Privacy Policy

At Entranova d.o.o., we respect and protect the privacy of individuals. We process personal data responsibly and in accordance with the Personal Data Protection Act (ZVOP-2) and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation or GDPR). In this Privacy Policy, references to "Entranova", "we", "us" or "our" mean Entranova d.o.o.. Details about our registered office and contact information can be found in the "Data Controller" section.

This policy applies to the processing of personal data of our customers, potential customers and visitors to our websites, regardless of the communication channel or form of data. It applies to both digital processing and physical documentation that arise in our business operations.

For details on the use of cookies, please see our Cookie Policy.

The data controller is Entranova d.o.o., Preradovičeva ulica 22, 2000 Maribor, Slovenia.

If you have any questions regarding this Privacy Policy, you can contact us by email at .mefoac@ronatnivno or by post at the above company address.

In the context of the described purposes, we primarily process the following categories of personal data:

• Identification data: name and surname
• Contact data: telephone, email, address
• Project and product data: building type, installation location, selected products, technical specifications
• Contractual relationship data: offers, contracts, invoices, payments, complaints, service records
• Technical data when using the website: IP address, device and browser data, date and time of access, pages visited

Most personal data is provided directly by you, for example when you communicate with us by phone, email or other electronic communication channels (such as messaging apps or social networks), when you complete forms on our websites, enter into a contract with us, order our products or services, or visit us in person.

In certain cases, we may also receive your contact details and project data from our business partners (for example architects, contractors or referrers) or on the basis of recommendations from existing customers, where this is necessary for preparing an offer or providing a service. These partners act as independent controllers and are responsible for the lawfulness of the disclosure of your data. Once we receive your data, we process it as a controller in accordance with this Privacy Policy and applicable law.

Providing personal data is voluntary, but without data that is marked as necessary for the preparation of an offer, conclusion and execution of a contract or fulfillment of legal obligations, we cannot provide these services.

Entranova may in some cases process personal data for purposes related to the original purpose of data collection. An example of further processing is an inquiry about a product, where we process previously provided data at the user's request to prepare an offer and then, upon confirmation of the order, for the conclusion of a contract and installation. We may process your data in various forms (digitally in databases, email inboxes, physically in filing cabinets, work orders for production and installation). The transfer of data from one form to another (e.g. printing an order for installers) is considered part of the primary processing for the execution of the contract.

In further processing, we take into account compliance with the purposes of the original data collection and ensure an appropriate legal basis for each further processing.

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected or for as long as required by applicable legislation. Personal data is stored in electronic systems and, where necessary, also in paper form; in both cases we apply appropriate technical and organisational measures. Approximate retention periods for the main processing purposes are:

• Business communication and offers: for the duration of negotiations on a potential contract and for a reasonable period after the communication has ended (as a rule up to 1 year), unless a contract is concluded.
• Contractual relationship and performance of services: for the duration of the contract and for the general limitation period for potential claims (as a rule up to 5 years after the end of the contractual relationship); invoices and related accounting documentation are kept for the periods required by tax and accounting legislation (usually 10 years after the end of the financial year to which the document relates).
• Service, complaints and legal claims: for the time needed to handle the individual case and for the period during which customers may assert their claims (as a rule up to 5 years after the case has been closed), unless longer retention is required by law.
• Direct marketing: until you withdraw your consent or object to the processing, or until we determine that the purpose of the processing has been achieved (for example if we have no interaction with you for a longer period). Minimal data on consent given or withdrawn may be stored for a reasonable period in order to demonstrate compliance.
• Technical and analytics data related to use of the website: in line with the retention periods specified in our Cookie Policy or until the relevant cookie expires or you withdraw your consent.
• Prize draws, surveys and other one-off activities: for the duration of the activity and for the period during which participants may assert claims (e.g. in relation to prizes or complaints) or for the periods laid down by applicable legislation.

Entranova may, in accordance with the purpose of processing, disclose some of your data to the following categories of third parties:

• Providers of sales, installation and service, and other contractual partners who collaborate in the delivery and execution of our projects
• Accounting services
• IT service providers (system maintenance, server hosting)
• Web analytics, advertising and digital marketing service providers
• State authorities, if they request data with a written explanation for the purposes of conducting a specific procedure

For certain processing operations we use external service providers (processors), such as IT, hosting or maintenance providers. They process personal data solely on our behalf and in accordance with our documented instructions and only for the purposes defined in the relevant data processing agreements concluded in accordance with Article 28 GDPR.

For our business, we use services where personal data may be transferred to third countries (e.g., USA). For such transfers, where possible, we rely on adequacy decisions issued by the European Commission (for example, the EU-US Data Privacy Framework for providers that participate in this scheme) or other appropriate safeguards, such as standard contractual clauses provided by these vendors in their contractual terms. Where necessary, we also implement additional technical and organizational measures to protect personal data.

Entranova implements all necessary technical and organizational measures to ensure the security of personal data in accordance with applicable legislation. We use modern security protocols, communication encryption and restrict access to data only to authorized persons who need this data for their work. Personal data is processed in our IT systems and, where necessary, also in physical files; access to them is granted only to authorized persons on a need-to-know basis.

In order to ensure the security and reliable operation of the website, basic technical data (e.g. IP address, date and time of access, address of the visited page) may also be temporarily processed when you visit our websites, whereby such processing is based on our legitimate interest in protecting systems and preventing abuse.

We do not currently carry out any decision-making based solely on automated processing that would have legal effects or similarly significantly affect you.

In accordance with the General Regulation, you have the following rights as an individual:

• Right of access: you can request information about whether we process your personal data and access to it
• Right to rectification: you can request correction of inaccurate or incomplete data
• Right to erasure: you can request deletion of your data when there is no reason for further processing
• Right to restriction: you can request restriction of processing in certain cases
• Right to portability: you can request transfer of data in a structured format
• Right to object: you can object to processing when it is based on our legitimate interest or is carried out for direct marketing purposes
• Right to withdraw consent: you can withdraw consent at any time
• Right in relation to automated decision-making: you have the right not to be subject to a decision based solely on automated processing of your personal data (including profiling) that would have legal effects or similarly significantly affect you. In such a case, you have the right to request human intervention in the processing of the decision, express your viewpoint, and contest the decision

Exercising rights is only possible upon prior reliable identification of the individual. If we cannot reliably identify you, we may reject your request. Please note that these rights are exercised to the extent and under the conditions determined by the GDPR and applicable legislation. In certain cases (e.g. when the law obliges us to keep certain data), we will not be able to fully fulfill your requests, which we will notify you accordingly.

To exercise your rights, contact us at the controller's contact details listed in the "Data Controller" section. We will respond to your request within the statutory deadline.

If you have any questions or requests regarding the processing of your personal data, please contact us first using the controller's contact details provided in the "Data Controller" section. We will try to find an appropriate solution and will respond within the statutory time limit.

Irrespective of this, you also have the right under the General Data Protection Regulation to lodge a complaint with the competent supervisory authority for data protection. In Slovenia, this is the Information Commissioner (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, email: gp.ip@ip-rs.si, website: www.ip-rs.si.

Our services and websites are not intended for persons under the age of 16. We do not knowingly collect or process personal data from persons under the age of 16. If we discover that we have inadvertently collected data from a person under the age of 16, we will delete such data immediately.

Entranova reserves the right to change and supplement this privacy policy. Any changes will be published on this page with a new update date. We recommend that you regularly check for any changes. Continued use of our services after the publication of changes means agreement with the amended policy.

In case of inconsistency between this privacy policy and applicable legislation, the provisions of applicable legislation apply.

In case of inconsistency between the Slovenian and translated (e.g., English) version of this privacy policy, the Slovenian version, which is considered the original, shall prevail.