification purposes, sending email newsletters, Facebook advertising)
– Telephone number (for notification purposes in case of events and courses)
– Home address (for fulfilling obligations arising from a sales contract – creation and sending of invoices)
– Company data (for fulfilling obligations arising from a sales contract – creation and sending of invoices)
Processing based on legal obligation:
The Company processes personal data of Individuals for the purposes of concluding, performing, monitoring, and terminating subscription relationships.
Traffic data includes any data processed for the purpose of transmitting communication over an electronic communications network or for its billing. This includes, for example:
– First and last name of the subscriber
– Email address
– Telephone number
– Home address
– Company data (optional)
Additional processing purposes may arise from applicable legislation, such as notifications related to crossing borders in accordance with national roaming regulations.
Processing based on legitimate interest pursued by the Company:
The Company may also process data on the basis of legitimate interests pursued by the Company or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the Individual requiring protection of personal data, particularly where the data relate to a child. In cases of further use of data collected about an Individual, the Company performs an assessment in accordance with the GDPR. Such further use of data in pseudonymized or aggregated form constitutes lawful use of data for marketing and other business or technical analyses. As an additional safeguard, certain data may be deleted in some forms of further processing of traffic data.
The Individual may object to such processing in accordance with point 6(iv) of this Policy.
Based on legitimate interest, the Company may contact Individuals to improve services in order to assess their satisfaction with services or user experience, even when this is not strictly necessary for the performance of a contract. The Company will not re-contact Individuals who have objected to such contact.
The Company stores aggregated traffic data, including roaming data, for the purpose of determining predominant domestic use or presence of an Individual in Slovenia for a period of six months.
In accordance with legitimate interest, the Company may process personal data to the extent necessary and proportionate to ensure uninterrupted operation, network and information security, i.e., the ability of a network or information system to resist accidental events or unlawful or malicious actions that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal data. This includes prevention of unauthorized access, malware dissemination, denial-of-service attacks, and damage to computer and communication systems. This may include processing network diagnostic data and historical diagnostic logs that could allow re-identification of an Individual.
The Company has a legitimate interest to anonymize or aggregate data after the expiry of statutory retention periods and continue to use them for analyses and research for marketing, network planning, and similar purposes.
Other legitimate interests may include prevention of abuse, enforcement of claims, or defense against claims in administrative or judicial proceedings. Legitimate interest also includes lawful assessment of Individuals’ creditworthiness.
In cases of suspected abuse, the Company may process data of Individuals in an appropriate and proportionate manner for the purpose of identification and prevention of fraud or abuse and may, where appropriate, disclose such data to third parties such as business partners, police, public prosecutors, or other competent authorities. Data on identified abuses may be retained for the prevention of future abuses or fraud.
The Company reserves the right to process data on fulfillment of contractual obligations (payment data) in order to ensure higher quality of its services.
Processing based on consent for personal data processing:
Processing of data may be based on consent given by the Individual to the Company. Consent may relate to notifications about offers and services, preparation of personalized offers, or provision of value-added services. Notifications are carried out via channels selected by the Individual in the consent. Email-based notifications include sharing the email address with an external processor for the purpose of displaying Company advertisements while browsing the web.
The Individual may withdraw or modify consent at any time in the same way it was given or in another manner defined by the Company, subject to identity verification. Withdrawal or modification applies only to data processed based on consent. The latest consent provided by the Individual is considered valid. Withdrawal of consent does not constitute termination of the contractual relationship with the Company.
Consent for a minor may be given by a parent, foster parent, or legal guardian. Such consent remains valid until revoked or modified by the parent, guardian, or the child once legally entitled to do so.
4) Transfer of Data to Third Parties and to Third Countries (outside the EU or EEA)
The Company may, where consistent with EU and Slovenian law, disclose personal data of Individuals to:
(i) entities performing specific processing tasks for the Company, such as invoicing, data analytics, service maintenance and development, where such tasks require processing of personal data;
(ii) entities providing sales and marketing services for the Company, including online and field sales and marketing, or cooperating with the Company in marketing and sales of its own or third-party services, to the extent necessary for such purposes.
BRST psihologija, Svetovanje in psihoterapija, Branka Strniša s.p., Britof 237, 4000 Kranj, Tax number: 77993586 has concluded a cooperation agreement with Svetovanje in izobraževanje, Kaja Strniša s.p., Šorlijeva ulica 11, 4000 Kranj, Tax number: 62286781, which handles marketing and sales activities and participates in service provision.
If the Company is merged with or acquired by another company, personal data will be transferred to the acquiring entity in accordance with the law. By using our services, you agree to the continued processing of your personal data by the acquiring entity.
5) Personal Data Retention Period
Billing data and related contact data may be stored until full payment of services or until the expiry of statutory limitation periods, which may range from one to five years. Invoices are retained for 10 years after the year to which they relate, in accordance with VAT legislation.
If traffic data is processed based on consent for marketing, sales, or value-added services, such data may be processed for as long as necessary for those purposes.
6) Rights of Individuals Regarding Personal Data Processing
The Company ensures the exercise of Individuals’ rights without undue delay and no later than one month after receipt of the request. This period may be extended by up to two additional months due to complexity or volume of requests, with notification and reasons provided within one month.
Requests may be submitted electronically or by post to info@brstpsihologija.si.
If requests are submitted electronically, information will be provided electronically where possible, unless otherwise requested.
Where there is reasonable doubt regarding the identity of the Individual, the Company may request additional information for verification.
If requests are manifestly unfounded or excessive, especially repetitive, the Company may:
– charge a reasonable fee considering administrative costs, or
– refuse to act on the request.
The Company enables the following rights:
(i) right of access,
(ii) right to rectification,
(iii) right to erasure (“right to be forgotten”),
(iv) right to restriction of processing,
(v) right to data portability,
(vi) right to object.
(i) Right of access
Individuals have the right to obtain confirmation whether personal data concerning them is being processed and access to such data and related information, including purposes, categories, recipients, retention periods, rights, complaint rights, data sources, and automated decision-making.
(ii) Right to rectification
Individuals have the right to have inaccurate data corrected and incomplete data completed without undue delay.
(iii) Right to erasure (“right to be forgotten”)
Individuals have the right to request erasure of personal data where legal grounds are met.
(iv) Right to restriction of processing
Individuals may request restriction under conditions defined by law.
(v) Right to data portability
Individuals have the right to receive personal data in a structured, commonly used, machine-readable format and transmit it to another controller.
(vi) Right to object
Individuals may object at any time to processing based on legitimate interest or for direct marketing purposes.
(vii) Right to lodge a complaint
Complaints may be submitted to info@brstpsihologija.si or to the Information Commissioner.
7) Validity of the Policy
This Policy is published on the website www.brstpsihologija.si and is valid as of 24 May 2018.
2. TERMS OF USE OF THE WEBSITE
Content published on the BRST psihologija website may only be used and reproduced for non-commercial purposes and must retain all copyright notices.
We strive to provide accurate and up-to-date content but do not guarantee its accuracy or timeliness. Content may be changed at any time without notice.
Users use all content at their own risk, and results are not guaranteed.
Neither BRST psihologija nor any other person involved in creating the website is liable for damages arising from use or inability to use the website.
3. PAYMENT METHODS AND INVOICING
Invoices are issued by BRST psihologija, Kaja Strniša s.p., Šorlijeva ulica 11, 4000 Kranj, Tax number: SI62286781.
Payments can be made via PayPal, credit cards, or bank transfer.
Upon selecting payment “by pro forma invoice,” payment details will be sent by email.
Payments must be made to BRST psihologija, Kaja Strniša s.p., TRR at Delavska hranilnica d.d., IBAN: SI56 6100 0001 8609 118.
Invoices are issued within 8 days of payment receipt. Invoices are sent electronically unless otherwise requested.
Access to digital content is provided within 48 hours of payment receipt.
4. COMPLAINTS AND REFUNDS
Buyers of online courses and workshops may request a refund within 30 days of purchase without stating a reason. After refund, access to content and Facebook group membership is revoked. Complaints are resolved within 72 working hours.
