In the company SOLINE Pridelava soli d.o.o. (hereinafter referred to as Soline) and in the Sečovlje Salina Nature Park (hereinafter SSNP), we are aware of the responsibility of handling personal data and we respect for your privacy. We process personal data carefully in accordance with the European Commission's General Data Protection Regulation (EU) 2016/679 (GDPR), which allows you to exercise more control over the use of your personal data and the Personal Data Protection Act (ZVOP-1).

1 Data Controller

Name: SOLINE Pridelava soli d.o.o.
Address: Seča 115, 6320 Portorož, Slovenia
Phone: +386 5 6721 330
Website: www.soline.si www.kpss.si www.thalasso-lepavida.si
Information on privacy, data protection and processing of personal data is published on the web pages of the company SOLINE d.o.o. and applies from 20 February 2019.

2 Your Rights

Soline provides you with rights in accordance with the General Regulation and the ZVOP. In case of any violation of your rights, you may contact the Data Controller (info@soline.si). The method of exercising rights is described below.
By agreeing to this Privacy Policy, you agree to have been made familiar with your rights and implementation methods.

3 Types of personal data, legal basis and the purpose of their processing

Soline collects and processes personal data on the basis of: the consent of data subjects, contracts concluded or the activities prior to entering into a contract, the legitimate interests we are pursuing and the fulfilment of the legal obligations that apply to our company.

3.1 Processing on the basis of consent
The subject whose personal data are processed on the basis of consent may consent to the processing of personal data for each particular purpose individually.

The data subject may at any time cancel the given consent for each specific purpose, in a simple and easily accessible manner.

You gave us the consent for the processing of personal data by agreeing, through one of the forms published on our website or by email, that we can provide you with a service for the stated purpose - for example, if you sign up for receiving content, such as e-news, invitations to events, publications and services, or register for the use of certain services. Consent can also be obtained in certain other business contacts. Any consent we require from you must be explicit and unambiguous. You can cancel your consent at any time just as easily as you gave it. We will document the cancellation of the consent (for example, your signing-up for and unsubscribing from e-news) in our database. The retention period, the separate purpose (s) and the possibility of cancellation are always clearly defined upon each consent. In the event of the cancellation of your consent, we will no longer use your personal data for the purpose for which the consent was cancelled. The data subject is informed in writing or other appropriate method of the purpose of processing of personal data prior to giving the consent. Any withdrawal of consent does not affect the legality of processing your personal data at the time before the withdrawal was made.

3.1.1 Sending news, notifications, promotions, etc.
As part of your consent to the sending of news, announcements and promotions, we may:

• send e-notifications about current prize games and promotional campaigns,
• send e-notification about news and offers,
• send e-invitations to events,
• send invitations by mail to events, 
• carry out phone and electronic collection of orders or registration to events, 
• send e-publications.

When giving consent, it will be indicated whether this applies to all of the above types of news, notifications, and promotions or just for each one of them. You can let us know at any time if you prefer to receive only notifications from a single category (or select it on our web pages).

Soline collects and processes the following personal data of the data subjects: name, surname, email, street, house number, postal code, city, telephone number and any other information you provide to us when giving your consent.

3.1.2 User Account Registration
The user registers a user account on a voluntary basis, thereby giving consent for the processing for the purpose of registering the user account. Upon registration, consent can be given for other aforementioned purposes.
For the purpose of registering a website user account, Soline collects and processes the following personal data:
• Mandatory information: username, first name, surname, email address, phone number, address.

3.1.3 Participation in prize games
By participating in a prize competition, the data subject gives consent for the processing of personal data for the purpose of carrying out the prize game organised by the company SOLINE d.o.o., which also includes informing the winners of the prize game.
For the purpose of implementation of the prize game, the company SOLINE d.o.o. collects and processes the following personal data: first name, surname, full address, email address, telephone number and date of birth. For the winners of the prize game, also the tax number and the bank account number according to the General Terms and Conditions.

3.2 Processing on the basis of the contract
SOLINE d.o.o. collects and processes personal data of subjects on the basis of a contract or activities prior to entering into a contract for the purpose of performing contractual obligations. We process your personal data in order to perform the contract.

The contract is entered with you upon:
1. ordering an online purchase or purchase via e-mail,
2. purchasing gift certificates and annual tickets for SSNP,
3. booking or purchasing guided tours and booking or purchasing Thalasso Spa Lepa Vida services,
4. concluding an agreement for the use of berths.

For contracts entered into for the purposes under points 1 to 3, Soline collects and processes the following personal data of subjects: first name, surname, email address, phone number, and full address.

For contracts entered into for the purposes under point 4, Soline collects and processes the following personal data of subjects:
- about the contracting party – user of the berth: first name, surname, address, VAT number, transaction bank account, phone number, registration number of the vessel, access ID card
- about family members to whom berth user may allow access: first name, surname

At entry into and exit from the Park area, the first name and surname of the entering person, access ID card, date, time and type of event can be recorded.

3.3 Processing on the basis of legitimate interests
Legitimate interest is the legal basis on which we process personal data of subjects with whom contact has been made in different situations in order to inform them of our services, when subjects legitimately expect to be informed (journalists, the media), or in cases of certain business contacts. Subjects are informed of this. We always consider whether our legitimate interest is justified and we take into account your interests in any processing.

