Privacy Policy

1. Introductory provisions

Purpose of the policy

This Privacy and Personal Data Protection Policy (hereinafter: “policy”) sets out the ways in which the online store aladdin.si (hereinafter: “controller” or “we”) collects, processes, stores and protects the personal data of the users and customers (hereinafter: “individual” or “you”) of its website.

The purpose of this document is to inform individuals comprehensively, transparently and in an understandable way about all aspects of the processing of their personal data. The controller is committed to the lawful, fair and transparent processing of personal data in accordance with applicable legislation.

All personal data processing procedures comply with the following key regulations:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: “General Data Protection Regulation” or “GDPR”).
• Personal Data Protection Act (Official Gazette of the Republic of Slovenia, No. 163/22; hereinafter: “ZVOP-2”).
• Electronic Communications Act (Official Gazette of the Republic of Slovenia, No. 130/22; hereinafter: “ZEKom-2”), in particular the part governing the use of cookies and other tracking technologies.

Definitions of key terms

To make this policy easier to understand, the key terms used in accordance with the GDPR are defined below:

• Personal data: Means any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• Processing: Means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
• Controller: Means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing; in this case, Aleš Žlavs s.p.
• Processor: Means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller (e.g. delivery service, accounting service).
• Data subject: Means the natural person whose personal data is processed (website user, customer).
• Consent: Means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.
• Cookie: A small text file that a website stores on your computer or mobile device when you visit it. It allows the website to remember your actions and preferences for a certain period of time.

2. Controller of personal data and data protection contact

The controller responsible for the processing of personal data described in this policy is:

• Full name: Aleš Žlavs s.p.
• Address: Dol pod Gojko 21B, 3213 Frankolovo, Slovenia
• Registration number: 3969584000
• VAT ID: SI16980204

Under ZVOP-2, the controller is not obliged to appoint a data protection officer (DPO), as the scope and nature of data processing do not meet the statutory conditions. Nevertheless, we are committed to a high standard of data protection and have therefore designated a dedicated contact for all questions, requests or the exercise of rights relating to your personal data:

• E-mail address: [email protected]
• Telephone number: +386 68 162 600

You can contact us at this address with any questions relating to the processing of your personal data and the exercise of your rights.

3. Legal bases, purposes of processing and types of personal data

We collect and process your personal data exclusively on the basis of predetermined and lawful purposes and the appropriate legal bases laid down by the GDPR. The legal bases and purposes of processing are described in more detail below.

Explanation of legal bases

The processing of your personal data is based on one of the following legal bases:

• Performance of a contract (Article 6(1)(b) GDPR): We rely on this basis when the processing of your data is necessary to fulfil an order you have placed or to take steps prior to entering into a contract (e.g. registering a user account). This includes processing data for delivery, payment and communication relating to the order.
• Legal obligation (Article 6(1)(c) GDPR): In certain cases, the law requires us to process data. The most important example is the issuing and retention of invoices in accordance with tax regulations such as the Value Added Tax Act (ZDDV-1).
• Consent (Article 6(1)(a) GDPR): For certain purposes, such as sending marketing e-mails (newsletters) or using non-essential cookies (e.g. for analytics or marketing), we will process your data only on the basis of your explicit, voluntary and informed consent. You can easily withdraw your consent at any time, which does not affect the lawfulness of processing prior to withdrawal.
• Legitimate interest (Article 6(1)(f) GDPR): We may also process your data on the basis of our legitimate interests, except where such interests are overridden by your interests or fundamental rights and freedoms. Examples of such processing include improving our services, preventing fraud and managing cases of uncollected parcels, thereby protecting our business from damage.

Overview of personal data processing activities

To ensure maximum transparency, the table below systematically presents the purposes of processing, the types of personal data collected, the applicable legal basis and the retention periods.

4. Recipients of personal data and transfers to third countries

We do not sell your personal data or pass it on to unauthorised third parties. We share data exclusively with trusted partners (contractual processors) who help us run our business and are contractually bound to protect your data.

