Legal documents

Privacy Policy

We explain which personal data we process, for which purposes and on which legal basis, and what rights you have. This policy is prepared in accordance with Articles 13 and 14 of the General Data Protection Regulation (GDPR).

Effective from: 8 November 2026

1. Controller

The controller of your personal data (hereinafter: we) is:

  • Kiroptera Consulting, Robert Babić s.p.

  • Vojkova cesta 63, 1000 Ljubljana, Slovenia

  • registration number: 9770712000

  • tax number: 76242943

  • email: info@kiroptera.com

We have not appointed a data protection officer. For any questions, write to us at info@kiroptera.com.

2. Scope of this policy

This policy applies to all business processes in which we process personal data: use of the website https://kiroptera.com and our social media profiles, booking and holding free consultations, our newsletter, and concluding and performing contracts for paid services.

Personal data means any information relating to an identified or identifiable individual. Processing means any operation performed on personal data, such as collection, storage, use or erasure. A processor is a person who processes personal data on our behalf and on our instructions.

3. How we obtain personal data

As a rule, we obtain personal data directly from you, for example when you write to us, book a consultation, subscribe to our newsletter or order a service. When you visit the website, some technical data is processed automatically.

Where our client provides us with your data in the course of a service (for example data on employees, shareholders or business partners), we inform you about the processing through this policy. We process such data only to the extent necessary to perform the service.

4. Do you have to provide your data

Providing data is voluntary unless required by law. Without some data, we cannot reply to you, hold a consultation or perform a service.

5. Purposes, types of data, legal bases and retention periods

Enquiries and preparing a proposal

Data: name and surname, contact details, company details and the content of the communication. Legal basis: taking steps at your request prior to entering into a contract (point (b) of Article 6(1) GDPR). Retention: six months after the end of the communication if no cooperation follows.

Booking and holding a free consultation

Data: name and surname, email address, the selected time, the data you enter in the booking form and the data you provide during the consultation. Before booking in Cal.com, you confirm a notice on the nature of the free consultation, and your confirmation is stored together with the booking. Legal basis: taking steps at your request prior to entering into a contract (point (b) of Article 6(1) GDPR) and our legitimate interest in proving the content of the consultation in the event of any claims (point (f) of Article 6(1) GDPR). Retention: five years after the consultation, which corresponds to the general limitation period under Article 346 of the Slovenian Obligations Code (OZ).

Concluding and performing contracts for paid services

Data: name and surname, address, telephone number, email address, tax number, company details, bank account number and other data needed to perform the service. Legal basis: performance of a contract (point (b) of Article 6(1) GDPR). Retention: for the duration of the contract and five years after it ends.

Compliance with legal obligations

Data: data on invoices and in business records and data required by regulations, for example tax and accounting rules and anti-money laundering rules where they apply to us. Legal basis: compliance with a legal obligation (point (c) of Article 6(1) GDPR). Retention: for the periods set by those regulations.

Newsletter

Data: name and surname, company name, email address and selected areas of interest. Legal basis: for our clients, Article 226(2) of the Slovenian Electronic Communications Act (ZEKom-2) in conjunction with our legitimate interest (point (f) of Article 6(1) GDPR), and for other recipients, your consent (point (a) of Article 6(1) GDPR). We tailor the content to the selected areas of interest based on our legitimate interest in sending you relevant information. Retention: until you unsubscribe, withdraw your consent or object.

[If you measure newsletter opens and link clicks, state it here and check the legal basis.]

Website operation and security

Data: IP address, browser and device type, and date and time of access, which the hosting provider processes automatically when you visit. Legal basis: our legitimate interest in a secure and functioning website (point (f) of Article 6(1) GDPR). Retention: in accordance with the hosting provider’s rules [check the period].

Visitor statistics

For visitor statistics we use Framer’s built-in analytics, which does not use cookies or create persistent identifiers. To count daily visitors, Framer converts the IP address and browser data with a hash function using a key that changes daily, so individuals cannot be identified from the results. Legal basis: our legitimate interest in understanding how the website is used (point (f) of Article 6(1) GDPR).

