DATA PROTECTION
Privacy Notice
This notice explains how HWP processes personal data when you visit the hwp.si website and when you submit a business enquiry, in accordance with the General Data Protection Regulation (GDPR), the Personal Data Protection Act (ZVOP-2) and, in respect of cookies and similar technologies, the Electronic Communications Act (ZEKom-2).
1. Data controller
HWP, Drugo podjetniško in poslovno svetovanje, d.o.o.
Bratovševa ploščad 18, 1000 Ljubljana, Slovenia
Company registration number: 9405607000
VAT ID: SI68987447
Contact for questions about personal data protection: julijana@hwp.si or +386 41 438 713.
2. What data we process and where we get it from
If you submit an enquiry through the contact form or write to us by email, we process the data you provide to us: your full name, company, work email address, an optional telephone number, your selected area of interest, an optional organisation size, optional reward components, and the text of your message.
We receive this data directly from you. The public form is not intended for individual salaries, employee names or identifiers, staff lists, individual results, health, trade union or other special categories of personal data, or files containing pay or survey data.
When you visit the website, technical data may be processed automatically, such as your IP address, the date and time of the request, the URL requested, the response status, browser or device information, and security events. This data arises in server, CDN and security logs for the purposes of content delivery, stability, abuse prevention and protecting the website.
The public-facing part of the website does not currently support user accounts, WordPress comments, user media uploads, or external videos and social media plug-ins. HWP does not use Gravatar, Google Analytics, the Meta Pixel, Hotjar, or advertising scripts.
3. Purposes and legal bases
- Responding to your enquiry and preparing a proposal: taking steps at your request prior to entering into a contract, where you are a prospective contracting party (Article 6(1)(b) GDPR), or HWP's legitimate interest in handling business communications, where you write on behalf of an organisation (Article 6(1)(f) GDPR).
- Managing the contractual relationship: performance of a contract (Article 6(1)(b) GDPR) and compliance with legal obligations, for example tax, accounting and data protection obligations (Article 6(1)(c) GDPR).
- Operating and securing the website: HWP's legitimate interest in ensuring availability, detecting errors, preventing spam, abuse and security incidents, and establishing or defending legal claims (Article 6(1)(f) GDPR).
- Non-essential cookies or similar technologies: consent, if HWP were to introduce them at a later date (Article 6(1)(a) GDPR and Article 225 of ZEKom-2). No analytics or marketing technologies are currently planned.
Ticking the box confirming that you have read the privacy notice is merely an acknowledgement and does not constitute consent or an independent legal basis. If HWP were to introduce a newsletter or other marketing communication, a separate, optional, unticked-by-default choice with a simple means of withdrawal would be provided for it.
4. Whether you are required to provide the data
Fields marked as required are necessary for HWP to understand and handle your enquiry. If you do not provide them, it may not be possible to send a response through the form. You are not required to provide optional data.
5. Recipients and data processors
The data may be accessed by authorised HWP personnel and by providers who deliver technical services for HWP and process data on HWP's instructions:
- Hostinger – hosting the website on the primary server in the Netherlands, content delivery/CDN, the outgoing server
smtp.hostinger.comfor sending messages from the web form, and forwarding and retaining a copy of the email; - Hostko – hosting the final work email inbox, to which messages received at julijana@hwp.si are automatically forwarded;
- Defiant, Inc. (Wordfence) – protecting the WordPress website, detecting malicious requests and security events;
The web form sends the message via FluentSMTP using the smtp.hostinger.com server and the julijana@hwp.si address. The message is then automatically forwarded to the work inbox hosted by Hostko. Hostinger retains a copy of the message after forwarding.
We may also disclose data to public authorities or other recipients where required by law or necessary to establish, exercise or defend legal claims.
6. Transfers outside the European Economic Area
HWP's website is hosted primarily on a server in the Netherlands, which is within the European Economic Area.
Some providers may process data outside the European Economic Area or allow remote access from third countries. Where there is no European Commission adequacy decision, HWP carries out any such transfer only using an appropriate mechanism under Chapter V GDPR, typically standard contractual clauses, together with additional safeguards where necessary.
7. Retention periods
- Enquiries that do not lead to a working relationship: a maximum of 12 months after the last substantive communication; once this period expires, HWP deletes the copy in the Hostinger inbox and the forwarded copy in the Hostko inbox.
- Proposal and contractual communication: for the duration of the relationship and thereafter for as long as required by statutory time limits or necessary for legal claims.
- Accounting and tax documentation: for the periods laid down by applicable regulations.
- Wordfence Live Traffic and FluentSMTP logs: a maximum of 30 days, unless longer retention of a specific record is necessary because of a security incident or legal claim.
- Cookie choice settings: 365 days, in line with the current Complianz configuration, or until withdrawn or re-chosen.
8. Your rights
Subject to the conditions set out in the GDPR, you may request access to your personal data, its rectification, erasure, restriction of processing, and data portability. You may object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing before the withdrawal.
Send your request to julijana@hwp.si. HWP will respond without undue delay and, as a rule, within one month. In complex cases or where there is a large number of requests, this period may, under the conditions set out in the GDPR, be extended by a further two months at most. Before responding, HWP may request information reasonably necessary to verify your identity.
9. Complaints to the supervisory authority
If you consider that your personal data is being processed in breach of the regulations, you have the right to lodge a report or complaint with the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, Slovenia, www.ip-rs.si.
10. Automated decision-making
Through this website, HWP does not make decisions based solely on automated processing that would produce legal effects concerning individuals or similarly significantly affect them, and does not carry out profiling of visitors.
11. Security and project data
Please do not send individual pay data, employee lists or other personal data in your initial enquiry. Secure transfer of project data, access, encryption, storage, deletion, and the roles of controller and processor are determined by contractual agreement. Pseudonymised data is still personal data.
12. Cookies and managing your choice
Details of the cookies and similar technologies actually in use are set out on the Cookies page. You can change your settings at any time via the "Manage consent" link in the website footer.
13. Changes to this notice
This notice is updated whenever the purposes, legal bases, providers, procedures or applicable requirements change. The date and version must remain visible at the top of the page.