# Privacy policy and cookies | UTG Vodnik > How UTG Vodnik d.o.o. collects, stores and processes personal data, which cookies the online shop uses and what your rights are. URL: https://www.utg-vodnik.si/en/privacy-policy Legal # Privacy policy Privacy and cookies ## 1. CONTROLLER AND SCOPE The controller of personal data is: **UTG Vodnik d.o.o.,** Tolstojeva ulica 12, Vir, 1230 Domžale, company registration number 2372754000, VAT ID SI47451742, telephone 01 724 82 58, email [info@utg-vodnik.si](mailto:info@utg-vodnik.si) (hereinafter: the controller) This policy explains the processing of personal data of visitors to the online shop, buyers, account users, loyalty programme participants, persons who send an enquiry, subscribers to notifications and other individuals who communicate with the controller. It applies to the online shop at www.utg-vodnik.si and to the controller's other websites, insofar as the described processing is actually carried out on them. For questions about privacy and to exercise your rights, write to [info@utg-vodnik.si](mailto:info@utg-vodnik.si) or to the postal address above. If the controller has appointed a data protection officer, the officer's contact details are published here or provided on request. ## 2. CATEGORIES OF PERSONAL DATA AND SOURCES Depending on how the services are used, we process: identification and contact data (first name, surname, address, telephone, email); order data (products, price, delivery, payment method, status, returns and complaints); data for invoices and statutory records; user account data (account identifier, securely stored password verification value, addresses, purchase history, favourite products); loyalty programme data (points, redemption of benefits); the content of enquiries and correspondence; voluntarily submitted reviews and display name; data on subscriptions to notifications and any responses to them; technical data (IP address, access time, log records, identifiers of cookies or local storage). As a rule, we obtain data directly from you. We may receive data on a completed payment or delivery from payment or delivery providers. Where a company orders products for an employee, we may receive contact details from the employee's employer; in such a case we inform the individual in accordance with Article 14 of the GDPR, if the relevant duty to inform applies. ## 3. PURPOSES, LEGAL BASES AND RETENTION PERIODS Purpose | Legal basis | Retention Order processing and delivery | Performance of a contract or steps prior to entering into a contract (Article 6(1)(b) GDPR); for contact persons of business customers, legitimate interest (6(1)(f)). | For as long as necessary to perform the contract and to exercise rights; documents subject to special statutory periods are kept for those periods. Issuing invoices, accounting and tax records | Legal obligation (6(1)(c)). | In accordance with tax and accounting regulations; invoices as a rule for 10 years after the end of the year to which they relate, unless a special regulation requires otherwise. Complaints, returns, guarantees, claims and disputes | Contract (6(1)(b)), legal obligation (6(1)(c)) and legitimate interest in establishing or defending claims (6(1)(f)). | For the duration of the proceedings and thereafter until the relevant limitation or statutory periods expire. User account | Performance of the agreement on use of the account (6(1)(b)). | Until the account is deleted or the service ends; business documents that must be retained are kept separately. Loyalty programme | Implementation of the programme terms (6(1)(b)); where necessary, legitimate interest in preventing abuse (6(1)(f)). | Until the membership expires or is closed and, where necessary, until the periods for claims expire. Contact messages and enquiries | Steps prior to entering into a contract (6(1)(b)) or legitimate interest in replying to business communication (6(1)(f)). | As a rule up to 2 years after the communication ends, unless a contractual relationship or a claim arises. Product reviews | Publication of a voluntarily submitted review on the basis of consent (6(1)(a)), if reviews are published on that basis; technical administration and, where necessary, prevention of abuse on the basis of legitimate interest (6(1)(f)). | Until the review is withdrawn or ceases to be displayed, except for data needed to defend claims. Newsletters and promotional messages | Consent (6(1)(a)); for marketing similar products to existing customers only where the conditions of ZEKom-2 (Slovenian Electronic Communications Act) are met and with the possibility of objection. | Until consent is withdrawn or an objection is made; we may retain minimal proof of consent and unsubscription to demonstrate compliance. Security, prevention of abuse and technical logs | Legitimate interest in the secure operation of the service (6(1)(f)) or legal obligation, where it exists (6(1)(c)). | The shortest necessary period determined in advance in light of security risks and obligations. Cookies and similar technologies | Essential cookies on the basis of the exception under Article 225 of ZEKom-2; non-essential cookies only after prior consent; for the processing of personal data, an appropriate basis under the GDPR. | For the periods stated in the cookie table or until consent is withdrawn. Where the retention period is not set by law, the controller determines it according to the purpose, the necessity of the processing and the possibility of exercising claims. After the period expires, the controller deletes or anonymises the data, unless another valid legal basis exists for further retention. ## 4. OBLIGATION TO PROVIDE DATA Data marked as mandatory when placing an order is necessary for the conclusion or performance of the contract or for compliance with legal obligations. If you do not provide it, we may not be able to fulfil the order. Creating a user account, submitting a review and subscribing to promotional notifications are voluntary, unless a particular service by its nature requires registration. ## 5. ELECTRONIC MARKETING AND CONSENT You may subscribe to newsletters and other promotional content with separate, voluntary and informed consent. You may withdraw consent at any time using the unsubscribe link in the message or at [info@utg-vodnik.si](mailto:info@utg-vodnik.si). Withdrawal