ARTI INŽENIRING d.o.o., Ulica Ivana Suliča 6A, 5290 Šempeter pri Gorica (hereinafter: the data controller) obtains and processes personal data of individuals while conducting its business. In order to provide you with basic information about the processing of personal data, we have drafted this Privacy Policy.

The policy contains several sets of information for the individuals that is provided under the General Regulation on the Protection of Personal Data (hereinafter: GDPR), which are sectioned according to the purpose for which the personal data of individuals is processed.

The controller processes personal data when you:
- use the website arti.si,
- contact us via e-mail or web contact form,
- conclude a contract for the provision of services;

Data controller information:
ARTI INŽENIRING d.o.o.
Ulica Ivana Suliča 6A
5290 Šempeter pri Gorici
ID number: 2246783000
e-mail tajnistvo@arti.si
Phone: +386 (0)31 628 389

 • DATA PROCESSING WHEN VISITING OUR WEBSITE

Te informacije o obdelavi osebnih podatkov so namenjene posameznikom, ki obiščejo spletno stran arti.si (v nadaljevanju: spletna stran).

• Purpose of processing and types of personal data

The controller processes your personal data when visiting the website in order to monitor and ensure the operation and security of the website use.

When visiting the website, data processing is performed and includes:
- the time of access to the website,
- your IP address,
- the address of the (sub)website,
- browser settings and information about the operating system of the computer or mobile device,
- the content you access on the website,
- your preferred language settings.

Za obisk spletne strani je obdelava navedenih osebnih podatkov nujna, saj predstavljajo t.i. nujne piškotke, o katerih si lahko več preberete v Cookie policy

• Legal basis for the processing of personal data
This processing is carried out on the basis of the controller's own legitimate interest (point (f) of Article 6 (1) of the General Data Protection Regulation (GDPR)).

• Explanation of legitimate interests
Upravljavec lahko obdeluje osebne podatke posameznika, ki uporablja spletno stran zaradi:

Ensuring information security and the operation of information systems
The controller performs the processing of personal data to ensure information security and operation of information systems, network and information security, prevention of unauthorized access to the controller's information systems and response to computer security threats and incidents. To this end, the operator also performs technical maintenance of the websites and services.

To prevent and detect abuse and conduct that may have signs of criminal conduct
In case of suspicion of abuse or criminal conduct, the controller may process data on users of websites and online services to an appropriate and proportionate extent for the purpose of identifying and preventing possible fraud or abuse (so-called black list) and may, if appropriate, provide this information to the competent authorities.

• Categories of personal data users: 
The controller may provide the personal data of the individual visiting the website to the following persons:
- external IT website service providers,
državnim organom na njihovo zahtevo ali primeru sumov kaznivih ravnanj;

• Information on transfers of personal data to a third country or international organization
- state authorities at their request or in case of suspicion of criminal conduct;

• Period of personal data storage
When storing individual’s activity data on the website (IP address), the processing and storage will last only for the time specified in the Cookie policyexcept in the case of incidents and violations. Data collected at the time of the identified abuse may be kept permanently.

• Rights of the data subject
An individual may request access to personal data, its rectification, to erasure (not when black-listed), restriction of processing and to object to processing under legitimate interest legal basis. To exercise your rights, contact us at ARTI INŽENIRING d.o.o., Ulica Ivana Suliča 6A, 5290 Šempeter pri Gorici, Slovenija, or on e-mail tajnistvo@arti.si.

• The right to lodge a complaint with the supervisory authority
The controller strives to process your personal data legally and to protect it with appropriate technological and organizational means. If you believe that your personal data is processed by the controller in contravention of the applicable regulations governing the protection of personal data, you have the right to file a complaint with the Information Commissioner of the Republic of Slovenia (address: Dunajska cesta 22, 1000 Ljubljana, e-mail: gp.ip@ip -rs.si, phone: 012309730, website: www.ip-rs.si).

For more information about the analytical and advertising cookies we use on the website, please follow the link to Cookie policy, which is an integral part of this Privacy Policy.

• Processing personal data upon submitting a contact form or sending us e-mail
This information on the processing of personal data is intended for individuals who contact us via email tajnistvo@arti.si or the contact form on our website arti.si.

• Purpose of processing and types of personal data
The controller processes the personal data you have provided in you e-mail message sent to tajnistvo@arti.si or by using our contact form, in order to provide you the information you have requested from us.

• Legal basis for the processing of personal data
This processing is carried out on the basis of the controller's own legitimate interest (point (f) of Article 6 (1) of the General Data Protection Regulation (GDPR)).

The information you provide is:
- contact details (name, e-mail address)
the content of your message;

The controller processes the data for the purpose of communication when you express such a request. Personal data from the contact forms are not used for other purposes. The provision of the requested personal data is necessary so that we can provide you with the information you have requested from us.

• Categories of personal data recipients
The controller cooperates with the processors on technical aspects of the establishment, operation and security of electronic communication. The controller has concluded appropriate DPA contracts with service providers.

• Information on transfers of personal data to a third country or international organization
Data from online communication is transferred to the USA, since the controller uses the services of the e-mail provider Microsoft Corporation, One Microsoft Way, Redmond, Washington, USA. The e-mail provider processes the data within the EU and the US Data Privacy Framework and has relevant contractual clauses embedded in the general terms and conditions of business.

