Privacy Policy

At IVORA d.o.o., we value your privacy and therefore constantly ensure the protection of personal data and follow the principles of secure personal data processing. In this Privacy Policy, we present to you what personal data we process, what the purpose of processing is, and also what your rights are regarding data processing. When processing your personal data, we adhere to the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality.

The controller of personal data processed in accordance with this Privacy Policy is IVORA d.o.o., Cesta v Mestni log 55, 1000 Ljubljana (hereinafter: IVORA).

We collect and process your personal data for the following purposes:

• To provide you with information you've requested or to perform services you've ordered. This data may include your name, address, email address, phone number, and other relevant information for providing information and performing services.
• To stay in touch with you as our business partners and keep you informed about our business activities and events. This data may include your name, address, email address, phone number, company, and other relevant information.
• To fulfill contractual obligations to you. This data may include your name, address, email address, phone number, job title, company, type of cooperation with us, and your health data, which we need to perform the ordered services.
• To improve our website. This data may include your IP address, geographical location, device data, browser type, referral source, length of visit, operating system, number of page views, previously viewed pages, and similar data.
• To comply with legal obligations or requirements.
• To send promotional messages related to our activities, including invitations to other events. This data may include your name, address, email address, phone number, company, and other relevant information.
• For recruiting new employees. This data may include your name, address, email address, phone number, date of birth, information about your education and experience, resume, photograph, and other relevant information.
• For the successful and efficient organization of our events, including promotional activities and the publication of audio, video, and photographic documentation from events. This data may include your name, address, company, email address, phone number; a short biography with a picture (of speakers and performers), and audio, video, and photographic documentation from events.

We process your personal data based on the following legal grounds:

• Processing based on a contract – in accordance with Article 6(1)(b) of the GDPR, processing may be necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
• Processing based on legitimate interest – in accordance with Article 6(1)(f) of the GDPR, data processing may be based on our legitimate interest.
• Processing necessary to protect the vital interests of the data subject or of another natural person – in accordance with Article 6(1)(d) of the GDPR.
• Processing based on consent – in accordance with Article 6(1)(a) of the GDPR. If the basis for our processing is consent, you can withdraw it at any time.
• Processing for compliance with a legal obligation to which the controller is subject – in accordance with Article 6(1)(c) and (e) of the GDPR.

IVORA may share your personal data with the following entities to fulfill the purpose for which it's processed:

• Contracted personal data processors who process personal data on behalf of IVORA as the controller, in accordance with the controller's instructions and on its behalf, and for the purposes stated above.
• Other entities, if required to do so in accordance with an order from a competent court or other state authority, or in accordance with applicable legislation.

We also transfer personal data to countries outside the EU/EEA (hereinafter: "third countries"), specifically to entities affiliated with us and to contracted personal data processors. Even in the case of such transfers, we adhere to the safeguards for personal data protection as stipulated by the GDPR, as far as and to the extent possible.

Social Media Platforms

Social media platforms include TikTok, Facebook, YouTube, Instagram, and others. TikTok, Facebook, YouTube, and Instagram act as independent controllers of personal data, and they will process your personal data in accordance with their privacy policies, e.g.,https://www.facebook.com/policy.php,https://www.tiktok.com/legal/privacy-policy?lang=en&appLaunch=app, andhttps://policies.google.com/privacy?hl=en-US.

Third-Party Services (Google)

Google is an independent controller of personal data and a service provider (e.g., Google Maps, Google Analytics) that processes your personal data in accordance with their privacy policy:https://policies.google.com/privacy?hl=en-US.

Links to Other Websites

This website may contain links to websites operated by third parties. As we have no control over them, we do not assume responsibility for the protection of personal data when you visit these websites. We recommend that you read the terms of use and privacy policies of these websites before using them.

Transfer of Personal Data to the USA

Warning: By using the IVORA website, your personal data may be transferred to and processed in the USA or a third country, or such transfer and further processing by social media platforms cannot be prevented. In this case, there may be less legal protection for your personal data than provided for by the General Data Protection Regulation (GDPR).

Data Transfer to the USA / Cessation of Privacy Shield Use:

We explicitly warn that, in accordance with the judgment of the EU Court of Justice, case no. C-311/18, dated July 16, 2020, the so-called Privacy Shield, which under certain circumstances confirmed an adequate level of personal data protection in the USA, no longer constitutes a valid legal basis for data transfer from the EU to the USA. If our data is transferred to the USA or if a service provider based in the USA is used, this is explicitly stated in this privacy policy.

What can the transfer of personal data to the USA mean for you as a user, and what are the risks associated with it?

