The purpose of this Privacy Policy is to inform individuals, clients, users of products or services, associates, employees and other persons (hereinafter: the “individual”) who cooperate with INCOM d.o.o. (hereinafter: the “company”) about the purposes, legal bases, security measures and individuals’ rights concerning the processing of personal data carried out by the company.

We value your privacy, which is why we always protect your data with care.

We process personal data in accordance with the applicable legislation on personal data protection and other legislation that provides us with a legal basis for processing personal data.

Any changes to this document will be published on our website. By using the website, you confirm that you are familiar with the entire content of the Privacy Policy.

Data controller:                                                                               COMPANY: INCOM                                                                           Manufacturing and trading company d.o.o. Ajdovščina           ADDRESS: Tovarniška cesta 6a                                                       CITY: 5270 Ajdovščina email: info@leone.si telephone: +386 5 364 39 00 Website: https://incomleone.com/sl/   Contact point: email: info@datainfo.si telephone: +386 2 620 4 300 website: www.datainfo.si

 

1) Personal data

Personal data means any information relating to an identified or identifiable individual; an identifiable individual is one who can be identified, directly or indirectly, in particular by reference to an identifier such as: a name, an identification number, location data, an online identifier or by reference to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual.

2) Purposes of processing and legal bases for data processing

The company collects and processes personal data on the following legal bases:

• processing is necessary for compliance with a legal obligation to which the controller is subject;
• processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
• processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party;
• the data subject has given consent to the processing of their personal data for one or more specific purposes;
• processing is necessary in order to protect the vital interests of the data subject or of another natural person.

 

Purchasing goods and services in a physical store

When an individual makes a purchase in person in a store, it can be made without processing personal data, unless the nature of the purchase means that processing personal data is strictly necessary to complete it.

The legal basis for data processing is a contract. The retention period is until the purpose of the contract has been fulfilled or up to 6 years after termination of the contract.

 Informing individuals by email, e.g. newsletters

In the course of its lawful activities, the company may inform clients, customers and users of its services at their email addresses about its services, events, training, offers and other content. An individual may at any time request that this type of communication and processing of personal data cease and unsubscribe from messages via the unsubscribe link in a received message or submit a request by email or by regular post to the company’s address.

The legal bases for data processing are legitimate interest and consent. The data will be processed until the individual unsubscribes from messages or withdraws consent, or until the purpose of processing has been fulfilled. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Video surveillance

We carry out video surveillance at INCOM d.o.o. Video surveillance (cameras are installed around the entrances to the organisation and inside the organisation itself) is used to monitor entry to and exit from the premises (pursuant to Article 77 of ZVOP-2). We also carry out video surveillance to protect individuals (users, employees and visitors) and the organisation’s property (on the basis of legitimate interest as laid down in point (f) of Article 6(1) of the General Data Protection Regulation, in conjunction with Article 76 and subsequent articles of ZVOP-2). Video surveillance is carried out within certain work premises where this is strictly necessary for the safety of people or property or for the protection of classified information or trade secrets. Video surveillance will help us detect, deal with or resolve incidents or extraordinary events, criminal offences, claims for compensation or other claims. Recordings are retained for up to 2 months, or up to 12 months for cameras outside public reach. Video surveillance enables an authorised person to monitor events live. All information concerning the implementation of video surveillance can be obtained via the organisation’s telephone number or email address. Individuals’ rights are described in this Privacy Policy.

Video surveillance is carried out by INCOM d.o.o. The video surveillance system is installed, maintained and managed by INCOM GROUP Družba za gospodarsko in organizacijsko upravljanje d.o.o.

Performance of concluded contracts

Where an individual enters into a contract with the company, that contract constitutes the legal basis for processing personal data. The company may therefore process personal data to conclude and perform a contract, such as the sale of goods and services, preparation of an offer, participation in various programmes, etc. If an individual does not provide personal data, the company cannot conclude a contract, nor can it provide the service or deliver goods or other products in accordance with the concluded contract, because it does not have the data required for performance. On this basis, the company processes only and exclusively the personal data necessary for the conclusion and proper performance of contractual obligations.

The legal basis for data processing is a contract. The retention period is until the purpose of the contract has been fulfilled or up to 6 years after termination of the contract, except where a dispute concerning the contract arises between the individual and the company. In such a case, the company retains the data for a further 10 years after a court decision, arbitration award or court settlement becomes final or, if there was no litigation, for 6 years from the date of the amicable resolution of the dispute.

Legitimate interest

The company may also process personal data on the basis of a legitimate interest that it pursues. This is not permissible where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. When relying on legitimate interest, the company carries out an assessment in accordance with the legislation. The processing of individuals’ personal data for direct marketing purposes is considered to be carried out in a legitimate interest.

The company may also process individuals’ personal data collected from publicly accessible sources or in the course of the lawful performance of its activities for the purposes of offering goods, services and employment, providing information on benefits, events, etc. To achieve these purposes, the company may use regular post, telephone calls, email and other means of telecommunications. For direct marketing purposes, the company may process the following personal data of individuals: the individual’s first name and surname, permanent or temporary residential address, telephone number and email address. The company may also process the above personal data for direct marketing purposes without the individual’s express consent. An individual may at any time request that this type of communication and processing of personal data cease and unsubscribe from messages via the unsubscribe link in a received message or submit a request by email or by regular post to the company’s address.

The legal basis for data processing is legitimate interest. The data will be processed until the individual unsubscribes from messages or until the purpose of processing has been fulfilled. Unsubscribing does not affect the lawfulness of processing based on consent before its withdrawal.

Processing based on consent or agreement

If the company does not have a legal basis established by law, a contractual obligation, legitimate interest or the protection of an individual’s life, it may ask the individual for consent or agreement. It may thus also process certain personal data of an individual for the following purposes where the individual gives consent:

• residential address and email address (for the purposes of providing information and communication);
• photographs, video recordings and other content relating to the individual (e.g. publication of pictures of individuals on the website for the purposes of documenting activities and informing the public about the company’s work and events);
• other purposes to which the individual agrees by giving consent.

 

If an individual gives consent to the processing of personal data and at some point no longer wishes this, they may request that processing of their personal data cease by submitting a request by email or by regular post to the company’s address. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. Following receipt of the withdrawal or request for erasure, the data will be erased within 15 days at the latest. The company may also erase these data before consent is withdrawn if the purpose of processing personal data has been achieved or if required by law.

Exceptionally, the company may refuse a request for erasure on the grounds set out in the General Data Protection Regulation in cases involving the exercise of the right to freedom of expression and information, compliance with a legal obligation to process data, reasons of public interest in the area of public health, archiving purposes in the public interest, scientific or historical research purposes, statistical purposes, or the exercise or defence of legal claims.

The legal basis for data processing is consent. The data will be processed until revocation or withdrawal of consent, or until the purpose of processing has been fulfilled. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Protection of an individual’s vital interests

The company may process the personal data of a data subject if this is necessary to protect their vital interests. In emergencies, the company may look for an individual’s identity document, check whether that person is in its database, examine their medical history or contact their relatives, without requiring the individual’s consent. This applies where it is strictly necessary to protect the individual’s vital interests.

3) Retention and erasure of personal data

The company will retain personal data only for as long as necessary to achieve the purpose for which the personal data were collected and processed. If the company processes data on the basis of law, it will retain them for the period prescribed by law. Some data are retained for the duration of cooperation with the company, while certain data must be retained permanently. The company retains personal data processed on the basis of a contractual relationship with an individual for the period necessary to perform the contract and for a further 6 years after its termination, except where a dispute concerning the contract arises between the individual and the company. In such a case, the company retains the data for a further 10 years after a court decision, arbitration award or court settlement becomes final or, if there was no litigation, for 6 years from the date of the amicable resolution of the dispute. Personal data processed by the company on the basis of an individual’s personal consent or legitimate interest will be retained until consent is withdrawn or a request for erasure of the data is made. Following receipt of the withdrawal or request for erasure, the data will be erased without undue delay. The company may also erase these data before consent is withdrawn if the purpose of processing personal data has been achieved or if required by law. Where an individual exercises their rights, the company retains that individual’s personal data until a final decision has been made on the matter and, after the decision becomes final, in accordance with the final decision in the matter.

Exceptionally, the company may refuse a request for erasure on grounds such as: the exercise of the right to freedom of expression and information, compliance with a legal obligation to process data, reasons of public interest in the area of public health, archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, or the exercise or defence of legal claims. After the retention period expires, the company must effectively and permanently erase or anonymise the personal data so that they can no longer be linked to a specific individual.

4) Contractual processing of personal data and transfers of data

The company may entrust individual personal data processing operations to a contracted processor on the basis of a data processing agreement. Contracted processors may process the entrusted data exclusively on behalf of the controller, within the scope of its authorisation set out in a written contract or other legal act and in accordance with the purposes defined in this Privacy Policy.

The contracted processors with which the company cooperates are primarily:

• accounting services and other providers of legal and business advice;
• infrastructure maintenance providers (video surveillance, security services);
• information system maintenance providers;
• email service providers and providers of software and cloud services (e.g. Microsoft, Google);
• social media and online advertising providers (Google, Facebook, Instagram, etc.)

 

For the purposes of better oversight and monitoring of contracted processors and ensuring that their mutual contractual relationships are properly regulated, the company also maintains a list of contracted processors specifying all the individual contracted processors with which the company cooperates.

Under no circumstances will the company disclose an individual’s personal data to unauthorised third parties. Contracted processors may process personal data only within the scope of the company’s instructions and may not use personal data for any other purposes.

The company, as controller, and its employees do not transfer personal data to third countries (outside the member states of the European Economic Area: EU Member States, Iceland, Norway and Liechtenstein) or to international organisations, except to the USA, whereby relationships with contracted processors in the USA are governed by standard contractual clauses (model contracts adopted by the European Commission) and/or binding corporate rules (adopted by the company and approved by supervisory authorities in the EU).

5) Cookies

The company’s website operates using so-called cookies, which are important for providing online services and are used to store information about the state of an individual web page, help collect statistics on users and website traffic, etc. When the website is accessed, only those cookies that are strictly necessary for the operation of the website (e.g. for the shopping cart) are placed on the device. Other cookies will be placed only with the individual’s consent. An individual may change the settings and delete cookies at any time (instructions are available on the websites of the respective browsers).

6) Data security and data accuracy

The company ensures information security and the security of its infrastructure (premises and application and system software). Our information systems are protected by antivirus software and a firewall, among other measures. We have introduced appropriate organisational and technical security measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, and against other unlawful and unauthorised forms of processing. Where special categories of personal data are transmitted, we transmit them in encrypted and password-protected form. Individuals themselves are responsible for providing their personal data securely and ensuring that the data provided are accurate and authentic.

7) Individuals’ rights regarding data processing

The data subject has the right to request access to personal data and rectification or erasure of personal data or restriction of processing concerning them, as well as the right to object to processing and the right to data portability. An individual’s request is handled in accordance with the provisions of the General Data Protection Regulation and the applicable personal data protection legislation.

An individual may exercise all the above rights and submit any questions by sending a request to the company’s address. The company will respond to an individual’s request without undue delay, no later than one month after receipt of the request. Taking into account the complexity and number of requests, this period may be extended by a maximum of two further months, of which the individual will be informed together with the reasons for the delay. Exercising rights is free of charge for the individual; however, the company may charge a reasonable fee if a request is manifestly unfounded or excessive, in particular if it is repetitive. In such a case, the company may also refuse the request. Where there is doubt about an individual’s identity, additional information needed by the company to establish their identity may be requested.

In its decision on the request, the company will also inform the individual of the reasons for the decision and of the right to lodge a complaint with the supervisory authority within 15 days of being informed of the decision. An individual may exercise the right to lodge a complaint with the supervisory authority at: the Information Commissioner of the Republic of Slovenia, at the address: Dunajska 22, 1000 Ljubljana (email: gp.ip@ip-rs.si, website: www.ip-rs.si).

 

This Privacy Policy applies from 24 September 2026 onwards.

Ajdovščina, 23 September 2026

 

INCOM d.o.o.

Director Boštjan Jerončič