Privacy policy

Legal notice on the protection of personal data and the use of cookies

The purpose of the AVR Privacy Policy Tomaž Rozina s.p. (hereinafter: the “Privacy Policy”) is to inform users of AVR services Tomaž Rozina s.p. and other persons (hereinafter also referred to as “individuals”) with the purposes and bases of personal data processing by AVR Tomaž Rozina s.p., Na Roje 12, 1275 Šmartno pri Litiji (hereinafter: “VITAL DISK”) and with the rights of individuals in this field.

With this privacy policy, we want to help you understand what data we collect, why we collect it, and how you can update, manage, export, and delete it. The company places a strong emphasis on the security of your personal data. All provided personal data is processed confidentially and is used only for the purpose for which it was provided. We manage your personal data with the utmost care, taking into account the applicable legislation and the highest standards of its treatment.

In accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter: the “General Data Protection Regulation” (or “GDPR”)), the Privacy Policy covers the following data:

  • contact information of the company AVR Tomaž Rozina s.p.,
  • purposes, bases, and types of processing the different types of personal data of individuals,
  • retention period of individual types of personal data,
  • rights of individuals with regard to the processing of personal data,
  • right to lodge a complaint regarding the processing of personal data,
  • validity of the Privacy Policy.

Personal data collected by the company AVR Tomaž Rozina s.p.

If you are only a visitor to the VITAL DISK website, we only collect data about you through the use of cookies. If you are a user of services or a subscriber of services provided by the company, we also collect other personal data about you, which we need in order to perform the services you have ordered or that you use.

This data is: 

  • your e-mail address for sending offers and e-notifications,
  • your address for product shipping, 
  • your first name and surname, address, e-mail address and telephone number for accepting orders, handling inquiries and sending offers, or dealing with matters in connection with the fulfilment of your other requirements.

Personal data manager

The manager of the personal data collection that is processed in accordance with this Privacy Policy is AVR Tomaž Rozina s.p., Na Roje 12, 1275 Šmartno pri Litiji, 31 639 190.

Purposes and bases of personal data processing

Contractual basis for personal data processing 

As part of the exercise of contractual rights and fulfilment of contractual obligations of the company, we process your personal data for the following purposes: to identify an individual, to prepare an order, to conclude a contract, to notify of any changes, to resolve any technical problems, objections, or complaints, to invoice services, and for other purposes that are necessary for the performance or conclusion of a contractual relationship between a company and an individual.

Legal basis for personal data processing

On the grounds of legitimate interests, we use your personal data to detect and prevent fraudulent use and misuse of services, further to ensure the stable and secure operation of our system and services, as well as to implement data security measures, to meet requirements for quality services, and to detect technical failure of systems and services.

On the grounds of legitimate interests, we also use your personal data for the purposes of any enforcement warrants, judicial and extrajudicial recovery of debts.  

In accordance with the General Data Protection Regulation (GDPR), AVR Tomaž Rozina s.p. may, in case of suspected abuse, process data on individuals to an appropriate and proportionate extent for the purpose of identifying and preventing possible fraud or abuse, and may, if appropriate, pass this information to other providers of such services, business partners, the police, the public prosecutor's office, or other competent authorities. In order to prevent future abuse or fraud, data on the history of identified abuse or fraud in connection with an individual, which includes data on the subscription relationship and, for example, an IP address, may be stored for five years after the termination of the business relationship.

Restrictions on the personal data transfer 

If necessary, we will authorize other companies and individuals to perform certain tasks that contribute to our services. In such a case, the company may also provide personal data to such carefully selected external processors who will enter into a contract with the company for the processing of personal data, or an agreement identical in content, or other binding document (hereinafter: the "Data Processing Agreement"). We will provide or make available such data to external processors only to the extent required for a specific purpose. This data may not be used by an external processor for any other purpose, provided that they meet at least all the standards for the personal data processing, provided for by applicable legislation. External processors are contractually obligated by the company to respect the confidentiality of your personal data. Personal data will not be transferred to a third country or an international organization.

On the basis of a reasoned request, the company AVR Tomaž Rozina s.p., also provides personal data to the competent state authorities that have a legal basis for such a request.

Retention period of personal data

The retention period is determined upon the category of individual data. We keep the data for as long as necessary to achieve the purpose for which the data was collected or further processed, or until the expiration of the statute of limitations for the fulfilment of obligations or the legally prescribed retention period. 

Invoicing data and related contact data on individuals may be kept for the purpose of fulfilling contractual obligations until the full payment of the service or until the expiration of the statute of limitations in relation to an individual claim, which may amount to one to five years. Invoices are kept for 10 years after the end of the year to which the invoice relates in accordance with the law governing the value added tax.

Other data obtained on the basis of your consent is kept for the duration of the business relationship and for additional 2 years after the termination, unless the law provides for a longer retention period. If an individual who gave consent for the personal data processing has not entered into a business relationship with us, the consent is valid for 2 years from the time of its submission or until its revocation. At the end of the retention period, the data shall be deleted, destroyed, blocked or anonymised, unless otherwise provided by law for each type of data.

Rights of individuals with regard to the personal data processing 

We guarantee the exercise of your rights in relation to your personal data processing without undue delay. We will decide on your request within one month of receiving your request. In case of complexity and a large number of requests, the deadline can be extended by a maximum of two additional months. If we extend the deadline, we will notify you of any such extension within one month of receiving the request, together with the reasons for the delay.

Requests regarding the exercise of your rights must be submitted to the following e-mail address or by mail to the following address: AVR Tomaž Rozina s.p., Na Roje 12, 1275 Šmartno pri Litiji. When you submit your request electronically, we will provide you with the information electronically whenever possible, unless you request otherwise. When there is a legitimate doubt as to the identity of an individual who submits a request regarding any of their rights, we may request that they provide us with additional information necessary to confirm the identity of that individual and their personal data.

If the requests of an individual, to whom personal data refers, are manifestly unfounded or excessive, in particular because they are repetitive, the company may:

  • charge a reasonable fee, taking into account the administrative costs of providing information or a notification, or of implementing the requested action, or refuse to act on the request.

We grant you the following rights regarding your personal data processing

  1. Right of access to data
    You always have the right to know whether the personal data in relation to you is being processed. Access to personal data and the following information: purposes of processing, types of personal data, users or categories of users to whom personal data has been or will be disclosed, in particular users in third countries or international organizations. Estimated retention period of personal data or, if this is not possible, the criteria used to determine this period.
  2. Right of correction
    You have the right to correct inaccurate personal data concerning you without undue delay and, taking into account the purposes of the processing, the right to supplement incomplete personal data, including the submission of a supplementary statement.
  3. Right to erasure ("right to be forgotten")
    You have the right to have your personal data deleted without undue delay when one of the following reasons applies:
    - when personal data is no longer needed for the purposes for which it was collected or otherwise processed, 
    - when you revoke the consent on the basis of which the processing takes place, and there is no other legal basis for the processing, 
    - when you object to the data processing and there are no overriding legitimate reasons for processing it,
    - when personal data has been processed unlawfully, 
    - when personal data must be deleted in order to fulfil a legal obligation in accordance with the EU law or the Slovenian legal order.
  4. Right to limit processing
    You have the right to restrict the processing of your personal data when one of the following cases applies:
    - when you dispute the accuracy of data, for a period that allows us to verify the accuracy of personal data,
    - when the processing is illegal and you oppose the deletion of personal data, but, instead, request a restriction on its use,
    - when we no longer need your personal data for the purposes of processing, but you need it to assert, enforce or defend legal claims,
    - if you have filed an objection regarding the data processing that is based on the legitimate interests of the company, until it is verified that our legitimate reasons outweigh your reasons.
    When the processing of your personal data has been restricted in accordance with the preceding paragraph, such personal data, with the exception of its storage, shall be processed only with your consent, either to assert, enforce or defend legal claims, or to protect the rights of another natural or legal person. We are obligated to inform you of such doings before the lifting of the restriction on the processing of your personal data.
  5. Right to personal data portability
    You have the right to receive your personal data that you provided to us in a structured, commonly used and machine-readable form, and the right to pass this data on to another manager without being hindered by the company, when the personal data processing is based on your consent and is performed by automated means. At your request, where technically feasible, personal data may be transferred directly to another manager.
  6. Right to object
    When we process your personal data for direct marketing purposes, you may object to such processing at any time. We will cease processing your personal data, unless we demonstrate compelling reasons for the processing that outweigh your interests, rights and liberties, or for asserting, enforcing or defending legal claims.

Right to lodge a complaint regarding your personal data processing

Any complaint regarding the processing of your personal data can be sent to the following e-mail address: or by mail to the following address: AVR Tomaž Rozina s.p., Na Roje 12, 1275 Šmartno pri Litiji.

In the event that we do not process your request within the legal deadline, or that we reject your request, you have the right to lodge a complaint with the Information Commissioner.

You also have the right to lodge a complaint directly with the Information Commissioner if you believe that the processing of your personal data violates Slovenian or EU regulations in the field of personal data protection (GDPR). If you have exercised your right of access to data and upon receiving the decision you believe that the personal data you received is not the personal data you requested or that you did not receive all of the requested personal data, you can lodge a reasoned complaint with the company within 15 working days before lodging a complaint with the Information Commissioner. We need to consider your complaint as a new request within five working days.