Privacy policy
In force from 24 October 2026 · version 1.0
This policy explains which personal data we process in the Cenovka service, why, and how you can exercise your rights under the General Data Protection Regulation (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2).
1. Who processes your data
Luka Brecelj s.p., Šutna 131, 4209 Žabnica, Slovenia, tax number 12483133, registration number 9694102000. For data protection questions write to info@cenovka.si. The provider is not required by law to appoint a data protection officer.
We act in two roles in the service:
- As processor for the company that opened your account. This covers items, prices, stores, labels and your user account. That company is the controller of this data; address requests about it to them, and we will help them. The relationship is governed by a data processing agreement.
- As controller for the data we need ourselves: customer contacts, billing, support and the security of the service. This policy covers that data.
2. What we process as controller
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, e-mail and phone of the customer's contacts, company details | Concluding and performing the contract, service notices | Performance of contract (Art. 6(1)(b)) | Term of the contract plus 5 years for possible claims |
| Invoices and payments | Billing for the service and the hardware | Legal obligation (Art. 6(1)(c), Slovenian VAT Act) | 10 years after the end of the year the invoice was issued |
| Sign-ins, IP address, browser type, access time | Security, abuse detection, fault finding | Legitimate interest (Art. 6(1)(f)) | Server logs are overwritten automatically, usually within weeks. IP address and browser type in the audit trail are deleted after 12 months. |
| Acceptance of the terms (version, time, IP address) | Evidence that the contract was concluded | Performance of contract and legitimate interest (Art. 6(1)(b) and (f)) | Term of the contract plus 5 years; IP address 12 months |
| Support messages | Handling questions and fault reports | Legitimate interest or performance of contract | 2 years after the matter is closed |
On a phone, drag the table sideways.
3. This website
The marketing site uses no cookies, no analytics and no third-party content. It has no forms and collects nothing from you. There is no consent banner because there is nothing to consent to. On a visit the server writes only the technical entry described in the table above.
4. User accounts
For a user account we hold the name, e-mail address, role and company. Passwords are stored only as a one-way hash (bcrypt), so nobody can read them. Changes are recorded in the company's audit trail with the time and the person who made them; sign-ins also record the IP address and browser type, and those two are deleted after 12 months. The account is closed by the company that opened it.
A handheld connects to the service with its own token, approved by the company's administrator. The application does not track device location.
5. Browser storage
The application stores in the browser only what is strictly necessary for the functionality you asked for: the sign-in token and basic details of the signed-in user, deleted on sign-out, and your appearance preferences, which stay until you clear them. Under the Slovenian Electronic Communications Act (ZEKom-2) this storage does not require consent.
6. Who receives the data
We do not sell data and do not use it for advertising. We pass it only to providers who help us run the service, under a processing agreement:
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| OVH SAS (OVHcloud) 2 rue Kellermann, 59100 Roubaix, France |
Hosting of the server, the database and daily backups | All data held in the service | Data centre in Germany (EU) |
| Hetzner Online GmbH Industriestr. 25, 91710 Gunzenhausen, Germany |
Storage of encrypted backups at a separate location (storage box) | Encrypted copies of the database (the provider holds no decryption key) | Data centre in Falkenstein, Germany (EU) |
| OVH SAS the same company as above |
Sending system messages (registration confirmation, password reset) | E-mail address and message content | Data centre in the EU |
On a phone, drag the table sideways.
If a company connects the service to its ERP (Vasco, for instance) or uploads a file from its own system, data is exchanged on that company's instruction. We disclose data to public authorities only where the law requires it.
7. Transfers outside the EU
The service is hosted with OVHcloud (OVH SAS, a European company based in France) in a data centre in Germany. Encrypted backups are held at a separate location with Hetzner Online GmbH, also in Germany. We do not transfer personal data to countries outside the European Union or the European Economic Area.
Item and price data is sent to the labels; there is no personal data among it.
8. Security
The connection to the service is always encrypted (HTTPS). Data belonging to different companies is separated, access is limited by role, and credentials for the ERP and the label system are stored encrypted (AES-256-GCM) and never returned to the browser, not even masked. Database backups are made daily and kept for 14 days on the server, with an encrypted copy kept for a further 30 days at a separate location.
9. Your rights
You have the right to:
- access your data and receive a copy of it,
- have inaccurate data corrected,
- erasure, where we no longer need the data or have no legal basis for it,
- restriction of processing and to data portability,
- object to processing based on legitimate interest.
Send your request to info@cenovka.si. We answer within one month at the latest. If the request concerns data for which we are the processor, we pass it to the company that opened your account.
If you believe we process data unlawfully, you may complain to the Information Commissioner, Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si, www.ip-rs.si.
10. Automated decision-making
The service makes no decisions based solely on automated processing or profiling.
11. Changes
We update this policy when the processing changes. Material changes are notified to company administrators by e-mail. The version in force is always published on this page.