Personal data controller and contact details


This policy applies to the processing (use) of any personal data, which is performed by the company TULI D.O.O., LJUBLJANA (controller) or on behalf of the controller.
Details about the controller:
TULI D.O.O., LJUBLJANA
Pot čez gmajno 7
1000 Ljubljana
Tax ID number: SI31878229
Telephone: 01 25 72 484
E-mail: info@tuli.si



Which personal data is processed:

Basic contact details (name, surname, telephone number, e-mail address);
Data on the use of our web pages (visits of individual pages, clicks on links, time spent) and the data concerning the response to our e-mails (whether the message was open, on which links you clicked);
Data we need to meet the obligations of the contract and the delivery of purchased goods (purchased product, price, delivery address, time of delivery, payment method, date of payment, complaint details, invoice details etc.).



Legal bases for processing of personal data:

We may process your personal data on the following legal bases:
when this is necessary to fulfil our legal obligations (e.g. issuing of invoices for the purchased goods);
when the processing of your personal data is necessary for the conclusion and fulfilment of a contract you have concluded with us or because you wanted us to prepare an offer;
when you have agreed to the processing of your personal data for a specific purpose, with regards to which you are always entitled to withdraw this consent (for example, for personalized notifications about our offer based on profiling);
when we have a legitimate interest for processing your personal data, for example, to send you an e-mail in case you left the shopping cart on our website without completing the purchase.



Purposes of processing personal data

We may use your personal data for one or more of the following purposes:
communicating with you regarding the provision of our services and responding to your enquiries;
the conclusion of a contract and the fulfilment of the obligations arising from the concluded contract;
marketing communication (sending e-mails);
to enforce any legal claims and to settle disputes;
for statistical analyses regarding the sale of our goods and the use of our websites;



How long we store your personal data and what happens to it afterwards

We store basic personal data as long as you have the status of our registered user on our web sites or you are subscribed to our news.
We store your personal data, which is processed on the basis of your consent, permanently or until you withdraw your consent.
We store the data on the issued invoices for 10 years after issuing them.
We store the data necessary for concluding the contract between you and our company and for meeting its obligations for 5 years after the fulfilment of the contract (delivery of goods).
After the storage period expires, your personal data is effectively erased or anonymised, which means that we process it in such a way that it can no longer be associated with you or attributed to you.



Voluntary data provision and the consequences of non-provision

The provision of personal data is voluntary. You are not obliged to provide us with your personal data, but in the case of non-provision, you cannot receive certain services or conclude a contract with us. The non-provision of which data results in the stated consequences will be indicated each time we want to collect personal data from you.



Who has access to your personal data

We do not forward your personal data to third parties and do not enable third parties to become acquainted with them (outside the company Tuli d.o.o.), except to those who have concluded a written contract with us, on the basis of which they perform certain tasks related to data processing, and they are obligated to comply with the legislation regarding the processing and protection of personal data (the so-called contract processors). The contract processors to whom we forward personal information are:
marketing service providers
call studio providers
providers of e-mail sending
accounting services provider
The contract processors may process personal data only in the framework of our instructions and may not process personal data for their own purposes. They are obliged, together with their employees, to protect the confidentiality of your personal data.
The contract processors of personal data do not transfer the data to third countries (outside the Member States of the European Economic Area – these are the EU Member States as well as Iceland, Norway and Liechtenstein).



What are your rights regarding your personal data, how can you withdraw your consent for processing and what are the consequences of withdrawal

You have the following rights regarding your personal data:

  • to demand at any time that we:
  • confirm whether we process your personal data;
  • give you access to personal data and the following information: the purposes of processing; types of personal data; users or categories of users to whom personal data has been or will be disclosed, particularly the users in third countries or international organizations; the anticipated data storage period or, if this is not possible, the criteria used to determine this period; the existence of automated decision-making, including profiling and the reasons for it, as well as the meaning and anticipated consequences of such processing for you;
  • provide one (free) copy of personal data in the format you specify yourself (if the request is made using electronic means of communication and you do not specify otherwise, the copy will be provided in electronic form); for additional copies you request, we may charge a reasonable fee with regards to the costs;
  • correct inaccurate personal data;
  • restrict the processing when:
    • you dispute the accuracy of personal data, for a period that allows us to verify the accuracy of personal data;
    • the processing is illegal and you oppose the erasure of personal data and demand a restriction on their use instead;
    • we no longer need your personal data for processing purposes, but you need them for enforcing, implementing or defending legal claims;
  • erase all personal data (the right to be forgotten) if the assumptions under Article 17 of the General Data Protection Regulation are met and particularly if you withdraw the consent for the processing of personal data;
  • extract your personal data in a structured, widely used and machine-readable form, with the right that you forward this data to another controller without our company hindering you in doing so;
  • stop using your personal data for the purposes of direct marketing, including profiling;
  • exclude you from the decision based solely on automated processing, including profiling, if the assumptions under Article 22 of the General Data Protection Regulation are met.
  • grant you the right to file a complaint against us with the Information Commissioner if you believe that the processing of your personal data violates the General Data Protection Regulation.



Procedure for exercising rights

You can address your requests regarding the exercise of your rights in relation to personal data in written form to any contact listed at the top of this document under Personal data controller and contact details.
For the purposes of reliable identification in the case you exercise your rights in connection to personal data, we may require additional information from you and may only refuse to act if we can prove that we cannot reliably identify you.
We are obliged to respond to your request with which you exercise your rights regarding your personal data without undue delay and no later than one month from receiving your request.