Privacy Policy of EVEN d.o.o.

In accordance with Article 37 of the General Regulation, we have not appointed a Data Protection Officer (DPO). If you have any questions regarding the processing of your personal data, please contact us at: info@even.si

We collect your personal data directly from you via email, telephone, or in person. We also obtain your personal data from your curriculum vitae (CV) and cover letter as part of the recruitment process, and when you complete our contact form.

This website also uses cookies. You can learn more about cookies here.

EVEN d.o.o. collects and processes your personal data on the following legal bases:

1. Processing of personal data is necessary for compliance with a legal obligation to which we, as the controller of personal data, are subject.

Based on legal provisions, EVEN d.o.o. processes personal data about its employees and job candidates, as permitted by labor and social security legislation. The company processes the following types of personal data for employment purposes based on legal obligation: name and surname, gender, date of birth, personal identification number (EMŠO), tax number, place, municipality and country of birth, citizenship, residence, etc.

EVEN d.o.o. processes data on issued invoices, payment amounts for products, and payer information (name and surname, bank account number) to monitor monthly payments. This is required by the Value Added Tax Act.

2. Processing of personal data is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract.

In cases where an individual enters into a contract with EVEN d.o.o., this represents the legal basis for processing personal data. EVEN d.o.o. may process personal data for the conclusion and performance of contracts, such as the sale of goods, preparation of offers, participation in various projects, etc. If an individual does not provide personal data, EVEN d.o.o. cannot enter into a contract, nor can the company deliver products in accordance with the concluded contract, as it does not have the necessary data to execute the order. On this basis, the company processes only those personal data that are necessary for the conclusion and proper performance of contractual obligations.

3. Processing of personal data is necessary for the purposes of our legitimate interests.

EVEN d.o.o. may also process personal data on the basis of legitimate interest that it pursues. When using legitimate interest, the company conducts an assessment of compliance with legislation.

4. The data subject has consented to the processing of his or her personal data for one or more specific purposes.

If EVEN d.o.o. does not have a legal basis for processing personal data established on the basis of law, contractual obligation, legitimate interest, or protection of the individual’s life, it may request the individual’s consent to process his or her personal data. When an individual gives consent, the company may process certain personal data for the following purposes: residential address and email address for the purpose of notification and communication, and photographs, video recordings, and other content for the purpose of documenting activities and informing the public about the company’s work and events.

If an individual gives consent to the processing of his or her personal data and at some point no longer wishes to do so, he or she may request that EVEN d.o.o. cease processing his or her personal data by submitting a request via email or regular mail. Upon receipt of the withdrawal or deletion request, his or her personal data will be deleted within fifteen days at the latest. The company may delete this data even before withdrawal when the purpose of processing this personal data has been achieved, or if required by law.

Exceptionally, the company may refuse a request to delete an individual’s personal data for reasons set out in the General Regulation in cases of exercising the right to freedom of expression and information, fulfilling a legal obligation to process, reasons of public interest in the field of public health, archiving purposes in the public interest, scientific or historical research purposes, statistical purposes, establishing or defending legal claims, etc.

Data is processed until withdrawal or revocation of consent or until the purpose of processing is fulfilled. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

5. Processing is necessary to protect the vital interests of the data subject.

EVEN d.o.o. may process the personal data of a data subject if this is necessary to protect his or her vital interests. In urgent cases, the company may search for an individual’s personal document, verify whether this person exists in its database, review his or her medical history, or contact his or her relatives, for which the company does not need the individual’s consent.

EVEN d.o.o. retains personal data only for as long as necessary to achieve the purpose for which the personal data was collected and processed.

If we process personal data on the basis of law, we retain it only for the period prescribed by law. Some personal data is retained only for the duration of cooperation with us, while some personal data is retained permanently.

Personal data that we process on the basis of a contractual relationship with an individual is retained for the period necessary to perform the contract and for six years after its termination, except in cases where a dispute arises between the individual and the company in connection with the contract. In such cases, we retain personal data for ten years after the final court decision, arbitration, or court settlement becomes final, or if there was no court dispute, five years from the date of amicable resolution of the dispute.

Exceptionally, we may refuse a request to delete personal data for reasons set out in the General Regulation, such as: exercising the right to freedom of expression and information, fulfilling a legal obligation to process, reasons of public interest in the field of public health, archiving purposes in the public interest, scientific, historical research, or statistical purposes, and establishing or defending legal claims. After the retention period expires, we effectively and permanently delete or anonymize personal data so that it can no longer be linked to a specific individual.

EVEN d.o.o. may entrust a processor with certain processing of personal data on the basis of a data processing agreement. Processors may process entrusted data exclusively on behalf of the controller, within the limits of its authorization, which is recorded in a written contract or other legal act, and in accordance with the purposes defined in this privacy policy.

