Privacy policy

1.1 Controller

The zastranke.si platform is operated by Računalniško programiranje, Aleksei Glebov s.p., Ljubljanska cesta 28A, 3000 Celje, Slovenia, registration number 7383932000, tax number 36616699. We are not registered for VAT.

This policy sets out what personal data we process, on what legal basis, how long we keep it and what rights you have.

1.2 Contact details

We have not appointed a data protection officer, as this is not mandatory for the scale of our processing. All privacy questions are handled at support@zastranke.si.

1.3 Response times

We answer a request within 30 days of receiving it. If a request is complex or several arrive at once, we may extend the deadline by up to two months; we tell you about the extension and the reason within the original period.

2.1 Business account owners

Businesses and independent professionals who run their schedule, clients and invoices on zastranke.si. For this data we are the controller.

2.2 Clients of those businesses

People who pick an appointment with a business through its booking page. For this data the business is the controller and we are the processor under section eleven.

2.3 Website visitors

Visitors to zastranke.si who do not have an account yet. For them we only process technical access data and essential cookies.

2.4 The two roles of zastranke.si

The same business may deal with us in both roles at once, so the distinction matters.

3.1 Data you give us directly

• Email address and password used to sign in.
• Business or professional name, address and the contact details you publish on your booking page.
• Phone number, if you enter one.
• Service descriptions, durations, prices and working hours.
• The content of messages you send to support.

3.2 Data we collect automatically

When the platform is accessed we log the IP address, request time, browser type and the requested address. We need these records to run the service, detect abuse and fix errors; we keep them for up to 12 months. We do not use advertising or third-party tracking cookies.

3.3 Data about the business's clients

A client books without registering. A name and phone number are required, an email address is not; without a name and phone the booking cannot be submitted. The chosen service, the appointment time and any notes the business adds are recorded too. We process this data solely on the business's instructions.

3.4 Special categories of data

The platform is not designed to collect health data or other special categories. Note fields are free text, so we advise businesses against entering health data; if one does so anyway, the business as controller is responsible for the legal basis.

5.1 Processors

We do not sell personal data and do not pass it on for anyone else's marketing. We use the external providers below; all of them process data in the European Union.

We never see or store payment card details. You enter them directly with the payment service provider, which is supervised as a bank; all that remains with us is the record of a paid invoice.

A map on a business's page loads only once a visitor scrolls it into view. Their browser then reaches the map provider, which sees their IP address; by its own policy it does not log it by default. A business address goes to the coordinate search only when the business presses “Find on the map” in its settings; nothing about a visitor is involved.

5.2 Transfers outside the EU

Processing takes place in the European Union. A transfer outside the EU would require a documented instruction from the business and a lawful transfer safeguard; we make no such transfers. We use no advertising analytics and no third-party visitor tracking.

5.3 Legal requests

We disclose data to an authority only on a valid legal request and only to the extent it requires. Where the law does not forbid it, we inform the person or business concerned.

6.1 What rights you have

• Access to the data we process about you.
• Rectification of inaccurate data and completion of incomplete data.
• Erasure where there is no longer a basis for processing.
• Restriction of processing while a dispute about the data is resolved.
• Portability of your data in a machine-readable format.
• Objection to processing based on legitimate interest.
• Withdrawal of consent where processing relies on it.

6.2 How to exercise them

Write to support@zastranke.si from the email address linked to the account. If we cannot confirm your identity from the request, we will ask for further confirmation. Requests about data for which a business is the controller are forwarded to that business and are not ours to decide.

6.3 Complaint to the supervisory authority

If you believe we process your data unlawfully, you may complain to the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si. You may complain whether or not you contacted us first.

11.1 Parties and subject matter

The business identified through its platform account is the controller. Računalniško programiranje, Aleksei Glebov s.p. is the processor. The subject matter is the provision of the platform for booking, client management and invoicing.

11.2 Categories of data and data subjects

The data subjects are the business's clients and people enquiring about its services. The data covers names, phone numbers, optional email addresses, chosen services, appointment times, the business's notes and the details on issued invoices. Processing lasts as long as the business uses the platform.

11.3 The business's instructions

We process client data only on the business's documented instructions, which include the account settings and written instructions to support@zastranke.si, unless the law requires otherwise. In that case we inform the business before processing, unless such notice is prohibited. If we consider an instruction to breach data protection law, we tell the business so.

11.4 Confidentiality and access

Access to client data is limited to people who need it for their work and are bound by confidentiality. Our staff access a business's data only where this is necessary to operate the platform or to provide support the business has asked for.

11.5 Security measures

We apply technical and organisational measures appropriate to the risk: encryption in transit, password hashing, separated environments, controlled access, regular backups and access logging. We review the measures whenever the system changes significantly.

11.6 Sub-processors

The business consents to the sub-processors below. We impose on them the same data protection obligations that apply to us, and we remain liable for them as for our own acts. The payment service provider is not one of them: it handles the business's subscription payments, not its clients' data. Details are on the Data processing details page.

We notify the business of any replacement or additional sub-processor at least 30 days in advance. Within that period the business may object; if we cannot resolve the objection, the business may terminate the subscription without notice.

11.7 Assistance with data subject requests

We help the business respond to requests for access, rectification, erasure, restriction, portability and objection, as far as the nature of the processing allows. A request a person sends to us is forwarded to the business and is not ours to decide. We also assist with impact assessments and prior consultation with the supervisory authority.

11.8 Breach notification

We notify the business of a personal data breach affecting its data without undue delay, as a rule within 48 hours of becoming aware of it. The notice covers the nature of the breach, the categories of data affected, the likely consequences and the measures taken.

11.9 Return and deletion of data

At the end of processing the business chooses return or deletion of the client data. Following a verified written request to support@zastranke.si we delete the data within 30 calendar days, including backups as they rotate. Data we are required by law to keep, such as issued invoices, is the exception. Cancelling a subscription deletes nothing by itself: the account moves to view-only access and retention continues. Copies kept outside the platform are the business's responsibility.

11.10 Demonstrating compliance and audits

On request we give the business the information needed to demonstrate that our processor obligations are met. An audit or inspection is announced at least 14 days in advance, takes place during working hours and must not compromise the confidentiality of other customers' data. The business bears the cost of the audit unless it reveals a material breach on our side.