Privacy Policy
The purpose of this Privacy Policy of Fiziosan d.o.o. (hereinafter referred to as the “Privacy Policy”) is to inform users of the services provided by Fiziosan d.o.o. and other individuals (hereinafter also referred to as “data subjects”) about the purposes and legal bases for the processing of personal data carried out by Fiziosan d.o.o., Ptujska ulica 19, 1000 Ljubljana (hereinafter referred to as the “Company”), as well as about the rights of individuals in this area.
The Company places particular emphasis on the security of your personal data. All personal data provided is treated confidentially and used exclusively for the purposes for which it was provided.
We process your personal data with the utmost care, taking into account applicable legislation and the highest standards of personal data protection.
We ensure the security of your personal data through appropriate organizational measures, internal procedures, advanced technological solutions, and external experts, with the aim of providing the highest possible level of protection for your personal data.
We apply appropriate security measures and reasonable physical, electronic, and administrative safeguards to protect collected data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access to personal data that has been transmitted, stored, or otherwise processed.
This Privacy Policy also provides additional information regarding the consent you have given for the processing of your personal data.
In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons regarding the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the “General Data Protection Regulation” or “GDPR”), this Privacy Policy includes the following information:
Company contact information;
purposes, legal bases, and types of processing of different categories of personal data;
retention periods for individual categories of personal data;
rights of individuals regarding the processing of personal data;
the right to lodge a complaint regarding the processing of personal data;
validity of this Privacy Policy.
Personal Data Collected by the Company
If you are only a visitor to our website, we collect information about you solely through the use of cookies.
If you are a user of our services or a customer ordering services provided by the Company, we also collect additional personal data required to provide the services you have ordered or use.
The personal data collected includes:
first and last name;
contact email address;
contact telephone number;
IP address;
information required to prepare an offer based on your inquiry, including your address and tax identification number.
Data Controller
The controller responsible for the processing of personal data in accordance with this Privacy Policy is:
Fiziosan d.o.o.
This Privacy Policy applies to all individuals who have ordered and/or use our services, submitted an inquiry, or visited our website.
Purposes and Legal Bases for Data Processing
Processing Based on a Contract
Within the scope of exercising contractual rights and fulfilling contractual obligations, the Company processes your personal data for the following purposes:
identification of the individual;
preparation of quotations and offers;
conclusion of contracts;
provision of ordered services;
notification regarding possible changes, additional information, and instructions related to the use of services;
resolving technical issues, objections, or complaints;
invoicing and accounting purposes;
other purposes necessary for establishing or performing the contractual relationship between the Company and the individual.
For invoicing purposes, and in accordance with tax regulations, we also collect and process your address in order to issue invoices correctly.
Processing Based on Legal Obligations and Legitimate Interests
Based on legitimate interests, the Company processes your personal data for the purposes of detecting and preventing fraudulent use and misuse of services, ensuring the stable and secure operation of our systems and services, implementing information security measures, meeting service quality requirements, and detecting technical failures of systems and services.
Based on legitimate interests, we may also process your personal data for the purposes of potential enforcement procedures and judicial or extrajudicial debt collection.
In accordance with the GDPR, where misuse or fraud is suspected, the Company may process personal data to an appropriate and proportionate extent for the purpose of identifying and preventing potential fraud or misuse.
Where appropriate, such data may also be disclosed to other providers of similar services, business partners, the police, public prosecution authorities, or other competent authorities.
For the purpose of preventing future misuse or fraud, information regarding identified cases of misuse or fraud associated with an individual, including information about the contractual relationship and data such as an IP address, may be retained for up to five years after termination of the business relationship.
Processing Based on Consent
The processing of personal data may also be based on your consent provided to the Company.
Your consent may, for example, relate to receiving information about offers, benefits, and improvements to the services provided by the Company.
The purpose of such communication is to adapt our services as closely as possible to your needs and preferences and thereby increase their value and usefulness to you.
Communication is carried out through the channels selected in your consent.
You may withdraw your consent to receive such communications at any time in accordance with this Privacy Policy.
You may withdraw or modify your consent at any time in the same manner in which it was provided, or in another manner specified in this Privacy Policy. The Company reserves the right to verify the identity of the individual submitting such a request.
A change of consent may also be arranged by sending an email to:
or by submitting a written request to the Company's registered address.
Withdrawal or modification of consent applies only to personal data processed on the basis of your consent.
The latest valid consent received by the Company shall apply.
The possibility of withdrawing consent does not constitute a right to terminate any existing contractual relationship between the individual and the Company.
Personal data processed based on your consent, unless consent is withdrawn, shall be retained for up to two years after termination of the business relationship with the Company.
Restrictions on the Disclosure of Personal Data
Where necessary for the performance of certain activities that contribute to the provision of our services, we may authorize other companies and individuals to perform specific tasks on our behalf.
In such cases, the Company may disclose personal data to carefully selected external processors who have entered into a personal data processing agreement with the Company or another legally binding arrangement of equivalent content (hereinafter referred to as the “Data Processing Agreement”).
Personal data will only be provided or made available to external processors to the extent necessary for the specific purpose.
External processors may not use such data for any other purpose and must comply with all applicable personal data protection standards required by applicable legislation.
External processors are contractually bound to maintain the confidentiality and security of your personal data.
The Company may also disclose personal data to competent public authorities upon a justified request where such disclosure has a legal basis.
For example, Fiziosan d.o.o. may respond to requests from courts, law enforcement authorities, and other public authorities, including authorities of another EU Member State.
Personal Data Retention Period
The retention period for personal data is determined according to the category of data concerned.
We retain personal data only for as long as necessary to achieve the purpose for which it was collected or further processed, or until the expiry of limitation periods for fulfilling obligations or legally prescribed retention periods.