• Period of personal data storage
The controller will process personal data from the contact forms until the purpose of their processing is achieved, i.e. completion of communication with the individual. If the communication is part of a contract, the correspondence it is kept in accordance with its retention period.

• Rights of the data subject
An individual may exercise the right of access to personal data, the right to rectification, restriction of processing, deletion or objection to the processing. The rights can be exercised by contacting us at ARTI INŽENIRING d.o.o., Ulica Ivana Suliča 6A, 5290 Šempeter pri Gorici, Slovenija, or by e-mail: tajnistvo@arti.si.
We will guarantee the exercise of your rights within one month of receiving the request, and this period may be extended by two months under certain conditions. If we extend the deadline, we will inform you about this and the reasons for the delay within one month of submitting the request.

• The right to lodge a complaint with the supervisory authority
An individual may exercise the right of access to personal data, the right to rectification, restriction of processing, deletion or objection to the processing. The rights can be exercised by contacting us at ARTI INŽENIRING d.o.o., Ulica Ivana Suliča 6A, 5290 Šempeter pri Gorici, Slovenija, or by e-mail: tajnistvo@arti.si. We will guarantee the exercise of your rights within one month of receiving the request, and this period may be extended by two months under certain conditions. If we extend the deadline, we will inform you about this and the reasons for the delay within one month of submitting the request.

• The right to lodge a complaint with the supervisory authority

This information is intended for individuals who enter into a contract with the controller or when, at the request of the individual, measures are taken prior to the conclusion of the contract (e.g. negotiations).

• Purpose of processing and types of personal data
In its field of work, the controller concludes contracts both with natural persons - individuals, as well as with legal entities where it processes personal data of their employees, representatives and other contractual partners or their employees. In all the cases mentioned, the personal data of individuals is processed and the purpose of the processing is the conclusion and implementation of the contract.

The data that the controller obtains from the individual when concluding and executing the contract is:
• name and surname,
• address,
• e-mail,
• phone number,
• the company on whose behalf the individual concludes the contract (in cases when the client is a legal entity),
• other data derived from the contract itself and the documentation that is the subject of the contract.

The controller obtains the personal data necessary for the conclusion of the contract directly from the individual. Providing the controller of the above-mentioned data is the individual's contractual obligation. If the individual does not provide the data, the controller will not be able to conclude a contract with him.

In the context of contact executing, the controller may also obtain other personal data from the authorities before which he is authorized to manage the process (e.g. administrative units, municipalities, ministries that issue permits and approvals). This goes for the personal data of the individual with whom he concludes the contract, as well as the data of third persons who act as parties in the procedures he leads, in accordance with regional regulations.

When performing supervision over the construction of buildings, the controller may also obtain and process personal data of third parties (such as laborers on construction sites), which are necessary for the execution of the contract on supervision over construction sites while the scope of data is specified in the regional construction legislation.

An individual's personal data may also be processed for the purpose of preventing and identifying abuses and conduct that could have signs of criminal conduct to the extent necessary to achieve these goals.

• Legal basis for processing personal data
The legal basis for the processing of personal data is the conclusion and exercising of the contract (point (b) of Article 6 (1) of the General Data Protection Regulation (GDPR)).

• Categories of personal data users: 
The controller may share the individual's data to the following entities:
•the competent authorities, within the obligations arising from the concluded contract,
•the investor (in the framework of supervision over the construction sites),
•accounting service (booking of invoices),
•providers of payment services and postal services (execution of transactions),
•to state authorities at their request (inspection procedures) or in case of suspicion of criminal acts,
•to state authorities in accordance with their legislative powers (e.g. Tax administration);

• Information on transfers of personal data to a third country or international organization

Data from online communication is transferred to the USA, since the controller uses the services of the e-mail provider Microsoft Corporation, One Microsoft Way, Redmond, Washington, USA. The e-mail provider processes the data within the EU and the US Data Privacy Framework and has relevant contractual clauses embedded in the general terms and conditions of business.

• Period of personal data storage
Personal data obtained by the controller during the negotiation phase for the conclusion of a contract, which was not concluded, are kept until the conclusion of the negotiations. Data on concluded contracts will be stored in accordance with regional legislation and accounting standards.

• Rights of the data subject
An individual can exercise the right of access to personal data, the right to correction, restriction of processing and transfer of data. The rights can be exercised by contacting us at ARTI INŽENIRING d.o.o., Ulica Ivana Suliča 6A, 5290 Šempeter pri Gorici, Slovenija or by e-mail: tajnistvo@arti.si.
We will guarantee the exercise of your rights within one month of receiving the request, and this period may be extended by two months under certain conditions. If we extend the deadline, we will inform you about this and the reasons for the delay within one month of submitting the request.

• The right to lodge a complaint with the supervisory authority
The controller strives to process your personal data legally and to protect it with appropriate technological and organizational means. If you believe that your personal data is processed by the controller in contravention of applicable regulations governing the protection of personal data, you have the right to file a complaint with the Information Commissioner of the Republic of Slovenia (address: Dunajska cesta 22, 1000 Ljubljana, e-mail: gp.ip @ ip-rs.si, phone: 012309730, website: www.ip-rs.si).

Nova Gorica, May 2023 (version 1.1.)