Privacy policy

Thank you for showing interest in our services. Protecting your privacy and personal data is a top priority for Expeditus Systems, Proizvodnja in prodaja komukacijskih naprav, Lena Grabec s.p. (hereinafter referred to as Expeditus Systems). You can browse our website and its subpages without having to provide any personal information. However, in order to access certain additional services, the processing of basic personal data may be necessary. Where there is no legal basis for such processing, we will always ask for your explicit consent.

For more details on how our website uses cookies, please refer to section “3. Cookies” below. You can also find more information on how Google processes your data at:
https://business.safety.google/privacy/

The processing of personal data such as name, surname, address, email address, or telephone number is always carried out in accordance with the applicable Personal Data Protection Act, the Electronic Communications Act, and the EU General Data Protection Regulation (GDPR). The purpose of this Privacy Statement is to inform you clearly about which personal data we collect, how it is used, what your rights are regarding your data, and how you can exercise those rights.

As the data controller, Expeditus Systems has implemented a variety of technical and organizational measures to ensure the comprehensive protection of the personal data we process. However, it is important to note that data transmission over the internet can be subject to security vulnerabilities, and complete protection cannot be guaranteed so we advice the user to be careful.

Definitions

This privacy statement is based on the definitions provided in the General Data Protection Regulation (GDPR). To facilitate understanding, we explain the terminology used below:

a) Personal Data
Personal data means any information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”). An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person.

b) Data Subject
A data subject is an identifiable natural person whose personal data is processed by the data controller.

c) Processing of Personal Data
Processing means any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

d) Restriction of Processing
Restriction of processing means marking stored personal data with the aim of limiting their processing in the future.

e) Automated Decision-Making, Including Profiling
This refers to any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

f) Anonymization (also Pseudonymization)
Anonymization means processing personal data in such a manner that they cannot be attributed to a specific individual without additional information which is kept separately and is subject to technical and organizational measures to ensure non-attribution.

g) Controller
The controller is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

h) Processor
The processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

i) Recipient
Recipient means a natural or legal person, public authority, agency or another body to which the personal data are disclosed, whether a third party or not. Public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.

j) Third Party
Third party means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorized to process personal data.

k) Consent
Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them for a specific purpose.

Name and Address of the Data Controller
The data controller, for the purposes of the Personal Data Protection Act, the Electronic Communications Act, and the GDPR, is:

Expeditus Systems, Proizvodnja in prodaja komukacijskih naprav, Lena Grabec s.p.

Šercerjeva 14 street, 2380 Slovenj Gradec, Slovenia

info@expeditussystems.com

https://expeditussystems.com

Cookies

The website of Expeditus Systems uses cookies, which are small text files sent to your browser when you visit the website.

Nowadays, almost all websites use cookies as they allow the recognition of users, store data about their visits, and provide a more user-friendly and seamless service experience.

With cookies, we customize the content on our website, remember your preferences, and record visits to our online store. This makes browsing faster, smoother, and more efficient.

You can disable cookies at any time in your web browser settings. You can also delete cookies that have already been set at any time. If you disable cookies, some functions of the website may no longer work properly.

By clicking the "Accept" button, you consent to the use of cookies and tools that improve the quality and functionality of our services, enable functional and personalized website design, measure the effectiveness of our ads and campaigns, customize content, and display personalized information for marketing purposes.

These tools allow for tailored advertising, advanced analytics, and evaluation based on target groups and user behaviour. This includes accessing and storing data on your device. If you do not wish your data to be processed as described here, you can close the notification banner by clicking the X or selecting "Reject All." You can withdraw your consent at any time with future effect. In the cookie settings, you can choose exactly which cookies you allow and which you do not.

For more information about how Google processes your data, please visit: https://business.safety.google/privacy/

Collection of General Data and Information

When an individual visits the website of Expeditus Systems, certain general data and information are automatically collected and stored in server log files. These may include: (1) the type and version of the browser used, (2) the operating system of the device accessing the site, (3) the referring website (so-called referrer), (4) visited subpages, (5) date and time of access, (6) IP address, (7) internet service provider, and (8) other similar data that can help protect our IT systems from potential attacks.

Expeditus Systems does not draw any personal conclusions about users from this data. The information is used solely for the following purposes: (1) proper delivery of website content, (2) optimization of content and advertising, (3) ensuring long-term reliability of our IT and web technologies, and (4) assisting law enforcement in case of cyberattacks. Therefore, the data is processed anonymously and statistically to improve data protection and security, ensuring the highest possible level of personal data protection.

It is important to note that anonymous server log data is stored separately from any personal data provided by users.

Registration on Our Website

Users have the option to register on the website by providing personal data through the designated registration form. The collected personal data is stored and used solely for the internal purposes of the data controller. Certain personal data may be shared with processors, for example, for services such as package delivery, who also use the data exclusively for internal purposes.

At the time of registration, the IP address assigned to the user by their Internet Service Provider (ISP), along with the date and time of registration, is also recorded. This information is necessary to prevent misuse of our services and, if needed, to support investigations of criminal activities. Storing these data is essential to protect the data controller, and they will not be shared with third parties unless required by law or for criminal prosecution purposes.

