The purpose of the privacy policy is to inform users of our services, employees, and other natural persons (hereinafter: “individual” or “user”) who work with or interact with CRMT d.o.o. (hereinafter: “company” or “CRMT”) on the purposes, legal bases, security measures, and rights of individuals regarding the processing of personal data carried out by our company when using the services on the website crmt.com / crmt.si or when entering into contact with us.
This privacy policy applies to all visitors and users of the website crmt.com / crmt.si, whereby users can only be adults with full legal capacity.
We value your privacy, so we always protect your data carefully.
We process personal data in accordance with European legislation (Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter: “General Regulation” or “GDPR”)), current Slovenian legislation in the field of personal data protection (ZVOP-2), and other legislation providing the legal basis for processing personal data records.
This personal data protection policy outlines how our company, as the controller, processes personal data received from individuals on lawful grounds.
1. Administrator:
The administrator of personal data is the company:
Name: CRMT d.o.o.
Adress: Ukmarjeva ulica 2, 1000 Ljubljana
https://www.crmt.com/
E-mail: dpo@crmt.com
Phone: +386 (0) 5 994 3 700
2. Authorized person
The following individuals are appointed as Data Protection Officers:
Tadej Kreča, Head of Project Management Office, dpo@crmt.com (responsible for personal data protection when the organization acts as a data processor).
Tea Založnik, Office Manager, dpo@crmt.com (responsible for protecting the organization’s internal personal data filings).
3. Personal data
Personal data means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. Data that has been anonymized so that it does not allow the identification of a specific individual is no longer considered personal data.
4) Purposes of processing and basis for data processing
The company collects and processes your personal data on the following legal bases as set out in the General Regulation:
- Consent of the data subject – Article 6(1)(a) of the General Regulation;
- Performance of a contract or steps prior to entering into a contract – Article 6(1)(b) of the General Regulation;
- Compliance with a legal obligation – Article 6(1)(c) of the General Regulation;
- Legitimate interests pursued by the controller or a third party – Article 6(1)(f) of the General Regulation;
- Protection of vital interests of the data subject or another natural person – Article 6(1)(d) of the General Regulation.
Is the provision of personal data obligatory? The provision of personal data for the performance of a contract (Article 6(1)(b) of the GDPR) constitutes a contractual obligation or a requirement necessary to enter into a contract. The provision of data in connection with fulfilling obligations determined by law (Article 6(1)(c) of the GDPR) is a statutory obligation. If you do not wish to provide us with your personal data, we cannot enter into a contract with you or exercise rights and duties arising from the contractual relationship.
4.1) Processing Based on Consent (Article 6(1)(a) GDPR)
Insofar as the company does not have a legal basis demonstrated on the basis of law, contractual obligation, or legitimate interest, it may request the individual’s consent. The company processes personal data based on consent for the following purposes:
- E-newsletters and notifications: Based on your subscription to e-newsletters, we use your e-mail address to send information about our offer, services, campaigns, and events. Subscriptions are collected through a web form provided by Pipedrive, and e-newsletters are sent using Pipedrive and/or Brevo. The provider of the tool processes the data as our processor in accordance with section 6. You can withdraw your consent at any time by clicking the unsubscribe link at the end of each e-newsletter or by sending a request to dpo@crmt.com;
- Residential address and e-mail address for notification and communication purposes;
- Photos, video recordings, and other content relating to individuals (e.g. publication of photos on the company website) for documenting activities and informing the public;
- Other specific purposes to which the individual explicitly consents.
The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
4.2) Execution of Contracts and Pre-contractual Measures (Article 6(1)(b) GDPR)
In the event that an individual enters into a contract with the company or submits an inquiry, this constitutes the legal basis for processing personal data.
- Sales Contracts, Orders, and Inquiries: Contact forms, support forms, and demo request forms are published on the website. These forms are provided by Pipedrive. Data entered in a form is not stored on the website but is transferred directly to our customer relationship management (CRM) system, Pipedrive. Mandatory data is processed to process inquiries or execute orders. If mandatory data is not provided, processing your request or executing the contract will not be possible.