Billing information and related contact details of individuals may be retained for the purpose of fulfilling contractual obligations until full payment for the service has been made, or at the latest until the expiry of applicable limitation periods related to individual claims, which may legally range from one to five years.
Invoices are retained for 10 years after the end of the year to which the invoice relates, in accordance with applicable VAT legislation.
Other personal data obtained on the basis of your consent is retained for the duration of the business relationship and for an additional two years after termination, unless a longer retention period is required by law.
If an individual who provided consent for the processing of personal data has not entered into a business relationship with us, such consent remains valid for two years from the date it was provided, unless withdrawn earlier.
After the retention period expires, personal data is deleted, destroyed, blocked, or anonymized, unless otherwise required by applicable law.
Rights of Individuals Regarding the Processing of Personal Data
We ensure that your rights regarding the processing of your personal data are exercised without unnecessary delay.
We will decide on your request within one month of receiving your request. In cases involving complexity or a large number of requests, this period may be extended by a maximum of two additional months.
If the deadline is extended, we will inform you of the extension within one month of receiving your request, together with the reasons for the delay.
Requests relating to the exercise of your rights may be submitted:
by email: info@fiziosan.si
by post to:
Fiziosan d.o.o.
Ptujska ulica 19
1000 Ljubljana
Where you submit a request electronically, we will provide information electronically whenever possible, unless you request otherwise.
Where there is a justified doubt regarding the identity of the individual submitting a request concerning their rights, we may request additional information necessary to confirm the identity of the data subject.
If requests from a data subject are clearly unfounded or excessive, particularly due to their repetitive nature, the Company may:
charge a reasonable fee taking into account the administrative costs of providing information, communication, or carrying out the requested action; or
refuse to act on the request.
You have the following rights regarding the processing of your personal data:
Right of access to personal data;
Right to rectification;
Right to erasure (“right to be forgotten”);
Right to restriction of processing;
Right to data portability;
Right to object.
(i) Right of Access to Personal Data
You have the right to obtain confirmation as to whether personal data concerning you is being processed and, where this is the case, access to your personal data and the following information:
the purposes of processing;
the categories of personal data processed;
the recipients or categories of recipients to whom the personal data has been or will be disclosed;
the envisaged period for which the personal data will be stored or, where this is not possible, the criteria used to determine that period;
the existence of the right to request from the controller the rectification or erasure of personal data, or restriction of processing of personal data concerning you, or to object to such processing;
the right to lodge a complaint with a supervisory authority;
where personal data has not been collected from you, any available information regarding its source.
(ii) Right to Rectification
You have the right to obtain, without undue delay, the correction of inaccurate personal data concerning you.
Taking into account the purposes of processing, you also have the right to have incomplete personal data completed, including by providing a supplementary statement.
(iii) Right to Erasure (“Right to Be Forgotten”)
You have the right to request the deletion of your personal data without undue delay where one of the following grounds applies:
the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
you withdraw your consent on which the processing is based, and there is no other legal basis for the processing;
you object to the processing and there are no overriding legitimate grounds for the processing;
the personal data has been unlawfully processed;
the personal data must be erased to comply with a legal obligation under EU or Slovenian law.
(iv) Right to Restriction of Processing
You have the right to request restriction of processing of your personal data where one of the following applies:
you contest the accuracy of the personal data, for a period enabling the Company to verify its accuracy;
the processing is unlawful, and you oppose the deletion of personal data and request restriction of its use instead;
the Company no longer needs the personal data for processing purposes, but you require it for the establishment, exercise, or defense of legal claims;
you have objected to processing based on the Company’s legitimate interests, pending verification of whether the Company’s legitimate grounds override your interests.
Where processing of personal data has been restricted, such data may only be processed, except for storage:
with your consent;
for the establishment, exercise, or defense of legal claims;
for the protection of the rights of another natural or legal person;
for reasons of important public interest under EU or national law.
Before the restriction of processing is lifted, we will inform you accordingly.
(v) Right to Data Portability
You have the right to receive personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format.
You also have the right to transmit such data to another controller without hindrance from the Company where:
processing is based on your consent; and
processing is carried out by automated means.
Where technically feasible, personal data may be transmitted directly from one controller to another at your request.
(vi) Right to Object
Where we process your personal data based on legitimate interests for marketing purposes, you may object to such processing at any time.
We will stop processing your personal data unless we demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or where processing is necessary for the establishment, exercise, or defense of legal claims.
Right to Lodge a Complaint Regarding the Processing of Personal Data
Any complaint regarding the processing of your personal data may be submitted:
by email: info@fiziosan.si
or by post to:
Fiziosan d.o.o.
Ptujska ulica 19
1000 Ljubljana
If we fail to decide on your request within the legally prescribed period or reject your request, you have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia.
You also have the right to lodge a complaint directly with the Information Commissioner if you believe that the processing of your personal data violates Slovenian or EU data protection regulations.
If you have exercised your right of access and, after receiving our decision, believe that the personal data provided does not correspond to the data requested or that you have not received all requested personal data, you may submit a reasoned complaint to the Company within 15 days before lodging a complaint with the Information Commissioner.
The Company must decide on such a complaint as a new request within five working days.
Final Provisions
For all matters not regulated by this Privacy Policy, the applicable legislation shall apply.
The Company reserves the right to amend this Privacy Policy.
Any changes to this Privacy Policy will be published on the official website:
at least 30 days before the changes become effective.
If you have any questions regarding this Privacy Policy or the personal data we store about you, please contact us at:
Validity of the Privacy Policy
This Privacy Policy is published on the official website of Fiziosan d.o.o. and enters into force on: