In this policy, we explain which personal data we process when you visit the qstom.si website, write to us or work with us, why we process it, how long we keep it and how you can exercise your rights. The policy has been prepared in accordance with the General Data Protection Regulation (GDPR), the Slovenian Personal Data Protection Act (ZVOP-2) and the Slovenian Electronic Communications Act (ZEKom-2).
This English version is a translation provided for information. In the event of any discrepancy, the Slovenian version prevails.
In short: we don’t use analytics, advertising or tracking cookies on the website, and we don’t load third-party content (e.g. Google Analytics, Facebook, YouTube or Google Fonts). We only collect personal data when you give it to us yourself through a form, email or phone, and we don’t sell it or share it for advertising.
1. Data controller
The controller of personal data is:
qStom d.o.o.
Slovenska ulica 17, 2000 Maribor, Slovenia
Branch office: Kavčičeva ulica 66, 1000 Ljubljana
Company registration number: 8181578000
VAT ID: SI21145032
Email: info@qstom.si
Phone: +386 41 678 701
For any questions about data protection and to exercise your rights, email us at info@qstom.si or write to the address above, marked “Data protection”. Given the nature and scope of our processing, we are not required to appoint a data protection officer (Article 37 GDPR).
2. What data we process and why
We process personal data only for specified, lawful purposes and only to the extent necessary for those purposes.
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Website operation and security | IP address, date and time of the request, requested URL, browser and device type (server logs) | legitimate interest in the secure and smooth operation of the website (Article 6(1)(f) GDPR) | short-term, in line with the hosting provider’s settings, unless the data is needed to handle a security incident |
| Replying to enquiries and preparing quotes (form, email, phone) | full name, company, email address, phone, current website address, selected service, message content | steps taken at your request before entering into a contract (Article 6(1)(b) GDPR) | up to 2 years from the last contact if we don’t start working together; if a contract is signed, as for contract performance |
| Visit data when submitting the form | submission page, previous and entry page, traffic source, IP address, browser, operating system | for the entry and previous page and traffic source, your consent in the cookie banner (Article 6(1)(a) GDPR); for the submission page and technical data, our legitimate interest in understanding which content you contacted us from and preventing form abuse (point (f)) | same as the enquiry |
| Contract performance, support and maintenance | details of the client’s contact persons, correspondence, support requests, invoicing details | performance of a contract (Article 6(1)(b) GDPR) | for the term of the contract and until the limitation periods for any claims expire |
| Compliance with legal obligations | data on invoices and other accounting documents | legal obligation (Article 6(1)(c) GDPR, the Slovenian VAT Act ZDDV-1 and accounting regulations) | 10 years after the end of the year the invoice relates to |
We do not use the data for automated decision-making or profiling (Article 22 GDPR). We don’t send newsletters; if we introduce them, we will only send them with your prior consent, which you can withdraw at any time.
Providing data in the form is voluntary. However, without the required data (name, email, selected service and message), we can’t reply to you. Once we no longer need the data after the retention period expires, we delete or anonymise it.
3. Cookies and browser storage
Cookies are small files that a website stores on your device. The same applies to data in browser storage (localStorage, sessionStorage). Under Article 225 of ZEKom-2, we may only store data without your consent if it is strictly necessary to provide a service you have explicitly requested. For everything else, we need your consent.
We don’t use analytics, advertising or tracking cookies, and we don’t load third-party content. On your first visit, the banner only asks whether we may remember your path through the site during your visit, so we can attach it to your enquiry. The “Accept” and “Decline” buttons are equal. If you decline, the website works exactly the same.
| Name | Type and purpose | Basis | Duration |
|---|---|---|---|
| q_consent | local browser storage (localStorage), first-party: remembers your choice in the cookie banner | strictly necessary | 12 months, after which we ask again |
| q_nav | browser session storage (sessionStorage), first-party: entry page, previous page and traffic source. The data stays in your browser and is only sent to us together with a submitted enquiry. | your consent (“Accept”) | until you close the browser tab |
| wordpress_*, wp-settings-* | first-party cookies: sign-in and admin settings; only set for signed-in website editors, not visitors | strictly necessary | until sign-out or up to 1 year |
You can change or withdraw your consent at any time via the Cookie settings link in the website footer. When you withdraw consent, we immediately delete the q_nav data from your browser. Withdrawal does not affect the lawfulness of processing before withdrawal.