Registration allows the data controller to provide users access to content or services that are only available to registered users due to their nature. Registered users may modify or completely delete their personal data stored on the data controller’s server at any time.

Upon request, the data controller will provide individuals with information about their stored personal data and will correct or delete such data if there are no legal obligations to retain it (e.g., tax requirements). All employees of the data controller are available as contact persons for any questions related to the management of personal data.

Newsletter Subscription

Users of the online store and website of Expeditus Systems have the option to subscribe to newsletters. The personal data submitted for processing is specified in the registration form used for subscription.

Expeditus Systems informs its customers and business partners about company offers via email. Only individuals who (1) have a valid email address and (2) voluntarily subscribe can receive these newsletters.

Upon subscribing, the user will receive a confirmation email (double opt-in) to verify that they are the authorized owner of the email address to receive such communications.

When subscribing, the user’s IP address, as assigned by their internet service provider (ISP), along with the date and time of registration, are recorded. This data is collected to prevent abuse of our services and, if necessary, to enable investigation of any criminal acts. The collected information is not shared with third parties unless legally required or for criminal prosecution.

Personal data collected through the newsletter subscription is used solely for sending newsletters. Subscribers may also receive important notifications regarding changes to the newsletter service or content. Personal data will not be disclosed to third parties.

Subscribers can unsubscribe at any time to stop receiving newsletters. They may also withdraw consent for personal data processing at any time. Every email contains an unsubscribe link for easy opt-out. Unsubscription can also be performed directly via the website or by contacting the data controller through other means such as email

Newsletter Tracking

The newsletter system used by Expeditus Systems includes so-called tracking pixels - small graphic elements embedded in HTML emails. These pixels allow the collection of statistical data on the success of email campaigns, such as whether an email was opened and which links were clicked.

The data collected through these tracking pixels is stored and analysed to improve the content of the newsletters and tailor it to the interests of individual recipients. This information is not shared with third parties.

Recipients have the right to withdraw their consent at any time, as granted during the double opt-in subscription process. Upon withdrawal, all associated personal data will be deleted. Expeditus Systems will automatically treat any unsubscription from the newsletter as a withdrawal of consent for data processing.

Option to Contact the Company via the Website

The website of Expeditus Systems allows users to communicate directly with the company through a contact form that requires an email address. If a user reaches out to the company via this form, the personal data they provide is automatically stored. This information is submitted voluntarily and is used solely to allow the company to respond to the inquiry or establish further contact. The collected data will not be shared with third parties.

Data Subject Rights

a) Right to Confirmation
Before any personal data is collected, the controller must obtain the individual’s clear, voluntary, and informed consent for processing. If a data subject wishes to exercise this right, they can contact the controller at any time.

b) Right of Access
The data subject has the right to access their personal data processed by the controller and to obtain a copy of that data. Under the GDPR, they are also entitled to the following information:

the purpose of the processing;
the categories of personal data concerned;
the recipients or categories of recipients (especially if in third countries or international organizations);
the envisaged storage period or the criteria used to determine that period;
the existence of rights to rectification, erasure, or restriction of processing;
the right to lodge a complaint with a supervisory authority;
the source of the data, if not collected from the individual;
the existence of automated decision-making, including profiling, and meaningful information about the logic involved and its consequences for the individual.

If data is transferred to a third country or international organization, the data subject has the right to be informed about appropriate safeguards in place.

c) Right to Rectification
The data subject has the right to request the correction of inaccurate personal data held by the controller and the completion of incomplete data. This right can be exercised at any time by contacting the controller.

d) Right to Erasure ("Right to be Forgotten")
The data subject may request the deletion of their personal data if any of the following conditions are met:

the data is no longer necessary for the purposes for which it was collected;
consent has been withdrawn and there is no other legal basis for processing;
the individual objects to the processing and there are no overriding legitimate grounds for processing;
the data was processed unlawfully;
deletion is required to comply with legal obligations under EU or Member State law.

If the data has been made public, the controller will take reasonable steps to inform other processors of the erasure request.

e) Right to Restriction of Processing
The data subject may request a temporary restriction of processing of their personal data in the following cases:

they contest the accuracy of the data (while verification is ongoing);
the processing is unlawful, and they request restriction instead of erasure;
the controller no longer needs the data, but the individual requires it for legal claims;
they have objected to processing and await the outcome of the balancing test between legitimate interests.

f) Right to Data Portability
The data subject has the right to receive their personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller, provided that:

the processing is based on consent or a contract;
the processing is carried out by automated means.

Where technically feasible, they may also request the direct transmission of data from one controller to another.

g) Right to Object
The data subject may object at any time to the processing of their personal data based on the controller’s legitimate interests (Article 6(1)(f) GDPR), including profiling. In such cases, the controller must stop processing the data unless it demonstrates compelling legitimate grounds that override the interests, rights, and freedoms of the data subject.

