Last updated: 4 October 2026
This policy explains how we process personal data when you visit www.ereklamacije.si, send an enquiry, book a demo or email us. It is prepared in accordance with the General Data Protection Regulation (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2). Data that our customers process in the eReklamacije platform is covered in section 10.
1. Controller
The controller of personal data is:
- Provider
- North Motion, Matej Radovan s.p.
- Address
- Podbreznik 15, 8000 Novo mesto, Slovenia
- Registration no.
- 7595085000 (Slovenian Business Register, AJPES)
- Tax no.
- 95236732 (not registered for VAT)
- info@ereklamacije.si
We have not appointed a data protection officer because, given the nature and scale of our processing, one is not required under Article 37 GDPR and Article 45 ZVOP-2. For any data protection question, email us at info@ereklamacije.si.
2. What data we process and why
We only process the data we need for the purposes below.
2.1 Visiting the website
- Data
- IP address, browser and operating system type and version, page visited, referring page and time of the request.
- Purpose
- Serving the website, keeping it running and secure, and preventing abuse.
- Legal basis
- Legitimate interest (Article 6(1)(f) GDPR).
- Retention
- The hosting provider keeps log records for no longer than 30 days.
2.2 Visitor statistics (only with your consent)
- Data
- Page visited, referring page, country, region and city (derived from the IP address), device type, operating system and browser. Visitors are only told apart by an identifier that is valid for one day. We do not store IP addresses and do not use cookies.
- Purpose
- Visitor statistics to improve the website.
- Legal basis
- Your consent (Article 6(1)(a) GDPR and Article 225 of the Slovenian Electronic Communications Act, ZEKom-2). You can withdraw it at any time under “Cookie settings” in the page footer.
- Retention
- Aggregated statistics for no longer than 24 months.
2.3 Enquiries via the “Book a demo” form
- Data
- Company name, work email, monthly number of complaints, current way of handling complaints, page language and time of submission.
- Purpose
- Preparing the demo and replying to your enquiry.
- Legal basis
- Legitimate interest in replying to a business enquiry (Article 6(1)(f) GDPR). If you enquire as a sole trader, also steps taken at your request before entering into a contract (Article 6(1)(b)).
- Retention
- No longer than 12 months after our last communication if no contract is concluded.
2.4 Booking a demo slot
- Data
- First and last name, email address, selected time slot, time zone and anything you enter in the booking form (e.g. phone number or a note).
- Purpose
- Organising and running the demo, and sending notifications and reminders about it.
- Legal basis
- Legitimate interest (Article 6(1)(f) GDPR); for sole traders also pre-contractual steps (Article 6(1)(b)).
- Retention
- No longer than 12 months after our last communication if no contract is concluded.
2.5 Email communication
- Data
- Email address, name, message content and attachments.
- Purpose
- Answering questions and conducting business communication.
- Legal basis
- Legitimate interest (Article 6(1)(f) GDPR); for communication about a contract, performance of the contract (Article 6(1)(b)).
- Retention
- As long as needed for the purpose, as a rule no longer than 12 months after the communication ends. Correspondence that forms part of business records is kept for as long as the law requires.
2.6 Business relationships with customers
- Data
- Name, job title and work contact details of customer contact persons, and invoicing details.
- Purpose
- Concluding and performing the contract, user support and invoicing.
- Legal basis
- Performance of a contract and legitimate interest (Article 6(1)(b) and (f) GDPR), and compliance with legal obligations, e.g. keeping accounting records (Article 6(1)(c)).
- Retention
- For the duration of the relationship and afterwards as long as the law requires (accounting records generally 10 years).
If you choose the website language manually, we remember your choice with a cookie until the end of your browser session. See our Cookie policy.
3. Our legitimate interests
Where processing is based on legitimate interest, these interests are: keeping the website secure and reliable and preventing abuse, replying to business enquiries, organising demos and conducting business communication. You provide the data in a business context and can reasonably expect us to use it to reply to you.
4. Do you have to provide the data?
Providing data is not a statutory or contractual requirement. Without a company name and email address, however, we cannot handle your enquiry, and without the booking form details we cannot confirm a slot.
5. Automated decision-making
We do not make decisions based solely on automated processing and do not carry out profiling (Article 22 GDPR).
6. Who has access to the data
We do not sell data or pass it to third parties for marketing. Access is limited to providers who perform services for us under a data processing agreement (Article 28 GDPR):
- Vercel Inc. (USA): website hosting and visitor statistics.
- Plus Five Five, Inc. (Resend) (USA): sending notifications about submitted enquiries.
- Cal.com, Inc. (USA): booking system.
- ImprovMX Incorporated (USA): forwarding email sent to info@ereklamacije.si.
- The email hosting provider of the mailbox where we receive messages and enquiries.
We may also disclose data to public authorities where the law requires us to.
7. Transfers to third countries
Some providers are based in the USA, so data may be transferred there. Transfers rely on:
- the European Commission adequacy decision for the EU-U.S. Data Privacy Framework (Article 45 GDPR), for providers certified under it (Vercel, Resend, Cal.com), and
- the European Commission Standard Contractual Clauses (Article 46(2)(c) GDPR) in the data processing agreements, for ImprovMX and as an additional safeguard for the other providers.
You can request a copy of the relevant safeguards at info@ereklamacije.si.
8. How long we keep data
Retention periods are listed for each purpose in section 2. When a period ends, we delete or anonymise the data. We review the periods regularly.
9. Your rights
Regarding your personal data, you have the right to:
- access (Article 15 GDPR),
- rectification of inaccurate data (Article 16),
- erasure (Article 17),
- restriction of processing (Article 18),
- data portability (Article 20),
- withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal (Article 7(3)).
Right to object
Where we process data on the basis of legitimate interest, you may object at any time on grounds relating to your particular situation (Article 21 GDPR). We will stop the processing unless we demonstrate compelling legitimate grounds that override your interests, or need the data to establish, exercise or defend legal claims. We do not carry out direct marketing; if we did, you could object to it at any time without giving reasons.
Send requests to info@ereklamacije.si. We reply without undue delay and within one month at the latest; for complex requests this may be extended by up to two further months, and we will tell you if so. Exercising your rights is free of charge. To protect your data, we may ask you to confirm your identity.
You may lodge a complaint with the supervisory authority: Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, Slovenia, gp.ip@ip-rs.si, +386 1 230 97 30, www.ip-rs.si. You may also complain to the supervisory authority of the EU member state where you live or work.
10. Data in the eReklamacije platform
For personal data that our customers (businesses) enter or receive in the platform, such as data of their customers who submit a complaint, the controller is the respective customer. We process that data as a processor, only on the customer’s instructions and under a data processing agreement (Article 28 GDPR).
If you submitted a complaint to a company that uses eReklamacije, please contact that company for information and to exercise your rights. If you send the request to us, we will forward it to the customer.
The platform and customer data are hosted on servers in Slovenia. For AI features we use the sub-processor OpenRouter, Inc. (USA) under Standard Contractual Clauses; AI is only used at a user’s request. The list of sub-processors is part of the data processing agreement and is available to customers on request.
11. Security
We use appropriate technical and organisational measures: encrypted connections (HTTPS), access limited to authorised persons, backups and providers that offer an adequate level of protection. See Security and compliance.
12. Children
The website is intended for businesses and is not directed at children under 15. We do not knowingly collect their data.
13. Cookies
The cookies and similar technologies we use are described in our Cookie policy.
14. Changes
We may update this policy, for example when our providers or the law change. The current version, with its last-updated date, is always published on this page. If we wanted to use data for a new purpose, we would inform you beforehand (Article 13(3) GDPR).