Privacy Policy

1. Data controller

The data controller is KUNDI, Ozare 19, Slovenj Gradec, Slovenija. For any privacy-related question you can reach us at info@kundi.si or +386 41 340 975.

We process personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Slovenian data protection law.

2. Data we collect

We collect only the data we need to operate this website and deliver our services:

• Contact details: name, email address, phone number and company name that you submit through our contact or quote forms.
• Enquiry details: project description, selected services, timeline and budget range.
• Technical data: IP address, browser type, language preference and pages visited, recorded automatically by our servers.
• Business data: information required to enter into a contract, issue invoices and meet tax obligations.
• Data accessed while delivering services: credentials, system logs and similar data, accessed strictly within the scope agreed with the client.

3. Purposes and legal bases

• Responding to enquiries and preparing quotes — steps taken at your request prior to entering a contract (Art. 6(1)(b) GDPR).
• Delivering contracted services and client support — performance of a contract (Art. 6(1)(b) GDPR).
• Issuing invoices and meeting statutory obligations — legal obligation (Art. 6(1)(c) GDPR).
• Keeping the website secure, preventing abuse and improving our services — legitimate interest (Art. 6(1)(f) GDPR).
• Sending business communications to existing clients or based on your consent — consent or legitimate interest (Art. 6(1)(a) or (f) GDPR).

4. Cookies and analytics

The website uses strictly necessary cookies or similar technologies, for example to remember your language preference. These are required for the site to work and cannot be switched off.

Where we use analytics or measurement tools, we configure them to collect as little data as possible and load them only after your consent where consent is required. You can delete or block cookies in your browser settings at any time, which may affect how some features work.

5. Sharing with third parties

We do not sell or rent your personal data. We disclose data only where necessary:

• to carefully selected processors (hosting, email, accounting, client support tooling) that process data solely on our instructions under a data processing agreement;
• where required by law or by a competent authority;
• where disclosure is necessary to establish, exercise or defend legal claims.

6. Transfers outside the EU/EEA

As a rule we process data within the European Economic Area. If a service provider processes data outside the EEA, we ensure an appropriate legal basis is in place, such as an adequacy decision or the European Commission’s standard contractual clauses.

7. Retention

We keep personal data only for as long as needed for the purpose it was collected for, or for as long as the law requires.

• Enquiries that do not lead to engagement: up to 12 months from the last communication.
• Contract documentation: for the term of the contract plus the applicable limitation period.
• Accounting records: as required by tax legislation.
• Technical logs: typically up to 12 months.

8. Security

We apply technical and organisational measures appropriate to the risk: encryption in transit, least-privilege access control, regular patching, backups and internal incident response procedures.

No transmission over the internet is ever completely secure. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify you as required by the GDPR.

9. Your rights

In relation to your personal data you have the right to:

• access your data and receive a copy of it;
• have inaccurate or incomplete data corrected;
• have your data erased (“right to be forgotten”);
• restrict processing;
• data portability;
• object to processing based on legitimate interest;
• withdraw consent where processing is based on consent;
• lodge a complaint with the Information Commissioner of the Republic of Slovenia or your local supervisory authority.

10. Exercising your rights

Send your request to info@kundi.si. We will respond within one month of receiving it. If the request is complex, that period may be extended and we will tell you why. We may need to verify your identity before acting on a request.

11. Children

Our services are aimed at businesses and organisations. We do not knowingly collect personal data from children. If we learn that we have, we delete it without delay.

12. Links to other websites

Our website may link to third-party websites. We are not responsible for their content or their handling of personal data, so we recommend reviewing their privacy policies.

13. Changes to this policy

We may update this policy from time to time as our services or the law change. The current version is always published on this page together with the date it was last updated.

14. Contact

KUNDI, Ozare 19, Slovenj Gradec, Slovenija. Email: info@kundi.si. Phone: +386 41 340 975.