Privacy policy

Effective from: 31 October 2026

1. Data controller

Valtom, montaža in storitve, Tomislav Vešligaj s.p. Tepešev graben 17, 3252 Rogatec, Slovenia Registration no. (matična številka): 6265677000 · VAT ID: SI52795128 Email: tomi@valtom.net · Phone: +386 40 700 901

Data protection officer: given the scope of processing, the controller is not required to appoint one (Art. 37 GDPR). For any questions about personal data, contact tomi@valtom.net.

2. Legal framework

We process personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR), the Slovenian Personal Data Protection Act (ZVOP-2) and the Electronic Communications Act (ZEKom-2).

3. What data we process, why and on what legal basis

3.1 Visiting the website (server logs)

• Data: IP address, date and time of access, page visited, browser and device type, referring page.
• Purpose: operation and security of the website, protection against misuse.
• Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Retention: up to 30 days, unless needed to investigate a security incident.

3.2 Contact form and inquiries

• Data: first name, last name, email, phone (optional), company and project location (optional), type of work, message content.
• Purpose: responding to your question or inquiry and preparing an offer.
• Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR) or legitimate interest in replying to your message (Art. 6(1)(f) GDPR).
• Retention: until your request is handled and no longer than 2 years after the last contact; if a contract is concluded, for as long as required by laws on retaining business records.

3.3 Job applications

• Data: first name, last name, email, phone, desired position, message and the information in your attached CV (e.g. education, work experience, certificates).
• Purpose: carrying out the recruitment process for employment or cooperation.
• Legal basis: steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR); for keeping your application for future opportunities, your consent (Art. 6(1)(a) GDPR).
• Retention: until the recruitment process ends and no longer than 6 months afterwards; with your consent, up to 2 years. Please do not include special categories of personal data in your CV (e.g. health data, religious beliefs) unless required by law.

3.4 Email and phone communication

Data you send us directly by email or phone is processed for the same purposes and retention periods as in sections 3.2 and 3.3.

3.5 Website analytics (Google Analytics 4) – only with your consent

• Data: a pseudonymous identifier in a cookie, page views (page path without parameters), approximate location, device and browser type, referring page; when a form is sent successfully, one event with the form type and language. We never send the content of forms, names, email addresses, phone numbers, CVs or message text to Google.
• Purpose: statistics on visits and form performance, to improve the website.
• Legal basis: your consent (Art. 6(1)(a) GDPR) and ZEKom-2. Without your consent Google Analytics is not loaded.
• Retention: no longer than the data retention period set in our Google Analytics 4 property.
• Withdrawal: at any time via the "Cookie settings" link in the footer; measurement stops immediately.

3.6 Cookies

The use of cookies is described in our Cookie policy.

4. Mandatory data

Fields marked as required are needed to handle your message or application. Without them we cannot respond.

5. Recipients and processors

We do not sell your data. Data may only be processed by contracted processors acting on our instructions (Art. 28 GDPR):

• Vercel Inc. (USA) – website hosting and technical server logs,
• Resend (USA) – email delivery service that forwards messages and applications sent through the website forms (including attached CVs) to our mailbox,
• NEOSERV – hosting of our mailbox, where email, including messages from the forms, is received and stored,
• Google Ireland Limited (Ireland; parent company Google LLC, USA) – Google Analytics 4, only with your consent.

The website does not keep form submissions in a database of its own; they are only forwarded by email.

We may also disclose data to public authorities where required by law.

6. Transfers to third countries

Some processors (e.g. Vercel, Resend, Google) are based in the USA. Transfers rely on the EU-U.S. Data Privacy Framework adequacy decision where the provider is certified, or on the European Commission's Standard Contractual Clauses (Art. 46 GDPR).

7. Your rights

You have the right to:

• access your personal data (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• object to processing based on legitimate interest (Art. 21),
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3)).

Send your request to tomi@valtom.net. We will respond within one month at the latest.

8. Complaints

If you believe our processing violates the law, you may lodge a complaint with the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si, www.ip-rs.si, or with the supervisory authority in your EU country of residence.

9. Automated decision-making

We do not carry out automated decision-making or profiling with legal or similarly significant effects on you. AI tools do not make independent decisions in candidate selection.

10. Security

We use appropriate technical and organisational measures: encrypted connection (HTTPS), restricted access to data and carefully selected processors.

11. Changes

We may update this policy. The current version is always published on this page with its effective date.