- Employment Applications (Employment Contract): Personal data obtained when applying for a published job vacancy by e-mail is processed exclusively to the extent necessary for selecting a suitable candidate (measures at the request of the data subject prior to entering into a contract). You are not obliged to provide the data, but doing so may prevent us from considering you in the selection process. Data is retained until the purpose is fulfilled or until appeal procedures for unselected candidates are concluded.
- Cooperation Proposals (Cooperation Contract): Personal data submitted when proposing or applying for business cooperation is processed strictly as necessary for the proposed cooperation. If data is withheld, cooperation may not be possible. Data is retained until the purpose is fulfilled or appeal procedures are completed.
4.3) Legitimate Interest (Article 6(1)(f) GDPR)
The company may also process personal data on the basis of legitimate interests, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject. When relying on legitimate interest, the company always conducts a balance assessment in accordance with the GDPR.
The company pursues the following processing activities based on legitimate interest:
- Log Files when Visiting the Website (crmt.com / crmt.si): Upon accessing the website, data is automatically collected in log files, including: IP address, name of accessed file, date and time of access, volume of data transferred, notification of successful access, ISP provider, operating system, browser type, and referrer URL. Log files are processed to ensure website functioning, system stability, data security, and protection of assets/business secrets.
- Video Surveillance of Access to CRMT Premises: Video surveillance at premises entrances is conducted to prevent damage to property and ensure the safety of people.
- Communication with Customers under Electronic Communications Legislation: If you did not object at the time of purchase or initial contact, we may inform existing customers about our offer by e-mail. You may opt out of receiving such messages at any time via the unsubscribe link or by contacting dpo@crmt.com.
- Direct Marketing and General Information: The company may process personal data (name, surname, address, phone number, e-mail) collected from publicly available sources or during lawful business activities for offering goods, services, employment, and events. Individuals can request the termination of such processing at any time.
4.4) Fulfillment of Legal Obligations (Article 6(1)(c) GDPR)
The company processes personal data based on statutory provisions (e.g. labor law, social security, tax legislation, and regulations in the field of service vigilance). Data processed includes employee names, gender, birth details, tax IDs, address, etc.
4.5) Protection of Vital Interests (Article 6(1)(d) GDPR)
The company may process personal data insofar as it is necessary to protect the vital interests of the individual or another natural person (e.g. verifying identity or contacting relatives in medical emergencies).
4.6) Partner Events, Co-organized Events, and Sharing of Attendee Data
From time to time, CRMT may organize events, webinars, or training sessions together with business partners (co-organizers, sponsors, speakers, technology vendors) (“Event Partners”).
- Categories of Personal Data: Name and surname, company name, job title, business email address, business phone number, country, registration status, attendance status, event preferences.
- Purposes: Event delivery and administration, logistics, post-event communication strictly related to the event, and aggregated reporting.
- Legal Bases: Performance of contract/registration, legitimate interest for event delivery, and explicit consent if an Event Partner wishes to use contact details for its own direct marketing (opt-in at registration).
- Transparency: Event Partners are identified at or before registration.
5. Storage and deletion of personal data
The company retains personal data only for as long as necessary to fulfil the purpose for which it was collected:
- Statutory Basis: Data is retained for periods prescribed by applicable law (e.g. tax/accounting records are kept for 10 years).
- Contractual Relationship: Data is retained for the duration of contract performance and for an additional 6 years after its termination (general limitation period).
- Warranty and Defect Claims: Data related to warranties or legal material defects is retained for 7 years.
- General Web Inquiries: Data is retained for 3 months.
- Legal Disputes: In case of litigation, data is retained for 10 years after final court judgment/settlement, or 5 years from out-of-court resolution.
- Log Files (Logfile): Data is retained until limitation periods expire or as required for system security.
- Video Surveillance: Recordings are retained for [INSERT NUMBER OF DAYS/MONTHS, E.G., 30 DAYS] after creation or until legal proceedings conclude.
- Consent and Legitimate Interest: Data is retained until consent is revoked or deletion is requested. Upon receipt of withdrawal, data is deleted within 15 days at the latest. Data processed for e-newsletters based on consent is stored until consent is withdrawn.
Upon expiration of retention periods, personal data is permanently deleted or anonymized.