If Expeditus Systems processes data for direct marketing purposes, the data subject has the right to object at any time. Upon objection, the controller will immediately stop processing data for marketing purposes.

h) Rights Related to Automated Decision-Making
The data subject has the right not to be subject to a decision based solely on automated processing (including profiling), which produces legal or similarly significant effects, unless:

the decision is necessary for entering into or performing a contract;
the processing is authorized by EU or Member State law;
it is based on the data subject’s explicit consent.

In such cases, the controller must implement appropriate safeguards to protect the data subject’s rights and freedoms.

i) Right to Withdraw Consent
The data subject has the right to withdraw previously given consent to personal data processing at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

Protection of Personal Data When Using Instagram Services

This website includes integrated features from the social media platform Instagram, which allows users to share photos and videos and distribute such content across other social networks. Instagram functions as an audiovisual platform for content exchange among users.

The provider of the Instagram service is Instagram LLC, located at 1 Hacker Way, Building 14 First Floor, Menlo Park, CA, USA.

When a user visits any subpage of the Expeditus Systems website that includes an Instagram component (such as the Instagram button), their browser automatically loads content from Instagram servers. During this process, Instagram receives information that the user has accessed a specific subpage of the website.

If the user is logged into their Instagram account at the time, Instagram can track which subpages of the Expeditus Systems website they visit during the session and link this data to the user's personal Instagram profile. If the user interacts with the Instagram button or feature on the website, Instagram records this interaction and associates it with their account.

Even if the user does not click on any Instagram elements, Instagram still receives information about the website visit if the user is logged in to Instagram at the time. To prevent this data transmission, users should log out of their Instagram account before visiting the Expeditus Systems website.

For more information about how Instagram handles personal data, please visit:
https://help.instagram.com/155833707900388
https://www.instagram.com/about/legal/privacy

Payment Method: Data Protection When Using PayPal as a Payment Processor

This website includes integrated components of the PayPal payment service. PayPal is a provider of online payment services that enables both individuals and businesses to make electronic transactions. Payments are made either through PayPal accounts—virtual accounts tied to an email address—or through credit card payments without requiring a PayPal account. PayPal also offers buyer protection and transaction management features.

The European operating company for PayPal services is:
PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg, Luxembourg.

If a user selects PayPal as a payment option during the checkout process on the Expeditus Systems website, personal data is automatically transmitted to PayPal to facilitate the payment process. By choosing PayPal, the user consents to the transfer of personal data necessary for completing the transaction.

The personal information shared with PayPal typically includes the user's name, surname, billing and shipping address, email address, IP address, phone number, and other relevant payment-related data. Additional data may be transmitted as required to process the transaction or fulfill the purchase.

The transfer of data serves purposes such as payment processing and fraud prevention. In certain cases, data may also be provided to credit agencies to verify identity and assess creditworthiness, based on a legitimate interest.

PayPal may share personal information with its affiliates, service providers, or subcontractors if necessary to fulfill contractual obligations or process data on behalf of Expeditus Systems.

Users have the right to withdraw their consent for PayPal to process personal data at any time. However, this does not affect data already required for contractual or legal purposes related to payment processing.

For more information about PayPal’s privacy practices, please visit:
https://www.paypal.com/us/webapps/mpp/ua/privacy-full

Legal Basis for Personal Data Processing

The legal basis for processing personal data, when consent is obtained from the individual for a specific purpose, is set out in Article 6(1) of the GDPR. If the processing is necessary for the performance of a contract to which the individual has voluntarily agreed—such as for the delivery of goods or provision of services—this is based on Article 6(1)(b) of the GDPR. The same applies to processing necessary for pre-contractual measures, such as inquiries about our products or services.

If the processing of personal data is required by law, for example to fulfill tax obligations, it is based on Article 6(1)(c) of the GDPR. In exceptional cases, where it is necessary to protect the vital interests of the individual or another person—for example, if a visitor to the company is injured and their personal details must be shared with a doctor, hospital, or another third party—the processing is based on Article 6(1)(d) of the GDPR.

Finally, processing may be carried out based on the legitimate interests of the company or a third party, as outlined in Article 6(1)(f) of the GDPR. This applies to processing activities not covered by other legal bases, provided that these interests do not override the interests, rights, and freedoms of the individual which require protection of personal data. The European legislator explicitly allows such processing because legitimate interests are often justified, especially when the individual is a customer of the data controller (see Recital 47, second sentence, GDPR).

Legitimate Interests of the Controller or Third Parties

When the processing of personal data is based on Article 6(1)(f) of the GDPR, our legitimate interests focus on conducting business operations with an emphasis on the well-being of all employees.

Retention Period of Personal Data

The retention period for personal data is determined by the applicable legal retention requirements. Once this period expires, the relevant data is routinely deleted, provided it is no longer necessary for the fulfillment or initiation of a contract.

Provision of Personal Data as a Legal or Contractual Requirement

Certain personal data must be retained due to legal obligations (e.g., tax regulations) or contractual requirements (e.g., information about contractual partners). In some cases, individuals must provide their personal data in order for a contract to be concluded. Without this data, entering into a contract with the individual is not possible. Before providing personal data, individuals may contact an employee at Expeditus Systems, who will explain whether providing personal data is legally or contractually mandatory and what the consequences are if the data is not provided.