Privacy statement - University of Ljubljana, School of Economics and Business
1) About the Privacy Statement
The purpose of the Privacy Statement of the School of Economics and Business of the University of Ljubljana (hereinafter: the "Statement") is to acquaint the users of summer and winter school services and special programmes of the School of Economics and Business of the University of Ljubljana (hereinafter SEB LU) and other persons (hereinafter referred to as "individuals") with the purposes and basis of the processing of personal data by the SEB LU and the rights of individuals in this field.
The SEB LU is particularly concerned about the security of your personal data. The transferred personal information is treated confidentially and is used only for the purpose for which the information was transferred. We handle your personal data with utmost care, keeping in mind the applicable legislation and the highest standards of their treatment. For the security of your personal information, we take care, inter alia, of appropriate organizational measures, work procedures and protocols for the protection of personal data. We use an appropriate level of protection and reasonable physical, electronic and administrative measures to protect the collected data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of personal data or unauthorized access to personal data that has been transferred, stored or otherwise treated.
At the same time, this Statement further explains the consent you have given for the processing of your personal information.
The Statement is in line with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free flow of such data and repealing Directive 95/46 / EC (hereinafter: 'the General Data Protection Regulation'), the following information is included:
SEB LU contact information,
purposes, bases and types of processing of various types of individuals' personal data,
retention time of individual types of personal data,
the rights of individuals with regard to the processing of personal data,
the right to file a complaint concerning the processing of personal data.
The controller of personal data processed in accordance with the Statement is the SEB LU, Kardeljeva ploscad 17, 1000 Ljubljana.
4) Categories of individuals whose personal data are processed
This Statement is for anyone who has ordered and / or used our services, or has submitted an inquiry, as well as for those who visit our website.
5) The purposes and bases for data processing
The field concerned is regulated also via the link http://www.ef.uni-lj.si/varstvo_osebnih_podatkov, but with the Statement itself we define the specific processing of data for the needs of the implementation of summer school services and special programs of the SEB LU.
5.1. Processing based on the contract:
In the context of the execution of contractual rights and the fulfillment of contractual obligations, the SEB LU processes your personal data for the following purposes: identification of an individual, preparation of a tender, conclusion of a contract, provision of the ordered services, notification of any changes, additional details and instructions for the use of services, solving technical difficulties, objections or complaints, billing of services and other purposes necessary for the implementation or conclusion of a contractual relationship between the SEB LU and an individual.
When calculating the services, based on tax regulations, we obtain and process your address for the correct issue of an invoice.
5.2. Processing based on the law:
On the basis of legitimate interest, we use your personal information to detect and prevent fraudulent use and misuse of services, further in the context of ensuring the stable and safe operation of our system and services, as well as for the purposes of implementing information security measures, meeting the requirements regarding quality of services and detecting technical failures of systems and services.
On the basis of legitimate interest, we use your personal information also for the purposes of possible enforcement, judicial and extrajudicial recovery.
In accordance with the General Regulation, in cases of suspicion of abuse, the SEB LU may process personal data in an appropriate and proportionate manner for the purpose of identification and preventing possible fraud or misuse, and may, if appropriate, also provide such information to other providers of such services, business partners, the police, the state prosecutor's office or other competent authorities. For the purpose of preventing future misuse or fraud, data on the history of identified misuses or fraud in connection with an individual, including subscription data and, for example, an IP address, can be kept for another five years after the termination of the business relationship.
5.3. Processing on the basis of consent to the processing of personal data:
Data processing can also be based on your consent that you provided to the SEB LU.
The consent may for example relate to informing about offers, benefits and improvements to the services offered by the SEB LU. The purpose of such informing is to make the services as close as possible to your needs and desires and to thereby increase the value for you. Notification is carried out via channels that you have selected in the consent. You can cancel the notification at any time in the manner defined by the relevant Statement.
CANCELLATION OF CONSENT: You can revoke or alter your consent at any time in the same way as you gave it or otherwise, as defined by the Statement, whereby the SEB LU reserves the right to identify the client. The change of consent can also be regulated by means of an e-mail to firstname.lastname@example.org or by a written request sent to the address of the authorized person for the protection of the SEB LU personal data or her e-mail address: email@example.com.
Withdrawal or modification of consent relates only to data processed on the basis of your consent. Your most recent consent that has been received is valid. The possibility of revoking consent does not constitute the entitlement to withdrawal in a business relationship of an individual with the SEB LU.
The data for which your consent is given will be processed in the absence of the revocation up to two years after the termination of your business relationship with the SEB LU.
6) Restrictions on the personal data transmission
If necessary, we will authorize other companies and individuals to perform certain works that contribute to our services. In such a case, the SEB LU may also provide your personal data to such carefully selected external processors that will conclude a contract for the processing of personal data with the SEB LU, or in substance the same agreement or other binding document (hereinafter: "Processing contract"). For external processors, such data will be transmitted or made accessible only to the extent required by a specific purpose. Such data may not be used by external processors for any other purpose, meeting at least all the personal data processing standards provided for in the applicable law. The external processors are contractually bound by the SEB LU to respect the confidentiality of your personal information.
On the basis of a reasoned request, the SEB LU also transmits personal data to the competent state authorities that have a legal basis for this. The SEB LU will, for example, respond to the requests of courts, law enforcement and other state authorities, which could also include the state authorities of another EU Member State.
