PRIVACY NOTICE

Last updated: 21 October 2026

1. Controller

PAVLIN proizvodnja, trgovina, storitve, d.o.o. (Pavlin d.o.o., Ljubljana), Gerbičeva ulica 116, 1000 Ljubljana, Slovenia.
Company registration number: 5357209, VAT ID: SI83552545, telephone: +386 1 24 28 301.
Contact for privacy questions: pavlin@pavlindoo.si.

Source of the data: we collect the data described in this notice directly from you when you submit a form; server logs are created automatically when you visit the website. We do not obtain data from other sources. This website does not make decisions based solely on automated processing, including profiling.

2. Contact form

Data: name or company name, email address, phone (optional), subject and message. The website has only one contact form, in Slovenian; the enquiry buttons on the pages in German, English and Italian lead to it. You can also write your enquiry in German, English or Italian; we do not record the language of the message as a separate item of data.

Purpose: replying to your enquiry and preparing a quote.

Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR) or our legitimate interest (Article 6(1)(f) GDPR).

Legitimate interest: our interest is to be able to reply to business enquiries (including from companies and other persons who are not yet our customers), prepare a quote and conduct business communication. The processing is limited to the data you enter in the form yourself and is to be expected for such an enquiry; we do not use the data for other purposes.

Whether you must provide the data: providing the data is neither a statutory nor a contractual requirement. Name, email address and message are needed so that we can reply; if you do not enter them, the form cannot be sent and we cannot reply to you this way (you can call us or write to the address in section 1). Phone and subject are optional; without them we reply by email.

Recipients: the message is delivered by email to the company mailboxes in which employees handle enquiries. The website and the transmission of the message from the form are technically provided by a hosting provider, and the mailboxes by email providers; the messages are transmitted and stored through them. We do not pass the data to other recipients unless the law requires it.

Retention:

• Ordinary enquiries: we keep them for 24 months after the last substantive communication, where no business relationship has arisen and there is no other legal basis for longer retention. Messages older than this period will be deleted in regular reviews of the mailboxes, which we are only now introducing; until the first review, older messages, including those received before this notice was published, may still be stored.
• Business correspondence and documents with statutory retention periods: if an enquiry leads to a transaction (quote, order, contract, invoice), the messages and documents that form part of business correspondence or of records with statutory retention periods are kept for as long as the regulations require; this retention is separate from the retention of ordinary enquiries.

3. Newsletter

The newsletter subscription form may be temporarily switched off; it is then not shown on the page. When active, it is shown only when the record of subscriptions can be written.

Data: email address, the language and page from which you subscribed, the time of subscription and confirmation, and a hashed (pseudonymised) value of the IP address.

Purpose: sending news about the offer of Pavlin d.o.o. Subscribing is not a condition for making an enquiry; it is separate from the contact form.

Legal basis: your consent (Article 6(1)(a) GDPR). For sending a newsletter by email for direct marketing purposes, your prior consent is also required under Article 226 of the Slovenian Electronic Communications Act (ZEKom-2).

Whether you must provide the data: subscribing is entirely voluntary and neither a statutory nor a contractual requirement. To subscribe we need your email address and your explicit consent; if you do not provide them, you do not receive the newsletter, which does not affect your ability to make an enquiry or to work with us.

Procedure: you subscribe in a separate form with explicit consent (the box is not pre-ticked). We send a message with a link to your email address; the subscription takes effect only once you confirm it (within 7 days).

Record of consent and unsubscription: we record confirmed subscriptions and unsubscriptions in a record on the server that is not accessible over the web. We accept a subscription only if the record can be written reliably; if it cannot, we do not activate the subscription and tell you so. We also notify a company mailbox of each entry.

Unsubscribing: at any time, without giving a reason: on the page Unsubscribe from the newsletter you enter your email address and confirm the unsubscription with the link in the message, or you write to us at the address in section 1. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.

Retention: we keep your email address until you unsubscribe. We keep proof of consent and unsubscription for as long as is needed to demonstrate that the processing was lawful or to establish, exercise or defend legal claims.

4. Protecting the form against spam

The form has a hidden field for detecting automated bots and a signed timestamp that contains no personal data. To limit the number of submissions from the same IP address, we keep only a hashed (pseudonymised) value of the IP address and the time of submission in a temporary file on the server; entries older than 1 hour are disregarded and deleted at the next submission. We use no external services for this.

Legal basis and legitimate interest: Article 6(1)(f) GDPR; our interest is to protect the website and mailboxes against unwanted and abusive messages. The processing takes place automatically when the form is submitted; without it we cannot offer the form safely.

5. Cookies and external services

The website does not set cookies, does not store data on your device and does not connect to third-party services when opened: we host fonts and program libraries on our own server and use neither visitor analytics nor embedded external maps. Consent for cookies is therefore not required (Article 225 of the Slovenian Electronic Communications Act, ZEKom-2). If we introduce any of these, we will do so only with your consent and after this notice has been updated.

Links to external sites: the Contact section has a link "Open location in Google Maps"; the pages also contain links to Facebook and to the websites hqp.si and maxprint24.si. These are ordinary links: no data is transferred until you click. When you open a link, the page is processed by its operator under its own rules.

6. Server logs

The website is hosted by an external hosting provider. The server may record technical access data in logs when you access the site (usually IP address, time, page requested and browser), which is needed for the secure operation of the website and for troubleshooting; the hosting provider is responsible for these logs and sets their retention period. Legal basis: legitimate interest in the security and operation of the website (Article 6(1)(f) GDPR).

7. Your rights

You have the right of access to your data, to rectification, erasure, restriction of processing, to object (in particular to processing based on legitimate interest) and to data portability, and the right to withdraw your consent at any time. Please send your request to the address in section 1.

You can lodge a complaint with the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si, or with the supervisory authority in the EU member state where you live or work.

8. Changes

We may update this notice if the services on the website or the regulations change. The date of the last update is shown at the top.