1. Controller of Personal Data

The controller of the personal data collected through this website is:
ŠTEMPIHAR d.o.o.
Poslovna cona A 12, 4208 Šenčur
Registration number: 5770904 | VAT ID: SI77779517
Phone: +386 (0)4 201 60 60 | Email: info@stempihar-trans.si

For any questions regarding personal data protection, you can contact us at info@stempihar-trans.si.

2. What personal data we collect and why

We process personal data lawfully, fairly, and transparently, in accordance with the General Data Protection Regulation (GDPR), the Personal Data Protection Act (ZVOP-2), and the Electronic Communications Act (ZEKom-2).

2.1 Contact form and inquiries
When you send us a message via the website form or to our email address, we process the data you provide (first and last name, company, email address, phone number, and message content). We use this data solely to respond to you or prepare an offer.

Legal basis: performance of steps at your request prior to entering into a contract and our legitimate interest in responding to inquiries (Article 6(1)(b) and (f) GDPR).
Retention period: until the inquiry is resolved and for a maximum of 2 years after the last contact; if a business relationship arises from the communication, the data is retained in accordance with contractual and legal obligations.

2.2 Conclusion and performance of contracts
If you enter into a contract with us or are a contact person of our business partner, we process the data necessary to perform the service, issue invoices, and communicate.

Legal basis: performance of a contract and compliance with our legal obligations, particularly tax and accounting requirements (Article 6(1)(b) and (c) GDPR).
Retention period: accounting documents are kept for 10 years in accordance with tax legislation; other contractual documentation is retained for up to 5 years after termination of the contract.

2.3 Job applicants
If you submit an application for a job posting or an unsolicited application, we process the data from your application and CV for the purpose of carrying out the recruitment process.

Legal basis: pre-contractual measures at your request (Article 6(1)(b) GDPR), and for the candidate pool your consent (Article 6(1)(a) GDPR).
Retention period: up to 6 months after the conclusion of the recruitment process, or in the case of consent for inclusion in the candidate pool for future job postings, up to 2 years.

3. Recipients of your data

We do not sell your personal data or share it with third parties for their own purposes. Access to the data may be granted to:
• our employees within the scope of their job duties;
• our contracted processors who provide services on our behalf (accounting service provider, web hosting provider, website maintenance provider) and have concluded a written data processing agreement with us;
• business partners and subcontractors where necessary for the performance of services (e.g. transport subcontractors, insurance companies);
• competent public authorities where required by law.

We process personal data within the European Union. If, in a specific case, data is transferred to a third country (e.g. via cloud service providers), we ensure appropriate safeguards in accordance with Chapter V of the GDPR, in particular European Commission adequacy decisions or standard contractual clauses.

4. Your rights

In relation to your personal data, you have the following rights:
• the right of access to your data;
• the right to rectification of inaccurate data or completion of incomplete data;
• the right to erasure (“right to be forgotten”);
• the right to restriction of processing;
• the right to data portability;
• the right to object to processing based on legitimate interest;
• the right to withdraw consent where processing is based on consent, without affecting the lawfulness of processing before its withdrawal.

Withdrawal of consent: where processing is based on your consent, you may withdraw it at any time by email to info@stempihar-trans.si or by post to our address. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to its withdrawal. After withdrawal, we will no longer process your data for that purpose and will delete it, unless there is another legal basis for its retention.

Exercising your rights: send your request by email to info@stempihar-trans.si or by post to our address. We will respond without undue delay, and no later than one month from receipt of the request.

Complaint: if you believe that we are violating personal data protection regulations, you have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia (Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si, +386 1 230 97 30, www.ip-rs.si).

5. Cookies

What are cookies
Cookies are small text files that a website stores in your browser when you visit it. On subsequent visits, they enable recognition of your device and retention of settings, thereby improving website functionality and user experience. In addition to traditional cookies, this policy also refers to similar tracking technologies such as tracking pixels and local storage.

Types of cookies we use
• Strictly necessary cookies ensure the basic functioning of the website and are used without your consent.
• Analytical cookies help us understand how visitors use the website so we can improve it.
• Marketing cookies are used to display more relevant content and measure the effectiveness of advertising.

Consent and withdrawal
For analytical and marketing cookies, we obtain your consent in advance via a cookie management banner upon visiting the website. You may withdraw or modify your consent at any time by clicking the “Cookie settings” link in the website footer.

Managing cookies in the browser
You can also manage cookies in your web browser settings, where you can accept or reject cookies, delete them, or set your browser to notify you before a cookie is stored. The procedure varies depending on the browser—instructions are usually available in the browser’s help section. Disabling strictly necessary cookies may affect the proper functioning of the website.

6. Security and policy changes

We protect your personal data with appropriate technical and organizational measures against unauthorized access, loss, or misuse.

This privacy policy may be updated from time to time. The current version is always published on our website with the effective date indicated.

ZVOP-2

Štempihar TLC d.o.o. carries out its activities in accordance with applicable laws and regulations.

Based on the General Data Protection Regulation (hereinafter: GDPR) and the Personal Data Protection Act (hereinafter: ZVOP-2), Štempihar TLC d.o.o. publishes the following information:

Data Controller

The data controller is Štempihar TLC d.o.o., Poslovna cona A 12, 4208 Šenčur. The company’s representative is the managing director Slavko Štempihar.

