Privacy Policy – Savske elektrarne Ljubljana

The controller of personal data collected through the website https://www.sel.si/ is:

SAVSKE ELEKTRARNE LJUBLJANA d.o.o.
Gorenjska cesta 46 1215 Medvode, Slovenia
Company number: 5044405000 VAT ID: SI74887351

For questions regarding the protection of personal data, contact us at info@sel.si or by phone at 01 474 92 74.

Data you provide yourself

On https://www.sel.si/ you can provide us with data through forms:

• Contact form: name, email address, phone number, message content.
• Newsletter sign-up: email address.
• Download of a publication or document: name, email address.
• Application for a vacancy and employment form: first and last name, email address, phone number, CV and attachments.

Providing the data is voluntary. Without it, we cannot provide the service related to the form (e.g. answer an inquiry, process a vacancy application, send the newsletter or the requested document).

Data collected automatically

When you visit the website, subject to your consent, the following data is collected automatically:

• Analytics data: IP address, type and version of browser, operating system, screen resolution, pages visited, time of visit, referral source.
• Cookies: unique identifiers to recognise repeat visits and measure the effectiveness of advertising. A detailed list is available on the Cookies page.

For the collection of analytics and marketing data, we use Google Consent Mode v2. Data from these categories is collected only after you actively consent to each cookie category. Without your consent, analytics and marketing data are not collected.

Data on the use of embedded content

Embedded content of third-party providers (YouTube videos, Google Maps) is available on some pages. This content is not loaded automatically. It is loaded only after your active click or when viewing the page that contains it. When loaded, the provider receives your IP address and browser data and may set its own cookies.

We process your data on the following legal bases under Article 6 of the GDPR:

Consent (Art. 6(1)(a) GDPR)

• Sending newsletters and notifications about the activities of the company.
• Collection of analytics data (Google Analytics).
• Collection of data for advertising purposes (Google Ads, Meta).
• Loading of embedded content of third-party providers (YouTube, Google Maps).

You may revoke your consent at any time. Revocation does not affect the lawfulness of processing prior to revocation.

Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR)

• Processing of inquiries received via the contact form.
• Provision of publications and documents you have requested.
• Processing of vacancy applications and employment forms.
• Performance of contracts and agreements we conclude with you or your company.

Legitimate interest (Art. 6(1)(f) GDPR)

• Ensuring the security of the website and preventing abuse.
• Conducting video surveillance of business premises and hydroelectric power plant facilities.
• Improving the operation and user experience of the website.
• Keeping business documentation and records.

For processing on the basis of legitimate interest, we have carried out a legitimate interests assessment (LIA), in which we have weighed our interests against your rights and freedoms. The results of the assessment can be requested at info@sel.si.

Legal obligation (Art. 6(1)(c) GDPR)

• Retention of data when required by tax or other legislation.
• Disclosure of data to competent state authorities under statutory provisions.

Table of processing operations

Purpose	Data	Legal basis	Retention period
Response to inquiry	Name, email, phone, message	Contract (Art. 6(1)(b))	Until end of communication + 1 year
Vacancy application	Name, email, phone, CV, attachments	Contract (Art. 6(1)(b))	Until end of selection + 1 year
Sending the newsletter	Email address	Consent (Art. 6(1)(a))	Until unsubscription
Publication/document download	Name, email	Contract (Art. 6(1)(b))	Until purpose fulfilled + 1 year
Visit analytics (GA4)	IP, browser, pages visited	Consent (Art. 6(1)(a))	14 months
User experience analysis (Clarity)	Mouse movements, clicks, scrolling	Consent (Art. 6(1)(a))	Per Clarity default periods
Advertising measurement (Google Ads, Meta)	Interactions, conversions	Consent (Art. 6(1)(a))	Per default periods of the provider
Advertising profiling	Behavioural data	Consent (Art. 6(1)(a))	Until revocation
Video surveillance	Image and time of recording	Legitimate interest (Art. 6(1)(f))	Up to 1 year (exceptions in case of proceedings)
Security and abuse prevention	IP, log records	Legitimate interest (Art. 6(1)(f))	6 months
Tax and business documentation	Business correspondence	Legal obligation (Art. 6(1)(c))	In accordance with tax legislation

We do not sell your personal data and do not pass it to third parties for their own purposes. We pass data only to processors that process the data on our behalf, on our instructions, and on the basis of concluded data processing agreements.

Categories of processors:

• Hosting provider, which provides the server infrastructure.
• Google LLC (Google Analytics, Google Ads, Google Tag Manager) for visit analytics and advertising measurement.
• Meta Platforms, Inc. for measuring the effectiveness of advertising campaigns.
• Microsoft Corporation (Microsoft Clarity) for user experience analysis, including session recording (mouse movements, clicks, page scrolling).
• YouTube (Google LLC) for the playback of embedded videos.

We may also disclose data when necessary to fulfil legal obligations, enforce court orders or protect our legitimate rights.