The categories of recipients of your personal data are:

• Postal and delivery service providers: For the purpose of delivering your order, we pass your data (first name, last name, address, telephone number, e-mail address for shipment notifications) to our contractual partners GLS General Logistics Systems d.o.o. and Pošta Slovenije d.o.o., depending on the delivery method selected.
• Payment service providers: When paying by payment card, Revolut Pay or Google Pay, the payment data is processed by the payment service provider Revolut Bank UAB (Lithuania, EU); when paying via PayPal, by PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg, EU). Your payment card details are entered directly with the payment service provider; we do not receive or store them.
• IT service providers: To ensure the smooth operation of the online store, we work with an external hosting provider (NEOSERV d.o.o., Slovenia). The servers on which your data is stored are located in Slovenia, which ensures a higher level of security.
• Newsletter and notification service providers: To send the newsletters you have subscribed to, we use the MailPoet tool (Wysija SARL, France, EU), and for web push notifications, which you can allow in your browser, the Brevo service (Sendinblue SAS, France, EU). You can unsubscribe from notifications at any time in your browser or via the link in the message.
• Analytics and advertising providers (only with your consent to cookies): Google Ireland Ltd. (Google Analytics, Google Ads, sign-in with a Google account) and Meta Platforms Ireland Ltd. (Meta Pixel). These providers may transfer data to servers in the USA; the transfer is based on the European Commission’s adequacy decision (EU-U.S. Data Privacy Framework) and standard contractual clauses.
• Accounting service: To fulfil legal obligations in the areas of accounting and tax.
• State authorities: In the event of a legal requirement (e.g. from the tax authority, a court or the police), we are obliged to provide the requested personal data.

Transfers of data to third countries

As a rule, we do not transfer your personal data outside the European Economic Area (EEA). An exception may arise if you choose to communicate with us via platforms operated by companies based in third countries such as the United States of America. Our online store also allows orders to be placed via the WhatsApp application, which is owned by Meta Platforms, Inc.

By initiating communication via such a platform yourself, you agree to its terms of use and privacy policy, which may include the transfer of your data (e.g. telephone number, message content) to servers in the USA. We have no influence over these transfers and cannot accept responsibility for them. We recommend that you familiarise yourself with the privacy policies of these providers. The same applies to the analytics and advertising providers referred to in section 4, which process data only if you have consented to the use of analytics or marketing cookies.

5. Retention periods for personal data

We retain your personal data only for as long as is strictly necessary to fulfil the purpose for which it was collected, or as required by applicable regulations. This is in line with the storage limitation principle of the GDPR. After the retention period expires, the data is permanently deleted, destroyed or anonymised.

The specific retention periods are:

• Data on issued invoices: In accordance with the Value Added Tax Act (ZDDV-1), we must retain invoices and related data for 10 years after the end of the year to which they relate.
• Data relating to a concluded contract (order): Data required to prove the fulfilment of contractual obligations (e.g. in the event of complaints or guarantee claims) is retained for 5 years from the fulfilment of the contract, which corresponds to the general limitation period under the Obligations Code.
• Data collected on the basis of consent: Data we process on the basis of your consent (e.g. e-mail address for newsletters) is retained until you withdraw your consent. After withdrawal, the data is deleted immediately and permanently.
• Data in the user account: Retained for as long as your user account is active. Upon your request to delete the account, the data is deleted.

6. Cookie policy

Our website uses cookies to provide a better user experience, functionality and security. The use of cookies complies with the provisions of the Electronic Communications Act (ZEKom-2) and the GDPR.

What are cookies?

Cookies are small text files that most websites store on the devices users use to access the internet, in order to recognise the individual devices used by users when accessing the site.

Managing cookie consent

When you first visit our website, a cookie notice is displayed where you can allow the installation of non-essential cookies by giving your explicit consent (an active action). For the installation of cookies that are not strictly necessary for the operation of the website, we always require your consent (opt-in principle). The following options are available to you:

• Accept all: Consent to the use of all types of cookies.
• Reject all: Only strictly necessary cookies will be used.
• Settings: The option to choose which types of cookies you allow.

Pre-ticked consent boxes are not permitted and we do not use them. You can change your cookie settings at any time via the link on our website.

Types of cookies we use

1. Strictly necessary cookies: These cookies are essential for the operation of the website and its basic functions, such as navigation, access to secure areas and the functioning of the shopping cart. Your consent is not required for them.
2. Analytics cookies: These cookies allow us to collect pseudonymised data on how visitors use our website. They help us understand the number of visitors and the most visited content, and improve the performance of the site. Your consent is required for them.
3. Functional cookies: These cookies enable advanced functionality and personalisation, for example saving your preferences (e.g. language selection). Your consent is required for them.
4. Marketing cookies: These cookies are used by us or our partners to display advertisements that are more relevant to you and your interests. They are also used to measure the effectiveness of advertising campaigns. Your consent is required for them.