The processors with whom EVEN d.o.o. cooperates are primarily:

• accounting service providers,
• providers of human resources, legal, and other business consulting,
• infrastructure maintenance providers (security, cleaning services),
• information system providers and maintenance providers,
• external website maintenance providers,
• email service providers, software and cloud service providers, and
• web analytics providers (Google).

EVEN d.o.o. maintains a register of processors for better oversight and control of processors and the organization of mutual contractual relationships, listing all specific processors with whom we cooperate.

The company does not under any circumstances disclose an individual’s personal data to unauthorized third parties. Processors may process personal data only within the scope of our instructions and may not use personal data for any other purposes.

EVEN d.o.o. as the controller and its employees do not transfer personal data to third countries (outside the member states of the European Economic Area – EU member states plus Iceland, Norway, and Liechtenstein) or to international organizations.

EVEN d.o.o. ensures information security and infrastructure security (premises and application system software). Our information systems are protected by antivirus programs and firewalls, among other measures. We have implemented appropriate organizational and technical security measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, and other unlawful and unauthorized forms of processing. When transmitting special categories of personal data, we transmit them in encrypted form and protected with a password.

As an individual, you are responsible for transmitting your personal data securely and ensuring that the personal data provided is accurate and reliable. We also strive to ensure that the personal data we process is accurate and up to date. For this purpose, we may occasionally contact you to confirm the accuracy of your personal data.

In accordance with the General Regulation, you have the following rights as a data subject regarding the processing of your personal data:

1. Right of Access

You may request information about whether we have your personal data, and if so, you have the right to know what data we have, on what legal basis we process it, and what we use it for. You may also request access to your personal data, which enables you to receive a copy of the personal data we have about you and verify that we are processing it lawfully.

2. Right to Rectification

You may request the correction of incomplete or inaccurate personal data that we process about you.

3. Right to Erasure (“Right to be Forgotten”)

Under certain conditions, you have the right to erasure of personal data. Erasure of your personal data is possible when:

• the purpose of processing personal data has been fulfilled and the data is no longer necessary,
• you withdraw consent,
• you object to the processing of your personal data and there are no overriding legitimate grounds for processing your personal data,
• unlawful processing of your personal data occurs, or
• erasure of your personal data is necessary to comply with a legal obligation.

4. Right to Restriction of Processing of Personal Data

Under certain conditions, you may request restriction of processing of your personal data. You may request restriction of processing of your personal data:

• when you request rectification of personal data,
• when the processing of your personal data is unlawful, but you oppose their erasure,
• when the controller no longer needs your personal data to fulfill the purpose, but you wish to retain your personal data for the purposes of establishing certain rights,
• for the duration of the assessment of an objection to processing that you have filed.

Restriction of processing of personal data is always temporary and ceases when the reason for restriction ceases.

5. Right to Object to Processing of Personal Data

Under certain conditions, you have the right to object to the processing of your personal data. In the event of an objection, we will substantively consider your objection and examine it in relation to our legitimate interest. You may object to the processing of your personal data when processing is based on legitimate interest.

6. Right to Data Portability

You have the right to request that we transmit your personal data that you have provided to us to another controller in a structured, commonly used, and machine-readable format. You may request the transfer of your personal data for personal data processed on the basis of a contractual relationship or consent and carried out by automated means. We can transfer your personal data to another controller only if this is technically feasible. Otherwise, we will transmit the personal data to you.

7. Right to Withdraw Consent

When we process your personal data on the basis of the legal basis of consent, you always have the option to withdraw consent. Upon receipt of notice that you have withdrawn your consent, we will cease processing your personal data. Withdrawal of consent does not affect the validity of processing of personal data retroactively.

We will respond to a request relating to the rights of the data subject without undue delay, and in any case within one month of receipt of the request. If this deadline is extended (by a maximum of two additional months) taking into account the complexity and number of requests, we will inform you of this. Access to an individual’s personal data and the exercise of rights is free of charge for the individual. However, EVEN d.o.o. may charge a reasonable fee if the request of the data subject is manifestly unfounded or excessive, especially if it is repetitive. In such cases, the company may also refuse the request. When exercising rights under this provision, the company may need to request certain information from the individual to help confirm the individual’s identity, which is only a security measure to ensure that personal data is not disclosed to unauthorized persons. If you have any questions regarding the processing of your personal data, you may contact us at any time via email at info@even.si or by regular mail at the company’s address.

If you believe that your rights as a data subject have been violated, you may contact the supervisory authority for protection or assistance, which in the Republic of Slovenia is represented by:

Information Commissioner
Dunajska cesta 22
1000 Ljubljana
Email: gp.ip@ip-rs.si
Web: www.ip-rs.si

EVEN d.o.o. does not carry out automated decision-making or profiling.

Any changes to this privacy policy will be published on our website. By using the website, the individual confirms that he or she accepts and agrees to the entire content of the Privacy Policy of EVEN d.o.o.

The Privacy Policy of EVEN d.o.o. was adopted by the responsible person of EVEN d.o.o. and is valid from December 15, 2025 onwards.