Purpose of Processing, Legitimate Interest and Legal Basis for Processing

Video surveillance and automatic number plate recognition (hereinafter: ANPR) are carried out to ensure the uninterrupted operation of the parking facility, maintain order in the parking area, and identify perpetrators of damage. This protects the property of Štempihar TLC d.o.o. or the parking owner (parking equipment and parking revenue) and enables the company to fulfil its contractual obligations related to the proper operation of the parking facility, identification of damage perpetrators, and generation of revenue from a paid private parking service. The legal basis for video surveillance is Article 6(1)(f) of the GDPR.

Definition of Users and Types of Personal Data Processed

A parking user is considered to be the driver, passenger, and any other person present within the area of video surveillance and ANPR. The following personal data are processed:

Video surveillance collects the following personal data:

– vehicle registration number
– date and time of vehicle entry and exit
– location data
– image of the vehicle with driver and passenger
– full image of the driver, passenger, and other occupants (only when the vehicle is parked within the camera’s field of view)

ANPR collects the following personal data:

– vehicle registration number
– date and time of vehicle entry and exit
– location data

Special and Further Processing, Transfer of Personal Data

Data may be used as evidence in civil proceedings initiated due to damage or loss of revenue caused by violations of parking rules.

Unusual further processing: live monitoring (without audio), with the possibility of voice communication via intercom. Conversations are not recorded unless the call is transferred to the Security Monitoring Center of Sinet d.o.o. (processor). Requests for access to conversation recordings must be addressed directly to the processor.

Personal data will not be transferred to third countries or international organizations.

Data Protection Officer

The Data Protection Officer is Maja Štempihar and can be reached at maja@stempihar-trans.si.

Retention Periods

Video recordings are deleted within 3 months of creation. ANPR records collected for the same license plate are automatically deleted upon vehicle exit if correctly recognized, and in any case no later than 7 days after entry.

Exceptions: Notwithstanding the above, video recordings and ANPR data are retained in the event of a damage incident (damage to parking equipment, loss of parking revenue, or costs incurred to restore order), provided that Štempihar TLC d.o.o. decides to pursue compensation. In such cases, data are stored until full compensation is paid or until the final conclusion of court proceedings regarding the claim, whichever occurs first.

Rights of the Individual

Individuals have the following rights under data protection law:

a) Right of access (Article 15 GDPR)
The individual has the right to obtain confirmation as to whether personal data concerning them are being processed and, if so, access to those data and related information under Article 15 GDPR. A copy is provided free of charge; additional copies may be subject to a reasonable fee.

b) Right to rectification (Article 16 GDPR)
The individual has the right to request correction or completion of inaccurate or incomplete personal data and to be informed of recipients of such data.

c) Right to erasure (“right to be forgotten”) (Article 17 GDPR)
The individual has the right to request deletion of personal data where conditions under Article 17 GDPR are met, and to be informed of recipients to whom data were disclosed and subsequently erased.

d) Right to restriction of processing (Article 18 GDPR)
The individual has the right to request restriction of processing under the conditions of Article 18 GDPR and to be informed of recipients of the data.

e) Right to data portability (Article 20 GDPR)
The individual has the right to receive personal data in a structured, commonly used, machine-readable format and to transmit them to another controller where technically feasible.

f) Right to object
The individual has the right to object to processing of their personal data at any time.

Notification of Data Breach

The controller shall notify the individual without undue delay when a personal data breach is likely to result in a high risk to their rights and freedoms.

Procedure for Exercising Rights

Requests relating to data protection rights may be submitted in writing by post to Poslovna cona A 12, 4208 Šenčur or by email to info@stempihar-trans.si.

Information may be provided orally upon proof of identity.

Identity verification may be required before processing requests to reduce the risk of unauthorized disclosure. Requests may be refused only if the controller cannot reliably identify the individual.

Requests will be answered without undue delay and at the latest within one month. This period may be extended by up to two additional months depending on complexity and number of requests. The individual will be informed of any extension within one month of receipt of the request.

Requests relating to data stored for a short period must be submitted within 24 hours of data creation.

Right to lodge a complaint with a supervisory authority

The individual has the right to lodge a complaint with the supervisory authority if they believe processing violates GDPR or ZVOP-2. The supervisory authority in Slovenia is the Information Commissioner (Dunajska cesta 22, 1000 Ljubljana, email: gp.ip@ip-rs.si).

INFORMATION ON VIDEO SURVEILLANCE at the headquarters of Štempihar TLC d.o.o. (Poslovna cona A 12, 4208 Šenčur)
(Article 13(1) GDPR and Article 76(4) ZVOP-2)

Štempihar TLC d.o.o. carries out video surveillance of access to official business premises at its headquarters in accordance with Article 77 ZVOP-2.

Video surveillance is carried out for the protection of legitimate interests of the company (legal basis under Article 6(1)(f) GDPR):
– safety of persons and property
– control of entry and exit to the premises

Notices of video surveillance are displayed to ensure individuals are informed in a timely manner.

Recordings are stored for up to 90 days and then permanently deleted. Access is limited to authorized persons. Data are not transferred to third countries.

Individuals are informed that rights must be exercised within retention periods. A request is considered timely if received at least 5 working days before expiry of the retention period.

Recordings are disclosed only under conditions set by applicable law (ZVOP-2). Access is granted only when necessary to protect interests covered by surveillance. Relevant recordings may be stored on portable media until a final decision is reached in relevant proceedings.

Live monitoring is enabled.

Rights may be exercised via email info@stempihar-trans.si or by post to Štempihar TLC d.o.o., Poslovna cona A 12, 4208 Šenčur.

Šenčur, 10th of June 2026

Štempihar TLC d.o.o.