For the purpose of fulfilling contractual obligations, the accounting data and the associated contact information on individuals may be kept until the full payment of the service or at the latest until the expiration of the limitation period in relation to an individual claim that can be statutory from one to five years. Accounts shall be kept for 10 years after the end of the year to which the account relates in accordance with the law governing value added tax.
Other information that we have obtained on the basis of your consent is kept for the duration of the business relationship and for 2 years after the termination, unless the law provides for a longer retention period. If the individual who gave their consent to the processing of personal data has not entered into a business relationship with us, their consent is valid for 2 years from the date when the consent was given or until its withdrawal.
After the expiry of the retention period, the data is deleted, destroyed, blocked or anonymized, unless the law specifies otherwise for the particular type of data.
8) Individuals' rights in relation to the processing of personal data
The exercise of your rights regarding the processing of your personal information is guaranteed without undue delay, so we will process your requirement as soon as possible, which will never be longer than a month after receiving your requirement. In the event of complexity and a greater number of requirements, the deadline may be extended by up to two additional months. If we extend the deadline, we will notify you of any such extension within one month of receiving the requirement together with the reasons for the delay.
The requirements regarding the exercise of your rights can be obtained by e-mail firstname.lastname@example.org or at the address of the personal data protection officer email@example.com or by post to the address of the SEB LU, Kardeljeva ploscad 17, 1000 Ljubljana.
Whenever you submit your requirement by electronic means, we will, whenever possible, provide you with information electronically, unless you request otherwise.
Where there is reasonable doubt as to the identity of an individual who submits a claim relating to one of his/her rights, we may request that additional information be provided to confirm the identity of the data subject.
If the data subject's claims are manifestly unfounded or excessive, especially as they are repeated, the SEB LU can:
charge you a reasonable fee, considering the administrative costs of transmitting information or communication or implementing the requested action, or
refuse to act on the request.
We provide the following rights regarding the processing of your personal information:
(i) the right of access to data (ii) the right to rectification (iii) the right to erasure (»the right to be forgotten«) (iv) the right to restrict processing (v) the right to transfer data (vi) the right to object
(i) the right of access to data
You are always entitled to know whether personal data is processed in respect of you and, if so, access to your personal information and the following information:
types of personal data being processed,
users or categories of users to whom personal data were or will be disclosed,
the estimated period of retention of personal data or, if this is not possible, the criteria used to determine this period,
the existence of a right to require the administrator to correct or delete personal data or limit the processing of your personal data, or the existence of the right to object to such processing,
the right to file a complaint with the supervisory authority,
when personal data is not collected from you, all available information related to their source.
(ii) the right to rectification
You have the right to obtain, without undue delay, correcting inaccurate personal information relating to you and considering the purposes of the processing, the right to supplement incomplete personal data, including the submission of a supplementary declaration.
(iii) the right to erasure (»the right to be forgotten«)
You have the right to achieve that without undue delay, your personal information is deleted when the subject of one of the following reasons:
when personal data are no longer needed for the purposes for which they were collected or otherwise processed,
when you cancel the consent on the basis of which the processing takes place, there is no other legal basis for processing,
when you object to the processing of data and there are no overriding legitimate reasons for processing them,
when personal data have been processed unlawfully,
when personal data should be deleted for the fulfillment of a legal obligation in accordance with EU law or the Slovenian legal order.
(iv) the right to restrict processing
You have the right to limit processing of your personal information when one of the following is true:
when disputing the accuracy of the data, for a period that allows us to verify the accuracy of personal data,
the processing is illegal, and you are opposed to the deletion of your personal information and, instead, request a restriction on their use,
we do not need your personal information anymore for processing purposes, but you need them to enforce, implement, or defend legal claims,
if you have filed an objection concerning processing based on the legitimate interests of the company until it is verified that our legitimate reasons are over your reasons.
When the processing of your personal information has been restricted in accordance with the preceding paragraph, such personal data, with the exception of their storage, shall be processed only with your consent, or for the enforcement, implementation or defense of legal claims or for the protection of the rights of another natural or legal person.
Before canceling the processing limit of your personal information, we are obliged to inform you of this.
(v) the right to transfer data
You have the right to receive your personal information, which you have provided us, in a structured, widely used and machine-readable form, and the right to transfer this information to another controller without the SEB LU obstructing you when processing is based on your consent and processing is carried out with automated means. At your request, where technically feasible, personal data may be transferred directly to another controller.
(vi) the right to object
Whenever your information is processed on the basis of a legitimate interest for marketing purposes, you may object to such processing at any time.
We will stop processing your personal information unless proven necessary processing grounds that prevail over your interests, rights and freedoms, or to enforce, implement or defend legal claims.
9) The right to file a complaint concerning the processing of personal data
Any complaint regarding the processing of your personal data can be sent to the e-mail address firstname.lastname@example.org or by post to the address of the SEB LU, Kardeljeva ploscad 17, 1000 Ljubljana.
In the event that we do not decide on your requirement within the legal deadline or if we reject your requirement, you have the possibility to file a complaint with the Information Commissioner.
You also have the right to file a complaint directly with the Information Commissioner if you believe that the processing of your personal data violates Slovenian or EU regulations in the field of personal data protection.
If you have exercised the right of access to the information and after receiving the decision, you believe that the personal data that you have received is not the personal data you requested or that you did not receive all the required personal information, you may file a reasoned complaint with the company within 15 days before submitting a complaint to the Information Commissioner. We need to decide on your complaint as a new requirement within five business days.
10) Final Provisions
For anything not regulated and provided for under the Privacy Statement in question, the applicable laws in the field of the protection of personal data are applied.