You can also delete or restrict cookies and browser storage data in your browser settings.
4. Who has access to the data
Your data is only accessible to qStom employees who need it for their work, and to contract processors who provide specific services for us and only process the data on our instructions under a data processing agreement (Article 28 GDPR):
- NEOSERV d.o.o., Slovenia – website hosting and server infrastructure;
- the email service provider through which we receive and send email;
- an external accounting service – for invoice data.
We may also disclose data to public authorities where required by law. We don’t sell data or share it with third parties for advertising.
We process data within the European Economic Area (EEA). If a transfer to a third country is ever necessary, we will only carry it out with appropriate safeguards, such as a European Commission adequacy decision or standard contractual clauses (Chapter V GDPR).
5. When we process data for our clients
When hosting, maintaining and developing websites and online stores, and when providing AI services, we may access personal data collected by our clients (e.g. data of an online store’s customers). In this case, our client is the controller of that data and qStom acts as a processor. We process the data solely on the client’s instructions and in accordance with a data processing agreement. Individuals should contact the controller directly about this data, i.e. the company that owns the website or online store.
6. Your rights
Under the GDPR, you have the right:
- of access to your data (Article 15),
- to rectification of inaccurate data (Article 16),
- to erasure (Article 17),
- to restriction of processing (Article 18),
- to data portability (Article 20),
- to object to processing based on legitimate interest (Article 21),
- to withdraw your consent at any time where it is the basis for processing (Article 7(3)),
- not to be subject to a decision based solely on automated processing (Article 22).
Send your request to info@qstom.si or by post to our address. We will respond without undue delay and at the latest within one month of receiving the request. In more complex cases, this period may be extended by up to two months, and we will let you know (Article 12 GDPR). Exercising your rights is free of charge. If we can’t reliably verify your identity, we may ask you for additional information.
7. Complaints to the supervisory authority
If you believe we are processing your data in breach of the regulations, please let us know first so we can fix the problem as soon as possible. You always have the right to lodge a complaint with the supervisory authority:
Information Commissioner of the Republic of Slovenia
Dunajska cesta 22, 1000 Ljubljana
Email: gp.ip@ip-rs.si
Phone: +386 1 230 97 30
Web: www.ip-rs.si
8. Data security
We use appropriate technical and organisational measures to protect your data (Article 32 GDPR):
- an encrypted HTTPS connection across the entire website,
- hosting on servers in Slovenia,
- regular system and extension updates and regular backups,
- restricted access to data with personal user accounts and strong passwords,
- protection of the form against automated abuse.
If a personal data breach occurs that could put your rights at risk, we will notify the Information Commissioner in accordance with the GDPR and, where necessary, you as well.
9. Minors, links and changes
Minors. Our services are intended for companies and organisations. We do not knowingly collect personal data of children under 15.
Links to other websites. The website contains links to external websites (e.g. a location map, funding programme websites). These websites only open when you click the link, and their controllers’ rules apply to data processing on them.
Changes to this policy. We update this policy as needed, for example when our services or the regulations change. The current version is always published on this page.
This policy applies from 5 November 2026.
Legal bases: Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR); Slovenian Personal Data Protection Act (ZVOP-2, Official Gazette of the Republic of Slovenia, No. 163/22); Slovenian Electronic Communications Act (ZEKom-2, Official Gazette of the Republic of Slovenia, No. 130/22, as amended).