1. Personal data controller and Data Protection Officer (DPO)

1.1 Primary controller

Findes Marketing d.o.o.
Litostrojska cesta 44A, 1000 Ljubljana, Slovenia
Company number: 8304912000 | VAT number: SI12345678
Email: info@findes.si
Website: https://findes.si

1.2 Data Protection Officer (DPO)

1.3 When a DPO is mandatory (Article 37 GDPR)

2. Which personal data we collect

2.1 Categories of personal data

2.2 Data we do NOT collect

3. Legal bases for processing (Article 6 GDPR)

4. Special categories of data (Article 9 GDPR)

4.1 Exceptions — when special categories may arise

5. Personal data retention periods

6. Your rights (DSAR — Data Subject Access Rights)

6.1 Procedure for exercising rights (DSAR procedure)

• Submission of the request: In writing to dpo@findes.si with the subject line 'DSAR request', or by post to the controller's address.
• Identification: Provide a copy of your identity document (to protect against unauthorised access). Findes Group does not require originals.
• Acknowledgement of receipt: Within 5 working days you will receive an acknowledgement and a reference number for your request.
• Processing: We process the request within 30 days. In complex cases, the deadline may be extended by a further 60 days with notice.
• Response: A written response by email or post, free of charge.
• Complaint: If you are dissatisfied with the response, you may lodge a complaint with the IP RS (ip-rs.si).

7. Disclosure of personal data to third parties

7.1 Categories of recipients

7.2 Sale of data to third parties

8. Personal data security

8.1 Technical measures

8.2 Organisational measures

• Minimum-access policy (need-to-know principle) — every employee may only access the data they require.
• Mandatory employee training on data protection (annual, documented).
• NDA (confidentiality agreement) for all employees and contractors.
• Procedure for managing access rights (onboarding/offboarding).
• Clean-desk and clean-screen policy.
• Regular internal data-security audits (at least once a year).

9. Joint Controllership (Article 26 GDPR)

In accordance with Article 26 GDPR, internal joint-controller agreements have been concluded between the following entities:

9.1 Specific notice — Insurance services

Findes Marketing d.o.o. carries out only informational and marketing activities and does not provide insurance advice.

10. Cross-border transfers of personal data (Articles 44–49 GDPR)

10.1 Transfer of data outside the EU/EEA

In the course of its business, Findes Group works with partners and service providers in countries outside the EU/EEA. Every transfer of data is based on appropriate safeguards:

11. Automated decision-making, profiling and artificial intelligence

11.1 When Findes Group uses automated decision-making

11.2 Your rights in automated decision-making

Where automated decision-making has a material effect on you (e.g. denial of access to a service), you have the right to:

• Request manual review of the decision by a qualified employee.
• Express your point of view and submit additional information.
• Contest the decision with reasoning.
• Request an explanation of the logic, significance and envisaged consequences of the automated decision-making.

Address your request to: dpo@findes.si with the subject line 'Objection to an automated decision'.

11.3 EU AI Act compliance

12. Children and minors (Article 8 GDPR)

12.1 Policy on minors

• Findes Group does not knowingly collect personal data of children under 16.
• For persons aged between 16 and 18, parental consent is required for services with financial implications (investments, insurance).
• If we discover that we have inadvertently collected data of a child under 16, we delete it immediately.
• Parents/guardians may request access to and erasure of a minor's data at dpo@findes.si.

13. Record of processing activities (Article 30 GDPR)

13.1 Obligation to maintain a record

In accordance with Article 30 GDPR, Findes Group maintains a written record of all personal data processing activities. The record contains:

The record is available for inspection by the Informacijski pooblaščenec RS upon request. Individuals may request a summary of the record relating to their data from the DPO.

14. Security incidents and personal data breaches (Articles 33–34 GDPR)

14.1 Procedure in the event of a security breach

• Incident detection: An employee or threat-detection system (SIEM) triggers an alert.
• Severity assessment: The DPO and security team assess the risk to individuals within 4 hours.
• Notification of IP RS: Where there is a risk to the rights and freedoms of individuals — notification to the IP RS within 72 hours of detection (Article 33 GDPR).
• Notification of affected individuals: Where there is a high risk — direct notification to the affected individuals without undue delay (Article 34 GDPR).
• Documentation: Every incident is documented in the breach register.
• Post-incident analysis: Within 30 days, a report is produced with findings and measures to prevent recurrence.

14.2 The notification to affected individuals contains

• The nature of the personal data breach.
• The contact details of the DPO for further information.
• The likely consequences of the breach.
• The measures Findes Group has taken or intends to take.
• Recommendations for individuals (e.g. password change, vigilance against phishing).

15. Cookies and tracking technologies

15.1 Summary

The Findes Group website uses cookies and similar tracking technologies. The detailed cookie policy is available at: Cookies Policy.

16. Complaint to the supervisory authority

If you consider that we are infringing your rights relating to the protection of personal data, you may lodge a complaint with the competent supervisory authority: