Privacy Policy

We take the protection of your personal data seriously. This policy explains what data we collect, why, for how long we keep it and with whom we share it, in line with Regulation (EU) 2016/679 (GDPR) and the Slovenian ZVOP-2. In force from 16 September 2026. In case of doubt the Slovenian version prevails.

Controller

Andrej Zupančič s.p., Gmajna 59, 1357 Notranje Gorice, Slovenia. Contact for personal-data matters: andrej@bodymindljubljana.si.

What we process and why

  • Sign-up for training or an event: name, e-mail, phone number, chosen programme, the goals and notes you enter, and for a child’s sign-up the child’s name and age. Purpose: handling the sign-up, running the training and related communication. Basis: performance of the contract or steps before it.
  • Invoice to a company: company name, address and tax number. Purpose: issuing the invoice. Basis: contract and legal obligation.
  • Member account: e-mail, password (stored only as a hash), address and the details you enter in your profile. Purpose: access to orders, pro-forma invoices, invoices and settings. Basis: contract.
  • Payments, pro-forma invoices and invoices: order, amount, method and date of payment and the documents issued. Card payments are handled by Stripe; we never see or store card data. Purpose: payment, invoicing, accounting. Basis: contract and legal obligation (ZDDV-1, ZDavPR).
  • Fiscal verification of invoices: for card, cash and PayPal payments the invoice data is sent to the Slovenian tax authority (FURS), for a company invoice also the buyer’s tax number. Basis: legal obligation (ZDavPR).
  • Incoming bank transfers: to match transfers to pro-forma invoices automatically we read, through Enable Banking, the credits on our bank account: payer’s name, amount, date and payment reference. This may concern people who are not customers (for example a parent paying for a child). Access is read-only. Purpose: identifying which pro-forma invoice has been paid. Basis: legitimate interest (efficient bookkeeping) and the legal duty to keep business records.
  • Newsletter: e-mail and name. Purpose: occasional news about training and events. Basis: consent given on the sign-up form (the box can be unticked) or when subscribing; you can withdraw it at any time with the unsubscribe link in every message or in your member account.
  • Contact form: name, e-mail and your message. Purpose: replying. Basis: legitimate interest or steps before a contract.
  • Website visits: to count visits we record the page, time, country, device and browser type and a one-way fingerprint derived from the IP address and browser that changes every day and cannot be linked to you. We do not store IP addresses. The host’s server logs contain IP addresses for security and are kept briefly. Basis: legitimate interest (operation and security of the site).

We do not use automated decision-making or profiling.

How long we keep data

  • Customer, sign-up and member-account data: 5 years after your last training, or until you delete your account, if earlier and no legal retention duty applies.
  • Invoices, credit notes, pro-forma invoices and related payment data: 10 years, as required by law (ZDDV-1, ZDavPR).
  • The log of incoming bank transfers: 10 years, together with the accounting records.
  • Newsletter data: until you withdraw consent.
  • Visit statistics are kept in aggregate; the daily visitor fingerprint is no longer linkable the next day.

Who receives the data

We do not sell data. We share it only with processors and recipients needed to run the service:

  • Neoserv d.o.o. (Slovenia) - website hosting and the mail server through which we send e-mail.
  • Brevo (Sendinblue SAS, France) - sending the newsletter; receives the subscriber’s e-mail and name.
  • Stripe Payments Europe Ltd. (Ireland) - card payments; Stripe is an independent controller for card data. Stripe privacy policy.
  • Enable Banking Oy (Finland) - intermediary for read-only access to the credits on our bank account (a PSD2 service).
  • PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) - PayPal payments, once available.
  • Financial Administration of the Republic of Slovenia (FURS) - fiscal verification of invoices under ZDavPR.
  • The provider’s accounting firm - bookkeeping.

The site embeds a Google Maps map; when the page loads, your IP address is sent to Google (Google Ireland Ltd.), which may involve a transfer to the USA under standard contractual clauses. Fonts and the pictures from our Instagram profile are stored on our own server, so visiting the site loads nothing from Google or Meta for them. See the Cookies page.

Your rights

At any time you may ask for access to your data, its correction, erasure or restriction of processing, receive it in a machine-readable form, object to processing based on legitimate interest, and withdraw consent without affecting the lawfulness of processing before withdrawal. Send your request to andrej@bodymindljubljana.si; we reply within one month. If you believe we process your data unlawfully, you may lodge a complaint with the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana.

Security

The site runs over an encrypted connection (HTTPS), passwords are stored hashed, and only the provider has access to customer data. Keys for payment and banking services are kept outside the publicly accessible part of the server.

Changes

We may update this policy when services or regulations change. The current version, with its date, is always published on this page.

← Back to home