Last updated: April 2026
This privacy policy explains how Goslarstvo Demšar, popravilo godal, d.o.o. ('we', 'us') collects, processes and protects personal data of visitors to demsarvioline.si. It is prepared in accordance with the EU General Data Protection Regulation (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2).
The controller is Goslarstvo Demšar, popravilo godal, d.o.o., Žabjak 3, 1000 Ljubljana, Slovenia. For any privacy question, contact us at info@demsarvioline.si or on +386 (0)1 426 25 31. We are not legally required to appoint a Data Protection Officer (DPO) and have not appointed one, as we do not carry out large-scale systematic monitoring or large-scale processing of special categories of data.
From the contact form we collect: full name, email, phone (optional), subject and message content. From the rental form we additionally collect: instrument type and size, and player's age (optional). Technical data (IP address, user-agent, request time) is automatically logged in server logs when you visit the site.
Data from the contact form is processed on the basis of GDPR Article 6(1)(b) (pre-contractual steps) or Article 6(1)(f) (legitimate interest in replying to general questions). Data from the rental form is processed under Article 6(1)(b) for the preparation and performance of the rental contract. Server logs and strictly-necessary cookies are processed under Article 6(1)(f) (legitimate interest in security and abuse prevention). Any analytics or marketing cookies are processed solely on the basis of your consent under Article 6(1)(a).
We use your data only to: (1) reply to your enquiry, (2) prepare offers and enter into rental, sale or service contracts, (3) perform contracts and communicate about them, (4) meet statutory obligations (e.g. accounting and tax), and (5) keep the site secure and working correctly. We never use data for marketing without explicit consent.
Enquiries that do not lead to a contract are kept for a maximum of 24 months from the last communication. Data related to concluded contracts is kept for the duration of the contract and thereafter for the periods prescribed by Slovenian tax and accounting law (at least 10 years). Server logs are kept for a maximum of 30 days, unless a security incident requires longer retention for investigation.
We use the following data processors: Vercel Inc. (website hosting), Resend, Inc. (delivery of form submissions to our email inbox), and Cloudflare, Inc. (form abuse protection — Turnstile; your IP address is processed during verification; third-country transfers under Standard Contractual Clauses). We have signed Data Processing Agreements (DPAs) with each processor under GDPR Article 28. We do not sell personal data and we do not share it with third parties for their own purposes. Access within our company is limited to authorised staff.
Some processors (Vercel, Resend, Cloudflare) are based in the United States, or data may be processed outside the EEA. For these transfers we rely on the European Commission's 2021 Standard Contractual Clauses (SCCs) as an appropriate safeguard under GDPR Article 46.
For security, abuse prevention and diagnostics, our host automatically records IP address, request time, page URL, user-agent and referrer. IP address is personal data under EU law. We process these logs on the legal basis of legitimate interest (GDPR Article 6(1)(f)) and keep them for a maximum of 30 days.
The website is not directed at children. The rental form is addressed to parents or guardians of young musicians; we do not collect children's data directly. Under Article 8 of Slovenian ZVOP-2, the age of digital consent in Slovenia is 15 years (stricter than the default 16 in GDPR). For processing personal data of children under 15, parental consent is required.
You have the right to: (1) access your personal data, (2) rectification of inaccurate data, (3) erasure ('right to be forgotten'), (4) restriction of processing, (5) data portability, (6) object to processing based on legitimate interest, and (7) withdraw consent where it was the legal basis. Send your request to info@demsarvioline.si. We will respond within 30 days. Exercising these rights is free, except for manifestly unfounded or excessive requests.
If you believe the processing of your personal data is unlawful, you have the right to lodge a complaint with the national supervisory authority, the Information Commissioner of the Republic of Slovenia. Address: Dunajska cesta 22, 1000 Ljubljana, Slovenia. Email: gp.ip@ip-rs.si. Phone: +386 (0)1 230 97 30. Website: www.ip-rs.si.
We do not carry out automated decision-making that produces legal or similarly significant effects, and we do not build profiles. All decisions about enquiries and contracts are taken by our staff.
A detailed explanation of cookies and your choices is available in the 'Cookie settings' button in the footer. We currently use only strictly necessary cookies (language preference, security). We do not use analytics or marketing cookies. Should we introduce them in future, they will only be loaded after your explicit consent.
Data in transit is protected by HTTPS (TLS). Form submissions are delivered directly to our email inbox and are not stored in a separate database. Access is restricted to authenticated, authorised staff. We review security settings and access logs regularly.
We may update this privacy policy from time to time to reflect changes in our business or in the law. Material changes will be announced on the website. The current version is always available on this page with a 'last updated' date.