List of cookies used

The table below shows examples of cookies that may be used on our website. A complete and up-to-date list of cookies, including their providers, purposes and duration, is always available in the cookie management tool on our website.

7. Rights of individuals

The General Data Protection Regulation (GDPR) grants you a number of rights in relation to your personal data. We undertake to enable the simple and effective exercise of these rights.

Your rights are:

• Right of access (Article 15 GDPR): You have the right to obtain from us confirmation as to whether personal data concerning you is being processed and, where that is the case, access to that data and additional information (on the purposes of processing, the types of data, the recipients, the retention periods, etc.).
• Right to rectification (Article 16 GDPR): You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you also have the right to have incomplete personal data completed.
• Right to erasure (“right to be forgotten”) (Article 17 GDPR): You have the right to obtain from us the erasure of your personal data without undue delay where one of the grounds for erasure applies (e.g. the data is no longer necessary for the purposes for which it was collected, you have withdrawn your consent, the processing was unlawful).
• Right to restriction of processing (Article 18 GDPR): You have the right to obtain from us the restriction of processing of your data if you contest its accuracy, if the processing is unlawful but you oppose erasure, or if you have objected to the processing.
• Right to data portability (Article 20 GDPR): You have the right to receive the personal data concerning you which you have provided to us in a structured, commonly used and machine-readable format, and the right to transmit that data to another controller, where the processing is based on consent or on a contract and is carried out by automated means.
• Right to object (Article 21 GDPR): Where we process your data on the basis of a legitimate interest, you have the right to object at any time, on grounds relating to your particular situation, to such processing. In the event of an objection to direct marketing, we will cease processing immediately.
• Right to withdraw consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

Procedure for exercising rights

You can exercise your rights by sending us a written request to the e-mail address: [email protected].

We will respond to your request without undue delay and at the latest within one month of receiving the request. This period may be extended by a further two months where necessary, taking into account the complexity and number of requests. We will inform you of any such extension within one month of receipt of the request, together with the reasons for the delay.

8. Right to lodge a complaint with a supervisory authority

If you believe that the processing of your personal data infringes the provisions of the General Data Protection Regulation or ZVOP-2, you have the right to lodge a complaint with the competent personal data protection supervisory authority.

The competent supervisory authority in the Republic of Slovenia is:

• Name: Information Commissioner (Informacijski pooblaščenec)
• Address: Dunajska cesta 22, 1000 Ljubljana
• E-mail: [email protected]
• Telephone: +386 1 230 97 30
• Website: www.ip-rs.si

9. Data security

We are committed to ensuring the highest level of security for your personal data. To prevent unauthorised access, disclosure, alteration or destruction of data, we implement appropriate technical and organisational measures in accordance with Article 32 of the GDPR.

These measures include:

• Technical measures:
  • Use of an encrypted HTTPS (TLS) connection to protect the transfer of data between your browser and our website.
  • Protection of servers with firewalls and other security mechanisms. Our servers are located in a secure data centre in Slovenia.
  • Regular updating of software and security systems.
  • Storage of user passwords exclusively in hashed form (hashing) to prevent their disclosure.
• Organisational measures:
  • Access to personal data restricted to authorised personnel who need the data to perform their work (the “need-to-know” principle).
  • Commitment of all employees and contractual partners to data confidentiality.
  • Established procedures for handling security incidents, including timely notification of the supervisory authority (within 72 hours of becoming aware of a breach, if the breach is likely to result in a risk to the rights and freedoms of individuals).
  • Regular review and updating of our security policies and practices.

10. Final provisions

Changes to the policy

We reserve the right to update this privacy policy from time to time to reflect changes in our business, legislation or technology. Every change will be published on this website. We will notify you of significant changes in an appropriate manner, for example by a notice on the website or by e-mail. We recommend that you review this policy regularly.

Validity

This policy applies from 01.01.2026 and replaces all previous versions. Last update (list of processors: delivery services, payment, newsletter, push notification, analytics and advertising providers): 13.10.2026.