Some of our processors (Google, Meta, Microsoft) are based in the United States of America. Data transfer to the USA takes place on the basis of the EU-U.S. Data Privacy Framework (EU-U.S. Data Privacy Framework), confirmed by the European Commission’s adequacy decision of 10 July 2023.

In addition, the European Commission’s standard contractual clauses (SCC) have also been concluded with the listed processors, providing a back-up safeguard mechanism in case the DPF framework is amended or repealed. If the legal basis for the transfer changes, we will adjust the safeguards accordingly and update this policy.

We retain data only for as long as is necessary to fulfil the purpose of collection or as required by law.

• Contact inquiries: until end of communication, then up to 1 year for any subsequent enquiries.
• Vacancy applications: until the end of the selection process, then up to 1 year, if you explicitly consent to retention for any further calls.
• Newsletter: until unsubscription (unsubscribe is possible in each message).
• Publication and document downloads: until purpose is fulfilled, then up to 1 year.
• Analytics data: in accordance with the default periods of each service (Google Analytics: 14 months).
• Cookies: retention periods are listed on the Cookies page.
• Video surveillance recordings: up to 1 year, except in the case of criminal proceedings or other proceedings where longer periods apply.
• Accounting and tax documentation: in accordance with the periods prescribed by tax legislation.

After the retention period expires, we securely delete or anonymise the data.

Under the GDPR and ZVOP-2 you have the right to:

• request access to your data (Art. 15 GDPR),
• request correction of inaccurate or completion of incomplete data (Art. 16),
• request erasure of data when there is no longer a legal basis for processing (Art. 17),
• request temporary restriction of processing (Art. 18),
• receive your data in a structured form or request transfer to another controller (Art. 20),
• object to processing on the basis of legitimate interests (Art. 21),
• revoke your consent at any time, without affecting the lawfulness of processing prior to revocation (Art. 7(3)).

You revoke your consent for sending the newsletter (e-news) by clicking the unsubscribe link in each message sent. You revoke your consent for cookies in the cookie settings, available at the bottom of the website or on the Cookies page.

To exercise all other rights, contact us at info@sel.si. We will respond to your request within 30 days.

If you believe that we are in breach of the regulations in the processing of your data, you have the right to file a complaint with the Information Commissioner of the Republic of Slovenia:

Information Commissioner of RS
Dunajska cesta 22, 1000 Ljubljana
www.ip-rs.si
Email: gp.ip@ip-rs.si
Phone: +386 1 230 97 30

To protect your personal data from unauthorised access, loss or disclosure, we use appropriate technical and organisational measures:

• SSL/TLS encryption for the transfer of data between your browser and our server.
• Regular updates of software and security patches.
• Restricting access to personal data to authorised persons.
• Encrypted backups.
• Regular review of security procedures and measures.

At Savske elektrarne Ljubljana, video surveillance is conducted for the purpose of:

• protecting people (including preventing endangerment of employees) and property,
• controlling entry to and exit from facilities (business premises and hydroelectric power plants),
• protecting confidential information and business secrets.

Details of the video surveillance are available in the document Information under Article 13 of the General Regulation (PDF).

Our website is not intended for persons under the age of 15 and we do not knowingly collect their personal data. If we discover that we have obtained data of a person under the age of 15 without the appropriate consent of a parent or guardian, we will delete this data immediately (Art. 8 GDPR in conjunction with Art. 112 ZVOP-2).

Our website may contain links to third-party websites. We are not responsible for their privacy practices and data processing. Before submitting personal data to other websites, we recommend that you read their privacy policies.

For the purpose of measuring advertising effectiveness and displaying relevant ads, with your consent we may process data on your behaviour on the website (pages visited, interactions, conversions). This data may be used through Meta Pixel and Google Ads to build audiences and for remarketing, which constitutes a form of profiling under Art. 4(4) GDPR.

No decisions with legal or similarly significant effects on you are made on the basis of this profiling (Art. 22 GDPR). Profiling is intended solely for ad personalisation.

You have the right to object to this profiling (Art. 21 GDPR). You can withdraw consent at any time in the cookie settings or contact us at info@sel.si.

SAVSKE ELEKTRARNE LJUBLJANA d.o.o. has assessed the need to appoint a Data Protection Officer (DPO) in accordance with Art. 37 GDPR. Given the nature, scope and purposes of processing, the appointment of a DPO is not legally required, as we do not carry out large-scale systematic monitoring of individuals or large-scale processing of special categories of data.

For all questions regarding the protection of personal data, contact us at info@sel.si or by phone at 01 474 92 74.

In the event of a personal data breach we will, in accordance with Art. 33 GDPR, notify the Information Commissioner of the Republic of Slovenia of the breach within 72 hours of becoming aware of it, unless it is unlikely that the breach would result in a risk to your rights.

If a breach could result in a high risk to your rights and freedoms, we will inform you directly without undue delay (Art. 34 GDPR), together with a description of the nature of the breach, the possible consequences and the measures we have taken.