This personal data protection policy (hereinafter: Policy) aims to inform subscribers, users, and other persons (hereinafter: the Data Subject) about the purpose and the grounds for personal data protection by the company and about their rights in this area. At the same time, this policy additionally explains the consent to process data. In accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: General Data Protection Regulation), this Policy includes the following information:
Where appropriate, the provisions relating to the Data Subject are used for the issues of secrecy and confidentiality of communications of users that are legal entities.
The data controller of the Data Subject’s data processed in accordance with the personal data protection policy is Mudita Institute.
Data processing on the grounds of a contract: the Company processes the Data Subject’s personal data for the purposes of notifying them about new additions to the website, for the purposes of direct marketing and for the purposes of segmentation.
In the context of exercising their rights and fulfilling contractual obligations, the Company processes the Data Subject’s personal data for the following purposes:
The Company processes the Data Subject’s personal data for the purposes of concluding, managing, and cancelling subscriptions.
Processing on the grounds of consenting to personal data processing: the processing of personal data could be based on the consent given by the Data Subject to the Company. The consent can refer to the notifications about the range of services and products, the preparation of the range of services and products aimed at the Data Subject’s user habits or conducting services with added value. Notifications are sent through channels chosen by the Data Subject in the consent. Notification via email includes forwarding the Data Subject’s email to an external processor with the purpose of showing ads of the company while browsing.
The Data Subject can withdraw or change their consent at any time in the same method the consent was originally given or in a different method as defined by the Company. The Company holds the right to identify the client. Withdrawing or changing consent only applies for the data processed on the grounds of the consent. The valid consent is the Data Subject’s latest consent received by the Company. The possibility to withdraw consent does not give the Data Subject the right to withdraw from a business relationship between the Company and the Data Subject. The consent can be given on behalf of a minor who cannot consent by themselves in accordance with the applicable law by the minor’s parent, foster parent, or legal guardian. Such consent is valid until withdrawn or changed by a parent, foster parent, legal guardian or a minor when they acquire the right in accordance with the applicable law.
When in accordance with the purpose of personal data processing according to the EU and Slovenian laws, the company can forward the Data Subject’s personal data to:
If the Company is integrated or acquired by another company, personal data are transferred to the acquirer in accordance with the law. By using services of Mudita Institute you consent with further processing of your personal data by the acquirer.
For the purpose of the fulfillment of contractual obligations, the Data Subject’s invoicing data and the related contact data can be kept until the complete payment of a service or until the limitation period of a claim has expired. Under the law, such limitation period can be from one to five years. Invoices are kept for ten years after the expiry of the year the invoice refers to in accordance with the law that regulates added value tax. If turnover data is processed on the grounds of the Data Subject’s consent for marketing, the sale of goods or services with added value, such data could be processed in the necessary scope for as long as necessary for such marketing or services. All other data acquired for the purposes of notification and direct marketing are kept until the withdrawal of consent.
The Company ensures the Data Subject could exercise their rights without undue delay and in all situations in one month after receiving the claim. The Company can extend the deadline for the Data Subject to exercise their rights for two additional months at most with regard to the complexity and number of claims. If the Company extends the deadline, it must notify the Data Subject about each such extension in one month after having received the claim, citing reasons for the delay. The Company accepts claims regarding the Data Subject’s rights via e-mail address email@example.com. When the Data Subject files a claim electronically, the information is provided electronically whenever possible, unless the Data Subject requests otherwise. Where there is reasonable doubt regarding the identity of the Data Subject exercising any of their rights regarding their personal data, the Company has the right to ask for additional information necessary to confirm the identity of the Data Subject. If the claims of the Data Subject are manifestly unfounded or excessive, in particular because of their repetitive character, the Company could charge a reasonable fee, taking into account the administrative costs of forwarding information or messages or executing the requested measures, or the Company could refuse to act on a request.
The Company ensures the Data Subject the following rights regarding personal data processing:
The Data Subject has the right to obtain confirmation as to whether the Company processes their personal data and if so, the right of access to their personal data and any additional information relating to personal data processing, including:
On the grounds of the Data Subject’s claim, the Company ensures a copy of whatever personal data of theirs is being processed. The company could charge a reasonable fee with regard to administrative costs for any additional copies of data that the data subject requests.
The Data Subject has the right to rectify inaccurate personal data without undue delay by the Company. The Data Subject has the right to supplement incomplete data with regard to the purposes for personal data processing, including by providing a supplementary statement.
The Data Subject has the right to erase their personal data without undue delay, and the Company is obliged to erase personal data without undue delay whenever:
When directory data or otherwise published data is involved, the Company takes reasonable measures, including technical measures, to notify data collectors that the Data Subject has requested to erase any connections to such personal data or their copies.
The Data Subject has the right to restrict processing whenever:
The Data Subject has the right to receive personal data which he or she has provided to the controller, in a structured, commonly used and machine-readable format, and to transmit that data to another controller without hindrance by the Company to which the personal data has been provided whenever:
The Data Subject has the right to object, on grounds relating to his or her particular situation, at any time to the processing of personal data concerning him or her if it is based on the legitimate interest of the Company or a third person. The Company shall no longer process the personal data unless the Company demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Data Subject or for the establishment, exercise or defense of legal claims. Where personal data is processed for direct marketing purposes, the Data Subject shall have the right to object at any time to the processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing. If direct marketing is based on consent, the right to object can be exercised by withdrawing the consent.
The Data Subject can lodge a complaint relating to personal data processing by email at firstname.lastname@example.org.
The Data Subject has the right to lodge a complaint directly with the information commissioner if the Data Subject considers the processing of personal data relating to him or her an infringement of Slovenia’s regulations or EU data protection legal framework.
If the Data Subject has claimed the right of access to data, and after having received the Company’s decision, considers the personal data he or she received not to be the personal data he or she requested, or that he or she has not received the personal data in its entirety, he or she should lodge an explanatory complaint with the Company within 15 days before lodging a complaint with the information commissioner. The Company must rule on the complaint as if it is a new complaint within five working days.
This policy has been published on the website https://mudita-institute.com and is valid as of 1 Januar 2023.