This privacy policy (hereinafter: Policy) of Mudita Institute (hereinafter: the Company) aims to inform subscribers, users, and other persons (hereinafter: the Data Subject) about the purpose and the grounds for personal data processing by the Company and about their rights in this area.

About the Personal Data Protection Policy

This personal data protection policy (hereinafter: Policy) aims to inform subscribers, users, and other persons (hereinafter: the Data Subject) about the purpose and the grounds for personal data protection by the company and about their rights in this area. At the same time, this policy additionally explains the consent to process data. In accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: General Data Protection Regulation), this Policy includes the following information:

• The contact information of the Company and the data protection officer
• The purposes, grounds, and types of the data subject’s personal data processing, including profiling their personal data
• The forwarding of data to third persons and to third countries
• The retention period of Data Subject’s types of personal data
• The Data Subject’s rights regarding data processing
• The right to file a complaint regarding personal data processing

Where appropriate, the provisions relating to the Data Subject are used for the issues of secrecy and confidentiality of communications of users that are legal entities.

Data Controller and Data Protection Officer

The data controller of the Data Subject’s data processed in accordance with the personal data protection policy is Mudita Institute. 

The Purposes and Grounds of Data Processing

Data processing on the grounds of a contract: the Company processes the Data Subject’s personal data for the purposes of notifying them about new additions to the website, for the purposes of direct marketing and for the purposes of segmentation.

In the context of exercising their rights and fulfilling contractual obligations, the Company processes the Data Subject’s personal data for the following purposes:

• E-mail address and name for the purposes of notifying about the website and sending the newsletter
• Phone number for the purposes of notifying about performing business services
• Home address for the fulfillment of payment obligations – drafting and sending invoices
• Company data for the fulfillment of payment obligation – drafting and sending invoices

Personal Data Processing under the Act

The Company processes the Data Subject’s personal data for the purposes of concluding, managing, and cancelling subscriptions.

Processing on the grounds of consenting to personal data processing: the processing of personal data could be based on the consent given by the Data Subject to the Company. The consent can refer to the notifications about the range of services and products, the preparation of the range of services and products aimed at the Data Subject’s user habits or conducting services with added value. Notifications are sent through channels chosen by the Data Subject in the consent. Notification via email includes forwarding the Data Subject’s email to an external processor with the purpose of showing ads of the company while browsing.

The Data Subject can withdraw or change their consent at any time in the same method the consent was originally given or in a different method as defined by the Company. The Company holds the right to identify the client. Withdrawing or changing consent only applies for the data processed on the grounds of the consent. The valid consent is the Data Subject’s latest consent received by the Company. The possibility to withdraw consent does not give the Data Subject the right to withdraw from a business relationship between the Company and the Data Subject. The consent can be given on behalf of a minor who cannot consent by themselves in accordance with the applicable law by the minor’s parent, foster parent, or legal guardian. Such consent is valid until withdrawn or changed by a parent, foster parent, legal guardian or a minor when they acquire the right in accordance with the applicable law.

Forwarding Data to Third Persons and Forwarding Data to Third Countries (Non-EU Member States or Non-Members of the European Economic Area)

When in accordance with the purpose of personal data processing according to the EU and Slovenian laws, the company can forward the Data Subject’s personal data to:

• Persons performing individual tasks of processing for the Company, such as the preparation and sending of invoices or data analytics, the maintenance and development of services when such tasks need to include personal data processing
• Persons performing the services of sales and marketing for the company, including field sales and marketing, or persons cooperating with the company in the area of marketing and sales of their own services or third person services in the scope necessary for such tasks in accordance with the purposes or the grounds as defined in this Policy

If the Company is integrated or acquired by another company, personal data are transferred to the acquirer in accordance with the law. By using services of Mudita Institute you consent with further processing of your personal data by the acquirer.

The Duration of Personal Data Retention

For the purpose of the fulfillment of contractual obligations, the Data Subject’s invoicing data and the related contact data can be kept until the complete payment of a service or until the limitation period of a claim has expired. Under the law, such limitation period can be from one to five years. Invoices are kept for ten years after the expiry of the year the invoice refers to in accordance with the law that regulates added value tax. If turnover data is processed on the grounds of the Data Subject’s consent for marketing, the sale of goods or services with added value, such data could be processed in the necessary scope for as long as necessary for such marketing or services. All other data acquired for the purposes of notification and direct marketing are kept until the withdrawal of consent.

The Data Subject’s Right Regarding Personal Data Processing

The Company ensures the Data Subject could exercise their rights without undue delay and in all situations in one month after receiving the claim. The Company can extend the deadline for the Data Subject to exercise their rights for two additional months at most with regard to the complexity and number of claims. If the Company extends the deadline, it must notify the Data Subject about each such extension in one month after having received the claim, citing reasons for the delay. The Company accepts claims regarding the Data Subject’s rights via e-mail address info@mudita-institute.com. When the Data Subject files a claim electronically, the information is provided electronically whenever possible, unless the Data Subject requests otherwise. Where there is reasonable doubt regarding the identity of the Data Subject exercising any of their rights regarding their personal data, the Company has the right to ask for additional information necessary to confirm the identity of the Data Subject. If the claims of the Data Subject are manifestly unfounded or excessive, in particular because of their repetitive character, the Company could charge a reasonable fee, taking into account the administrative costs of forwarding information or messages or executing the requested measures, or the Company could refuse to act on a request.

