Privacy policy

info-slovenija.si brings together two services, run by two different companies. The business directory is operated by Veldes net d.o.o., Plemljeva ulica 8, 1210 Ljubljana – Šentvid, Slovenija. Accommodation bookings and the payments behind them are operated by SEA LINE napredne storitve d.o.o., Spodnje Gorje 153A, 4247 Zgornje Gorje, Slovenija, matična številka 7516088000, davčna številka 93879512.

Each company is the data controller for its own part of the service. If you only use the directory, your data is processed by the first; if you book a stay, or host one, the data needed for the booking and the payout is processed by the second. Each group of data below says which service it belongs to.

We process personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Slovenian law.

Data we collect

Directory (all users):

• Registration and listing data: name or company name, email, phone, address and listing content.
• Contact and inquiry data: name, email, phone and message content. When you submit an inquiry or a review we also store the IP address, solely to prevent abuse.
• Technical visit data: page-view and search statistics are kept in aggregate (a count per day), not linked to an individual. See the Cookie policy.
• Questions asked of the on-site assistant are stored without any record of who asked them, and are used to improve the answers.

Data we collect when you book a stay

This data is processed only when you make a reservation:

• Booker details: name, email, phone, stay dates, number of guests and any notes.
• Payment data: the amount, the payment status, the card brand and the last four digits. **We never receive or store the full card number** — the payment is made directly with the payment service provider.
• **Guest registration data (eTurizem):** for each guest, full name, date of birth, gender, citizenship, and the type and number of an identity document. We are required to collect this under the Slovenian residence-registration and tourism acts; without it, guest registration and the tourist tax cannot be handled.
• Tourist-tax data: the guest’s age bracket, which determines the rate or an exemption.
• If you write a review of a stay, the review text, the rating and the IP address are stored.

Data we collect from hosts

This data is processed only when you host a property:

• Business data: name, address, tax and registration numbers, and the accommodation register number (RNO).
• Payout data: bank account and legal-representative details, including an identity document. **Identity verification is carried out by the payment service provider and the document is uploaded directly to them; we neither see nor store it.**
• Fiscal-verification data: tax number, business-premises details and the digital certificate used to sign invoices. The certificate is stored encrypted and used solely to sign your own invoices.
• A record of your acceptance of the host terms: the date, the version of the terms and the commission rate in force at that moment.
• Messages you send us from the control panel: the message, any attached image, the page you were on and your browser details.

Purposes and legal bases

• **Performance of a contract** (Art. 6(1)(b) GDPR): running your account, publishing a listing, carrying out a reservation, calculating and paying out to the host, issuing invoices, and support.
• **Legal obligation** (Art. 6(1)(c) GDPR): guest registration in the eTurizem system, tourist-tax calculation and remittance, fiscal verification of invoices with FURS, retention of accounting records, and platform reporting (DAC7).
• **Legitimate interest** (Art. 6(1)(f) GDPR): preventing abuse and fraud, securing the service, aggregate visit statistics, and recovering unpaid amounts.
• **Consent** (Art. 6(1)(a) GDPR): optional cookies and analytics, and update emails where you switch them on. Consent can be withdrawn at any time.
• We do not carry out automated decision-making with legal effects, or profiling in that sense.

Who we share data with

We do not sell personal data. We share it only where it is needed to deliver the service or where the law requires it:

• **The host of the property you booked**: name, email, phone, stay dates, number of guests and the guest registration data. For delivering the stay and for the statutory guest registration, the host is an independent controller.
• **The payment service provider** (Stripe), to take the payment, pay out the host, and carry out statutory identity verification.
• **The Financial Administration of the Republic of Slovenia (FURS)**, for fiscal verification of invoices, to the extent the law prescribes.
• **AJPES / eTurizem**: the registration itself is filed by the host, who carries that obligation; our role is to prepare and hand over the data you entered.
• **The municipality** to which the host remits the tourist and promotion tax.
• Processors that make the service work technically: hosting and server infrastructure, email delivery, accounting, maps, and the language-model provider behind the on-site assistant. We have data-processing agreements with all of them.
• A copy of the email we send you is also kept in the mailbox we reply from.

Transfers outside the European Economic Area

Some processors — the payment service provider and the language-model provider among them — may process data outside the EEA. Those transfers rely on the European Commission’s standard contractual clauses or on an adequacy decision; you can request a copy of the safeguards at the address below.

How long we keep data

• **Guest registration data (name, date of birth, gender, citizenship, document): 90 days after check-out**, then deleted automatically. Until then it is visible only to you and the host.
• Reservation and payment data: until the contractual limitation periods expire, as a rule five years.
• Issued invoices and accounting records: as long as tax and accounting law requires, as a rule ten years.
• Account and listing data: for as long as the relationship lasts; after an account is deleted we remove or anonymise it, except what the law requires us to keep.
• Unconfirmed registrations: cleaned up automatically shortly after the confirmation link expires.
• Aggregate visit and search statistics: contain no personal data and are therefore not time-limited.

Your rights

Under the GDPR you have the right to:

• access your data and correct inaccurate data,
• erase data and restrict processing,
• object to processing and withdraw consent,
• data portability,
• lodge a complaint with the Information Commissioner of the Republic of Slovenia (Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si).

What those rights do not cover

Data we are required by law to collect and keep — guest registration data, or the details on an invoice already issued — cannot be erased on request before the statutory period ends. Nor can we erase data the host holds as an independent controller; in that case please contact them directly, and we will help you do so.

Security

Access to personal data is limited to those who need it for their work. The connection to the site is encrypted, passwords are stored only in a form they cannot be read back from, and hosts’ digital certificates are encrypted on top of that. Guest registration data is deleted automatically when its period ends, with no human involvement.

Contact

To exercise your rights or for privacy questions, email podpora@info-slovenija.si or call 030 744 680. For questions about reservations and payouts, write to pravno@info-slovenija.si.

Changes to this policy

We update this policy whenever the way we process data changes. The date of the last change is shown at the top. For significant changes we notify registered users by email or in the control panel.