YouTube videos

The YouTube player loads only after your consent, when you click “Play video” or allow external content in the cookie settings. A connection is then established with the servers of Google Ireland Limited, which processes data such as your IP address. Legal basis: your consent (point (a) of Article 6(1) GDPR), which you can withdraw at any time in the cookie settings.

Establishing and defending legal claims

Data: the data needed in the circumstances of the individual case. Legal basis: our legitimate interest in establishing and defending legal claims (point (f) of Article 6(1) GDPR). Retention: until the proceedings are finally concluded or until the limitation periods expire.

Client testimonials

We publish client testimonials and names only on the basis of explicit consent (point (a) of Article 6(1) GDPR), which can be withdrawn at any time. Retention: until consent is withdrawn.

When the retention period ends, we permanently delete or anonymise personal data so that it can no longer be linked to an individual.

6. Who we share data with

We do not sell data. We share it only with processors that process it on our behalf under a data processing agreement, and with authorities where required by law. Processors may not use the data for their own purposes and must keep it confidential. The categories of our processors are:

  • website hosting and visitor statistics provider

  • consultation booking system provider

  • video conferencing provider for remote consultations

  • email service provider

  • newsletter service provider

  • accounting service for bookkeeping

Section 7 applies to transfers of data outside the European Economic Area. We will send you the list of individual processors on request at info@kiroptera.com.

When YouTube videos are played, Google Ireland Limited processes data in accordance with its own privacy policy.

7. Transfers to third countries

Some providers are established or have servers outside the European Economic Area, in particular in the United States. We transfer data to third countries only on the basis of a European Commission adequacy decision, such as the EU-US Data Privacy Framework, or other appropriate safeguards under Chapter V GDPR, in particular standard contractual clauses. We will send you a copy of the safeguards used on request.

8. Automated decision-making and profiling

We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you (Article 22 GDPR). Tailoring the newsletter to selected areas of interest is not such decision-making.

9. Your rights

Under the GDPR, you have the right:

  • of access to your personal data and information about its processing

  • to rectification of inaccurate data or completion of incomplete data

  • to erasure of data, except where we must keep it by law or need it to establish or defend legal claims

  • to restriction of processing

  • to portability of data you have provided to us, where processing is based on consent or a contract and carried out by automated means

  • to object to processing based on legitimate interest and to object to direct marketing

  • to withdraw your consent at any time, which is as easy as giving it, without affecting the lawfulness of processing before the withdrawal

Send your request to info@kiroptera.com with the subject “Data protection request”. We reply without undue delay and at the latest within one month of receipt. Taking into account the complexity and number of requests, we may extend this period by up to two further months, in which case we inform you within one month of receiving the request (Article 12(3) GDPR). Where we cannot reliably establish your identity, we may request additional information.

If you believe that the processing of your data infringes the rules, you may lodge a complaint with the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, Slovenia, email gp.ip@ip-rs.si, www.ip-rs.si. You may also lodge a complaint with a supervisory authority in another EU Member State, in particular where you live or work (Article 77 GDPR).

10. Data security

We protect data with appropriate technical and organisational measures, including regular updates of hardware and software, security software, protection of business premises and restricting access to data to authorised persons.

We notify a personal data breach to the Information Commissioner without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in a risk to the rights and freedoms of individuals (Article 33 GDPR). Where the breach is likely to result in a high risk, we also inform the affected individuals without undue delay (Article 34 GDPR).

11. Social media

The website contains links to our profiles on YouTube and LinkedIn. These networks process data in accordance with their own terms and privacy policies:

  • YouTube: https://www.youtube.com/howyoutubeworks/privacy/

  • LinkedIn: https://www.linkedin.com/legal/privacy-policy

The providers of these networks are responsible for the processing of data on them. You can also address questions about our profiles to us.

12. Changes to this policy

We may amend this policy, in particular when regulations or our business processes change. The current version is always published on this page, and we inform you of material changes in an appropriate manner.

13. Contact

For questions about the processing of personal data, write to us at info@kiroptera.com.