The Company ensures the Data Subject the following rights regarding personal data processing:

• The right of access
• The right to rectification
• The right to erasure (“the right to be forgotten”)
• The right to restriction of processing
• The right to data portability

The Right of Access

The Data Subject has the right to obtain confirmation as to whether the Company processes their personal data and if so, the right of access to their personal data and any additional information relating to personal data processing, including:

• The purposes of processing
• Types of personal data
• Users or categories of users to whom personal data was or will be disclosed, in particular users in third countries or international organizations
• Whenever possible, the foreseen retention period or, if this is not possible, the measure necessary to specify such a period
• The right to require the data controller to rectify or erase personal data, or limit the processing of the Data Subject’s personal data, or the right to object to personal data processing
• The right to lodge a complaint with a supervisory authority
• If personal data was not collected from the Data Subject, all available information relating to the source
• The existence of automated decision making, including profiling, and reasonably estimable information about the logic involved, and the meaning and foreseen consequences of such processing for the Data Subject

On the grounds of the Data Subject’s claim, the Company ensures a copy of whatever personal data of theirs is being processed. The company could charge a reasonable fee with regard to administrative costs for any additional copies of data that the data subject requests.

The Right to Rectification

The Data Subject has the right to rectify inaccurate personal data without undue delay by the Company. The Data Subject has the right to supplement incomplete data with regard to the purposes for personal data processing, including by providing a supplementary statement.

The Right to Erasure (“The Right to Be Forgotten”)

The Data Subject has the right to erase their personal data without undue delay, and the Company is obliged to erase personal data without undue delay whenever:

• Personal data is no longer necessary for the purposes chosen or processed in any other method.
• The Data Subject withdraws their consent which is the grounds to process personal data and no other legal basis exists.
• The Data Subject objects to the processing based on the Company’s legitimate interests, but no overriding legitimate grounds exist for the processing.
• The Data Subject objects to the processing for the purpose of direct marketing.
• Personal data must be erased to honor a legal commitment in accordance with the EU law or Slovenian legislation.
• Data is involved regarding the supply of services of information society, incorrectly collected data of a child who in accordance with the applicable law is unable to provide such data.

When directory data or otherwise published data is involved, the Company takes reasonable measures, including technical measures, to notify data collectors that the Data Subject has requested to erase any connections to such personal data or their copies.

The Right to Restriction of Processing

The Data Subject has the right to restrict processing whenever:

• The Data Subject opposed the accuracy of data for the period which enables the data collector to verify the accuracy of personal data.
• The processing is unlawful, and the Data Subject opposes the erasure of personal data but requests to restrict their use instead.
• The Company no longer needs the personal data for the purposes of processing, but the Data Subject needs them for the establishment, exercise or defense of legal claims.
• The Data Subject has objected to processing pending the verification of whether the legitimate grounds of the controller override those of the Data Subject.

The Right to Data Portability

The Data Subject has the right to receive personal data which he or she has provided to the controller, in a structured, commonly used and machine-readable format, and to transmit that data to another controller without hindrance by the Company to which the personal data has been provided whenever:

• The processing is based on the Data Subject’s consent or contract and is carried out by automated means.

The Right to Object

The Data Subject has the right to object, on grounds relating to his or her particular situation, at any time to the processing of personal data concerning him or her if it is based on the legitimate interest of the Company or a third person. The Company shall no longer process the personal data unless the Company demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Data Subject or for the establishment, exercise or defense of legal claims. Where personal data is processed for direct marketing purposes, the Data Subject shall have the right to object at any time to the processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing. If direct marketing is based on consent, the right to object can be exercised by withdrawing the consent.

The Right to Lodge a Complaint Relating to Personal Data Processing

The Data Subject can lodge a complaint relating to personal data processing by email at info@mudita-institute.com.

The Data Subject has the right to lodge a complaint directly with the information commissioner if the Data Subject considers the processing of personal data relating to him or her an infringement of Slovenia’s regulations or EU data protection legal framework.

If the Data Subject has claimed the right of access to data, and after having received the Company’s decision, considers the personal data he or she received not to be the personal data he or she requested, or that he or she has not received the personal data in its entirety, he or she should lodge an explanatory complaint with the Company within 15 days before lodging a complaint with the information commissioner. The Company must rule on the complaint as if it is a new complaint within five working days.

The Validity of the Policy

This policy has been published on the website https://mudita-institute.com and is valid as of 1 Januar 2023.