The risks for you as a user arise from the powers of US intelligence services and the legal situation in the USA, which, in the opinion of the EU Court of Justice, currently no longer ensures an adequate level of personal data protection. The standard contractual clauses adopted by the Commission in 2010 (2010/87/EU of 5.2.2010), Article 46(2)(c) of the General Data Protection Regulation (the so-called "old contractual clauses"), are no longer valid. The European Commission adopted the so-called "new standard contractual clauses" on June 4, 2021. After December 22, 2021, only the new contractual clauses represent a valid basis for the transfer of personal data.

What measures do we take to ensure that personal data transfers to the USA are legally compliant?

Whenever US providers offer this option, we opt for the processing of personal data on servers within the EU. This is intended to technically ensure that the data is located within the European Union and that access by US intelligence agencies is not possible.

For the continued use of tools originating from the USA, we take the following measures:

Whenever possible, before using a tool originating from the USA, we inform about the operation of such a tool and ask for your consent. The risks associated with data transfer to the USA are listed above. We strive to conclude the aforementioned standard contractual clauses with US providers.

We will process your personal data only until the purpose for which it is processed is fulfilled, in accordance with applicable legislation. If your consent forms the legal basis for processing, we will process your data only until your consent expires or is withdrawn.

Individuals have a number of rights regarding personal data, which they can exercise free of charge. Before exercising a right, IVORA verifies the identity of the individual asserting their rights. An individual submits their request using a written form to Cesta v Mestni log 55, 1000 Ljubljana, or electronically via info@klinikavisnjar.si.

IVORA fulfills a justified request within 1 month. In case of complexity of the request or a large number of requests, the fulfillment period may be extended by an additional 2 months. IVORA informs the individual about such an extension and the reasons for it.

Right of access to data: Upon request, we inform the individual whether personal data concerning them is being processed, and if so, we provide the following information:

• The purposes of personal data processing;
• The types of data being processed;
• The recipients or categories of recipients to whom the personal data have been or will be disclosed;
• Data retention periods;
• The existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
• The right to lodge a complaint with the Information Commissioner;
• Where the personal data are not collected from the data subject, any available information as to their source;
• The existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Based on the request, IVORA prepares a copy of the personal data being processed and provides it to the individual.

Right to rectification: An individual can at any time request that IVORA correct inaccurate data or complete incomplete data relating to them.

Right to erasure (the right to be forgotten): An individual can request that their personal data be erased in the following cases:

• The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• The individual withdraws consent on which the processing is based, and where there is no other legal ground for the processing;
• The individual objects to the processing of personal data, and there are no overriding legitimate grounds for the processing, or the individual objects to the processing in accordance with Article 21(2) of the GDPR;
• The personal data have been unlawfully processed;
• The personal data have to be erased for compliance with a legal obligation in Union or Slovenian law.

Right to restriction of processing: An individual can request that the processing of data relating to them be restricted when:

• The data is inaccurate,
• The processing is unlawful, and the individual, to whom the personal data relates, opposes the erasure of the personal data and requests instead the restriction of their use,
• MEDLINE no longer needs the data for the purposes of processing, but the individual needs them for the establishment, exercise, or defense of legal claims,
• The individual has objected to the processing, pending the verification whether the legitimate grounds of the controller override those of the individual to whom the personal data relates.

Right to data portability: Under the conditions of Article 20 of the GDPR, an individual can request an export of the data they have provided to IVORA, in a structured, commonly used, and machine-readable format, and has the right to transmit those data to another controller without hindrance from IVORA.

Right to object: An individual can object to the processing of personal data under the conditions of Article 21 of the GDPR.

Withdrawal of consent: An individual has the right to withdraw consent for the processing of their personal data, where processing is based on consent, without affecting the lawfulness of processing based on consent before its withdrawal.

An individual can send any complaint or request regarding the processing of personal data to the email address info@klinikavisnjar.si or by mail to: Cesta v Mestni log 55, 1000 Ljubljana.

Furthermore, every individual whose personal data is concerned has the right to lodge a complaint directly with the Information Commissioner if they believe that the processing of personal data relating to them violates applicable legislation. Contact: Informacijski pooblaščenec, Dunajska cesta 22, 1000 Ljubljana. Phone: 01 230 97 30, Email: gp.ip@ip-rs.si, DPO for IP Office: dpo@ip-rs.si.

All data will be strictly protected in accordance with personal data protection regulations and IVORA's internal acts, and will not be used for other unauthorized purposes. The company implements appropriate technical and organizational measures to ensure a high level of personal data security in its information systems and to safeguard the rights of data subjects.