Privacy policy of the Chamber of Commerce and Industry of Slovenia (CCIS)

The purpose of the CCIS Privacy Policy is to inform individuals, service users, employees, and other persons (hereinafter: the individual) who cooperate with the Chamber of Commerce and Industry of Slovenia (hereinafter: CCIS) about the purposes, legal bases, security measures, and rights of individuals regarding the processing of personal data by CCIS.

Personal data are processed in accordance with European legislation (General Data Protection Regulation – Regulation (EU) 2016/697) and the applicable Slovenian legislation governing personal data protection.

Controller

The controller is:

Chamber of Commerce and Industry of Slovenia

Dimičeva 13, 1504 Ljubljana

Telephone: +386 1 5898 000

Email: info@gzs.si

Personal data

Personal data means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Purposes of processing and legal bases for data processing

CCIS collects and processes personal data on the following legal bases:

• the data subject has given consent to the processing of their personal data for one or more specific purposes;
• processing is necessary for the performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract;
• processing is necessary for compliance with a legal obligation to which the controller is subject;
• processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party;
• processing is necessary to protect the vital interests of the data subject or another natural person.

1. Consent

CCIS may process certain personal data of an individual where the individual has provided consent, including:

• first name;
• last name;
• the company where the individual is employed and their position within the company;
• email address for notifications and communication;
• photographs, video recordings, and other content relating to the individual (e.g. publication of individuals’ images on the CCIS website) for documenting activities and informing the public about the work and events of CCIS;
• other data for which the individual provides consent.

The individual provides consent for the processing of personal data by clicking “send” / “subscribe” / “register” on the CCIS website via the online order form or via the link “Change e-news subscription settings and unsubscribe”.

The individual may withdraw their consent at any time by clicking the link “Change e-news subscription settings and unsubscribe”, located in the footer of each message received from CCIS, or by sending an email to info@gzs.si. In the event of withdrawal of consent, personal data will no longer be used to inform the individual about CCIS content (e-newsletters, events, publications, and other CCIS products).

Any withdrawal of consent shall not affect the lawfulness of the processing of personal data carried out prior to such withdrawal.

2. Performance of a contract

When an individual enters into a contract with CCIS, this contract forms the legal basis for processing personal data. Personal data may therefore be processed for the purposes of concluding and performing the contract. If the individual does not provide personal data, CCIS cannot conclude the contract or provide the service in accordance with the contract, as it would not have the necessary data to do so.

CCIS will also process certain personal data of individuals (first name, last name, email address, telephone number, payment data, etc.) for the purpose of planning and organising trainings, seminars, and other CCIS events for which the individual has registered.

3. Compliance with a legal obligation

Based on statutory provisions, CCIS processes personal data relating to its employees, as permitted by labour and social security legislation. On the basis of legal obligations, CCIS processes, in particular, the following types of personal data for employment purposes: first name and last name, gender, date of birth, personal identification number, tax number, place, municipality and country of birth, citizenship, place of residence, etc.

Certain data are also processed and stored on the basis of tax legislation (e.g. data relating to issued invoices).

4. Public authority

CCIS processes personal data when necessary for performing tasks within the scope of public powers conferred upon it. Such processing is based on applicable legislation and is carried out within the scope and for the purposes defined by law.

5. Legitimate interest

CCIS may also process personal data on the basis of its legitimate interests, to a limited extent. Such processing is not permitted where these interests are overridden by the fundamental rights and freedoms of the data subject that require the protection of personal data. When relying on legitimate interest, CCIS always conducts an assessment in accordance with the General Data Protection Regulation.

6. Processing necessary for the protection of the vital interests of the individual

CCIS may process an individual's personal data when necessary to protect that individual's vital interests. In emergency situations, CCIS may access the individual’s personal identification documents or contact their relatives without requiring the individual’s consent. This applies only when strictly necessary to protect the individual’s vital interests.

Retention and erasure of personal data

CCIS retains personal data only as long as necessary to fulfil the purpose for which the data were collected and processed. Where CCIS processes data based on  statutory requirements, it retains such data for the period prescribed by law. Certain data are retained for the duration of cooperation with CCIS, while some data must be retained permanently.

Personal data processed by CCIS on the basis of a contractual relationship with an individual are retained for the period necessary for the performance of the contract and for a further six (6) years following its termination, except where a dispute arises between the individual and CCIS in relation to the contract. In such cases, CCIS retains the data for ten (10) years following the final and binding court decision, arbitration award, or court settlement, or, where no judicial proceedings have been initiated, for five (5) years from the date of amicable settlement of the dispute.