6. Contractual processing of personal data and data export
The company may entrust contractual processors (accounting services, IT maintenance, e-mail providers, cloud software, etc.) with personal data processing. Processors act strictly on behalf of and according to written instructions from the controller. The company maintains an updated list of contractual processors.
Processors for the website and marketing
For the operation of the website and for marketing, we work mainly with the following processors:
- Optiweb d.o.o., Kapucinski trg 7, 4220 Škofja Loka, Slovenia: development, maintenance and hosting of the website crmt.com / crmt.si;
- Pipedrive OÜ, Estonia: web forms and customer relationship management (CRM), sending of e-newsletters;
- Brevo SAS, France: sending of e-newsletters;
- Google Ireland Limited, Ireland: online questionnaires (Google Forms).
We have concluded data processing agreements with all processors in accordance with Article 28 of the General Regulation. Some providers (Pipedrive, Brevo and Google) may also process data outside the European Economic Area, in particular in the USA. Such transfers are based on the EU-US Data Privacy Framework or Standard Contractual Clauses, as described below.
Transfer of Personal Data to Third Countries: Personal data is not transferred to international organizations or third countries outside the EEA, except to providers in the USA and the United Kingdom (UK):
United States of America (USA): Transfers are conducted pursuant to Commission Implementing Decision (EU) C(2023) 4745 of 10 July 2023 on the adequate level of protection of personal data under the EU-US Data Privacy Framework, or based on Standard Contractual Clauses (SCCs).
7. Automated Decision-Making and Profiling
Automated individual decision-making is not carried out by the company.
In the event that you explicitly consented to receiving e-newsletters or personalized offers, profiling may be carried out based on your stated interests for marketing optimization purposes. Consent to profiling is not a requirement for using the website or services. Individuals have the right to object to profiling or unsubscribe from direct marketing at any time free of charge.
8. Cookies
Cookies saved by the browser can be deleted by the individual (instructions can be found on the websites of the individual browsers).
9. Data Security and Data Accuracy
The company manages information and infrastructure security (premises and application software). Information systems are protected by anti-virus software and firewalls. Technical and organizational measures are implemented to protect personal data against unlawful destruction, loss, alteration, disclosure, or access. Special categories of data are transmitted encrypted and password-protected.
Individuals are responsible for securely providing accurate personal data. The company makes reasonable efforts to ensure data accuracy and may periodically contact data subjects to verify accuracy.
10. Individual Rights Regarding Data Processing
In accordance with the General Regulation, individuals have the following rights:
- Right of Access: Request confirmation of whether personal data is being processed and obtain a copy.
- Right to Rectification: Request correction of inaccurate or incomplete data.
- Right to Erasure (“Right to be Forgotten”): Request deletion of personal data when processing is no longer necessary or upon withdrawal of consent.
- Right to Restriction of Processing: Request temporary suspension of data processing under specified conditions.
- Right to Data Portability: Receive personal data in a structured, commonly used, and machine-readable format.
- Right to Object: Object at any time to processing based on legitimate interest (Article 6(1)(f) GDPR), including profiling and direct marketing.
- Right to Withdraw Consent: Withdraw consent at any time where processing relies on consent.
Exercising Rights: To exercise any rights, send a request by email to dpo@crmt.com or by mail to the company address. Requests will be handled without undue delay and within one month (extendable by up to two months for complex requests). Exercising rights is free of charge, unless requests are manifestly unfounded or excessive.
Right to Lodge a Complaint: If an individual believes processing violates data protection law, they have the right to lodge a complaint with the supervisory authority: Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana (https://www.ip-rs.si/).
11. Terms and Conditions & Intellectual Property
When using the website crmt.com / crmt.si, copyright, trademark, and related intellectual property rights of third parties must be respected. All website content (images, videos, graphics, logos) is protected. Users commit to refraining from any misuse of content. For more details, refer to the General Terms and Conditions and Terms of Business published on the website.
12. Announcement of Changes
Any changes to our Privacy Policy will be published on the company website: https://www.crmt.com/. By using the website, the individual confirms acceptance of this privacy policy.
This Personal Data Protection Policy was updated on: 29. 4. 2024