3.4 Processing in accordance with a legal obligation to which the Controller is subject
SOLINE d.o.o. collects and processes personal data of subjects on the basis of legal obligations which apply to the controller, for the following purposes: accounting records, invoicing, debt recovery, personnel matters.

For these purposes, we collect and process the following personal data: first name, surname, address, bank details, tax number, personal identification number, email address, phone number.

The law allows us to collect certain personal data for clearly defined purposes, it also determines the storage period, the manner of handling these data and the fulfilment of other security requirements (video surveillance, employees, salaries, etc.).

Personal data about employees are processed by Soline in accordance with the law. They are subject to collection and processing pursuant to the Labour and Social Security Records Act (ZEPDSV) and other laws regulating employment relations.

In order to ensure the necessary level of security for people and property, the personal data of individuals moving in the area subject to video surveillance are processed on the basis of the Constitution and the Personal Data Protection Act (ZVOP-1), namely a video recording and the date and time of entry to and exit from the area. Personal data are kept for up to one year after the occurrence.

4 To whom do we provide your personal data?

As a rule, we do not share your personal information with third parties. Only in a few cases, when you have consented to it (we will also inform you about this), or when we can ensure that the recipient provides an adequate level of data protection, we do so if this is required for the performance of a contract or the provision of a service.

In cases where this is provided for by law, we are obliged to forward your personal data to official bodies.

When performing our activity, your personal data may sometimes be processed by our contracted processors. As the controller, we are responsible for the careful handling of your personal data, therefore we enter into personal data protection contracts or amendments to the contracts with processors in line with the General Data Protection Regulation. In this way, we are especially committed to protecting the personal data you have provided or we have received.

As a rule, Soline does not transfer personal data to third countries. In cases where Soline's suppliers or contract partners come from third countries and in the provision of their services to Soline or to the users personal data processing may occur, Soline allows this subject to the conditions laid down by the General Regulation - in particular by using appropriate safeguards in accordance with the General Regulation (which may include entering into an appropriate contract for the processing of personal data or other safeguards provided for by the General Regulation).

5 Personal data storage period

Personal data obtained by consent is kept for 5 years after your consent has been revoked.

Subject's personal data, which are processed on the basis of a contract, may be kept for 10 years from the fulfilment of contractual obligations by both parties, and in the event of the recovery of unpaid contractual liabilities, 10 years after the completion of legal proceedings.

Personal data collected on the basis of legitimate interests are kept until the rights of the subject to whom they relate have been exercised or as long as the purpose for which they were originally collected exists.

In cases of statutory provisions, enforceable administrative or judicial orders, SOLINE, as a taxable person, must ensure the keeping of accounts relating to the supply of goods or services in the territory of Slovenia for at least 10 years after the expiration of the year to which the accounts relate. This means that your personal data will also be stored on the account.

6 What personal data about you are collected and processed, for what purpose and for how long are your personal data stored?

Records of personal data filing system processing activities are given in Attachment 1 "Privacy Policy and Personal Data Protection"

7 Rights of data subjects

Users may request:

• output or consultation of data allowing them to be informed of the users' personal data that Soline processes,
• rectification of data when users consider that personal data processed by Soline are not correct,
• erasure or restriction of processing of their personal data if they wish to terminate or restrict the processing of all or part of their personal data by Soline.

In addition, users may:

• object to the processing of personal data on the basis of a legitimate interest or for direct marketing purposes,
• exercise the right to portability of personal data communicated to Soline by them.

Users exercise their rights by submitting a request in writing to Soline, by email: info@soline.si or by post: SOLINE d.o.o., Seča 115, 6320 Portorož, Slovenia.

The users must properly identify and clearly define their request in the application by which they exercises their rights. Data rectification may be communicated by Soline in writing or by signing a new contractual relationship document indicating the corrected data. Certain user rights may be restricted in individual cases on the basis of regulations (e.g. a ban on notifying an investigation, etc.). Soline will provide subjects with information on actions taken following the received requests, as a rule, within one month, but no later than in three months.

Right to complain:

Should the user consider that Soline violates his rights in processing personal data, he may file a complaint with Soline. The user can send the complaint to Soline d.o.o., Seča 115, 6320 Portorož, Slovenia, or at the email address: info@soline.si 
Users may also file a complaint with the personal data protection supervisory authority. In the Republic of Slovenia, the supervisory authority for the protection of personal data is the Information Commissioner.

8 Non-communication of data and consequences

When concluding contractual relationships with users, Soline only requires data which it may require in accordance with the regulations or the data necessary for the conclusion and implementation of the contract. The required data are stated in the contract or in this Policy. In the event that the user fails to provide data or Soline is not able to obtain them, Soline may refuse to conclude a contract or withdraw from a contract. Subjects can also provide other additional data to Soline.

9 Final provisions

In addition to this Privacy Policy, the processing of data under a particular contractual relationship is governed by the contract and any conditions that additionally regulate the individual contractual relationship.
This Policy is published and is available on the company's website and at the sales points of Soline.