Personal data processed by CCIS on the basis of the individual’s consent are retained until the consent is withdrawn or a request for erasure is submitted. Upon receipt of a withdrawal or request for erasure, the data shall be erased no later than fifteen (15) days thereafter. CCIS may also erase such data before  withdrawal where the purpose of processing has been achieved or where required by law.

Upon expiry of the retention period, CCIS shall effectively and permanently erase or anonymise personal data so that it can no longer be associated with a specific individual.

Processing of personal data by contractual processors and data transfers

For certain personal data processing activities, CCIS may, on the basis of a data processing agreement, entrust processing to a contractual processor. Contractual processors may process the entrusted data solely on behalf of the controller, within the limits of the authorisation granted by the controller, as set out in a written contract or other legal act, and in accordance with the purposes defined in this Privacy Policy.

Contractual processors engaged by CCIS primarily include:

• providers of information technology services related to the servicing and maintenance of software;

• providers oo email, software and cloud services.

Under no circumstances will CCIS disclose personal data to unauthorised third parties. Contractual processors may process personal data only in accordance with the instructions of CCIS and may not use personal data for any other purpose.

Cookies

A cookie is a file that stores website settings. Websites place cookies on users’ devices  to recognise individual devices and the settings used  when accessing the website. Cookies enable websites to identify  whether a user has previously visited the website and, in the case of advanced applications, allow individual settings to be adjusted accordingly. The storage of cookies is fully controlled by the user's browser, and users may restrict or disable cookie storage at their discretion.

Cookies are essential for providing user-friendly online services; most common e-commerce functionalities would not be possible without them. Interaction between the web user and the website is faster and simpler through the use of cookies. Cookies enable the website to remember an individual’s preferences and experience,making browsing more efficient and user-friendly.

Cookies serve various purposes. They store information about the state of a particular website (such as details of individual website customisation), assist in providing online services (e.g. online stores), support the collection of statistics on users and website visits, and provide insights into user browsing habits, etc. Through the use of cookies, it is possible to assess the effectiveness of our website's design.

List of cookies on the CCIS website

First-Party Cookies

Third-Party Cookies

Cookies used on the CCIS website do not collect personal data that would enable the identification of an individual and cannot damage an individual’s computer, tablet, mobile phone, or other device. Cookies enable the operation of the CCIS website and help determine which information is most useful to visitors.

By using this website, individuals agree that cookies may be placed on their  computer or mobile device.

If an individual wishes to change how cookies are used in their browser, including blocking or deleting cookies, this can be done by adjusting  the browser settings. For cookie management, most browsers allow individuals to accept or reject all cookies, accept only certain types of cookies, or receive a warning when a website wishes to store a cookie. Cookies stored by the browser can also be easily deleted; instructions are available on the respective browser's website.

Rights of the individual in relation to data processing

In accordance with the General Data Protection Regulation, individuals have the following personal data protection rights:

• the right to request information on whether their personal data are being processed;
• the right to request access to their personal data, enabling them to obtain a copy of the personal data held by CCIS;
• the right to request rectification of inaccurate personal data and completion of incomplete personal data;
• the right to request erasure of personal data (the so-called right to be forgotten);
• the right to request restriction of the processing of their personal data;
• the right to object to further processing of their personal data;
• the right to request portability of their personal data;
• the right to withdraw consent previously given for the collection, processing, and transfer of their personal data for a specific purpose; upon receipt of a notice of withdrawal of consent, CCIS will cease processing personal data, unless CCIS has another lawful basis to continue such processing.

If an individual wishes to exercise any of these rights, they may notify CCIS in writing by post at Chamber of Commerce and Industry of Slovenia, Dimičeva 13, 1504 Ljubljana, or by email at info@gzs.si.

Right to lodge a complaint with the supervisory authority

If an individual considers that the processing of their personal data infringes data protection legislation, they have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia (address: Dunajska 22, 1000 Ljubljana, email: gp.ip@ip-rs.si, telephone: +386 1 230 97 30, website: www.ip-rs.si).

Publication of amendments

Any amendments to the CCIS Privacy Policy will be published on the CCIS website. By using the website, the individual confirms that they accept and agree to the full content of the CCIS Privacy Policy.

Ljubljana, 30 January 2026