Legal
Privacy policy
Last updated: [fill in the date this page goes live]
1. Who is responsible for your data
The data controller for this website is KRESAL STEKLARSTVO d.o.o., Celovška cesta 275, 1000 Ljubljana, Slovenia. Registration number (matična številka): 9386726000. VAT number (ID za DDV): SI60339608.
Sara — please double-check the street name against your official company registration document; the public registry listing showed "Celovška cesta" but this should be confirmed before publishing.
Email: info@studio-kresal.com · Phone: +386 31 730 923
I process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2). I have not appointed a Data Protection Officer, as I am not required to do so under Article 37 GDPR.
2. What data I collect, and why
Contact form
When you send an enquiry I collect your name, your email address, the piece you are enquiring about (optional), the content of your message, and the date and time it was sent.
Purpose: to read your enquiry, reply to it, and where relevant discuss a possible commission or purchase.
Legal basis: Article 6(1)(b) GDPR — steps taken at your request prior to entering into a contract; or Article 6(1)(f) GDPR — my legitimate interest in responding to business correspondence, where your enquiry is general in nature.
Providing this data is voluntary, but without your name, email address and message I cannot reply to you.
Server logs
My hosting provider automatically records IP address, browser type and version, operating system, referring page, and the date and time of access. Purpose: security, stability and availability of the website. Legal basis: Article 6(1)(f) GDPR. This data is not used to identify you and is not combined with any other data.
Analytics
This website does not use Google Analytics or any other third-party analytics or tracking service. No analytics cookies are set, and no visitor behaviour is tracked across sessions.
3. What I do not do
- I do not sell, rent or trade your personal data.
- I do not use your data for automated decision-making or profiling.
- I do not send marketing emails unless you have separately and explicitly asked to receive them.
- I do not collect special categories of personal data.
4. Who else may see your data
| Provider | Purpose | Location |
|---|---|---|
| Netlify, Inc. | Website hosting, contact form delivery | USA / EU |
| [email provider] | Email correspondence | [EU / USA] |
| [accountant] | Invoicing, where an enquiry becomes an order | Slovenia |
These providers process data on my behalf under a data processing agreement in accordance with Article 28 GDPR. Where personal data is transferred to the United States, the transfer is made on the basis of the EU–US Data Privacy Framework adequacy decision and/or the European Commission's Standard Contractual Clauses under Article 46 GDPR.
Beyond this, I disclose personal data only where I am legally obliged to do so.
5. How long I keep your data
| Data | Retention |
|---|---|
| Enquiries that do not lead to an order | 2 years from the last correspondence |
| Correspondence that leads to a purchase | 10 years, as required by Slovenian tax and accounting law |
| Server logs | [confirm with Netlify — typically 7–30 days] |
When a retention period ends, the data is deleted or irreversibly anonymised.
6. Your rights
Under the GDPR you have the right to access your data (Art. 15), to have it corrected (Art. 16), to have it erased (Art. 17), to have processing restricted (Art. 18), to receive your data in a portable format (Art. 20), to object to processing based on legitimate interest (Art. 21), and to withdraw consent at any time where processing is based on consent (Art. 7(3)) — withdrawal does not affect the lawfulness of processing carried out before it.
To exercise any of these rights, write to info@studio-kresal.com. I will respond within one month. Where a request is complex, this may be extended by up to two further months; I will tell you if that happens, and why. Exercising these rights is free of charge. I may ask you to confirm your identity first, so that I do not disclose your data to someone else.
7. Cookies
Essential cookies are required for the website to function and to protect the contact form against spam. These cannot be switched off, and no consent is required for them under Article 6(1)(f) GDPR and Article 225 of the Slovenian Electronic Communications Act (ZEKom-2).
This website does not use analytics or advertising cookies, so no cookie consent banner is shown.
You can also block or delete cookies through your browser settings, though this may affect how the site works.
8. Security
I take appropriate technical and organisational measures to protect your data — encrypted transmission (HTTPS/TLS), access control, and the use of reputable, GDPR-compliant providers. No transmission of data over the internet can be guaranteed to be entirely secure. If a breach occurs that is likely to result in a high risk to your rights and freedoms, I will notify you and the supervisory authority as required by Articles 33 and 34 GDPR.
9. Children
This website is not directed at children, and I do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided me with personal data, contact me and I will delete it.
10. Your right to complain
If you believe my processing of your personal data infringes the GDPR, you may lodge a complaint with the Slovenian supervisory authority:
Informacijski pooblaščenec Republike Slovenije
Dunajska cesta 22, 1000 Ljubljana, Slovenia
gp.ip@ip-rs.si · +386 1 230 97 30 · www.ip-rs.si
You may also complain to the supervisory authority in the EU member state where you live or work.
11. Changes to this policy
I may update this policy — for example if I add a new service or provider. The current version is always available at studio-kresal.com/privacy-policy, with the date of the last update shown at the top. Where a change is material, I will make it clearly visible on the website.