does not affect the lawfulness of processing before withdrawal. A purchase is not conditional on consent to promotional communications. Where the statutory exception is used for electronic marketing of similar products to existing customers, we give the individual a clear, simple and free-of-charge opportunity to refuse already when the contact details are obtained and in every message. We process data on the opening of messages and clicks for individual analytics only on an appropriate legal basis and with transparent prior information. ## 6. RECIPIENTS, PROCESSORS AND DISCLOSURE OF DATA To the extent necessary, data may be received by delivery services (depending on the delivery method chosen, Pošta Slovenije and DPD), the payment gateway provider Bankart, providers of hosting and technical maintenance of the online shop (including the provider of the elShop platform, where actually involved), providers of email and marketing messages, accounting and legal advisers, and competent authorities where required by law. An individual recipient may act as an independent controller or as a processor, depending on its role. With processors we conclude appropriate agreements under Article 28 of the GDPR. We do not sell data. We disclose to recipients only the data necessary for their purpose. As a rule we do not receive or store payment card data if the payment is made directly with the payment service provider. However, we may receive a transaction identifier and the payment status. ## 7. TRANSFERS OF DATA TO THIRD COUNTRIES If the use of external services involves a transfer of personal data outside the European Economic Area, we carry it out only where the conditions of Chapter V of the GDPR are met, for example on the basis of a European Commission adequacy decision or appropriate safeguards such as standard contractual clauses, together with supplementary measures where necessary. You may request information on specific countries, recipients and safeguards at the controller's contact address. ## 8. RIGHTS OF THE INDIVIDUAL Under the conditions of the GDPR, you have the right to information and access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20), objection (Article 21), and the right not to be subject to a decision based solely on automated processing which produces legal or similarly significant effects, except in cases permitted by law (Article 22). Where processing is based on consent, you may withdraw it at any time. Send your request to [info@utg-vodnik.si](mailto:info@utg-vodnik.si). As a rule we reply at the latest within one month of receipt; in cases specified by law, the period may be extended by a further two months, of which we will inform you. Exercising your rights is as a rule free of charge. To protect data, we may request additional information necessary to confirm your identity. You have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, website www.ip-rs.si. You may also use other legal remedies provided by the GDPR. ## 9. AUTOMATED DECISION-MAKING AND PROFILING In the ordinary course of online orders, the controller does not use solely automated decision-making with legal or similarly significant effects within the meaning of Article 22 of the GDPR, provided that such processing is not actually established. Any personalisation of the offer or segmentation of customers must be described separately, if carried out. ## 10. SECURITY OF PERSONAL DATA We implement appropriate technical and organisational measures in light of the risks, including access control, protection of data transmission, backups, management of user rights and procedures for handling security incidents. Absolute security cannot be guaranteed, but this does not reduce the controller's statutory liability. In the event of security breaches, we act in accordance with Articles 33 and 34 of the GDPR. ## 11. COOKIES AND LOCAL STORAGE Cookies are small files or data stored on a device. Similar technologies include the browser's local storage. Essential technologies enable the functioning of expressly requested features (e.g. cart and login); consent is not required for them if the conditions of Article 225 of ZEKom-2 are met. Analytical, advertising and other non-essential technologies are used only after prior valid consent, if we introduce them. Name / technology | Purpose | Provider | Duration cart_session | Cart before login | UTG Vodnik | 30 days elshop_auth | Login session | UTG Vodnik | Until logout / session expiry wishlist_session | Favourite products | UTG Vodnik | 60 days wb_skip | Choice regarding use of credit note | UTG Vodnik | Until the browser is closed elshop_compare, elshop_compare_meta (local storage) | Product comparison | UTG Vodnik | Until the data is removed As of the date this draft was prepared, the website states that it does not use analytical or advertising cookies. This statement is valid only if confirmed by an actual technical review. Individual technologies that support favourite products or comparison must be assessed as to whether they are truly necessary for the service expressly requested by the user. If non-essential cookies are introduced, a mechanism must be available that allows acceptance, refusal and subsequent withdrawal by individual purposes. Refusal must be as simple as acceptance; consent cannot be presumed from continued use of the website. You can also manage cookies in your browser settings, but this is not a substitute for the necessary prior consent. ## 12. EXTERNAL CONTENT AND LINKS When using the Bankart payment gateway, displaying Google Maps maps or playing YouTube videos, individual providers may process personal data under their own rules. If embedded content uses non-essential cookies or similar technologies, we do not activate it before appropriate consent, unless a valid statutory exception applies. External links lead to the websites of other controllers, to which their privacy policies apply. ## 13. CHANGES TO THE POLICY We may update the policy due to changes in legislation, business processes or technologies. The current version is published on the website with the date of the last update. Where the law requires an additional notice or new consent, we provide it before the new processing. Changes to the policy do not in themselves create a new legal basis for processing. Last updated: 28 October 2026.