Privacy & Data Protection Policy

Last Updated & Effective Date: January 1, 2026

1. Introduction and Data Controller Information

This Privacy Policy describes the policies and procedures of Festival Vaultvist d.o.o. ("Festivalvaultvist", "we", "our", or "us"), registered at Mestni trg 14, 1000 Ljubljana, Slovenia (Company Registration SI-88492019), regarding the collection, storage, protection, use, and disclosure of personal data when you visit and interact with festivalvaultvist.com (the "Service").

We operate as the Data Controller in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), the Slovenian Personal Data Protection Act (ZVOP-2), and applicable international standards including the California Consumer Privacy Act (CCPA/CPRA).

2. Categories of Personal Data Collected

We collect personal information directly provided by you as well as technical logs automatically recorded by our servers:

• Directly Provided Information: When you complete our contact forms, request expedition routes, or correspond with our logistics team, we collect your full name, email address, telecommunication details, and specific travel inquiries.
• Technical and Server Telemetry: Anonymized or pseudonymized Internet Protocol (IP) addresses, browser type, operating system version, referring URLs, device characteristics, timestamps, and page interaction duration.
• Cookie and Local Storage Markers: Small analytical and functional tokens deployed strictly subject to your explicit prior consent as described in our Cookie Policy.

3. Legal Bases for Processing Under GDPR

We process your personal information strictly where authorized under Article 6 of the GDPR:

• Consent (Art. 6(1)(a)): For non-essential analytics cookies, personalized route recommendation feeds, and voluntary newsletters.
• Contractual Performance (Art. 6(1)(b)): To respond to incoming expedition inquiries, process expedition itineraries, and deliver requested field documentation.
• Legal Obligation (Art. 6(1)(c)): To comply with mandatory Slovenian corporate accounting, tax laws, and lawful government directives.
• Legitimate Interests (Art. 6(1)(f)): To safeguard infrastructure integrity, prevent cyber attacks, resolve technical errors, and optimize overall site performance without overriding fundamental rights.

4. Data Retention and Safeguards

We retain personal data only for the duration necessary to satisfy the specific purposes outlined in this policy, unless a longer statutory retention period is mandated by Slovenian law (e.g., commercial accounting documents retained for up to 10 years).

All data transmissions are secured using Transport Layer Security (TLS 1.3 encryption). Access to customer correspondence is restricted through multi-factor authentication and role-based privilege controls.

5. Your Fundamental Data Subject Rights

Under the GDPR and associated privacy frameworks, you have the following enforceable rights regarding your data:

• Right to Access: Request full confirmation and copies of personal data we hold concerning you.
• Right to Rectification: Request correction of inaccurate, obsolete, or incomplete records.
• Right to Erasure ("Right to be Forgotten"): Request immediate permanent deletion of your data where processing is no longer legally justified.
• Right to Restriction of Processing: Demand limitation of processing during pending verification of disputes.
• Right to Data Portability: Receive your data in a structured, commonly used, machine-readable format (JSON/CSV).
• Right to Object and Withdraw Consent: Revoke consent at any moment without affecting the lawfulness of prior processing.

6. Contact the Data Protection Officer (DPO)

For all inquiries, formal SARs (Subject Access Requests), or privacy concerns, please contact our designated Privacy Office:

Data Protection Officer
Festival Vaultvist d.o.o.
Mestni trg 14, 1000 Ljubljana, Slovenia
Email: [email protected] or [email protected]
You also maintain the right to lodge a formal complaint with the Slovenian Information Commissioner (Informacijski pooblaščenec RS, Dunajska cesta 22, 1000 Ljubljana).